Azure Virtual Desktop file transfer: every option compared

Four questions about your users and your policies point to a starting point. The sections below explain each option in detail.

Drive redirection makes the PC's drives appear inside the session as \\tsclient\C, shown in Explorer as C on <PC name>. It is controlled by the drivestoredirect RDP property on the host pool: empty selects no drives, * selects all of them including ones connected later, and you can also list drive letters or DynamicDrives.

• Off by default. Microsoft's documentation says drive redirection is disabled by default for newly created host pools.
• The strictest setting wins. The host pool property, Intune and the Group Policy setting Do not allow drive redirection combine, and the most restrictive one applies. That policy also blocks file transfer through the clipboard.
• Client support. Windows, macOS, iOS/iPadOS and Android clients support it; the browser client is limited to upload and download. On Windows you can't choose individual folders, on macOS you can and can make them read-only, and iOS redirects a single folder.
• Performance. Every file operation is a round trip to the PC inside the RDP connection, which makes large folders slow. Windows 11 24H2 clients with KB5053598 or later can set fAllowQueryDirPrefetch to speed up folder listing. We explain the mechanics in why RDP drive redirection is slow.

If drives are missing in the session, our AVD local drives not showing checklist walks through the host pool, policy and client checks in order.

Copying a file on the PC and pasting it into the session is the quickest way to move one file, when it is allowed. The redirectclipboard property is off by default, and for new host pools clipboard redirection is disabled in both directions.

• Files only from Windows and macOS. The iOS client copies text and images, Android and the browser copy text only.
• Direction and data-type policies. Restrict clipboard transfer from server to client and its client-to-server counterpart let you allow plain text, images, Rich Text Format or HTML in each direction. None of the levels allows files, which is exactly why Microsoft says that "by restricting the content type, clipboard can be enabled without the risk of files being transferred". They need a recent cumulative update on the session host, for example KB5039212 on Windows 11 22H2 and 23H2 or KB5040437 on Windows Server 2022 (details).

Users who connect from a browser don't get their drives. They get a virtual drive in the session called Remote virtual Drive on RDWebClient, with an Uploads and a Downloads folder.

• 255 MB per upload. Microsoft documents a "file size limit of 255 MB for all file uploads" through the virtual drive. Uploaded files stay until the user signs out of Windows App.
• Clipboard files up to 4 GB. Pasting files through the browser clipboard allows up to 4 GB per file, and files larger than 256 MB can only be downloaded in Microsoft Edge or Google Chrome.

Microsoft's security recommendations for Azure Virtual Desktop say to "consider using OneDrive for Business to replace allowing drive redirection for file transfers". The user saves to OneDrive on the PC, the file syncs to Microsoft 365, and the OneDrive sync app in the session brings it down. With Known Folder Move, Desktop, Documents and Pictures are OneDrive folders on both sides.

It works well when files belong in Microsoft 365 anyway. It is a sync, not a view of the PC: files that aren't in OneDrive, such as an export saved to C:\Exports or a USB drive, don't reach the session. And on shared session hosts it has a cost that is easy to underestimate.

On a multi-session host, OneDrive isn't installed once for the machine and shared. Microsoft's image guidance installs it per machine with OneDriveSetup.exe /allusers and adds a machine-wide Run key that starts OneDrive.exe /background for every user who signs in (source). Twenty users on a host means twenty sync apps, each with its own account, its own cache and its own connection to Microsoft 365.

Memory and CPU

Microsoft publishes no memory or CPU figures for OneDrive.exe. What it does say about session hosts is that background activity like "background indexing or change monitoring, and offline synchronization" has an effect that "is quickly amplified for many active sessions", and it advises disabling unnecessary processes that start at sign-in. Its sizing guidance starts multi-session hosts at 8 vCPUs and 16 GB of RAM, with 2 to 6 users per vCPU depending on the workload (source), and none of its workload profiles includes a sync client.

Reports from the field show why that matters. In one Microsoft Q&A thread, a user describes OneDrive using almost 5 GB of memory and up to 20% of the CPU, and 11 GB after a reinstall. That was one PC, not a session host, but on a 16 GB host shared by a dozen people, one user's sync app behaving like that takes memory from everyone else.

Disk and profile containers

• FSLogix is required on pooled hosts. "Without FSLogix profile containers, OneDrive isn't supported in non-persistent VDI environments." The OneDrive cache is stored in the user's container, and OneDrive's disk-space checks look at the container rather than the OS disk (source).
• Opened files stay local. With Files On-Demand, an online-only file downloads when it is opened and stays on the device until the user frees up space. On a session host, "the device" is the user's profile container, so it grows with every file they open.
• Plan the container size. FSLogix containers default to 30 GB (source), Microsoft suggests a separate 50 GB container for heavy OneDrive users (source), and recommends keeping at least 30% free space.
• Storage Sense is usually off. For Windows 10 multi-session hosts Microsoft recommends disabling Storage Sense, which is also the feature that frees up OneDrive files automatically.
• One session per container. OneDrive with FSLogix doesn't support the same container being used by two sessions at once (source).
• Item limits. Microsoft recommends "syncing no more than a total of 300,000 items" across a user's cloud storage for optimum performance.

Network

Every session syncs on its own. Microsoft's network planning guide puts it plainly: "Each installation multiplies the bandwidth used". Initial syncs and Known Folder Move cause upload spikes, which is why Microsoft recommends Files On-Demand and rolling Known Folder Move policies out slowly.

If you run OneDrive on session hosts

1. 1

   Install per machine. Use /allusers and the machine-wide Run key, so the sync app isn't installed into every profile.

2. 2

   Turn on Files On-Demand and silent sign-in. Avoid full downloads, and let users sign in with their Windows account.

3. 3

   Size containers for the cache. Watch container growth for the first weeks, and consider a separate ODFC container for heavy users.

4. 4

   Budget memory per user. Measure OneDrive.exe on a pilot host under real use before setting users per host.

5. 5

   Roll out Known Folder Move in waves. Spread the upload spike across days rather than one Monday morning.

A share that both the PC and the session host can reach works as a drop box: save on one side, open on the other. Many AVD estates already have Azure Files for their FSLogix containers, which Microsoft recommends for "most of our customers". It needs the PC to have network access and permissions to the share, which is easy in the office and harder from home, and users have to know which share to use.

One more built-in option deserves a mention: USB redirection passes a USB device such as a memory stick through to the session. It is only available from Windows clients and is designed for LAN connections under 20 ms latency.

TwinPane takes a different approach: instead of moving copies around, the session sees the PC. The TwinPane Server runs in each user's session and mounts their PC as the Client PC (X:) drive, and can point the session's Desktop, Documents and Downloads at the PC's own folders. Double-click a file in the session and it opens in the app on the PC. Both sides connect outbound to the TwinPane service and encrypt end to end; RDP drive and clipboard redirection can stay disabled.

What it needs: Windows PCs, the TwinPane Client on the PC and the Server on the session host, and outbound internet access on both. It is not a backup or a sync service, so files that should live in Microsoft 365 still belong in OneDrive. See how TwinPane works and the Mirror Mode guide.