topic Re: Best practice for installing agents on Windows "multi-session" Azure AVD? in Cortex XDR Discussions

Best practice for installing agents on Windows "multi-session" Azure AVD?

Maxstr — Wed, 24 Apr 2024 15:06:40 GMT

Which method should be used to install the Cortex XDR agents for the Azure-only Windows 11 multi-session VDI? Since it's both a terminal server, and a non-persistent VDI that gets re-imaged from a golden image?

Re: Best practice for installing agents on Windows "multi-session" Azure AVD?

nsinghvirk — Fri, 03 May 2024 16:41:10 GMT

Hello @Maxstr

Thanks for reaching out on LiveCommunity!

This setup aligns more with Temporary Session hence please follow below guidelines to install XDR for TS setup.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-Agent-for-Virtual-Environments-and-Desktops

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Cortex-XDR-Agent-for-Virtual-Environments-and-Desktops?section=UUID-d6a1ed10-1a91-a8d1-03d2-ef4cedec0e51_idd2d64f0d-f4f6-413a-99e9-224339a5161b

Re: Best practice for installing agents on Windows "multi-session" Azure AVD?

Maxstr — Fri, 19 Jul 2024 16:51:37 GMT

That doc says that temporary sessions are for sessions that don't have Cortex pre-installed. In our use-case, we've pre-installed the Cortex agent onto the gold image, and we spun up 4 hosts with that gold image. When a user logs in, it automatically places them into a host based on availability. The next day they might end up on a different host (and all their stuff is carried over with OneDrive and FSLogix).

The gold image changes whenever we run new updates, so once a month.

Re: Best practice for installing agents on Windows "multi-session" Azure AVD?

J.Meltz — Wed, 30 Jul 2025 20:01:56 GMT

We are in the same situation and would appreciate any clarification on the proper way to install Cortex for this scenario.

Should we be using the VDI switch, install to our gold image & scan, and then deploy to the pool?

Should we be using the TS switch and install to the VDI instance when is deployed to the pool?

Should we be using both switches?

Re: Best practice for installing agents on Windows "multi-session" Azure AVD?

nsinghvirk — Thu, 31 Jul 2025 16:38:48 GMT

Hello @J.Meltz

Thanks for reaching out to us. For your use case "--temporary-session" is the right option. It is intended for either physical or virtual endpoints that repeatedly revert to a snapshot (or image) on which the Cortex XDR agent is not installed. You have to install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning.