FSLogix Profile Containers for Azure Virtual Desktop: Complete AZ-140 Guide

In a pooled host pool, a user can land on any session host at each sign-in. A local profile on host 3 means nothing when they land on host 7 tomorrow. FSLogix fixes this by storing the whole profile in a VHDX on network storage and attaching it at sign-in. Windows sees a local profile. Applications see a local profile. There is no file copy during logon, which is why it beats roaming profiles.

The four FSLogix components

Component	What it does	Use it when
Profile Container	Puts the entire user profile in a VHD(X) and mounts it at sign-in.	Almost always. This is the default for AVD pooled host pools.
ODFC (Office Data File Container)	Puts only Microsoft 365 data (Outlook OST, Teams cache, OneDrive, activation) in a separate container.	You use another profile solution, or you want Office data on separate storage.
Cloud Cache	Writes the container to a local cache and replicates to multiple storage providers at once.	You need profile availability across storage outages or regions.
Application Masking	Hides apps, files, registry keys, fonts, and printers per user or group.	One image serves users who should not all see the same apps.

Profile Container: the core configuration

FSLogix is preinstalled on AVD marketplace images. You configure it in the registry under HKLM\SOFTWARE\FSLogix\Profiles, through Group Policy (ADMX templates), or with the Intune Settings Catalog. The minimum viable set is small:

$path = "HKLM:\SOFTWARE\FSLogix\Profiles"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name Enabled -Type DWord -Value 1
Set-ItemProperty -Path $path -Name VHDLocations -Type MultiString -Value "\\stavdprofiles.file.core.windows.net\profiles"
Set-ItemProperty -Path $path -Name VolumeType -Type String -Value "vhdx"
Set-ItemProperty -Path $path -Name SizeInMBs -Type DWord -Value 30000
Set-ItemProperty -Path $path -Name IsDynamic -Type DWord -Value 1
Set-ItemProperty -Path $path -Name DeleteLocalProfileWhenVHDShouldApply -Type DWord -Value 1
Set-ItemProperty -Path $path -Name FlipFlopProfileDirectoryName -Type DWord -Value 1

• VolumeType: defaults to vhd. Set vhdx explicitly.
• SizeInMBs: max container size, default 30000. You can increase it later. You cannot shrink it by lowering the value.
• IsDynamic: default 1. The file grows as data is written instead of allocating the full size up front.
• VHDLocations: one or more UNC paths. Multiple paths are tried in order. They are not replicated, which is the job of Cloud Cache.

Control who gets a container

FSLogix creates two local groups on each host: FSLogix Profile Include List (contains Everyone by default) and FSLogix Profile Exclude List. Exclude wins over include. Put local admins and break-glass accounts in the exclude list so you can still sign in when storage is down.

Concurrent sessions

By default (ProfileType = 0) a profile container can be attached read-write by one session. If a user opens a desktop in two host pools that share storage, the second sign-in finds the VHDX locked and retries based on LockedRetryCount and LockedRetryInterval. If you need concurrent access, use ProfileType = 3 (try read-write, fall back to read-only), or better, give each host pool its own VHDLocations path.

ODFC: when to split Office data out

ODFC uses its own key, HKLM\SOFTWARE\Policies\FSLogix\ODFC, with its own Enabled and VHDLocations, plus include switches such as IncludeOutlook, IncludeOneDrive, and IncludeTeams.

A Profile Container already holds Office data, because it holds the whole profile. So ODFC isn't a performance add-on you turn on by default. Use it when:

• You keep a different profile solution (roaming profiles, a third-party tool) and only want to fix the Office cache problem.
• You want large Outlook OST and Teams data on a different storage tier or with a different retention policy from the profile itself.

Cloud Cache: resilience at a price

With plain VHDLocations, the session host reads and writes directly to the share. If the share drops, the session hangs and FSLogix tries to reattach. Cloud Cache changes the model:

1. The container is cached on the session host's local disk.
2. Reads come from the local cache after the first access.
3. Writes go to the local cache, then replicate to every provider in CCDLocations.
4. If one provider fails, the session continues on the others.

# Two SMB providers in different regions
Set-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles -Name CCDLocations -Type MultiString -Value `
  "type=smb,name=""EastUS"",connectionString=\\stprofeus.file.core.windows.net\profiles;type=smb,name=""WestUS"",connectionString=\\stprofwus.file.core.windows.net\profiles"
# Do not configure VHDLocations at the same time

The costs are real. Every write happens more than once. Local disk usage climbs on each host because each signed-in user has a cache. Sign-in and sign-out take longer on first use. Use a premium OS disk or a large enough temp disk, and plan for it in your VM size choice.

