Question

Your company runs a pooled Azure Virtual Desktop host pool with non-persistent session hosts deployed from a golden image in an Azure Compute Gallery. Security requires that every session host report to Microsoft Defender for Endpoint with correct device identity, and that newly recreated hosts appear automatically without producing duplicate or orphaned device entries in the Defender portal. What should you do to onboard the session hosts?

Accepted Answer

Configure the VDI onboarding package for non-persistent VDI in Microsoft Defender for Endpoint and apply it to the golden image before capture, using the single-entry-per-device option.

Answer

Run the local onboarding script manually on each running session host after it is provisioned, then delete stale devices in the Defender portal each night.

Answer

Embed the standard (persistent) Defender for Endpoint onboarding script in the golden image so every cloned host uses the same baked-in device ID.

Answer

Enable Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent on the subscription and rely on it to onboard hosts to Defender for Endpoint.