Best practice for installing agents on Windows "multi-session" Azure AVD?

[Maxstr]

Which method should be used to install the Cortex XDR agents for the Azure-only Windows 11 multi-session VDI? Since it's both a terminal server, and a non-persistent VDI that gets re-imaged from a golden image?

[nsinghvirk]

Hello @Maxstr 

Thanks for reaching out on LiveCommunity!

This setup aligns more with Temporary Session hence please follow below guidelines to install XDR for TS setup.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Corte...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Corte...

[Maxstr]

That doc says that temporary sessions are for sessions that don't have Cortex pre-installed. In our use-case, we've pre-installed the Cortex agent onto the gold image, and we spun up 4 hosts with that gold image. When a user logs in, it automatically places them into a host based on availability. The next day they might end up on a different host (and all their stuff is carried over with OneDrive and FSLogix). 

The gold image changes whenever we run new updates, so once a month.

[J.Meltz]

We are in the same situation and would appreciate any clarification on the proper way to install Cortex for this scenario.

Should we be using the VDI switch, install to our gold image & scan, and then deploy to the pool?

Should we be using the TS switch and install to the VDI instance when is deployed to the pool?

Should we be using both switches?

[nsinghvirk]

Hello @J.Meltz 

Thanks for reaching out to us. For your use case "--temporary-session" is the right option. It is intended for either physical or virtual endpoints that repeatedly revert to a snapshot (or image) on which the Cortex XDR agent is not installed. You have to install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning.