🔹 Feature: FSLogix Profile Containers for Cloud-Only & External Identities (Azure Virtual Desktop)
🔹 What It Does: You can now store FSLogix profile containers on Azure Files using Microsoft Entra Kerberos — for cloud-only and external identities. That means full Azure Virtual Desktop with roaming profiles, with zero Active Directory. No domain controller, no AD DS, no Entra Domain Services, and no line-of-sight to a DC from your session hosts. Pure cloud identity, the way AVD should have always worked. ☁️🔐
What Is It Giving You:
✅ Truly AD-Free AVD: Entra ID itself issues the Kerberos tickets needed to access the SMB file share. Session hosts don’t need any network line-of-sight to a domain controller. Perfect for greenfield, cloud-native, or M&A scenarios with no on-prem AD.
✅ Cloud-Only AND External Identities: Previously required hybrid identities synced from on-prem AD. Now, cloud-only Entra ID accounts — and external identities — are supported (Azure public cloud). Ideal for contractors, B2B guests, and born-in-cloud orgs.
✅ Simplified “Manage Access” Permissions: With Entra Kerberos enabled, the Azure file share exposes a Manage access tab to assign permissions directly to Entra users, groups, or SIDs — no more icacls gymnastics over a DC connection.
✅ One Clean Identity Source: A storage account uses exactly one auth method — Entra ID, AD DS, or Entra Domain Services, never two. Cloud-only keeps design unambiguous and auditable.
✅ Roam Across Many Session Hosts: Set LoadCredKeyFromProfile=1 so Credential Manager keys follow the profile — users can roam across any number of VMs in the host pool.
✅ Multi-Session via Intune: CloudKerberosTicketRetrievalEnabled now works on Windows multi-session OS when configured through the Intune Settings Catalog.
🛠️ The Must-Do Configs:
🔸 Mandatory App Tag: Add kdc_enable_cloud_group_sids to the storage account’s Entra app registration tags — without it, cloud-only group permissions silently fail.
🔸 Disable MFA on the Storage Account: Kerberos ticket acquisition happens silently at logon; enforce MFA at AVD client login instead.
🔸 Grant Admin Consent: The storage account service principal must be allowed to issue Entra tokens.
🔸 Client Enablement: Configure CloudKerberosTicketRetrievalEnabled via Intune/GPO/registry, then set FSLogix Enabled + VHDLocations pointing to \\
🚀 The shift: For Zero Trust organizations running AVD with no on-prem footprint, this closes the last identity gap. No AD, no DC, no compromise.
