Lesson: Storage Planning for Azure Virtual Desktop (AVD)

Introduction: The Foundation of the User Experience

When you deploy Azure Virtual Desktop (AVD), the underlying storage infrastructure is arguably the most critical component for user satisfaction. While your compute resources—the Virtual Machines (VMs) running the session hosts—handle the processing of applications, the storage layer holds the actual user environment. If the storage is slow, unresponsive, or improperly configured, users will experience sluggish application launches, slow profile loading, and frustrating delays when saving files. This is not just a technical bottleneck; it is a direct contributor to the perceived quality of the entire desktop experience.

In a modern AVD environment, we move away from traditional, locally-attached disks for user data. Instead, we rely on centralized storage solutions that allow users to roam between different session hosts seamlessly. Whether a user signs in to a VM in the morning or moves to a different one during a shift, their data, settings, and application states must follow them. This requirement makes the choice and implementation of storage solutions like Azure Files or Azure NetApp Files the cornerstone of a stable AVD architecture. In this lesson, we will explore the technical requirements, performance considerations, and implementation strategies for designing a storage layer that supports a productive and reliable AVD environment.

Understanding User Profiles and FSLogix

To understand storage planning, you must first understand what you are storing. In the current AVD ecosystem, the industry standard for user profile management is FSLogix Profile Containers. FSLogix works by redirecting the user profile—which is usually stored in the local C:\Users folder—into a Virtual Hard Disk (VHD or VHDX) file hosted on a remote file share.

When a user logs into an AVD session, the FSLogix agent on the session host mounts this VHDX file. To the operating system and the applications, the user profile appears to be local. This approach is highly effective because it eliminates the "profile bloat" and synchronization delays associated with older technologies like Roaming Profiles or Folder Redirection. However, because the entire profile is encapsulated in a single disk file, the performance of the remote storage becomes the primary factor in how quickly that profile mounts and how smoothly the user interacts with their desktop.

The Impact of IOPS and Throughput

Every time a user opens an application, saves a document, or even interacts with the Windows shell, the OS performs read/write operations against the profile container. If you have 50 users on a single session host, and each of those users is accessing their own VHDX file, the file share must handle a massive volume of concurrent I/O requests.

Callout: Profile Containers vs. Office Containers It is important to distinguish between Profile Containers and Office Containers. A Profile Container captures the entire user profile, including desktop settings and application data. An Office Container specifically targets Outlook OST files and OneDrive cache. Many administrators implement both, using the Office Container to offload high-churn data (like email caches) to a different storage location, effectively splitting the I/O load and preventing the main profile VHDX from growing excessively large.

Evaluating Storage Options for AVD

When planning your storage, you generally choose between two primary managed services in Azure: Azure Files and Azure NetApp Files. Each has specific performance tiers, pricing models, and use cases.

Azure Files (Premium Tier)

For the vast majority of AVD deployments, Azure Files Premium is the recommended solution. It provides high-performance, low-latency storage based on solid-state drives (SSDs). It supports the SMB protocol, which is required for FSLogix, and integrates natively with Active Directory (AD) or Microsoft Entra Domain Services (formerly Azure AD DS).

• Performance: Premium tier offers consistent, high IOPS (Input/Output Operations Per Second) and throughput.
• Scalability: You can scale the share size dynamically as your user count grows.
• Simplicity: It is a managed PaaS (Platform as a Service) offering, meaning you do not have to manage the underlying storage servers or patches.

Azure NetApp Files (ANF)

Azure NetApp Files is an enterprise-grade storage service that offers even higher performance and advanced features like snapshots, replication, and high-performance throughput. It is typically reserved for massive, highly demanding environments with thousands of users or specific requirements for data protection.

• Performance: Offers sub-millisecond latency and extreme throughput, suitable for very large-scale deployments.
• Feature Set: Includes advanced data management features like rapid cloning and sophisticated snapshotting.
• Cost: Generally higher than Azure Files, making it a "premium" choice for specific enterprise needs.

Step-by-Step: Implementing Azure Files for FSLogix

To set up storage for AVD, you need to follow a structured process. Here is how you deploy an Azure Files Premium share specifically for user profiles.

Step 1: Create the Storage Account

1. Navigate to the Azure Portal and create a new Storage Account.
2. Choose the Premium performance tier.
3. Select File shares for the account kind.
4. Ensure the account is in the same region as your AVD session hosts to minimize network latency.

Step 2: Configure Networking

For security, you should never expose your storage account to the public internet.

1. In the Storage Account settings, navigate to Networking.
2. Select Enabled from selected virtual networks and IP addresses.
3. Add the Virtual Network (VNet) where your AVD session hosts reside.
4. Alternatively, create a Private Endpoint to ensure all traffic stays within the Azure backbone network.

Step 3: Set Up Identity-Based Access

FSLogix requires that the session hosts have permission to read and write to the file share.

1. Enable Active Directory Domain Services or Microsoft Entra Domain Services authentication on the Storage Account.
2. Assign the Storage File Data SMB Share Contributor role to the computer accounts of the AVD session hosts.
3. Ensure the users themselves have the Storage File Data SMB Share Elevated Contributor role to allow them to manage their own profiles.

Step 4: Create the File Share

1. Within the Storage Account, click on File shares.
2. Create a new share with a quota sufficient for your user base (e.g., 500GB or 1TB).
3. Assign a "Reserved" capacity to ensure the share has enough IOPS to handle peak login times.

Warning: The "Login Storm" Scenario A common mistake is failing to account for the "login storm"—the period at the start of the workday when all employees sign in simultaneously. During this time, the storage account will see a massive spike in IOPS as hundreds of VHDX files are mounted at once. Ensure your storage tier is provisioned for this peak, not just the average daily usage.

Best Practices for Performance Optimization

Storage planning is not a "set it and forget it" task. To maintain a smooth user experience, you must actively manage and optimize your configuration.

1. Optimize VHDX Size

Do not set your VHDX size to an excessively large number just to be safe. If you set a 100GB limit per user, but they only use 10GB, you are wasting space and potentially impacting backup/snapshot performance. Use the FSLogix SizeInMBs registry setting to set a realistic, yet generous, limit.

2. Implement Storage Quotas

Use Azure Files quotas to prevent a single user or a runaway process from consuming the entire share. This acts as a circuit breaker for your infrastructure.

3. Monitor with Azure Monitor

Use the Insights feature in the Storage Account to track metrics like SuccessE2ELatency and Transactions. If your latency consistently exceeds 10-20ms, your storage is likely under-provisioned, and you need to increase your capacity or move to a higher performance tier.

4. Use Separate Shares for Different Groups

If you have different departments with different needs (e.g., developers who store large local repositories vs. office staff who only use web apps), consider splitting them into different file shares. This allows you to scale performance independently for each group.

Technical Configuration: The FSLogix Registry Settings

Once the storage is provisioned, you must configure the session hosts to use it. This is typically done via Group Policy Objects (GPO) or Intune configuration profiles. The most critical settings are the VHDLocations and the Enabled flag.

Below is an example of the registry keys required for FSLogix to connect to your Azure File share:

# Example PowerShell script to configure FSLogix registry settings
# Replace the path with your actual Azure Files UNC path

$StoragePath = "\\yourstorageaccount.file.core.windows.net\profiles"

# Enable FSLogix
New-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "Enabled" -Value 1 -PropertyType DWord -Force

# Set the location of the profile containers
New-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "VHDLocations" -Value $StoragePath -PropertyType MultiString -Force

# Set the maximum size of the VHDX in MB (e.g., 30GB)
New-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "SizeInMBs" -Value 30720 -PropertyType DWord -Force

Explanation of the code:

• Enabled: This turns on the FSLogix service. Without this, the system will continue to use standard Windows local profiles.
• VHDLocations: This is the most important setting. It tells the session host exactly where to look for the user's VHDX file. The path must be the UNC path of your Azure File share.
• SizeInMBs: This defines the maximum dynamic size of the VHDX file. Using 30720 (30GB) is a common starting point for knowledge workers who store some local files but offload large data to cloud storage like OneDrive.

Common Pitfalls and How to Avoid Them

Even with a well-planned architecture, administrators often stumble over a few common issues. Being aware of these will save you hours of troubleshooting.

1. The "Network Latency" Trap

If you place your storage in a different Azure region than your AVD host pool, the latency will be high enough to make the desktop feel "broken." Always ensure that the Storage Account and the AVD Host Pool are in the same region. If you are operating in a multi-region environment, you must use a storage solution that supports geo-replication or deploy regional storage accounts.