Application Masking

Application Masking lets one golden image serve different user groups. You install every app in the image, then hide what a group shouldn't see. Rules are built with the FSLogix Rule Editor and saved as a rule set (.fxr) and an assignment file (.fxa). Copy both to C:\Program Files\FSLogix\Apps\Rules on every host. Rules apply at sign-in, and changes take effect without a reboot.

You can hide applications, folders, files, registry keys, fonts, and printers, and you can assign rules by user, group, process, network location, or computer. It is also how you redirect a specific app to a specific Java version.

Storage options: Azure Files vs Azure NetApp Files

Option	Best for	Identity support	Notes
Azure Files Standard	Labs, small pilots	AD DS, Entra Domain Services, Entra Kerberos	HDD-backed. Struggles with logon storms. Pay-as-you-go transactions add up.
Azure Files Premium	Most production AVD deployments	AD DS, Entra Domain Services, Entra Kerberos	SSD. Billed on provisioned capacity (and with provisioned v2, provisioned IOPS and throughput). Supports private endpoints.
Azure NetApp Files	Large or latency-sensitive deployments	AD DS or Entra Domain Services through an AD connection	Needs a delegated subnet and a capacity pool. Service levels Standard, Premium, Ultra. Higher entry cost.
File server VM / Storage Spaces Direct	Legacy or special cases	AD DS	You manage patching, HA, and backups. Rarely the best exam answer.

Two exam-relevant rules fall out of that table. First, if the session hosts are Entra joined with no domain controller, Azure Files with Entra Kerberos is the fit. Azure NetApp Files needs an AD connection. Second, pick the storage in the same region as the session hosts. Cross-region SMB adds latency to every profile read.

Permissions recap

Whatever the storage, the permission model is the same. Share level: give users the Storage File Data SMB Share Contributor role (Azure Files) or Change on the share. NTFS: users get Modify on the root folder only, CREATOR OWNER gets Modify on subfolders and files, admins get Full Control. That prevents users from opening each other's VHDX files.

Exclusions that keep containers healthy

• Antivirus: exclude *.VHD, *.VHDX, the FSLogix program files, the profile share path, and the Cloud Cache folder (%ProgramData%\FSLogix\Cache) if you use it. Scanning a VHDX while it is attached slows every logon.
• Profile bloat: use redirections.xml to exclude browser caches and temp folders from the container. Smaller containers mean faster attaches and lower storage cost.
• Teams and OneDrive: both work inside the container. Keep OneDrive Files On-Demand enabled so synced files stay as placeholders.

Troubleshooting checklist

Symptom	Check	Fix
User gets a temporary profile	FSLogix log in C:\ProgramData\FSLogix\Logs\Profile	Usually access denied: check RBAC, NTFS, identity source, and Kerberos
Local profile used instead of container	Existing local profile on host	Set DeleteLocalProfileWhenVHDShouldApply = 1
Slow sign-in during morning peak	Share IOPS, standard tier	Move to Premium or raise provisioned IOPS
“VHD is locked” errors	User signed in elsewhere or orphaned session	Sign out the other session, or use separate paths per host pool
Container full	SizeInMBs reached	Increase the value. Existing containers expand at next sign-in
Admins locked out when storage fails	Include/exclude groups	Add admins to FSLogix Profile Exclude List

Run frx.exe list-redirects and check the FSLogix Apps event logs on the host. In AVD Insights, long sign-in durations often trace back to profile attach time.

Quick-reference exam traps

• Profile Container holds Office data already. ODFC is for other profile solutions or separate storage.
• Cloud Cache uses CCDLocations, replaces VHDLocations, and costs local disk and extra writes.
• Multiple VHDLocations entries are failover paths, not replication.
• Entra joined hosts with no DC: Azure Files with Entra Kerberos. Not Azure NetApp Files.
• A storage account supports one identity source at a time.
• Exclude List beats Include List.
• Application Masking hides installed apps. App Attach delivers apps that are not in the image.
• Keep profile storage in the same region as the session hosts.

Resources

• What is FSLogix? – Microsoft Learn
• FSLogix configuration setting reference
• FSLogix Cloud Cache concepts
• Implement and manage FSLogix (training module, includes rule sets and application masking)
• Storage options for FSLogix profile containers in Azure Virtual Desktop
• AZ-140 study guide – skills measured

---

Checked against Microsoft Learn FSLogix and Azure Virtual Desktop documentation as of October 2026.