By David,
Azure Virtual Desktop (AVD) is Microsoft's service for running Windows desktops and apps in Azure and streaming them to users on any device. If you've been asked to look at it, or you've inherited one, this guide explains what AVD actually is, how the pieces fit together, what the licensing covers, and what you still have to build yourself. It's vendor-neutral until the section on where Atlas AVD fits.
AVD in one paragraph: Microsoft runs the AVD service itself: the web, broker and gateway services that sign users in, show them their desktops and apps, and connect them. You run the session hosts: Windows virtual machines in your own Azure subscription, built from your image, on your network, joined to your identity. Users connect from Windows App or a web browser and get either a full Windows desktop or just the apps you publish. Many users can share one VM with Windows 11 or Windows 10 Enterprise multi-session, which only runs on AVD. If your users already have an eligible Microsoft 365 or Windows license, there's no extra per-user fee for AVD itself. You pay Azure for the VMs, storage and networking it runs on.
Microsoft changes AVD's features and licensing terms from time to time. Everything below reflects Microsoft Learn and Azure's pricing pages as of October 2026, with links to each source so you can check what has changed since.
How AVD works: the architecture
AVD splits a virtual desktop deployment in two (Azure Virtual Desktop service architecture):
- Microsoft runs the connection infrastructure. The web service that gives each user their list of desktops and apps (the feed), the broker that orchestrates connections, the gateway that relays the remote desktop traffic, and the databases behind them. In a traditional Remote Desktop Services (RDS) farm, these were servers you built, patched and made highly available. In AVD they're a service, run in around 40 Azure regions.
- You run everything the user's session actually runs on. Microsoft's words: you're responsible for "creating and managing session hosts, including any operating system image customizations and applications, virtual network connectivity, the resiliency, and the backup and recovery of those session hosts". You also provide the user identities and decide who gets access.
The four AVD objects, from the user down
AVD organizes everything you publish into four kinds of Azure resource (Azure Virtual Desktop terminology):
| Object | What it is | Rules worth knowing |
|---|---|---|
| Workspace | A logical grouping of application groups. It's what users see as a collection in Windows App. | An application group must be in a workspace before its users can see it, and it can only be in one. |
| Application group | Controls access to a full desktop or to a set of apps on one host pool. You assign users and groups here. | Two types: Desktop and RemoteApp. One desktop application group per host pool, but as many RemoteApp groups as you like. |
| Host pool | A collection of Azure VMs registered to AVD as session hosts, normally all built from the same image. | Pooled or personal. Pooled pools load-balance sessions breadth-first or depth-first, up to a maximum session limit per host. |
| Session host | A Windows VM running the AVD agent. This is where users' apps actually run. | Windows 11 or 10 Enterprise, Enterprise multi-session, or Windows Server 2016 to 2025. 64-bit only. |
What surrounds them
Those four objects don't work on their own. Every AVD deployment also needs these (Prerequisites for Azure Virtual Desktop):
- Identity. Microsoft Entra ID always authenticates users, and personal Microsoft accounts aren't supported. Session hosts join either Microsoft Entra ID or an Active Directory domain (AD DS or Microsoft Entra Domain Services). With a domain, user accounts have to be hybrid identities, synchronized between the two.
- User profiles. On a pooled host pool, a user can land on a different host every time they sign in, so their profile can't live on the VM. FSLogix keeps each profile in a virtual disk on a file share, usually Azure Files or Azure NetApp Files, and attaches it at sign-in. Users licensed for AVD through Microsoft 365, Windows Enterprise or RDS are licensed for FSLogix too (Prerequisites for FSLogix). When it goes wrong, it's the most common cause of AVD support tickets: see FSLogix troubleshooting and FSLogix optimization.
- Networking. A virtual network and subnet in the same region as the session hosts, with a route to your domain controllers, DNS, apps and data. Session hosts make outbound connections to the AVD service over TCP 443, so you don't open any inbound ports or give them public IP addresses. Microsoft recommends keeping round-trip latency from users to the region under 150 ms.
- Images. Session hosts are built from a Windows image: either one of Microsoft's images or your own custom "golden" image, stored in an Azure Compute Gallery or as a managed image.
- A client. Users connect with Windows App or the Remote Desktop client on Windows, macOS, iOS, iPadOS and Android, or from a web browser. The old Remote Desktop Connection (MSTSC) client isn't supported.
What happens when a user connects
- The user opens Windows App and signs in with their Entra ID account. The web service returns their feed: the desktops and apps their application groups give them.
- They select a desktop or app. The connection reaches the nearest gateway through Azure Front Door, and the broker picks a session host. On a pooled host pool that's the least or most loaded host, depending on the load-balancing setting. On a personal host pool it's the user's own VM.
- The broker tells the AVD agent on that session host to connect out to the same gateway, and the gateway relays the session between them. With RDP Shortpath, the session can switch to a direct UDP connection for lower latency.
Because the session host dials out rather than listening, the "no inbound ports" property comes with the design, not from extra firewall work.
Pooled vs personal, desktops vs RemoteApp
The biggest early decision in any AVD design is the host pool type (Azure Virtual Desktop terminology):
| Pooled host pool | Personal host pool | |
|---|---|---|
| Users per VM | Many, up to the maximum session limit you set | One. Each VM is assigned to one user. |
| Where a user lands | Any host, chosen by the load balancer at each sign-in | Always their own VM |
| Profiles | Must roam, usually with FSLogix | Can stay on the VM's own disk |
| Updates | Redeploy hosts from an updated image | Patch each VM, like a physical PC |
| Scaling | Autoscale switches hosts on and off by schedule and load | Autoscale starts VMs on schedule or with Start VM on Connect, and deallocates or hibernates them when users sign out or disconnect |
| Typical fit | Task and knowledge workers on a standard app set | Developers, power users, and apps that need admin rights or a persistent machine |
Pooled pools are where AVD's economics come from, especially with Windows 11 Enterprise multi-session, which runs many interactive sessions on one VM and is exclusive to AVD. Most estates end up with both: pooled for the majority, personal for the few who need it. The trade-offs, and how to run both side by side, are covered in Pooled vs Personal Host Pools in AVD.
The second decision is what to publish:
- Desktop application groups give users a full Windows desktop. They work with pooled and personal host pools.
- RemoteApp application groups publish individual apps, which open on the user's device like local apps while running in Azure. They work with pooled host pools only, and they suit one line-of-business app that needs to sit next to its data in Azure, or contractors who need one app and nothing else.
A pooled host pool can carry a desktop group and RemoteApp groups at the same time. If a user is assigned both on the same host pool, they only see the host pool's preferred application group type.
Licensing: what's included and what you pay Azure for
AVD has two separate costs: the right to access it, which most organizations already own through Microsoft 365 or Windows licensing, and the Azure infrastructure it runs on, which is always billed by Azure.
Access rights for your own users
Each user who connects needs an eligible license. Which one depends on the session host operating system (Licensing Azure Virtual Desktop, as of October 2026):
| Session host OS | Eligible licenses for your own employees and contractors |
|---|---|
| Windows 11 or 10 Enterprise, or Enterprise multi-session | Microsoft 365 E3, E5, A3, A5, F3, Business Premium or Student Use Benefit. Windows Enterprise E3 or E5. Windows Education A3 or A5. Windows VDA per user. |
| Windows Server 2016, 2019, 2022 or 2025 | A Remote Desktop Services (RDS) Client Access License with Software Assurance, per user or per device, or an RDS User Subscription License |
The licensing difference is usually what decides the session host OS. Windows 11 Multi-Session vs Windows Server compares the two side by side, including Office and Teams support and when Windows Server still wins.
A few details catch people out:
- Microsoft 365 Business Premium qualifies; Business Basic and Business Standard don't. They aren't on the list, and neither are the Office 365 plans.
- Contractors and guests need a license in your tenant. A license assigned in their own company's directory doesn't give them access rights to your AVD. Microsoft recommends buying them the same kind of license as your employees and assigning it to their identity in your tenant.
- Windows Server session hosts also need an RDS license server they can reach, on-premises or in Azure (Apply Windows license to session host VMs).
- Testing is easier in Dev/Test. In an Azure Dev/Test subscription, users can connect for acceptance testing and feedback without a separate license.
Access rights for external customers
If you're selling an app to customers rather than giving desktops to your own people, there's per-user access pricing instead. You enroll an Azure subscription, and AVD charges a flat monthly fee for each external user who connects at least once that month, in two tiers: Apps and Desktops + apps. It isn't a way to license your own staff or contractors, and it isn't available for Windows Server session hosts. Current prices are on the Azure Virtual Desktop pricing page.
What Azure bills you for
Whichever way users are licensed, Azure charges for the resources AVD runs on (Azure Virtual Desktop pricing):
- Virtual machines: the session hosts' compute, usually the biggest line. With eligible licenses, Windows 10 and 11 Enterprise session hosts carry no separate Windows license charge. The Azure portal applies that automatically when it creates them.
- Storage: OS disks, images, and the file shares that hold FSLogix profiles.
- Networking: data leaving Azure, plus anything you add, such as a firewall, VPN or ExpressRoute.
- Everything around it: Log Analytics for monitoring, backup, and the other Azure services you connect.
