KojiYamada3095

Posted on Sep 14

Endpoint management and virtual desktop admins who are considering Azure NetApp Files (ANF) as the profile storage location for AVD

#avd #azure #fslogix #azurevirtualdesktop

About this article

What you'll learn
- How to use ANF as the storage location for FSLogix profile containers
- The FSLogix registry settings
- How to verify that it works
Test environment: Azure Virtual Desktop / Azure NetApp Files (as of September 2026)
Assumptions: An Active Directory Domain Services (AD DS) environment

FSLogix stores a user profile in a VHD(X)-based container and attaches it to the session host at sign-in. You use it to persist user settings and data in non-persistent VDI and multi-session environments.

FSLogix containers are placed on an SMB file share. There are various options, such as a shared file server in an on-premises environment, but this article covers storing them on Azure NetApp Files (ANF). As a managed SMB file server, Azure NetApp Files delivers low latency and high throughput.

Container types

Type	Description
Profile Container	Stores the complete user profile in a VHD(X). This is what this article uses
ODFC Container	Separates only Office-related data into a different container
Cloud Cache	Not a type, but an optional configuration for the containers above

Overall workflow

#	Where	What
1	Azure portal	Create a NetApp account
2	Azure portal	Create a capacity pool
3	Azure portal	Configure an Active Directory connection
4	Azure portal	Create an SMB volume
5	Session host	Configure the registry
6	Session host	Verify that it works

Other prerequisites

An Azure account with contributor or administrator permissions
A subnet delegated to Azure NetApp Files
ANF can be accessed only from the same VNet, or a peered VNet in the same region
Only one subnet per VNet can be delegated to ANF
One AD connection per NetApp account

[Step 1] Create a NetApp account

Select Create a resource → search for Azure NetApp Files → select Create

Setting	Description
Name	The display name of the NetApp account
Subscription	Any subscription
Resource group	Any resource group
Location	The same region as the session hosts

A NetApp account must be created in the region where the volumes will be deployed.

[Step 2] Create a capacity pool

In the NetApp account you created → Capacity pools → + Add pool

Setting	Description
Name	The display name of the capacity pool
Service level	Standard / Premium / Ultra
Size (TiB)	Set as needed
QoS type	Auto / Manual

[Step 3] Configure an Active Directory connection

Before creating an SMB volume, you need to create an Active Directory connection.

3-1. Prepare the account used for the domain join

An AD DS domain user account in the same domain where the ANF computer accounts are created
Permissions to create computer accounts in the specified OU

3-2. Create the Active Directory connection

NetApp account → Active Directory connections → Join

Required fields

Setting	Description
Primary DNS	The IP address of the DNS server required for the domain join
Secondary DNS	Same as above
AD DNS Domain Name	The fully qualified domain name of the AD DS (for example, `contoso.com`)
AD Site Name	The default is `Default-First-Site-Name`
SMB server (computer account) prefix	The naming prefix for the computer accounts that ANF creates in AD DS
Username / Password	The account used for the domain join, and its password

Organizational unit path

Specify the LDAP path for the organizational unit (OU) where the SMB server computer accounts will be created. The format is OU=second level, OU=first level. If no value is provided, the CN=Computers container is used.

Optional fields

Setting	Description
AES Encryption	Enables AES encryption authentication support for the admin account of the AD connection
LDAP Signing	Integrity verification for SASL LDAP binds between ANF and AD DS
LDAP over TLS	Secures communication between ANF and the AD LDAP server. Don't enable it with Microsoft Entra Domain Services
Backup policy users	Grants privileges such as `SeBackupPrivilege`
Security privilege users	Grants `SeSecurityPrivilege`. Supported only for SQL Server

Registration complete

[Step 4] Create an SMB volume

NetApp account → Volumes → + Add volume

4-1. Basics tab

Setting	Description
Volume name	Any name
Capacity pool	The pool created in step 2
Quota	Regular volumes are 50 GiB to 100 TiB
Virtual network	The Azure virtual network from which you want to access the volume
Subnet	The subnet delegated to ANF
Availability Zone	None / the same zone as the session hosts

4-2. Protocol tab

Setting	Value
Protocol type	SMB
Active Directory	The connection created in step 3
Share name	The share name that users see
Enable Continuous Availability	✅ Enable it (recommended for FSLogix)
SMB3 Protocol Encryption	When enabled, clients that don't use SMB3 encryption can't access the volume
Access Based Enumeration	Hides directories from users who don't have access permissions

After creation, the Mount path is shown on the volume's Overview.

