Storage Accounts for Azure Virtual Desktop (AVD)

Introduction: Why Storage Matters in AVD

When you deploy Azure Virtual Desktop (AVD), you are essentially decoupling the operating system from the user's workspace. In a traditional physical desktop environment, a user’s documents, desktop icons, and application settings live on their local hard drive. In a virtualized environment, these components must be stored centrally so that a user can log into any virtual machine (VM) in the pool and find their environment exactly as they left it. This is where Azure Storage Accounts come into play.

A storage account acts as the foundational building block for user profiles, application data, and shared files within an AVD infrastructure. If your storage configuration is incorrect, your users will experience slow login times, application crashes, or even data loss. Understanding how to select, configure, and secure these storage resources is perhaps the most critical skill for an AVD administrator. This lesson will walk you through the architectural choices, implementation strategies, and maintenance requirements for managing storage in your AVD environment.

Understanding FSLogix and Storage Requirements

Before diving into the technical configuration of Azure Storage, we must address the primary consumer of that storage: FSLogix. FSLogix is the industry-standard solution for handling user profiles in non-persistent virtual desktop environments. It works by capturing the user's entire profile into a Virtual Hard Disk (VHD or VHDX) and attaching that disk to the VM at the moment the user logs in.

Because these VHDs are stored on a network share, the performance of the underlying storage system directly dictates the user experience. If the storage latency is high, the "Profile Container" will take a long time to attach, leading to the dreaded "black screen" or long login hang-times. To avoid this, you need a storage solution that supports high throughput and low latency, specifically the SMB protocol.

Key Storage Options for AVD

When planning your AVD storage, you generally have three primary choices provided by Azure:

• Azure Files (Premium): This is the gold standard for AVD. It is a fully managed file share based on the SMB protocol that supports massive throughput and low latency. It is designed specifically for high-performance workloads like FSLogix.
• Azure Files (Standard): While cheaper, this option often struggles with the high input/output operations per second (IOPS) required by multiple concurrent users launching applications. It is generally not recommended for production AVD environments.
• Azure NetApp Files: This is an enterprise-grade storage service. It is extremely fast and capable of handling thousands of users, but it comes with a higher cost and complexity compared to Azure Files. It is usually reserved for very large, global deployments.

Callout: Performance Bottlenecks The most common mistake in AVD deployments is choosing a storage tier that cannot handle the "login storm." A login storm occurs when 50 or 100 users attempt to sign in at the exact same time, such as at 9:00 AM on a Monday. During this time, the storage account must handle thousands of read/write requests simultaneously to mount all those VHDs. If your storage tier is undersized, the system will queue these requests, and users will wait minutes to reach their desktop.

Implementing Azure Files for FSLogix

The most common implementation for AVD storage is using Azure Files with Premium performance. This provides a balance of manageability and performance that fits most organizations.

Step-by-Step: Provisioning the Storage Account

1. Create the Storage Account: In the Azure Portal, navigate to "Storage accounts" and click "Create." Choose a subscription and resource group.
2. Performance Tier: Select "Premium" and then choose "File shares" as the account kind. This is crucial for enabling the high-performance features required for FSLogix.
3. Redundancy: Choose "Locally-redundant storage (LRS)" if you are just starting out. While Geo-redundant storage (GRS) is available, it is often not necessary for FSLogix profiles, as you can recreate profiles from scratch if a region fails, and the cost of GRS is significantly higher.
4. Networking: Under the networking tab, it is best practice to enable "Private endpoints." This ensures that your storage traffic never leaves the Azure backbone network, providing both performance and security benefits.

Configuring the File Share

Once the storage account is created, you must create the actual file share where the VHDs will live:

1. Navigate to your new storage account.
2. Select "File shares" from the left-hand menu.
3. Click "+ File share" and give it a name (e.g., profiles).
4. Set the quota to a size that accommodates your users. A good rule of thumb is to calculate 30GB to 50GB per user, plus some overhead for growth.
5. Ensure the protocol is set to "SMB."

Tip: Managing Storage Costs You can use Azure's "Cool" access tiers for data that isn't accessed frequently. However, for FSLogix profiles, you must use the "Hot" or "Premium" tier. Do not attempt to move active profile containers to a cool tier, as the performance penalty will cause significant issues for users.

Security: Integrating with Active Directory

A storage account is useless if your AVD virtual machines cannot authenticate to it. You must ensure that the storage account is joined to your domain (either on-premises Active Directory or Microsoft Entra Domain Services).

Authentication Methods

• Active Directory Domain Services (AD DS): Best for hybrid environments where you have a traditional Windows Server AD setup.
• Microsoft Entra Domain Services (formerly Azure AD DS): Best for cloud-only environments that do not have a traditional domain controller.

Once joined, you must configure the NTFS permissions on the file share. This is a common pitfall: administrators often forget that the storage account permissions and the NTFS permissions are two different things. You need to grant the "Storage File Data SMB Share Contributor" role to your users so they can access the share, and then set granular folder-level permissions so users can only access their own profiles.

Setting NTFS Permissions

After mounting the share to a machine, you need to set the following permissions to ensure security:

1. Creator Owner: Full Control (This allows the user to manage their own profile).
2. System: Full Control (Required for the OS to perform operations).
3. Administrators: Full Control (For support and troubleshooting).
4. Authenticated Users: Modify only on the root folder (This allows users to create their own sub-folder for their profile).

Code Example: Automating Storage Deployment

Automation is essential for AVD. Deploying storage accounts manually is prone to error. Below is a PowerShell snippet using the Azure module to deploy a Premium storage account.

# Define variables
$resourceGroupName = "rg-avd-storage"
$location = "eastus"
$storageAccountName = "stavdprofiles001"

# Create the resource group
New-AzResourceGroup -Name $resourceGroupName -Location $location

# Create the storage account
$storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroupName `
  -Name $storageAccountName `
  -Location $location `
  -SkuName Premium_LRS `
  -Kind FileStorage

# Create the file share
$ctx = $storageAccount.Context
New-AzStorageShare -Name "fslogix-profiles" -QuotaGiB 1024 -Context $ctx

Explanation of the code:

• SkuName Premium_LRS: This sets the account to Premium performance with local redundancy.
• Kind FileStorage: This is a specific requirement for Premium storage accounts in Azure Files.
• QuotaGiB 1024: We are allocating 1TB of space. You should adjust this based on your user count and storage policy.

Best Practices for Long-Term Maintenance

Managing AVD storage is not a "set it and forget it" task. As your user base grows, your storage needs will shift.

Monitoring Performance

Use Azure Monitor to keep an eye on your storage account metrics. Specifically, look for:

• SuccessE2ELatency: This measures the time it takes for a request to be completed. If this number spikes, your users are experiencing lag.
• Transactions: A high number of transactions can lead to cost increases.
• Capacity: Ensure you are not reaching your quota limit, as this will prevent users from logging in.

Handling Profile Bloat

Over time, users tend to accumulate junk in their profiles. This increases the size of the VHD, which leads to longer login times and increased storage costs. You should implement an "exclusion" policy in your FSLogix configuration.

Warning: Profile Bloat By default, FSLogix captures everything in the user profile. This includes temporary browser files, recycle bin contents, and cached update files. You should use the FSLogix "Redirections.xml" file to exclude these folders from the VHD. This can reduce the size of a user profile by 50% or more.

Implementing Backups

Azure Files supports snapshots. You should enable "Azure Backup" for your file shares. This allows you to restore a single user's profile VHD if it becomes corrupted. Corruption is rare, but it does happen if a user loses power while their profile is mounted or if a VM crashes during a write operation.

Common Pitfalls and How to Avoid Them

1. Using Standard Storage for Production

Many admins try to save money by using Standard tier storage. While it works for a few users, it will fail under load. Always start with Premium for production AVD environments.

2. Ignoring Latency

Storage accounts must be in the same region as your AVD session hosts. If your session hosts are in "East US" and your storage account is in "West US," the network latency will make the profiles unusable. Always keep storage and compute in the same Azure region.

3. Over-provisioning

While you want to ensure enough space, don't allocate 10TB if you only have 50 users. Azure Files Premium charges based on the provisioned capacity. You can increase the size at any time, so start with a reasonable estimate and scale as you monitor usage.

4. Poor NTFS Permission Design

Do not give "Everyone" or "Authenticated Users" full control over the root share. Use the "Contributor" role for access, and then use NTFS permissions to restrict sub-folder access. This prevents one user from accidentally deleting another user's profile.

Quick Reference: Storage Selection Table

Advanced Concepts: FSLogix Cloud Cache

For organizations that cannot afford a single minute of downtime, standard Azure Files might not be enough. If the storage account goes offline, the users cannot log in. To solve this, you can use FSLogix Cloud Cache.

Cloud Cache allows you to define multiple storage locations. When a user logs in, FSLogix writes their profile changes to all configured locations simultaneously. If one storage account becomes unavailable, the system automatically fails over to the other.

How to implement Cloud Cache:

You configure this through Group Policy (GPO) or Registry settings on the AVD session hosts. You provide a list of paths separated by semicolons: CCDLocations = "type=smb,connectionString=\\storage1\share;type=smb,connectionString=\\storage2\share"

This provides a level of redundancy that is often required for mission-critical applications. However, keep in mind that this doubles your storage costs and increases the network traffic for every write operation.

Troubleshooting Storage Issues

When a user complains about "slow logins" or "applications not saving settings," your first step should always be the storage layer.

1. Check the Event Logs: Look at the Microsoft-FSLogix-Apps/Operational log on the session host. It will tell you if the profile container failed to attach or if there were permission errors.
2. Test Connectivity: Use the Test-NetConnection command from the session host to ensure you can reach the storage account on port 445. Test-NetConnection -ComputerName <storage-account-name>.file.core.windows.net -Port 445
3. Check Quotas: If the user cannot save files, check if the file share has reached its capacity limit.
4. Verify Permissions: Ensure the machine account of the session host has the correct permissions to the share. The computer account is the one accessing the share, not just the user account.

Callout: The "Computer Account" Factor A common point of confusion is that the session host (the VM) performs the heavy lifting of mounting the VHD. Therefore, the VM's identity must have the necessary permissions to the storage account. If you see "Access Denied" errors, verify that the computer object is correctly synced to the domain and has the appropriate roles assigned.

Summary: Key Takeaways

To ensure your AVD storage is reliable, performant, and cost-effective, remember these core principles:

• Prioritize Performance: Always choose Azure Files Premium for production FSLogix workloads to avoid login storms and performance bottlenecks.
• Proximity is Key: Ensure your storage account and your session host virtual machines reside in the same Azure region to keep latency at an absolute minimum.
• Security by Design: Separate storage access control (RBAC) from file-level security (NTFS). Grant users minimal access to the share and use NTFS to secure individual profile folders.
• Optimize Costs with Exclusions: Use FSLogix redirection files to prevent unnecessary data (like browser cache and temp files) from bloating your VHDs, which saves storage space and improves login times.
• Monitor and Scale: Use Azure Monitor metrics to track latency and capacity. Scale your storage quotas dynamically as your user base grows to maintain performance.
• Plan for Resilience: For critical environments, consider FSLogix Cloud Cache to provide redundancy across multiple storage locations, ensuring users can work even if one storage provider faces an outage.
• Automation: Use Infrastructure as Code (IaC) like PowerShell or Bicep to deploy your storage accounts. This ensures consistency across your environments and prevents manual configuration errors.

By following these guidelines, you move away from a reactive "troubleshooting" mindset and into a proactive "infrastructure management" mindset. Storage is the foundation of the user experience in AVD; by treating it with the technical rigor it deserves, you ensure that your users have a responsive, stable, and productive virtual desktop experience every time they log in.