Run Azure Virtual Desktop in your own data center

AVD Hybrid puts session hosts on your own hardware, connected to Azure through Azure Arc. We plan, pilot and build it with a tested, zero-touch process.

Microsoft Partner
Why AVD Hybrid

Azure Virtual Desktop, on your own hardware

Your hardware, Microsoft’s control plane

Session hosts run on hardware you already own. Brokering, identity and management stay in Azure.

Data stays in your data center

Desktops and data remain on-site, for residency, compliance and latency-sensitive apps.

One desktop service

The same Windows App, Entra ID sign-in and Intune management as AVD in Azure.

How it works

Your hosts stay home. Azure runs the service.

Session hosts run on your hardware and connect out to Azure; nothing connects in.

Your data centerSession hosts run on hardware you already ownYOUR HYPERVISORHOST+ scaleDesktops and data stay hereOUTBOUNDHTTPS ONLYno inbound portsMicrosoft AzureThe control plane, run by MicrosoftMicrosoft Entra IDSign-in and device identityMicrosoft IntunePolicies, apps and securityAzure ArcManages each host as an Azure resourceAzure Virtual DesktopBrokers every session to the right hostYour usersConnect with Windows App, from anywhere
Your data centerYour hardware, your supported hypervisorSession hosts, as many as you needWindows 11 Enterprise (single-session) or Windows Server 2025Built from one golden image, zero-touchYour apps, file servers and dataStay next to the desktops, on-siteMicrosoft AzureThe control plane, run by MicrosoftAzure Virtual Desktopbrokering, host poolsAzure Arcconnects your hostsMicrosoft Entra IDsign-in, SSOMicrosoft Intuneapps and policiesOutbound HTTPS onlyno inbound portsUsers connect with Windows AppYour data centerYour hardware, your supported hypervisorSession hosts, as many as you needWindows 11 Enterprise (single-session)or Windows Server 2025Built from one golden image, zero-touchYour apps, file servers and dataStay next to the desktops, on-siteOutbound HTTPS onlyno inbound portsMicrosoft AzureThe control plane, run by MicrosoftAzure Virtual Desktopbrokering, host poolsAzure Arcconnects your hostsMicrosoft Entra IDsign-in, SSOMicrosoft Intuneapps and policiesUsers connect with Windows App
What every build includes

Secure and repeatable from the first host

From power-on to readyEvery new host sets itself up. Nobody signs in to it.0102030 MINPower onclone the imageSets itself upnew name, new identityJoins your identityEntra ID and IntuneConnects to Azuremanaged like any Azure resourceReady for usersAvailable in the host poolTimes measured in testing. A whole batch runs in parallel, so a batch takes about as long as a single host.
Secure by default, on every hostBuilt in at first boot, so nothing depends on someone remembering a step.SESSION HOSTIts own admin passwordUnique on every host, rotated automaticallyEncrypted diskRecovery key stored in Entra IDNo secrets left behindSetup credentials removed after first bootShort-lived onboarding accessLimited to one resource group, set to expireTeams, optimizedCalls and video tuned for virtual desktopsEvery host is joined, enrolled, encrypted and policy-managed before a user ever signs in.
Built for day 2One operating model for the life of every host,not a one-off deployment.Image updates, credential renewal andretirement are all repeatable and checked,so the pool stays clean as it grows.REPEATABLEBuildfrom a versioned golden imageVerifyevery layer checkedUpdatenew image version, renewed credentialsRetireremoved from every layer, verified

Clone

Clone hosts from one tested golden image.

First boot

Each host names itself, joins Entra ID and enrolls in Intune.

Azure Arc

The host connects to Azure through Azure Arc.

Host pool

One script adds the whole batch to the host pool.

Zero-touch session hosts

One golden image; every clone sets itself up on first boot, with nobody signing in.

Teams that works

Microsoft Teams media optimization set on every hybrid host.

Windows LAPS

Each host gets its own rotating local admin password.

BitLocker

Disk encryption on, with recovery keys stored in Entra ID.

Microsoft 365 Apps

Office and policies arrive from Intune on every new host.

Image updates

New versions from versioned snapshots, with a rollback point.

Short-lived secrets

The onboarding identity is limited to one resource group, and secrets are removed from each host.

Clean removal

One script removes a host from every layer, then checks it’s gone.

One package

Readiness, Pilot, then Build and Scale

Three steps, with one team start to finish.