Compute only bills while a VM is allocated, which is why scaling matters more than anything else on an AVD bill. To estimate your own costs, try the AVD Cost Calculator, then read Cut Idle AVD Compute: Our Cost Model Shows Up to 60%.
What Microsoft gives you vs what you have to build
AVD gives you a solid service and a set of native building blocks. Turning them into a desktop service your users are happy with is still your job. Here's how it splits:
| Area | What Microsoft provides | What you still build and run |
|---|---|---|
| Connections | Web, broker and gateway services; load balancing; reverse connect; RDP Shortpath | Nothing to host. You choose the regions and the network path. |
| Session hosts | Azure VMs, a host pool wizard in the Azure portal and, for pooled pools, the session host configuration approach that creates and updates hosts from one definition | Choosing VM sizes, deploying hosts, joining them to a domain, replacing broken ones, and patching personal desktops |
| Images | Microsoft's Windows images, custom image templates, Azure Compute Gallery | Your golden image: apps, optimizations, a monthly update cycle, testing, versioning and rollback |
| Scaling | Autoscale scaling plans and Start VM on Connect | Schedules and thresholds that match how your users actually work, and checking that they save money |
| Monitoring | Azure Virtual Desktop Insights on Log Analytics, and AVD diagnostics | Workspaces, alert rules, someone to act on them, and working out why a logon took 90 seconds |
| App delivery | RemoteApp publishing, and App Attach for MSIX, Appx and App-V packages | Deciding which apps go in the image, which are attached and which are installed, plus packaging and updates |
| Profiles | FSLogix | File share design, permissions, sizing and capacity monitoring |
| User experience | Windows App and the web client | Onboarding, self-service for "my session is stuck", and a support process |
| Security | Entra ID, Conditional Access, no inbound ports | Host hardening, role assignments, logging and patching |
None of the right-hand column is unusual, and Microsoft documents a native way to do most of it. The work is that it's spread across several Azure services and blades, and it has to be repeated for every host pool and, for MSPs, every customer. That's where most AVD projects spend their time after the first desktop works. It's also where the top 10 AVD mistakes come from. Two of the most expensive are images built by hand and scaling left switched off.
A note for anyone reading older guides: AVD was called Windows Virtual Desktop until 2021. The original AVD (classic), which predates Azure Resource Manager objects, retired on 30 September 2026, and connections to classic resources are blocked (What is Azure Virtual Desktop?). Everything in this guide is about current AVD.
Who AVD is a good fit for
AVD tends to be the right answer when:
- You already own the licenses. Microsoft 365 E3, E5 or Business Premium already includes AVD access rights, so the decision is about Azure infrastructure cost, not new per-user software.
- Many users run a similar set of apps. Multi-session pooled hosts let you share VMs, and autoscale lets you stop paying for them outside working hours.
- Apps or data need to stay in Azure. A line-of-business app next to its database, sensitive data that shouldn't sit on laptops, or regulated workloads that have to stay in your own subscription.
- You need secure access from unmanaged devices. Contractors, BYOD, call centers and seasonal staff get a managed Windows session without you managing their hardware.
- You're replacing RDS, Citrix or VMware Horizon. AVD removes the gateway and broker servers you run today. See Migrating from VMware Horizon to Azure Virtual Desktop.
- You have, or can get, Azure skills. Someone has to own the subscription, the network, the images and the scaling.
It's worth looking at Windows 365 instead when you want a fixed monthly price per user for a personal Cloud PC, with less Azure infrastructure to design and run, and you don't need multi-session density or RemoteApp. That's a real decision with its own trade-offs, covered in Azure Virtual Desktop vs Windows 365.
AVD isn't a fit for users who need to work offline, or users far from any Azure region where AVD's latency guidance can't be met.
How Atlas AVD fits
Atlas AVD is a management layer for the right-hand column of that table. It doesn't replace AVD: your host pools, session hosts and users stay in AVD, in your subscription, and Atlas manages them through Azure's APIs. Here's how it maps:
- Host pools and session hosts. Atlas finds the host pools you already have, and Create Host Pool builds new pooled or personal pools in a guided wizard. See VM provisioning.
- Golden images. Imaging captures a golden image from an existing VM without touching the source, versions it in an Azure Compute Gallery, replicates it to other regions, and rolls it out with Rolling Replace (Zero Downtime), which drains each old host first rather than forcing sign-outs. See Imaging.
- Scaling. Atlas runs its own autoscale engine per host pool: a Session hosts running 24/7 floor, schedules that raise the minimum for the working day, and draining before a host is stopped. Power on Connect starts VMs when users arrive. If a pool already has a native AVD scaling plan enabled, Atlas leaves that pool to it. See the Autoscale Engine.
