Azure Virtual Desktop (AVD) is Microsoft’s cloud platform for delivering remote Windows desktops and applications from Azure. Users connect to a hosted session, while the actual operating system, user profile, and desktop shell run on managed infrastructure rather than on the endpoint itself.
AVD matters in cyber security because it centralizes access, identity, logging, and patching, but it also concentrates failure risk. If profile attachment, shell startup, or a post-update component breaks, users may see a black screen, delayed sign-in, or missing desktop even though the host is still running. Defenders use AVD to reduce data exposure on local devices and to enforce controls such as conditional access and session monitoring. Attackers may target the identity layer, session configuration, or mismanaged remote access rather than the virtual desktop itself. In practice, troubleshooting often focuses on login telemetry, profile containers such as FSLogix, and whether explorer.exe starts correctly inside the session.