Monitoring AVD with Azure Monitor

You have deployed Azure Virtual Desktop — host pools are running, users are connecting. But how do you know if things are actually going well? Are users waiting too long to connect? Is a session host about to run out of memory? Did five people fail to log in this morning?

That is what monitoring solves. Azure Monitor gives you a single pane of glass to see everything happening inside your AVD environment — from connection reliability to host CPU usage.

---

What Data Does Azure Monitor Collect?

Azure Monitor pulls data from three layers of your AVD environment:

Layer	What is collected	Examples
AVD control plane	Diagnostic logs from host pools and workspaces	Connection attempts, feed refreshes, errors, management actions
Session host OS	Performance counters and event logs	CPU percentage, available memory, disk I/O, logon events
User sessions	Session-level metrics	Round-trip latency, frames skipped, input delay

All of this data is sent to a Log Analytics workspace — think of it as a central database where everything lands for querying and visualisation.

---

Setting Up Diagnostics

Before Azure Monitor can show you anything, you need to tell AVD to send its data somewhere. This involves two steps:

Step 1 — Enable Diagnostic Settings on the Host Pool

Go to your host pool in the Azure portal, select Diagnostic settings, and add a setting that sends logs to your Log Analytics workspace. The key log categories are:

• Checkpoint — lifecycle events (VM started, session created)
• Connection — every user connection attempt and result
• Error — failures and error codes
• Management — admin actions (scaling, drain mode changes)
• Feed — workspace feed refresh events

Step 2 — Enable Diagnostic Settings on the AVD Workspace

The AVD workspace (not the Log Analytics workspace — confusing, yes) also has diagnostic settings. Enable the Feed category here to track when users refresh their app feed.

Step 3 — Install the Azure Monitor Agent on Session Hosts

For OS-level data (CPU, memory, event logs), you need the Azure Monitor Agent (AMA) installed on each session host. A Data Collection Rule (DCR) tells the agent what performance counters and event logs to collect.

Exam Tip — Diagnostic Settings vs Azure Monitor Agent

The exam loves to test whether you know the difference. Diagnostic settings are configured on the AVD resource (host pool, workspace) and collect control-plane data. The Azure Monitor Agent is installed on session host VMs and collects OS-level data. You need BOTH for full monitoring.

---

AVD Insights — Your Dashboard

AVD Insights is a pre-built Azure Monitor workbook designed specifically for Azure Virtual Desktop. It gives you four key dashboard views:

1. Connection Reliability

How many connections succeeded vs failed? Which error codes appear most? Which users have repeated failures?

2. User Experience

Round-trip latency, input delay, and frame quality. If users complain that “it feels laggy,” this tab shows you the numbers.

3. Host Utilisation

CPU, memory, and disk usage per session host. Spot that one VM running at 95 percent CPU while others sit idle.

4. Session Details

Who is connected, to which host, for how long, and what apps are they running?

🎧 Mia’s morning routine at Horizons Health: Every morning at 7:30, Mia opens AVD Insights before the day shift arrives. She checks the connection reliability tab — three nurses failed to connect overnight. She drills into the error codes: all three hit ConnectionBrokenMissedHeartbeat. That tells her the network at the north clinic dropped briefly. She messages Tom (night shift) to confirm, then checks host utilisation — the radiology host pool is already at 80 percent CPU because Dr. Patel started her imaging sessions early. Mia flags it for the scaling plan review.

---

Key Metrics to Watch

Not all metrics are equally important. Focus on these for both the exam and real life:

Metric	Why it matters	Alert threshold example
Active sessions per host	Shows load distribution	More than 15 per host (depends on VM size)
CPU percentage per host	Overloaded hosts degrade user experience	Above 85 percent for 5 minutes
Available memory	Low memory causes app crashes	Below 1 GB
Round-trip latency	Directly impacts how “snappy” the session feels	Above 150 ms
Connection failures	Users cannot work if they cannot connect	More than 5 failures in 10 minutes
Disconnect rate	Frequent disconnects signal network or host issues	Above 10 percent of sessions

---

Custom Workbooks

AVD Insights is great out of the box, but you can customise it:

1. Open AVD Insights in the Azure portal
2. Click Edit to enter edit mode
3. Modify existing tiles, add new KQL queries, or change visualisations
4. Save as a new workbook (do not overwrite the built-in one)

Common customisations include filtering by department, adding cost-per-user calculations, or building an executive summary view.

🏢 Raj’s enterprise dashboard: TerraStack has 8,000 users across three host pools — engineering, finance, and general. Raj cloned AVD Insights and added a top-level dropdown that filters by host pool. He added a cost tile that pulls VM pricing data and divides by active user count. Andrea (the CIO) now gets a weekly email with a screenshot showing cost-per-user trending downward since the Citrix migration. Dmitri added a network latency heatmap broken down by office location.

Deep Dive — Useful KQL Queries for AVD

Here are starter queries you can paste into Log Analytics:

Failed connections in the last 24 hours: WVDConnections | where TimeGenerated > ago(24h) | where State == "Failed" | summarize count() by UserName, Error

Average round-trip time by user: WVDConnections | where TimeGenerated > ago(7d) | where State == "Connected" | summarize avg(RoundTripTimeMs) by UserName

Session host CPU over 80 percent: Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" | where CounterValue > 80 | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m)

---

Setting Up Alerts

Monitoring is only useful if someone actually looks at it. Alerts close the gap by notifying you when something goes wrong.

To create an alert:

1. Navigate to Azure Monitor then Alerts then Create alert rule
2. Set the scope to your host pool or session host resource group
3. Choose a signal (e.g., custom log query for failed connections)
4. Define the threshold (e.g., more than 5 failures in 10 minutes)
5. Attach an action group (email, SMS, Teams webhook, or Logic App)

Common alerts for AVD:

• High CPU on any session host
• No available sessions in a host pool (capacity exhausted)
• Spike in connection failures
• Host in drain mode for more than 24 hours (forgot to bring it back?)

---

Performance Optimisation

Monitoring naturally leads to optimisation. Use AVD Insights data to:

• Right-size VMs — If hosts consistently use less than 30 percent CPU, you are paying for too much compute. Scale down to a smaller VM size.
• Rebalance load — If breadth-first balancing leaves some hosts overloaded after scaling events, review your maximum session limit per host.
• Identify noisy users — One user running heavy Excel models can tank a session host. Move them to a dedicated host pool with GPU-backed VMs.
• Tune scaling plans — If users complain about slow logins at 9 AM, your ramp-up schedule might start too late.

Exam Tip — Workbook vs Dashboard vs Alert

The exam may ask when to use each. Workbooks are for detailed, interactive investigation (drill-down, filters, KQL). Azure Dashboards are for pinning key tiles to a shared overview (less interactive). Alerts are for automated notification when thresholds are breached. AVD Insights is a workbook, not a dashboard.

---

Flashcards

---

Knowledge Check

---

Summary

Azure Monitor is how you keep your AVD environment healthy. Enable diagnostic settings on host pools and workspaces, install the Azure Monitor Agent on session hosts, and use AVD Insights as your daily dashboard. Set alerts so problems find you before users do.

Next up: Now that you can see what is happening, let us make AVD respond automatically — Autoscaling and Session Management.