- Monitoring. Analytics covers sessions, users, VMs and experience, including a Logon Breakdown of where logon time goes, built from AVD diagnostics in Log Analytics. Alert Rules notify Teams, Slack or a webhook. See AVD monitoring.
- App delivery. Each host pool's Application catalog list installs WinGet packages as new hosts are built, and Install Apps reaches hosts that are already running. See WinGet deployment.
- Profiles. FSLogix Management pushes FSLogix configuration to session hosts and watches profile share capacity. See the FSLogix Capacity Monitor.
- User experience. The User Portal gives users their desktops in one place, in their own language, and Reset My Session signs a stuck session out so they can reconnect to a healthy host without a ticket.
- Cost. Cost Intelligence shows what each host pool costs and where scaling or idle hosts are wasting money. See Cost Intelligence.
- Many tenants. One Atlas deployment can manage several customers' Entra tenants, each with its own database, which is how MSPs run AVD for their clients. See Atlas for MSPs.
Atlas runs in your tenant too. The Atlas application, its PostgreSQL database and its Key Vault deploy into your own Azure subscription, and people sign in to it through your Entra directory. Atlas's control plane handles trials, billing, licensing and update availability, and holds no standing access to your Azure or directory after onboarding. Why We Built Atlas AVD Inside Your Azure Tenant explains what runs where.
Self-service trials are open for Azure commercial today; Microsoft 365 GCC and GCC High / Azure Government are on a waitlist. To see everything Atlas does, browse the features or the pricing. To get a first host pool running, follow How to Deploy AVD in Under 30 Minutes.
FAQ
What is Azure Virtual Desktop used for?
Running Windows desktops and apps in Azure and streaming them to users on any device. Common uses are remote and hybrid work, secure access for contractors and unmanaged devices, keeping apps next to their data in Azure, and replacing on-premises Remote Desktop Services, Citrix or VMware Horizon.
Is Azure Virtual Desktop free with Microsoft 365?
The access rights are. Microsoft 365 E3, E5, A3, A5, F3 and Business Premium include the right to use AVD with Windows 10 and 11 Enterprise session hosts, as of October 2026. You still pay Azure for the virtual machines, storage and networking your deployment uses.
Does Microsoft 365 Business Premium include Azure Virtual Desktop?
Yes. Microsoft 365 Business Premium is on Microsoft's list of eligible licenses for Windows 10 and 11 Enterprise and Enterprise multi-session session hosts. Microsoft 365 Business Basic and Business Standard aren't.
What is the difference between Azure Virtual Desktop and Windows 365?
AVD runs in your Azure subscription. You design the host pools and pay Azure for what runs, and it supports multi-session hosts and RemoteApp. Windows 365 is a per-user Cloud PC at a fixed monthly price, with less infrastructure for you to manage. Our AVD vs Windows 365 comparison goes through the trade-offs.
What is a host pool in Azure Virtual Desktop?
A collection of Azure virtual machines registered to AVD as session hosts, normally built from the same image. A pooled host pool shares its VMs between many users. A personal host pool gives each user their own VM.
Does Azure Virtual Desktop need a domain controller?
No. Session hosts can join Microsoft Entra ID with no domain controller. They can also join Active Directory Domain Services or Microsoft Entra Domain Services when apps need a domain. As of October 2026, Microsoft's AVD prerequisites still call for hybrid user identities when FSLogix profiles on Azure Files are used with Entra-joined session hosts.
What is Windows 11 Enterprise multi-session?
A Windows 11 edition that lets several users sign in to the same virtual machine at once, with the normal Windows 11 desktop experience. It's exclusive to Azure Virtual Desktop and is the usual choice for pooled host pools.
Can I use Azure Virtual Desktop on a Mac, iPad or Chromebook?
Yes. Users connect with Windows App or the Remote Desktop client on Windows, macOS, iOS, iPadOS and Android, including Chromebooks that run Android apps, or from a web browser.
What happened to Windows Virtual Desktop?
It was renamed Azure Virtual Desktop in 2021. The original version, now called AVD (classic), retired on 30 September 2026. Current AVD uses Azure Resource Manager host pools, application groups and workspaces.
Microsoft product details in this article are taken from Microsoft Learn and Azure's pricing pages as of October 2026: What is Azure Virtual Desktop?, Azure Virtual Desktop terminology, Service architecture and resilience, Prerequisites for Azure Virtual Desktop, Licensing Azure Virtual Desktop, Apply Windows license to session host VMs, Host pool management approaches, App Attach, Prerequisites for FSLogix and Azure Virtual Desktop pricing. Licensing terms change, so check those pages before you buy.