Hi all, what is the best practice for instant clone Win11 VDI-s? I configured Hybrid Join, and wait for Hybrid Join. So after VDI creation it can take quite long until the new VDI is Joined and sign-in enabled. I can imagine a scenario, when users log in then log on, and then log in. and then there is no free VDI which is already joined. So no login possible. 1. I can think, to have always enough VDI-s spare. But how to understand the user behavior, to size this correctly. 2. To enable seamless SSO, then no hybrid Join is needed to SSO, and problem not existing. But there is security concerns as I understand. 3. In Conditional Access to make some rules that VDI-s must not be hybrid joined. maybe something else? Thanks.

Hi Robert, Essentially, depending on your requirements you can choose between using Seamless SSO, or Azure PRTs for SSO (through hybrid domain joining). I love Hybrid Domain joining instant clones, but it comes with considerations: 1. On first/initial deployment, there will be a significant delay where you have to wait for Azure AD Connect to sync the objects to your Entra tenant. 2. You must enable "Re-Use Computer Account" if you're using Hybrid domain joined instant clones. 3. On first/initial deployment, consider deploying the maximum number of Instant Clones you will use. This will allow the objects to be created and sync'ed to Entra. After this, you can bring the number down and use the minimums/maximums after the objects have been created and sync'ed, and only deploy the minimum number required. 4. If using Hybrid Domain joined instant clones, you may want to set your spare VM count higher, to have more standby instant clones created earlier, allowing the hybrid domain join process to function sooner. 5. There is a GPO setting that can be configured, that only allows users to connect after a hybrid domain join is completed. You may want to use this, in addition to having a higher spare count. In regards to your security concern with Seamless SSO, I'm assuming you're talking about rotating the Kerberos decryption keys? Keep in mind that a lot of organizations use Seamless SSO, and you can regularly rotate these keys should you wish to use Seamless SSO. Both Seamless SSO and SSO with PRTs through Hybrid join work great when configured properly 🙂 Using Hybrid Domain joining allows some extra functionality when it comes to conditional access and access to other Entra features that require hybrid joining.