u/LastCraft5004

I'm deploying Azure Virtual Desktop (AVD) session hosts using Terraform, but I can't get the session hosts to auto enroll in Intune.

The Azure AD (Entra ID) extension is configured correctly, and the VMs are successfully joining Entra ID. However, the MDM field shows "None" in Entra, even though I've enabled automatic Intune enrollment for all users and all Windows devices.

This is in Azure Government, and I've updated all the enrollment-related URLs/TLDs to use .us where applicable (MDM Terms of Use, MDM Discovery, MDM Compliance, and WIP Discovery).

From my research, the only requirements seem to be:

- System-assigned managed identity enabled on the VM

- Azure AD login/Entra join extension configured

I'm also running terraform apply using my own account, which has both Contributor and Intune Administrator roles.

Has anyone run into this issue in Azure Gov? If so, what was the root cause and how did you resolve it?

Note - event viewer isnt showing much on the vm

Any troubleshooting tips would be appreciated.

Anybody having issues connecting to ZPA app segments and authenticating after the MSFT update?

I have a POC AVD environment with the following setup:

FSLogix profiles stored on Azure Files
Entra ID joined multi-session hosts
Apps/configuration deployed through Intune
Zscaler being used for traffic inspection

Recently, the logon process and overall OS load time have become noticeably slower. We’re already bypassing the required AVD FQDNs so traffic goes direct instead of through inspection, and the FSLogix profiles are still small since this is only a POC.

I’m trying to figure out where the bottleneck is coming from and what the best way is to troubleshoot it.
Things I’m considering:

FSLogix profile/container attach delays
Intune policy or app processing during sign-in
Zscaler impact even with bypasses configured
Azure Files latency/authentication
Entra ID sign-in delays on multi-session hosts

What tools/logs would you check first to pinpoint the root cause? Also, what changes have made the biggest difference for reducing AVD login times in your environments?

Microsoft RC4 deprecation / move to AES appears to be breaking authentication with Zscaler Client Connector in our environment.

Has anyone else run into this issue recently? If so, what was the fix or workaround? Trying to figure out whether this is related to Kerberos encryption settings, machine policies, or something on the Zscaler side.

I’m considering taking the Microsoft Azure Solutions Architect Expert (AZ-305) but honestly I’m struggling to see the value outside of just adding another cert to the list.

I already work with Microsoft Azure daily and currently have:

Microsoft Azure Administrator (AZ-104)
Microsoft Azure AI Fundamentals (AI-900)
Designing and Implementing a Microsoft Azure AI Solution (AI-102)

Most of my day-to-day work is hands-on in Azure already, so part of me is thinking I could just brush up on services/concepts for a couple weeks and wing the exam.

But another part of me is wondering if it’s even worth doing at all:

- Did AZ-305 actually help your career/interviews/pay?
- Did it make you better architecturally, or was it mostly checkbox knowledge?
- If you already had real Azure experience, how much studying did you actually need?
- Would you still take it if your employer wasn’t paying for it?

Trying to decide whether I should:
Actually sit down and properly study for it
Just wing it based on experience
Skip it entirely and save the money
Curious what people who already work heavily in Azure, have the cert or work as an SA think

How are you guys handling Windows Updates for multi-session AVD hosts in Azure Gov?

As far as I’m aware:

• Intune Update Rings aren’t supported
• Azure Update Manager also isn’t supported in Azure Gov

Right now, doing updates manually feels like a huge operational headache. I could probably automate parts of it with Run Command / PowerShell scripts, but it still feels pretty clunky for production-scale management.

We’re also not looking to bring in third-party tooling just for patching (I know solutions like Nerdio exist, but purchasing additional software isn’t currently on the table).

Curious what others in Azure Gov.....

This is becoming a constant thing where strong8k TiVimate app constantly breaking
Error: HttpDataSourceException
Where I have to clear the data and reconfigure everything from scratch 😭

Anybody having an issue with their app where the discovery section is continuously trying to load but nothing loads?
I’ve tried deleting and re installing, power cycle my iPhone, update the app
Nothing is working

Has anyone successfully deployed Zscaler Client Connector (ZCC) for VDI using Microsoft Intune as a Win32 app?

Zscaler recommends deploying it as a Line-of-Business (LOB) app, and that approach works—but we’re running into the command-line argument character limit, which blocks us from using it in our scenario.

We’ve been trying to package it as a Win32 app instead (using .cmd / .bat wrappers via the IntuneWin package), but the deployment consistently fails during install.

Curious if anyone has:

Successfully deployed ZCC for VDI via Win32 app

Worked around the command-line length limitation (token/provURL issues)

Found a more reliable packaging or install method

Any guidance, lessons learned, or working examples would be greatly appreciated.

