Modernize VDI with Azure Recordsdata and Entra Cloud-Native Identities

Hiya Of us!

You probably have ever run a Digital Desktop Infrastructure (VDI) property, you already know the recurring riddle. The session hosts are designed to be stateless and pooled, but each consumer expects a persistent Outlook profile, their OneDrive cache, their pinned apps, and a sub-ten-second logon. On this session on the Microsoft Azure Infrastructure Summit 2026, Adam Groves and Priyanka Gangal from the Azure Recordsdata group confirmed how Azure Recordsdata plus Microsoft Entra ID lastly allow you to ship that have with out dragging area controllers alongside for the trip.

📺 Watch the session:

VDI has at all times been a balancing act between elasticity and continuity. The compute layer needs to be ephemeral. The consumer needs to be at house. Bridging these two worlds used to imply a stack of id plumbing that quietly grew till it turned its personal platform. This session adjustments that math.

Here’s what jumped out for me:

• Cloud-only id for SMB. Azure Recordsdata now authenticates pure Microsoft Entra ID customers and teams, together with B2B visitors, instantly over SMB Kerberos. No on-premises Energetic Listing required, no Entra Join required, no line of sight to a site controller.
• NTFS ACLs and Kerberos preserved. You retain the safety mannequin your apps already perceive. Permissions nonetheless stay on the file system, tickets nonetheless come over SMB, and FSLogix doesn’t care that the id stack beneath is totally different.
• Efficiency constructed for the spike. Metadata caching is mostly accessible and rolling out by default. Concurrent file handles per share are transferring from 2,000 at this time to 10,000, with a roadmap towards 30,000 to 50,000. Which means fewer storage accounts to shard throughout when 9 AM hits.
• Zonal placement and smarter alerts. Premium LRS now allows you to co-locate the share with its session hosts inside the identical availability zone, and new percentage-based metrics lastly make alert thresholds transportable throughout shares of any dimension.

In brief, the boring id and storage plumbing that propped up VDI for a decade is being collapsed into one thing you possibly can truly run as a cloud-native service.

Let’s set the desk. VDI on Azure (whether or not you run Azure Digital Desktop, Citrix on Azure, or Omnissa Horizon) makes use of pooled session hosts. These hosts are deliberately stateless to allow them to be patched, scaled, and recycled with out ceremony. The consumer’s id is “Connie Cloud” at this time, and on a special host tomorrow.

FSLogix solves the continuity half of the puzzle. It packages the consumer’s profile and Workplace knowledge containers (the profile container and the ODFC, the Workplace Knowledge Folder Container) as VHDX recordsdata that get dynamically hooked up when Connie logs on and indifferent when she indicators out. These VHDX recordsdata must stay someplace sturdy, quick, and reachable over SMB from any host within the pool.

That’s exactly what Azure Recordsdata delivers. It’s a absolutely managed SMB file share service that integrates cleanly with FSLogix profile containers and App Connect picture shops for AVD. The reference structure and sizing steering are documented on Microsoft Be taught for anybody who needs the official map.

The historic friction was id. Till lately, SMB authentication to Azure Recordsdata required both on-premises AD DS joined to the storage account or hybrid identities synced by Entra Join. That meant conserving area controllers (and the community paths to achieve them) alive purely to fulfill storage authentication. As of this 12 months, Azure Recordsdata helps pure Microsoft Entra ID identities for SMB Kerberos, which closes that loop.

Right here is the simplified movement Adam and Priyanka walked by throughout the demo.

1. The consumer (an Entra-only account, no on-prem footprint) indicators into an Entra-joined AVD session host with single sign-on.
2. The session host must mount the consumer’s FSLogix profile container from an Azure Recordsdata share.
3. The host requests a Kerberos service ticket. As a result of the share has Microsoft Entra Kerberos authentication enabled, Entra ID points that ticket instantly, no on-prem KDC concerned.
4. The SMB connection is established, the share-level RBAC position (for instance Storage File Knowledge SMB Share Contributor) is checked, after which the listing and file ACLs (normal NTFS) are evaluated.
5. FSLogix attaches the VHDX, the profile hundreds, Outlook is comfortable, OneDrive is comfortable, and Connie’s pinned taskbar reveals up precisely the best way she left it.

Just a few particulars value submitting away:

• Two layers of authorization. Share-level entry makes use of Azure RBAC roles. Merchandise-level entry makes use of NTFS ACLs. Each nonetheless apply, which is why your current permissions mannequin carries over cleanly.
• B2B visitor help. Vendor and contractor accounts that are available as visitors in your tenant may be granted entry to file shares without having a synced shadow account.
• Metadata caching is the unlock. VDI is metadata-heavy: listing enumerations, file opens, renames, and closes hammer the share at logon. Metadata caching reduces P50 latency on these operations by roughly 80 to 90% and roughly doubles metadata transaction throughput, which is what makes the upper concurrent deal with limits reasonable. The complete SMB efficiency reference on Microsoft Be taught lays out the knobs.
• Zonal placement. Premium LRS allows you to pin the share to the identical availability zone as your session host pool, so the SMB site visitors doesn’t bounce throughout zones.

The place does this present up in your operations overview?

• Retire orphan area controllers. Loads of retailers have a few DCs in Azure that exist solely so Azure Recordsdata can authenticate. Cloud-native Entra ID allows you to flip these off and shrink the id assault floor.
• Less complicated M&A and vendor onboarding. Including a associate group or a brand new acquisition not requires forest trusts or a sync venture. Invite visitors, assign them to a gaggle, grant the group entry to the share.
• Fewer storage accounts and shares to handle. Larger concurrent deal with limits imply you possibly can consolidate customers that you simply beforehand needed to unfold throughout many accounts simply to dodge the two,000-handle ceiling. Much less sprawl, much less monitoring, fewer naming conventions to recollect.
• Predictable logon instances at scale. Metadata caching is the type of characteristic you solely discover when it’s lacking. With it on by default, giant host swimming pools see flatter logon latency curves throughout the morning rush.
• Operational consistency. Proportion-based metrics allow you to set a single rule like “alert at 10% remaining capability” and apply it cleanly to a 5 TiB share and a 100 TiB share with out bespoke thresholds.

In brief, the ROI dialog strikes from “how will we hold VDI working” to “how a lot of the supporting forged can we delete.”

If you wish to kick the tires this week, here’s a sensible beginning path.

1. Stock your VDI id story. Are you working hybrid as a result of the apps want it, or as a result of Azure Recordsdata used to want it? If it’s the second, you’ve a candidate workload for cloud-only id.
2. Spin up a pilot Premium SSD Azure Recordsdata share in the identical area (and ideally the identical availability zone) as a small AVD host pool.
3. Allow Microsoft Entra Kerberos authentication on the storage account. The configuration is now in the usual Azure portal, no extra aspect journeys to the fileperms portal.
4. Assign Azure RBAC roles on the share stage (Storage File Knowledge SMB Share Reader, Contributor, or Elevated Contributor as applicable) to your Entra teams.
5. Set NTFS ACLs on the directories that may host FSLogix containers, and level FSLogix on the share’s UNC path.
6. Take a look at with a cloud-only consumer (no on-prem id in any respect) to verify the end-to-end movement.
7. Activate metadata caching and the brand new metrics and set percentage-based alerts so you discover the bounds earlier than your customers do.

Catch the total Microsoft Azure Infra Summit 2026 session playlist right here: https://www.youtube.com/playlist?listing=PLjt5SKzX1iI8con7FJDB56G6hHqxGm7ki

Cheers!

Pierre Roman