Blog
End user experience monitoring for Windows 365 and AVD (tools and best practices)
Learn end user experience monitoring for AVD and Windows 365: tools, thresholds, and best practices to diagnose slow sessions.
Table of Contents
- What end user experience monitoring measures for cloud desktops
- Where native Microsoft monitoring takes you, and where management layers add context
- The third-party EUEM landscape and the agentless trade-off
- How Nerdio Manager unifies experience monitoring across both paths
- Common experience problems in AVD environments and how to diagnose them
- Best practices for monitoring cloud desktops at scale
- Frequently asked questions about end user experience monitoring
A user calls the help desk at 9:15 AM. Their Azure Virtual Desktop (AVD) session is "slow," apps take forever to open, and they've already missed two meetings.
You open AVD Insights, dig through Log Analytics, switch to the Microsoft Intune admin center to check the Windows 365 Cloud PCs on another team, and twenty minutes later you still can't say whether the problem is the network, the session host, or an FSLogix profile that won't mount.
That gap between "something is slow" and "here's the root cause" is what end user experience monitoring exists to close. The gap stays wide when your two cloud desktop paths live in separate consoles and share no common dashboard.
This guide is for EUC leaders and platform owners running Windows Cloud (Windows 365 and Azure Virtual Desktop) at scale who need precise signals, real tooling, and a path to fixing problems before users open a ticket.
What end user experience monitoring measures for cloud desktops
End user experience monitoring (EUEM) continuously tracks the signals that determine whether a virtual desktop feels fast or broken to the person using it, including logon time, session responsiveness, network latency, application availability, and resource health. The point is to catch degradation early enough that users do not have to report it first.
In the cloud desktop world, the term overlaps with digital employee experience (DEX), a broader view of an employee's experience with the digital workplace based on device performance, applications, networks, and sentiment. For Windows 365 and Azure Virtual Desktop, that translates into a handful of measurable signals Microsoft publishes thresholds for.
Network round-trip time (RTT) is the first one. Microsoft's AVD thresholds are as follows:
| RTT range | User impact |
| < 100 ms | Ideal; low-quality sessions begin above this threshold |
| < 150 ms | Should not affect experience |
| 150–200 ms | Acceptable for text processing |
| > 200 ms | May affect user experience; sessions become low quality |
Session responsiveness comes next. Microsoft's documented threshold for User Input Delay in Azure Virtual Desktop is 100 ms. Once delay crosses that line, Microsoft directs you to aggregated CPU, memory, and disk activity on the session hosts, with target ranges cited at 40–70% average CPU and 50–80% memory.
Frame quality gives you the visual side of responsiveness. End-to-end delay per frame under 150 ms is "good," 150–300 ms is "okay," and above 300 ms is "bad."
Windows 365 reports its own signals through a different lens. The Resource Performance Report produces a 0–100 score, a weighted average of CPU and RAM spike-time scores that feeds the organization's Microsoft Productivity Score, and Cloud PC Monitoring tracks Mean Time to Failure, the average time a Cloud PC runs normally before a failure.
Where native Microsoft monitoring takes you, and where management layers add context
Microsoft gives you real monitoring on both platforms, but they live in two different places and serve different operational views. Knowing how each one works tells you where a management layer can add cross-platform context.
Windows 365: Intune-based monitoring
Windows 365 monitoring lives entirely in the Microsoft Intune admin center, with three reports covering different signals.
- The Connection Quality Report covers per-device RTT (most recent and median), available bandwidth (most recent and median), remoting sign-in time (median), protocol, and UDP utilization.
- The Resource Performance Report produces the 0–100 score described earlier.
- Cloud PC Monitoring, in public preview, pulls Cloud PC health, performance, and configuration into integrated dashboards with connection health trends and reliability data.
The catch sits in how admins are expected to use what they get. The Connection Quality Report documentation notes the report "provides objective data" that admins must apply against their own "subjective performance criteria," and native Windows 365 reporting doesn't roll those signals into a composite user experience score.
Native RDP session quality documentation focuses on optimization guidance rather than continuous experience scoring, so translating the raw signals into "is this session healthy?" still falls to the team.
Azure Virtual Desktop: Azure Monitor and AVD Insights
AVD Insights is a dashboard built on Azure Monitor Workbooks. To stand it up you need a configured Data Collection Rule, the Azure Monitor Agent installed on every session host, and a dedicated Log Analytics workspace.
Once it's running, AVD Insights measures RTT by gateway region (median and 95th percentile), connection reliability, per-session user input delay with the 100 ms alert threshold, frame drop and end-to-end delay, and session host CPU, memory, and disk via performance counters. That gives admins a host, session, connection, and frame-level operational picture.
Cost shapes how much of this telemetry you actually keep. AVD Insights bills on data ingestion under Azure Monitor Logs pricing at roughly 2 to 15 MB per VM per day, per AVD Insights costs, and once you hit the Log Analytics daily cap, ingestion stops for the rest of the day.