Reference: https://help.zscaler.com/cloud-branch-connector/customizing-zscaler-client-connector-vdi-install-options-msi#Intune
cmd sample:

start /wait msiexec /i "ZCCVDIInstaller" PROVURL="connector.zscaler.net/api/v1/ccaTemplate?name=avd-vdi-templat" TOKEN="OifxeRzY9w zIBniuKn8m GVnrox7MeE M5mu6nF6vl dU50kBy3px vQKFx7VDIP skpv2Hia78 jXVQCrusOy I95yt6NR03 0beV0QzA4g CnNPnPfDu1 49vvpd67Im WlfaxTb5GC PC3yzBlVoP DEN9q4kdvt ZzJ5WLKoU6 JE031beWI5 j1RdJ7zan9 rARkyJyUFN 0HSRPdfOqE THIpFGEEMm nyj1jfronk u5TYkaYcGq TGXNKauCqq TqblUJSnGQ 3YD08kQCBX w1fmnr8ixl UMf7w1BfRt OXvxVMlzr3 aYXRFqny6b Y8HiqB6itN OD2KDFmdpa dYA27O9Doj rcaEMZw2JF ARXDOyLHtk 4sKF4LoSCt SK9swDheTr uZkCwJd27Q JTiRBxaOfF e4fDrTVKXE E3GXrP816N DmpKY0XYrB b7yAiAyn8X BgIunnNOlg ZtGYsIPQvp OotPikgg3m AOaw1Alojn XFKqioD7bK LgJlQEi9Es 1IVqVQSqRX xxpZHq7VVr psspLgugwi 7J550d3Zpc 5Jqkrfe4un CWj7eZS9Qn ErfFhElvqf u4rrDluGbs N6l71sFvMe IdEaQtYlkP nzPMy3vr5z Sgaq4YJllu 3lD7EJwklC 7mSDGhZ2jR sOHY7Hgt5G 1GBqLKVZux QjI7OGm7Lq MzXhuVJknr NZ8zjK9X5t Ue9wUnrIiB yTIPY791wJ ktfDN866cT mk2TDnhQpY gm9oC0QumP EM94FB4UGb ASadudgK0Y Wf6T3QmGpf hP5SLl0cIH An4Ssuz2NuZrSZ6 sJQmiZZwr2 MvLngf1Bj1 SB3qfzXenO hLDtxSgBQM vDphkCUSY5 Zs9XJYauU0 GJJ5IrY4y5 0QihTqacb9 cgPLScyRyU BLn21Gx0H7 Qf5K12V91i dONQqhrplhHYCO JFhHPenfzx Ia2jAw0nIU tkPvd2N6cF exSB4HMkId MdcdcDPrG4 YEP5l0IJXF ovGV8aSYgN EoC1ktLnuh Vho4ViUCFT TnnhebCg6m RiGCbGt6O0 s32eneEuEE 0XGg0KnABH vMco4Y4vUw NPQaYGKBag yMwzmkjRTL 62vPYvf1ww kalOEtzpRI DBLmFUnGdm siFcRplPnb UmsgwXBCd2 YXdkCBw0Aw ZDb6VS3YM8 uhQVrLeYLq lahxARp70R RRgZDdc8Lu 5vRV1ZGu1C YY7d0veYeH ULTlXy0AVO ZdlsBNa8dQ Lc0QJGI8V5 10sFCEdNqW ZWIhuZOZME uMf34yE8s6 F0ltcgFKJm gN2Td7AUW6 XUqbOfTU4V GTeEQypGYW i4oh1PnYdN x8ObE0uCIM xlfg57E6Dj 1T5yPuqGlA moiz1V52gC t3FT6GHkYy Io27LNwYKL 9VHDnZ2JcK bpeQBPPzIm kBw4ywdIMt bfDnUzBmBN BD1hWvGoMr Hlot3tKAZU hU4Y1go9Ev N243Oz8uWB 5evO5M3vR7 c4rcy2nQNp K9fAri76bU yBo8Vory2M Wj44ktVfch lwTBS26O06 37pLrAHRmc WarhPVrrLm I8VsoM0Q63 wAaekOX1Yv BjPOwEw18c 0wRpnDOcv8 NgBiqudygn U4Cd3ZByEk x2ZzKo4ET5 1iyYPecTX1 77aojfhIVp 4wriScwGIn 0YhzwG6eKK G1yV4BHq8V U0GlASlvcU MWQUPDW" MODE=1 SERVERIP=10.1.10.100 ONBOARD=1 CONFIGREADTIMEOUT=60 HIDEAPPONUILAUNCH=1