Virtual Desktop (VDI) and DaaS Security Guide: Citrix and AVD

A virtual desktop puts corporate applications and data one sign-in away from any device on the internet, so a weak gateway, a stale golden image or a shared multi-session host becomes a direct route into the estate. Virtual desktop infrastructure (VDI) and desktop as a service (DaaS) are often sold as a security control because data stays in the data centre or cloud, but that is only true when access, the image, session isolation and the management plane are all governed. This guide covers on-premises VDI and cloud DaaS, with platform detail for Citrix Virtual Apps and Desktops, Citrix DaaS, Azure Virtual Desktop (AVD) and Windows 365. It is written for endpoint, identity and infrastructure teams who run or are replacing a virtual desktop estate. Remote access gateways in general are covered in the Remote Access Identity Guide; this page goes into the desktop layer behind them.

Key takeaways

• The gateway is the front door. NetScaler ADC and Gateway flaws such as CitrixBleed leaked session tokens that bypassed MFA, so patching must be followed by killing existing sessions.
• Multi-session hosts are a shared trust boundary. Never give users local admin on pooled hosts, and never mix users from different organisations on the same multi-session host.
• The golden image is your baseline and your risk. Build it in a pipeline, patch it monthly, version it and redeploy, rather than patching hosts by hand.
• Data controls live in redirection policy. Clipboard, drive, printer and USB redirection, screen capture protection and watermarking decide whether data really stays in the desktop.
• Profiles and service identities are the quiet weak points. FSLogix shares, Cloud Connectors, image build identities and broker service accounts need the same governance as the desktops.

VDI, DaaS and where the security boundary sits

A virtual desktop is a Windows (occasionally Linux) desktop or published application that runs on a server and is displayed on the user's device over a remoting protocol such as ICA/HDX (Citrix) or RDP (Microsoft). Virtual desktop infrastructure is the customer-run version: hypervisors, brokers, gateways and storage in your own data centre. Desktop as a service moves the control plane, and sometimes the hosts, to a provider. A hosted virtual desktop is the generic term analysts use for either.

• Persistent VDI: each user keeps a dedicated machine across sessions, so changes survive. Good for power users, but each desktop drifts like a physical laptop.
• Non-persistent VDI: pooled hosts are reset or rebuilt from the golden image, with user state in a profile container. Persistence and drift shrink, but the profile store and image become the high-value targets.
• Multi-session: several users share one session host (Windows Enterprise multi-session, Windows Server RDS, Citrix multi-session VDAs). Highest density, and the strongest need for isolation between users.
• Cloud PC: Windows 365 provisions one dedicated, persistent Cloud PC per user, managed through Intune like a physical device.

Microsoft's AVD documentation states it plainly: most components are Microsoft-managed, "but session hosts and some supporting services and components are customer-managed or partner-managed." The same logic applies to Citrix DaaS, where Citrix runs the Delivery Controllers and management console while the customer runs Virtual Delivery Agents (VDAs) and Cloud Connectors in its own resource locations. Amazon WorkSpaces follows the AWS shared responsibility model in the same way. VMware Horizon, now sold as Omnissa Horizon, is still a common customer-run platform; the controls in this guide apply to it, but the setting names below are for Citrix and Microsoft.

Platform reference: Citrix, AVD and Windows 365

For firewall review: Citrix reserves 1494 (ICA) and 2598 (Common Gateway Protocol) for Citrix traffic only; VDA to Delivery Controller registration uses port 80 by default, or TLS on 443 with WebSocket. AVD session hosts need no inbound ports because of Reverse Connect.

VDI authentication and the gateway

Most VDI compromises start at the front door. ATT&CK covers this as T1133 External Remote Services, whose description names "VPNs, Citrix, and other access mechanisms" directly.

• MFA at the gateway, not only the desktop: enforce phishing-resistant MFA through the identity provider for every user and admin. The Change Healthcare breach began with a Citrix remote access portal that accepted a password alone. See the Phishing-Resistant MFA Guide.
• Conditional Access on the desktop app: for AVD and Windows 365, target the Azure Virtual Desktop and Windows 365 cloud apps with policies on user risk, sign-in risk, device compliance and location. Microsoft recommends Token Protection on the endpoint running Windows App; it does not apply inside the session host. See the Conditional Access Guide.
• Device trust for unmanaged endpoints: decide explicitly whether personal devices may connect. Options include Citrix Endpoint Analysis scans, Intune app protection policies for mobile and web clients, and WorkSpaces trusted devices, which check a client certificate. Note that WorkSpaces does not check revocation (no CRL or OCSP) for those certificates, so removal of a lost device needs another control.
• Single sign-on into the session: federated sign-in (Citrix Federated Authentication Service, Entra single sign-on for AVD) removes a second prompt, but the issuing component becomes a tier zero asset.