At scale, that pricing pushes teams to collect less telemetry exactly when more session hosts and more users argue for collecting more.
Intune Advanced Analytics
The Intune Suite add-on extends endpoint analytics with several capabilities:
- Anomaly detection. Machine-learning identification of experience regressions after a configuration change.
- Device timeline. A chronological view of events on a given device.
- Near-real-time device query. Ad hoc queries against current device state.
- Resource performance reports. Sliceable by device scope.
The catch is latency. According to the Advanced Analytics FAQ, data is typically updated every 24 hours, and end-to-end latency can exceed that window for events like restarts and stop errors when the device doesn't reboot immediately after the event. Boot and sign-in event history only goes back 29 days, so anything older drops off before you can correlate it.
Zoom out and the bigger problem becomes obvious. Windows 365 monitoring lives in Intune, Azure Virtual Desktop monitoring lives in Azure Monitor, and Microsoft's own guidance treats Intune as the center of gravity for Cloud PC operations.
Since many enterprises run both products side by side, the question that matters at 9:15 AM is no longer which dashboard has the data, but how fast the team can correlate signals across both when an incident spans platforms.
The third-party EUEM landscape and the agentless trade-off
At scale, teams often add dedicated DEX platforms on top of native Microsoft monitoring. Each one makes a different bet on how to collect data, and that bet determines what they can see and what they cost you to run.
Several vendors target the broader EUEM/DEX and VDI monitoring market, including Lakeside Software's SysTrack, Liquidware's Stratusphere UX, eG Innovations, ControlUp, Nexthink, and Exoprise.
For EUEM tools, the category spans endpoint telemetry, synthetic monitoring, application monitoring, and remote support. The architecture choice underneath these tools sets your attack surface, deployment burden, and data freshness all at once.
Agent-based monitoring
Agent-based monitoring runs a process on each session host or Cloud PC. That gets you granular, real-time visibility like live process behavior, immediate crash and hang events, and OS-level activity that network tools can't see.
The cost is deployment weight and ongoing agent maintenance, since every agent is another process to deploy, update, and secure across large host and Cloud PC estates; that distributed host footprint can also create an expanded attack surface.
Agentless monitoring
Agentless monitoring pulls data through APIs and the control plane instead. It avoids installing and maintaining a monitoring process on every host and reduces management overhead. Agentless approaches use non-invasive methods such as API connections and log analysis, while the trade-off is slightly less immediacy than a process sitting directly on the host.
For many enterprise EUC teams running cloud desktops, the agentless trade-off lands favorably: API and log-based coverage, no per-host monitoring agent to maintain, and near-real-time data for troubleshooting.
This is the architecture Nerdio Manager for Enterprise uses for monitoring and reporting, and it's where a management layer puts Windows 365 and Azure Virtual Desktop monitoring data in one management workflow.
How Nerdio Manager unifies experience monitoring across both paths
The data lives in two operational views built for two different Microsoft services, and admins stitch it together during active incidents. Nerdio Manager addresses that directly by surfacing both Windows 365 and Azure Virtual Desktop experience signals in one place, without proprietary agents on your session hosts.
Nerdio Manager runs as a packaged Azure application in your own tenant and extends the native Azure Virtual Desktop service. For monitoring and reporting, Nerdio Manager provides agentless, near-real-time insights without a proprietary Nerdio monitoring agent on session hosts.
Unified insights across Windows 365 and Azure Virtual Desktop
Centralized Insights covers near-real-time visibility into performance, usage, logon health, and resource utilization across Windows 365, Intune endpoints, and Azure Virtual Desktop. For Windows 365, that includes connection quality details such as session protocol and latency for troubleshooting. Configurable alert thresholds send notifications through email, Teams, or ticketing systems.
Across Windows Cloud, Nerdio Manager puts experience monitoring, remediation, application delivery, capacity right-sizing, and Intune-managed endpoint control into one workflow. The specifics break down by path:
- Windows 365: Nerdio Manager extends Microsoft Intune management for Cloud PC lifecycle, reporting, policy backup and restore, and application delivery. Cloud PC status and usage details surface alongside Advisor recommendations, and utilization data feeds right-sizing actions including resize recommendations and Flex (formerly Frontline) license conversion where appropriate.
- Azure Virtual Desktop: The same workflow detects and repairs broken session hosts through Auto-Heal.
- Both paths: Unified Application Management shortens application deployment to Windows 365 endpoints to about 30 seconds, compared with native Intune delivery windows that can take up to 3 hours.
Many enterprises run both Windows 365 and Azure Virtual Desktop together, which is why the same management workflow needs to watch both.
Remediation from the same monitoring workflow
Monitoring only pays off when it shortens the time to a fix. Native auto-scaling handles session-count-based scaling plans; Nerdio Manager's patented auto-scaling dynamically scales based on real-time usage and powers down idle resources during off-peak.
When VMs power down during off-peak, they're stopped and deallocated so compute charges actually stop.
