A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
Hello @76416518,
Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.
This usually happens if a user doesn’t connect via AVD but via direct RDP connection to the VM. Example: an admin.
You can check the event logs of the VM for that time to identify the user.
--please don't forget to upvote and accept as answer if the reply is helpful--