NetScaler ADC and Gateway: lessons from Citrix Bleed

Citrix ADC was renamed NetScaler ADC, and the same appliance usually fronts StoreFront as NetScaler Gateway. Two memory disclosure flaws show why gateway patching alone is not enough.

• CitrixBleed (CVE-2023-4966): Citrix's bulletin classes it as "Sensitive information disclosure" and limits it to appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Leaked session tokens let attackers hijack authenticated sessions without passing MFA. See the CitrixBleed 2023 breach analysis.
• CitrixBleed 2 (CVE-2025-5777): an out-of-bounds read with the same affected configurations. Citrix's post-upgrade advice, as reported at the time, was to terminate all active ICA and PCoIP sessions so that "potentially stolen session tokens are voided", and not to rely on a reboot instead. See the CitrixBleed 2 breach analysis.
• Response pattern: patch, kill all sessions on every node, rotate credentials and secrets stored on the appliance, then hunt for session reuse from new IP addresses. Treat end-of-life firmware (12.1 and 13.0 trains) as vulnerable by default. See the Edge Device Security Guide.

Golden image and session host hardening

In non-persistent VDI the golden image is the security baseline for every desktop. Build it like software, not like a pet server.

1. Automate the build: in AVD, custom image templates use Azure Image Builder to produce a versioned image in Azure Compute Gallery. Built-in steps include installing FSLogix, enabling screen capture protection, configuring session timeouts and applying Windows updates. Citrix Machine Creation Services and Provisioning Services consume a master image in the same way.
2. Patch monthly and redeploy: Microsoft recommends patching base images monthly so new hosts start secure. Roll new image versions to a validation host pool first, then drain and replace production hosts. See the Patch Management Guide.
3. Harden the platform: Trusted Launch with Secure Boot and vTPM, HVCI and Credential Guard, managed disk encryption, and confidential VMs where memory encryption is required. Do not BitLocker the disk holding FSLogix profile data.
4. Control what runs: App Control for Windows (WDAC) or AppLocker, targeted at the device. Microsoft notes that "RemoteApp isn't a security feature": publishing only some applications does not stop users launching others. See the Application Allowlisting Guide.
5. Endpoint protection inside the image: antivirus and EDR on every session host, with the documented FSLogix VHD/VHDX exclusions, and non-persistent onboarding so rebuilt hosts do not duplicate or orphan sensor records.
6. Keep secrets out of the image: Citrix warns against creating accounts on templates before cloning and against scheduled tasks that store privileged domain credentials. Local administrator passwords must be unique per host after sealing, for example with Windows LAPS.

Session isolation, redirection and data controls

VDI promises that data stays in the desktop. Redirection policy decides whether that holds.

Microsoft states that screen capture protection "is not DRM-level protection"; it cannot stop a phone camera, hence watermarking. Mobile and browser clients need Intune app protection plus a Conditional Access grant of "Require app protection policy" for the same protection.

Choosing the isolation model

Microsoft's trust-level guidance is a good default for any platform: standard users from one organisation can share Windows Enterprise multi-session hosts; users who need administrative rights should get a personal host pool with one host per user; users from different organisations should be in a separate tenant and subscription. On pooled hosts, idle disconnect, sign-out and screen lock policies stop the next user or a passer-by inheriting a session. Restrict session host egress through a firewall or proxy, because by default AVD session hosts can reach any internet destination. See the Network Segmentation Guide.

Profiles and storage: FSLogix

FSLogix profile containers store each user's profile in a VHD or VHDX on an SMB share, attached at sign-in. The share holds every user's browser cookies, cached tokens and Outlook data, so it is a credential store in practice.

• Permissions: Microsoft's recommended NTFS configuration gives CREATOR OWNER Modify on subfolders and files only, the administrative group Full Control, and users Modify on the top folder only, so that "only the user (CREATOR OWNER) has access to their profile directory or VHD(x) file."
• Azure Files: use identity-based access with the default share permission "Storage File Data SMB Share Contributor", reserve "Storage File Data SMB Share Elevated Contributor" for administrators who set ACLs, avoid mounting with the storage account key, and use private endpoints.
• Backups and replicas: Cloud Cache and backup copies are just as sensitive as the primary share. See the Backup Security and Immutable Backup Guide.