Console Connect lets technicians remotely shadow and troubleshoot Azure Virtual Desktop and Windows 365 sessions, as well as any Windows device managed by Intune and Nerdio Manager, from the same portal, so Tier 1 can capture the session context and resolve issues that can be fixed from that context before escalating.
For right-sizing, Nerdio Manager analyzes CPU, RAM, and session usage to recommend specific VM configurations before you commit. It adds cloud-desktop context to recommendations, including the difference between an underutilized session host and a host that is still required for user availability. Fewer manual configuration steps also mean fewer places for configuration errors to creep in.
These capabilities let admins move from a slow-session signal to scaling, Auto-Heal, right-sizing, or remote troubleshooting from the same workflow.
Common experience problems in AVD environments and how to diagnose them
Three root causes generate the bulk of help-desk volume in Azure Virtual Desktop environments at scale: FSLogix profile load delays, session host resource contention, and network latency. Each one shows up differently in the data, and each one requires a different fix.
These patterns are specific to AVD's session host and profile architecture. Windows 365 Cloud PCs run on a different operational surface with its own policy, application, and latency issues, but the three below are where AVD-specific diagnosis time goes.
FSLogix profile load delays
FSLogix profile load delays are a common, well-documented failure mode, and storage behavior under concurrent logon load is usually the culprit. Profile containers mounted over SMB can exhaust storage IOPS when the container and user data share a disk, and standard Azure Files throttles under concurrent logon load (Premium SSD is recommended for 10 or more concurrent users per host).
Security tooling is a frequent and surprising culprit. In one documented case, a DLP tool scanning profile VHDX files drove waitForVolumeMount to 632,782 ms, roughly ten minutes, until the policy was changed to exclude those files. Remediations include co-locating session hosts and file shares in the same region, using separate performant shares for Office and profile containers, excluding VHDX paths from endpoint scanning, and applying FSLogix registry settings via Group Policy or Intune.
Session host resource contention
Resource contention on session hosts shows up across CPU, memory, and disk, and the fix is watching the right counters at the right intervals. Azure Virtual Desktop hosts can show pressure across all three, and VM-level IOPS limits can cap performance independently of disk limits.
Watch the right counters at the right intervals (disk queue length and available memory at 30-second polling, session counts at 60 seconds), move OS disks to Premium SSD, and scale up or add hosts when counters stay high.
Network latency
Network latency is the third pattern, and RTT thresholds differ between the two paths.
For Azure Virtual Desktop, RTT should stay below 150 ms. For Windows 365, RTT around 220 ms commonly causes freezing, disconnections, and "Connection paused" states.
The biggest wins come from avoiding hairpinning RDP traffic through centralized VPNs or TLS inspection devices, preferring UDP via RDP Shortpath over TCP, and reprovisioning a Cloud PC in a closer region when latency stays above 200 ms.
The thread connecting all three AVD patterns is that diagnosis requires correlated signals across logon, host, and network. That is precisely why a unified view shortens the path from symptom to root cause.
Best practices for monitoring cloud desktops at scale
Operating experience monitoring at scale works best as a repeatable discipline built around five practices that build on each other:
- Baseline and collect data: Use a designated Log Analytics workspace for Azure Virtual Desktop session hosts and set up the AVD Insights configuration workbook, planning retention so data beyond two years exports to a storage account. For Windows 365, use the Connection Quality Report to find Cloud PCs underperforming against RTT and bandwidth benchmarks.
- Layer proactive alerting on top: Configure alerts for VM performance, critical session host event IDs (3702 and 3703 for unavailable-state problems), Service Health, and Resource Health, and use Connection Monitor for continuous network checks that identify which component is responsible. For Windows 365, native guidance centers on RDP session quality optimization and Cloud PC reports; configurable threshold alerts in a management layer fill in when teams need proactive quality-degradation notifications.
- Automate remediation where you can: Windows 365 surfaces Cloud PC status as Available or Unavailable with a "Troubleshoot this connection" action; Intune Remediations deploy script packages on demand; and dynamic auto-scaling reacts to real-time CPU, RAM, and session loads while Auto-Heal repairs broken machines.
- Right-size based on actual utilization: The Windows 365 Resource Performance Report surfaces a resize action directly in Intune, and Nerdio enterprise customers can save up to 55% on Azure compute through patented auto-scaling.
- Close the loop with scale-deployment governance: Use Azure Policy to enforce Azure Monitor Agent installation across all VMs and filter out telemetry you don't use for alerting to control ingestion cost.
The combined effect is a shift from firefighting to prevention. The more of these practices you automate, the more your team catches FSLogix mount delays, resource contention, and latency spikes before the 9:15 AM call ever comes in.
Get a demo to see how Nerdio Manager works across your Windows 365 and Azure Virtual Desktop environment, or try it free in your own Azure tenant.
Frequently asked questions about end user experience monitoring
Resources
Learn more about Nerdio Manager
