Azure Virtual Desktop Hybrid Runs AVD on your Own Hardware

Open RDP to the internet today and you will be compromised in minutes.

That is the tradeoff so many teams keep running into. You move a line of business app back on premises to cut Azure costs, and now you need secure remote access to that server again. But a VPN or an exposed RDP port puts you right back in reach of zero day exploits and brute force attacks.

Azure Virtual Desktop hybrid solves that problem. By pairing Azure Virtual Desktop with Azure Arc, you can run AVD session hosts on your own hardware, whether that is VMware, Hyper V, Nutanix, or bare metal, while keeping the brokered connection with no open ports that makes AVD in Azure secure. It gives you a path forward if you are planning a hybrid cloud setup, weighing a VMware alternative, or moving off Citrix and RDS. 

What is Azure Virtual Desktop Hybrid?

Azure Virtual Desktop hybrid runs AVD session hosts on virtual machines you host yourself, and you connect to them through Azure with no VPN. Once you Arc enable the VM and deploy an extension, it connects through Microsoft the same way a cloud host does. Users open the Windows App, see their workspace, and connect over a fast UDP tunnel, so nothing looks different to them. The desktop just runs on your hardware instead of in Azure.

Nathan Taylor sat down with Denis Vozian, an Azure Cloud Engineer at Sourcepass, to break it down on the Demystifying Microsoft podcast. They cover the history of remote access, the deployment process, and the limits worth knowing before you plan a rollout.

How is Azure Virtual Desktop Different from RDP and Citrix?

Remote access has a rough history. For years, teams ran remote desktop through Citrix or stood up RDS servers behind web gateways, and in the early days it was common to open port 3389 straight to office desktops. That does not hold up now. Open RDP to the internet and you are compromised almost right away.

Microsoft first floated a cloud hosted remote desktop gateway at Ignite 2017, but it never shipped. Windows Virtual Desktop did ship in 2018, and it was later renamed Azure Virtual Desktop. AVD removed the open port problem by brokering the connection through Microsoft and authenticating the user before any port opens. That design is why it works well with MFA, single sign on, Conditional Access, and mobile access from devices like iPads.

Why are Companies Moving Back to Hybrid Cloud?

A few years ago, the advice was simple. Move everything to Azure. Many of those migrations made sense, and the scalability and security hold up well. But teams found that heavier workloads can get expensive fast, and a large line of business app tied to a big SQL Server is a common example.

Cost is what pushed the shift toward hybrid IT. Some infrastructure stays in Azure, while some moves back to the office or a data center, where owning hardware can cost less. The catch is remote access. Once that server is on premises again, you need a secure way to reach it, and nobody wants to reopen RDP or trust an SSL VPN that could be sitting on the next zero day. That is where Azure Virtual Desktop hybrid comes in.

How does Azure Virtual Desktop Hybrid Work Without a VPN?

You host the VM yourself, Arc enable it, and deploy the Azure Virtual Machine extension. From there, it connects over HTTPS through the same broker AVD uses in Azure, with no VPN and no open inbound ports. The connection runs over UDP, so it is fast, and users reach it through the Windows App like any cloud host.

The model works a lot like the way Tailscale routes traffic through a node without a full VPN. You get a secure peer to peer style tunnel to a desktop on your own servers. It also helps with data residency. If your data has to stay on your own servers, Azure Virtual Desktop hybrid keeps it there while giving you the same secure access, no Citrix required. 

Azure Virtual Desktop Hybrid vs Azure Local 

Azure Local can also run AVD on premises, but it comes with limits. You are tied to certified hardware, a hyper converged design with storage on the server, and a set configuration. VM deployment is clunkier too, since you build an image and store it rather than spinning up a machine from an ISO, and those images eat storage fast.

Azure Virtual Desktop hybrid does not care what it runs on. As long as the VM is Arc enabled and the extension is deployed, it works on the hypervisor you already use. That is the advantage over Azure Local, you get the same Azure Virtual Desktop experience without being locked into specific hardware or a fixed configuration. 

Is Azure Virtual Desktop Hybrid a Good VMware Alternative?

If you are working through a post VMware plan, Azure Virtual Desktop hybrid gives you a way to run those workloads on your existing hardware. You can run AVD on VMware, Hyper V, Xen, Nutanix, or bare metal Windows 11 desktops and use it as your remote session manager. Against VMware Horizon, Citrix, and RDS, it tends to cost less and take less work to maintain, and RDS in particular carries security and upkeep costs that are hard to justify.

There is room to lower licensing costs too. With Arc enabled machines and Azure Hybrid Benefit, you can push the total below what Horizon and Citrix usually run. You also drop the job of managing and securing the connection broker yourself, and you can enforce Conditional Access policies in Microsoft Entra ID to control who reaches each virtual desktop.

What do you Need to Deploy Azure Virtual Desktop Hybrid?

The prerequisites are short. You need Azure Arc deployed, the Azure Virtual Machine extension installed, and your identity model sorted out. It supports both Microsoft Entra ID joined and on premises Active Directory joined setups, so hybrid identity is covered. Once a host connects to your host pool and application group, you assign a group, and users see their workspace in the Windows App like standard AVD. Server based scenarios get more complex, but most deployments center on Windows 11, so you can still add tools like FSLogix.

How do you Arc Enable and Deploy the Session Hosts?

The real work is Arc enabling the VM, since that step creates the Azure identity that lets you push extensions to it. On a Hyper V cluster, this can run through Azure DevOps. A DevOps agent runs under a group managed service account with permissions to the Hyper V hosts, and PowerShell then creates the VMs and disks on the nodes. It injects a script through an unattend.xml file to Arc enable each machine on first boot. The pipeline waits until the machine shows as Arc enabled, then deploys the extensions that join it to the host pool.

To keep it reliable, the extension work can be handed off to a Bicep template once the machine is in the cloud, so nothing extra runs on the agent. Nerdio can handle the VM creation and Arc enablement in its enterprise editions, but you are not locked in. Any hypervisor with an API that can create a VM and inject the Arc script securely can drive this. You can also publish full desktops or individual remote apps, just like standard AVD.

What are the Current Limitations of Azure Virtual Desktop Hybrid?

Two limits are worth knowing before you plan a rollout. Windows 11 multisession is not supported yet, and Windows 11 on a physical device is not supported either, and physical device support limited to Windows Server versions. For many teams, multisession is the whole reason to run this on their own hardware.

Timing explains part of it. The capability was announced in November 2025 and is still in global preview as of mid 2026 and Microsoft is updating it quickly. There may also be licensing pressure tied to remote desktop that shapes how multisession lands. 

Where Azure Virtual Desktop Hybrid Fits in your Environment?

Azure Virtual Desktop hybrid lets you keep workloads on your own hardware for cost or data residency reasons. You do not give up the security or flexibility that made AVD worth using. As VMware changes push teams to rethink their stack, it lets you move those workloads without giving up secure access.

If you are weighing a hybrid rollout, a VMware alternative, or a move off Citrix and RDS, we have deployed AVD across many environments and can help you plan and stand up a hybrid deployment that fits yours. Reach out to our team of experts to talk through your setup.

For more conversations like this one, subscribe to the Demystifying Microsoft podcast. We break down what is new across Azure, Microsoft 365, and the wider Microsoft ecosystem.