[Step 5] Configure the registry

Configure the following registry settings on the VMs that act as session hosts.

Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\FSLogix\Profiles

Below is a list of settings taken from the official Microsoft documentation. Enabled and VHDLocations are required.

Value name	Type	Value	Official classification	Default
`Enabled`	DWORD	1	Required	0
`VHDLocations`	MULTI_SZ	`\\<anf-fqdn>\<share-name>`	Required	—
`VolumeType`	REG_SZ	`VHDX`	Recommended	`vhd`
`DeleteLocalProfileWhenVHDShouldApply`	DWORD	1	Recommended	—
`FlipFlopProfileDirectoryName`	DWORD	1	Recommended	0
`LockedRetryCount`	DWORD	3	Recommended	12
`LockedRetryInterval`	DWORD	15	Recommended	5
`ReAttachIntervalSeconds`	DWORD	15	Recommended	10
`ReAttachRetryCount`	DWORD	3	Recommended	60
`ProfileType`	DWORD	0	Default	0
`SizeInMBs`	DWORD	30000	Default	30000

To configure them with PowerShell, use the following.

$regPath = "HKLM:\SOFTWARE\FSLogix\Profiles"

New-ItemProperty -Path $regPath -Name "Enabled" -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path $regPath -Name "VHDLocations" -PropertyType MultiString -Value "\\<anf-fqdn>\<share-name>" -Force
New-ItemProperty -Path $regPath -Name "VolumeType" -PropertyType String -Value "VHDX" -Force
New-ItemProperty -Path $regPath -Name "DeleteLocalProfileWhenVHDShouldApply" -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path $regPath -Name "FlipFlopProfileDirectoryName" -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path $regPath -Name "LockedRetryCount" -PropertyType DWORD -Value 3 -Force
New-ItemProperty -Path $regPath -Name "LockedRetryInterval" -PropertyType DWORD -Value 15 -Force
New-ItemProperty -Path $regPath -Name "ReAttachIntervalSeconds" -PropertyType DWORD -Value 15 -Force
New-ItemProperty -Path $regPath -Name "ReAttachRetryCount" -PropertyType DWORD -Value 3 -Force
New-ItemProperty -Path $regPath -Name "SizeInMBs" -PropertyType DWORD -Value 30000 -Force

Deploying the settings with Group Policy

Get the ADMX / ADML files here: https://learn.microsoft.com/en-us/fslogix/how-to-use-group-policy-templates

File	Destination (domain)
`fslogix.admx`	`%systemroot%\sysvol\domain\policies\PolicyDefinitions`
`fslogix.adml`	`%systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]`

Policy location: Computer Configuration → Administrative Templates → FSLogix

[Step 6] Verify that it works

6-1. Check the service and the settings

Run the following at a command prompt on the session host.

sc query frxsvc

Confirm that it reports STATE : RUNNING.

Next, run the following.

reg query HKLM\SOFTWARE\FSLogix\Profiles

Confirm that Enabled is 0x1 and that VHDLocations contains the ANF mount path.

6-2. Check the file

Connect to the session host and open the Mount path in File Explorer.

\\<anf-volume-fqdn>\<share-name>\<username>_<SID>\Profile_<username>.vhd

6-3. Check that the profile roams

Sign out of the first session host, sign in to a second session host, and if your desktop changes (wallpaper, file layout, and so on) carry over, it works.

DEV Community