Azure virtual desktop problems after enabling defender for cloud

Question

Hello, we recently enabled Defender for Cloud on our Azure virtual desktop session hosts using Microsoft.Azure.AzureDefenderForServers.MDE.Windows extension. We suddenly noticed that some users started to be forcefully logged off from their Virtual desktop sessions and often were unable to log in again.

We had to disable Defender for Cloud monitoring to make users log in again and staying logged in without issues.

In our Virtual desktop environment we use FSLogix Profiles: maybe there is a conflict between FSLogix and Defender for Cloud? Is there a way to configure both products to work correctly?

Answer 1

Hi, thank you all for your responses, we are implementing the exclusions and configurations you provided.

We will update you after a short testing period.

Regards

Answer 2

Hey! Sorry you’re running into this—what you’re describing (users getting forcefully disconnected and then unable to log back in after enabling Defender for Cloud on AVD session hosts) is commonly caused by real-time Microsoft Defender (MDE) inspection interacting with FSLogix profile VHD/VHDX access.

Why this happens (most common cause)

When Defender for Cloud deploys the MDE.Windows extension, it enables Microsoft Defender real-time protection on the session hosts.

With FSLogix, user profiles are typically mounted/unmounted as VHD/VHDX virtual disks during sign-in and sign-out. Without the right exclusions, the Defender real-time scanner can interfere with those file-system operations, which may lead to profile/container access conflicts mid-session—and that can surface as forced logoffs and failed reconnections.

What to do

The fix is usually to configure the required Microsoft Defender Antivirus exclusions for FSLogix on each AVD session host (via GPO, Intune, or PowerShell). Apply these exclusions consistently to every host in the host pool(s).

Here’s a starting PowerShell snippet for Defender exclusions (FSLogix-focused):

FSLogix exclusions for Defender / MDE on AVD session hosts

Add-MpPreference -ExclusionProcess "frxsvc.exe"

Add-MpPreference -ExclusionProcess "frxccds.exe"

Add-MpPreference -ExclusionProcess "frxdrv.sys"

Add-MpPreference -ExclusionProcess "frxdrvvt.sys"

Add-MpPreference -ExclusionProcess "frxccd.sys"

Add-MpPreference -ExclusionPath "$env:ProgramFiles\FSLogix\Apps"

Add-MpPreference -ExclusionPath "$env:ProgramData\FSLogix"

Add-MpPreference -ExclusionExtension ".VHD"

Add-MpPreference -ExclusionExtension ".VHDX"

If your FSLogix containers are stored on an SMB share, also exclude the share path, for example:

$SharePath = "\\storageaccount.file.core.windows.net\sharename"

Add-MpPreference -ExclusionPath $SharePath

Additional exclusions to consider

Depending on your FSLogix configuration, you may also need exclusions covering:

• VHD/VHDX related metadata/lock patterns
• FSLogix registry locations (HKLM\SOFTWARE\FSLogix\ and HKLM\SOFTWARE\Policies\FSLogix)

(These details are called out in the FSLogix prerequisites/Defender exclusion guidance.)

Verify exclusions are actually applied

After applying, confirm with:

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

About “disabling Defender” permanently

In most cases, you don’t need to disable Defender for Cloud. Instead, you keep Defender on and adjust exclusions so FSLogix VHD/VHDX mounting/unmounting isn’t blocked/flagged.

---

Follow-up questions (to tailor the exact exclusion set)

1. Are your FSLogix profile containers stored on SMB/Azure Files, or locally on the session host?
2. Are you using roaming/container properties that affect where the VHD/VHDX and temp files are created?
3. What exact Defender for Cloud plan is enabled (and is it only applying the MDE.Windows extension)?
4. Can you share the event/log details around the forced disconnect (for example, any FSLogix-related error messages or Defender alerts)?
5. Are these session hosts non-persistent / using a VDI image with onboarding scripts, or are they updated via the extension only?

---

References

• FSLogix antivirus exclusions / prerequisites: https://learn.microsoft.com/fslogix/overview-prerequisites
• Defender for Cloud ↔ MDE integration: https://learn.microsoft.com/azure/defender-for-cloud/integration-defender-for-endpoint
• Onboard AVD Windows devices to MDE: https://learn.microsoft.com/defender-endpoint/onboard-windows-multi-session-device
• Non-persistent VDI onboarding for MDE: https://learn.microsoft.com/defender-endpoint/configure-endpoints-vdi

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.