2. Ignoring Cloud Cache

FSLogix has a feature called Cloud Cache. This allows you to store the profile in multiple locations simultaneously. If one storage account goes offline, the user can continue working using the second location. Many admins skip this to save costs, but for mission-critical environments, it is a vital insurance policy.

3. Misconfiguring NTFS Permissions

Azure Files requires specific NTFS permissions on the share root. If these are not configured correctly, users will be unable to create their profile VHDX files, leading to "temporary profile" errors. Always ensure that the Creator Owner has full control and that the Authenticated Users have the appropriate read/write permissions on the share folder.

Note: Temporary Profiles If a user gets a "Temporary Profile" warning, it almost always means the session host could not mount the VHDX from the file share. Check the FSLogix event logs on the session host to see if it is a permission issue, a network connectivity issue, or if the VHDX is currently locked by another process.

Security Considerations for User Data

Because you are centralizing all user data into a single location, the security of that storage account is paramount. You are essentially creating a "treasure chest" of all your users' files.

• Encryption at Rest: Ensure that your storage account uses customer-managed keys (CMK) if your organization requires strict control over data encryption. By default, Azure encrypts data at rest, but CMK adds an extra layer of compliance.
• Role-Based Access Control (RBAC): Follow the principle of least privilege. Only the AVD session hosts should have access to the file share. Administrators should manage the storage account via Azure RBAC, not by mapping the drive as a user.
• Soft Delete: Enable "Soft Delete" for file shares. This allows you to recover files or entire shares if they are accidentally deleted by a user or an automated script. It is a simple setting in the Storage Account that provides a significant safety net.

Scaling Your Storage Infrastructure

As your AVD environment grows, you will eventually reach the limits of a single file share. Azure Files Premium has specific limits on IOPS and throughput per share. When you hit these limits, you have a few options:

1. Horizontal Scaling: Create multiple file shares and distribute your user groups across them. For example, you could have \\storage\share1 for Finance and \\storage\share2 for Marketing.
2. Performance Tier Upgrades: If you are on a smaller provisioned capacity, simply increasing the share size in Azure will often increase the available IOPS and throughput automatically.
3. Advanced Caching: If you have remote offices, consider using Azure File Sync to cache data closer to the users, although this is more common for traditional file servers than for FSLogix profile containers.

Troubleshooting Storage Issues

When things go wrong, the first place to look is the FSLogix logs. These are located on the session host at C:\ProgramData\FSLogix\Logs.

• Check for "Access Denied": If the logs show access denied, re-verify the NTFS permissions on the file share and the Azure RBAC roles on the Storage Account.
• Check for "Disk Busy": If the logs indicate the disk is busy or timing out, check the Azure Monitor metrics for the storage account to see if you have reached your IOPS limit.
• Check for "Network Unreachable": This usually indicates a DNS issue or a firewall blocking SMB traffic (port 445). Ensure your virtual network allows outbound traffic on port 445 to the Azure Files service tag.

Summary and Key Takeaways

Planning storage for AVD is an exercise in balancing performance, cost, and complexity. By choosing the right service—typically Azure Files Premium—and configuring it with FSLogix, you provide a stable and fast environment for your users.

Key Takeaways for your AVD Storage Strategy:

1. Prioritize Performance: User experience is driven by storage speed. Do not skimp on IOPS, especially during the morning login window.
2. Use FSLogix: It is the industry standard for a reason. It decouples the user profile from the session host, enabling the flexibility required for modern cloud desktops.
3. Right-Size Your Shares: Use quotas to manage costs, but ensure you have enough headroom to handle growth and peak usage.
4. Secure the Infrastructure: Treat your storage account as a high-value asset. Use private endpoints, restrict network access, and implement the principle of least privilege.
5. Monitor Proactively: Use Azure Monitor insights to detect performance degradation before users start calling the help desk.
6. Plan for Redundancy: Consider Cloud Cache or geo-redundant storage options if your business requirements dictate high availability during regional outages.
7. Keep it Simple: Avoid over-engineering the architecture until you have clear performance data that justifies moving to more complex solutions like Azure NetApp Files.

By following these principles, you will build a storage foundation that is not only capable of supporting your current AVD needs but is also prepared to scale as your organization evolves. Remember, in the world of virtual desktops, the storage layer is the invisible engine that determines whether your users love or loathe their daily work experience. Invest the time to get it right, and the rest of your AVD deployment will be significantly easier to manage.