Microsoft has moved managed identity support for Azure Virtual Desktop host pools to general availability, per the Azure Virtual Desktop What’s New page. This is more than a checkbox GA — it comes with a clear signal about where host pool management is heading, and there is an action item hiding in it for every AVD operator.

For IT leaders, the takeaway is twofold: AVD automation can now run keyless, and the grace period for adopting that model is finite.

1. What Is Now Generally Available

Managed identity support for AVD host pools is GA across the scenarios that matter for day-to-day operations:

  • Session host configuration — provisioning and configuring session hosts without embedded credentials.
  • Autoscale — scaling plans acting on host pools under a managed identity.
  • Start VM on Connect — powering on session hosts as users connect, without stored secrets.
  • Azure Virtual Desktop for Azure local — the hybrid footprint is covered by the same model.

Why this matters: These are precisely the flows that historically pushed operators toward service principals with client secrets sitting in automation. Every one of those secrets was a rotation chore and a leakage risk.

2. Why Managed Identity Is the Right Default

Managed identities are Azure-native credentials: no secret material to store, rotate, or accidentally commit to a repository. For AVD, that means the automation that provisions, scales, and powers on your session hosts authenticates keylessly, with access governed by role assignment rather than by possession of a string.

Why this matters: Credential hygiene is compliance hygiene. Removing static secrets from host pool automation tightens your audit story and eliminates an entire class of “expired secret broke autoscale” incidents — the ones that surface at 8 a.m. on a Monday when users cannot get a session.

3. The Coming Requirement — Plan the Migration Now

Buried in the same announcement is the part that deserves a calendar entry: in a future service update, host pools configured with a session host configuration will require a managed identity in order to add session hosts to the host pool.

In other words, what is optional today becomes enforced tomorrow — and the enforcement lands exactly at the moment you scale out or replace session hosts, which is the worst time to discover it.

What to do now:

  • Inventory host pools that use a session host configuration.
  • Enable a managed identity on those host pools and validate that adding a session host works under the new model.
  • Update provisioning runbooks and IaC so new host pools are born on managed identity rather than migrated to it later.

The Bottom Line

Managed identity support going GA removes the last excuse for credential-based AVD automation, and the announced future requirement turns “should do” into “will do.” The operators who move now get a quiet, uneventful transition; the rest get a failed scale-out at an inconvenient hour.

Need help modernizing Azure Virtual Desktop operations ahead of the requirement? Talk to Big Hat Group’s advisory team.