One package · one team, start to finish

Step 1

AVD Hybrid Readiness Assessment

We confirm your hardware, licenses and network are ready, and plan the pilot.

  • Licensing and OS fit (single-session)
  • Hypervisor platform health and capacity
  • Network, Entra ID, Intune and Conditional Access readiness
  • Comparison with your legacy or on-prem VDI

You get: Readiness report with rated findings, and the pilot plan

Step 2

AVD Hybrid Pilot

A working pilot on your own hardware, with real users, in weeks.

  • Azure setup: host pool, Arc onboarding identity, single sign-on
  • Golden image and zero-touch provisioning
  • Intune: Office, LAPS, BitLocker; Teams optimization
  • Pilot users, sized to your rollout

You get: Pilot host pool and the golden image

Step 3

Build and Scale

We roll out to production from the pilot image.

  • Production host pools, naming and groups
  • Image update process
  • Handover and admin training

You get: Production host pools and a documented day-2 process

Closing documents

Health Check and As-Built

A rated Health Check and a complete As-Built of what we built.

See the samples ↓

Closing documents

Health Check and As-Built for your new environment

The package closes with a rated Health Check and a complete As-Built of what we built, so your team takes over with evidence and documentation. These pages are from a sample AVD Hybrid build for Northwind Traders, a fictional company.

Scoped and quoted for your environment after a short call. Your pilot runs alongside your legacy or on-prem VDI.

What this process delivers

  1. Add a new host~30 minpower-on to Available
  2. Clone it in your hypervisorZerohands-on steps inside Windows
  3. Build one or manyParallelthe whole batch at once
  4. Retire a hostClean exitretired from every layer, verified

Figures from TechSogna’s own testing, November 2026.

Free guide, on request

AVD Hybrid quick build-out guide

Zero-touch session hosts, built from one golden image

Our step-by-step runbook, from start to finish: the identity setup, the image, cloning, Intune policies, day-2 updates and a troubleshooting guide.

  • Written for AVD and infrastructure admins
  • Tested end to end
  • Preview pages here; the full guide is emailed on request
  • Scripts are provided to clients as part of an engagement
Request the full guide

Protected by Cloudflare Turnstile

See our Privacy Policy.
Guide cover
Cover
Guide overview, first part
At a glance
Guide step 3, first partContinues in the full guide
Step 3: build the golden image

Preview pages. The full guide and its scripts aren’t downloadable; the guide is sent on request.

FAQ

Frequently asked questions

What is Azure Virtual Desktop Hybrid?

Microsoft’s Azure Virtual Desktop with the session hosts on your own hardware, connected through Azure Arc. Azure handles brokering, identity and management. Microsoft made it generally available in September 2026.

Which hypervisors do you build AVD Hybrid on?

We build AVD Hybrid on VMware vSphere and Nutanix AHV, and on Azure Local on request. Microsoft supports session hosts on any on-premises hypervisor that runs Windows virtual machines; check Microsoft’s documentation for current requirements.

Which Windows versions can the session hosts run?

We build Windows 11 Enterprise (single-session) and Windows Server 2025 hosts. Windows 11 multi-session isn’t available for AVD Hybrid, so plan for one user per Windows 11 host. Windows 11 hosts are Entra joined for a simple, modern sign-in.

How is AVD Hybrid licensed?

Each user needs a qualifying Windows or Microsoft 365 license plus Microsoft’s per-user AVD Hybrid service license. Windows Server hosts also need RDS CALs with Software Assurance. Check Microsoft’s current licensing.

What doesn't Microsoft manage for hybrid hosts?

Power management, autoscale and Start VM on Connect aren’t available for hybrid hosts. We cover host building and lifecycle with scripted, repeatable processes.

How fast can new hosts be added?

Multiple hosts build in parallel: in testing, each new host was Available about 30 minutes after power-on, with no hands-on steps inside Windows. One script adds the whole batch to the host pool.

Can we move from our current VDI on the same hardware?

Usually yes, if your hypervisor is supported. The package starts with a Readiness Assessment that checks the fit, and the pilot runs alongside your legacy or on-prem VDI.

Start with a Readiness Assessment

One team takes you from readiness to production. In 15 minutes we’ll tell you plainly whether AVD Hybrid fits your hardware and licenses.

Book a Readiness callNot ready to talk yet? Get the free build-out guide ↑