Private Link and Network Troubleshooting

Azure Private Link for AVD

What Private Link protects

Connection Type	Without Private Link	With Private Link
Session host to control plane	Public internet (HTTPS)	Private endpoint in VNet
Client feed download	Public internet	Private endpoint (workspace)
Initial resource discovery	Public internet	Private endpoint (global sub-resource)
RDP session data	RDP Shortpath (UDP) or reverse connect (TCP) via public internet	Can still use RDP Shortpath via managed network

Private endpoint architecture

You need up to three types of private endpoints:

1. Host pool private endpoint (connection sub-resource)

• Creates a private IP for the session host to control plane connection
• Session hosts communicate with the AVD broker and gateway over this private path
• One private endpoint per host pool

2. Workspace private endpoint (feed sub-resource)

• Allows clients on your network to discover available desktops and apps
• Clients download the feed (list of published resources) over the private connection
• One private endpoint per workspace

3. Global private endpoint (global sub-resource)

• For the initial service discovery that happens before the workspace feed
• Shared across all AVD deployments in your tenant
• Only one needed per tenant, but it affects ALL host pools (be careful)

💡 Exam tip: Global sub-resource impact

The global private endpoint is special — it applies to your ENTIRE tenant, not just one host pool. If you enable it, ALL clients in your organisation must be able to reach the global private endpoint. This means users outside your corporate network (working from home without VPN) may lose the ability to discover AVD resources.

The exam may present a scenario where “some users can see AVD resources and others cannot” after enabling Private Link. Check whether the global private endpoint is configured and whether all users can reach it.

🏛️ JC’s decision: “The Federal Department requires all management traffic to stay on private networks. We deployed host pool and workspace private endpoints. But we did NOT enable the global sub-resource because field workers need to discover resources from home without VPN. We use Conditional Access policies to control who can actually connect.”

DNS requirements for Private Link

Private endpoints get private IP addresses. You must configure DNS so that AVD FQDNs resolve to these private IPs instead of public IPs.

Approach	How It Works	When to Use
Azure Private DNS Zones	Auto-registration of private endpoint DNS records	Recommended for Azure-native deployments
Conditional DNS forwarders	On-premises DNS forwards specific zones to Azure DNS	Hybrid environments with on-premises DNS
Host file overrides	Manual IP mapping on each client/session host	Testing only — not scalable

The required Private DNS zones:

• privatelink.wvd.microsoft.com — for host pool and workspace endpoints
• privatelink-global.wvd.microsoft.com — for the global endpoint

Common mistake: Forgetting to link the Private DNS zone to the VNet where session hosts reside. If the DNS zone exists but is not linked to the VNet, session hosts cannot resolve the private endpoint addresses.

Network troubleshooting

When AVD connections fail, diagnose systematically:

Step 1: Check AVD service health

• Azure portal → Service Health → check for AVD service incidents
• AVD health check API

Step 2: Verify session host health

In the Azure portal, check the host pool → Session hosts:

Status	Meaning	Action
Available	Healthy and accepting connections	No action needed
Needs assistance	Health check failed (domain join, DNS, agent, etc.)	Check the health check details
Unavailable	VM is off, deallocated, or unresponsive	Start the VM or investigate OS issues
Upgrading	AVD agent is updating	Wait — should resolve automatically

Step 3: Test connectivity from session host

From a session host, verify:

• DNS resolution: Resolve-DnsName rdweb.wvd.microsoft.com
• Control plane connectivity: Test-NetConnection -ComputerName rdweb.wvd.microsoft.com -Port 443
• Time sync: Ensure the clock is within 5 minutes of UTC (Kerberos tolerance)
• Agent health: Check the RDAgentBootLoader and WindowsAzureGuestAgent services

Step 4: Check from the client side

• Verify the client can reach rdweb.wvd.microsoft.com (or the Private Link FQDN)
• Check for proxy or firewall interference
• Test with the AVD web client (client.wvd.microsoft.com) to rule out client app issues
• Check certificate errors (expired TLS, untrusted CA)

ℹ️ Deep dive: Common connectivity failures

“Needs assistance” on session host:

• Domain join failed → check DNS can resolve the domain controller, and the machine account is not stale
• SxS stack listener not ready → restart the RDAgentBootLoader service
• URL access check failed → ensure the session host can reach all required AVD endpoints

Client cannot see any resources:

• User is not assigned to an application group → check app group assignments
• Workspace is not published → ensure the workspace contains the application group
• Private Link DNS misconfiguration → verify FQDN resolves to the private endpoint IP

Connection drops after 30 seconds:

• Often a certificate or TLS handshake issue
• Check if a proxy is intercepting and re-signing the TLS connection

Azure Monitor for network diagnostics

Use Azure Monitor and AVD Insights workbooks to monitor:

Metric	What It Shows	Where to Find It
Connection latency	RTT between client and session host	AVD Insights → Connection Performance
Session disconnect rate	Percentage of sessions that disconnect unexpectedly	AVD Insights → Connection Reliability
RDP Shortpath status	Whether connections use UDP or fell back to TCP	AVD Insights → Connection Details
Bandwidth utilisation	Network throughput per session	Azure Monitor → VM network metrics

🎧 Mia’s toolkit: “I check AVD Insights every morning. If the disconnect rate spikes, I look at which session hosts are affected and correlate with network metrics. Last week, a new firewall rule was blocking TURN traffic — 30% of remote connections lost Shortpath and fell back to TCP. AVD Insights showed it before users even called.”

Question

What are the three types of private endpoints for Azure Virtual Desktop?

Click or press Enter to reveal answer

Answer

1. Host pool (connection sub-resource) — session host to control plane. 2. Workspace (feed sub-resource) — client resource discovery. 3. Global (global sub-resource) — initial service discovery, applies to the entire tenant.

Click to flip back

Question

Why is the global Private Link sub-resource risky to enable?

Click or press Enter to reveal answer

Answer

It applies to your entire tenant, not just one host pool. If enabled, ALL clients must be able to reach the global private endpoint to discover AVD resources. Users outside your corporate network (e.g. home workers without VPN) may lose access to the AVD feed.

Click to flip back

Question

What DNS zone is needed for AVD Private Link host pool and workspace endpoints?

Click or press Enter to reveal answer

Answer

privatelink.wvd.microsoft.com — this zone must be created, populated with the private endpoint records, and linked to the VNet where session hosts and/or clients reside.

Click to flip back

Knowledge Check

After enabling Private Link for an AVD host pool, JC discovers that session hosts show 'Needs assistance — URL access check failed.' What is the most likely cause?

AThe session hosts do not have public IP addressesBThe Private DNS zone is not linked to the session host VNet, so AVD FQDNs resolve to public IPs that are blockedCPrivate Link requires a premium SKU load balancerDThe session host VMs are too small to handle Private Link traffic

Check Answer

Knowledge Check

Priya enabled the global Private Link sub-resource for NomadTech. Now remote workers at home report they cannot see any AVD resources in the Windows App, but office workers can. What happened?

ARemote workers need to upgrade their Windows App clientBThe global private endpoint is only reachable from the corporate network — remote workers without VPN cannot reach it for initial resource discoveryCRemote workers need to be reassigned to application groupsDThe workspace private endpoint is blocking remote access

Check Answer

🎬 Video coming soon

Private Link and Network Troubleshooting

---

Next up: Storage Planning for User Data — choose the right storage for FSLogix profiles, user data, and session host needs.