The management plane and its non-human identities

An attacker with broker or cloud admin rights can publish a malicious application to every user or change the image. This is where identity governance earns its place in VDI.

• Admin roles: scope Citrix delegated administration and Azure RBAC roles (for example Desktop Virtualization Contributor versus Reader) to the smallest set of host pools or delivery groups, and require privileged access workstations and just-in-time elevation. See the Privileged Access Management Guide.
• No direct RDP: Microsoft advises avoiding direct RDP to session hosts and using just-in-time access when it is needed. Citrix suggests disabling Remote Desktop Services on single-session VDAs that are not administered over RDS.
• Machine and service identities: Citrix Cloud Connectors, the Azure Image Builder user-assigned managed identity, autoscale and scaling plan identities, domain join accounts and broker service accounts all hold standing rights. Inventory them, give each an owner, scope domain join rights to the VDI organisational unit, and rotate any stored secrets. See the Service Account Security Guide.
• Control plane trust: if XML trust is enabled on Citrix Delivery Controllers, Citrix advises ensuring "only trusted StoreFront servers are able to connect", using Security Keys, firewall rules or IPsec. Enable HTTPS and disable HTTP on the Controller.

Hybrid cloud VDI and VDI replacement decisions

A VDI replacement project usually moves browser-based work to an enterprise browser and keeps desktops for thick-client or high-sensitivity work. See the Enterprise Browser and Browser Security Guide. Small organisations should lean on DaaS defaults and spend effort on Conditional Access and redirection; large ones need image pipelines, delegated admin and dedicated monitoring.

Implementation: a phased rollout

1. Inventory: list every gateway, StoreFront or web access URL, host pool or delivery group, image, profile share, admin role and service identity, noting which are persistent or multi-session.
2. Close the front door: patch gateways, confirm MFA and Conditional Access on every published entry point, remove password-only access paths, and kill sessions after any gateway security update.
3. Pilot data controls: apply redirection, screen capture protection and watermarking to a pilot host pool or delivery group. Test Teams screen sharing, printing and line-of-business apps before widening.
4. Move to an image pipeline: build the next golden image from a template, deploy to a validation pool, and keep the previous image version in the gallery so rollback is a redeploy, not a rebuild.
5. Lock down profiles and admin: fix FSLogix ACLs, remove local admin on pooled hosts, scope admin roles, and move direct RDP behind just-in-time access.
6. Turn on monitoring: send gateway, broker, session host and identity logs to the SIEM and set the alerts below.
7. Rollback plan: keep previous policy objects and image versions, change one host pool at a time, and document how to restore redirection for critical users quickly.

Detection and measurement

• Gateway: NetScaler authentication and session logs; alert on one session ID or cookie used from two IP addresses, and on logins outside expected geographies.
• Identity: Entra sign-in logs for the Azure Virtual Desktop and Windows 365 apps, failed Conditional Access, token protection failures.
• Session hosts: Windows event 4624 with logon type 10 (RemoteInteractive), 4778 and 4779 for session reconnect and disconnect, the TerminalServices-LocalSessionManager operational log, and process creation for unexpected admin tools. ATT&CK T1021.001 covers RDP-based lateral movement from desktops to servers.
• Platform logs: the AVD WVDConnections, WVDErrors and WVDCheckpoints tables and Azure Activity Log for host pool changes; Citrix configuration logging for Studio admin changes.

Metrics that show the programme is working:

• Days from a gateway security bulletin to patched and sessions terminated (target: within the vendor or CISA window).
• Percentage of VDI sign-ins that satisfied phishing-resistant MFA and a device compliance check.
• Age of the oldest golden image version in production (target: under 35 days).
• Number of users with local admin on multi-session hosts (target: zero).
• Percentage of host pools or delivery groups with clipboard and drive redirection restricted to approved exceptions.
• Service identities in the VDI management plane with a named owner and reviewed rights.

Framework mapping

Common failure patterns

• Patching the gateway but not killing sessions: upgraded appliances still honour tokens stolen before the upgrade.
• One legacy portal without MFA: a forgotten Citrix or RD Web URL that still accepts passwords alone.
• Local admin on pooled hosts: one admin user on a multi-session host can reach other users' sessions or plant persistence for everyone on it.
• Redirection left open for convenience: clipboard and drive mapping for all users turns the desktop into a file transfer service.
• Golden images patched by hand: images age for months, and secrets or test accounts get sealed into every clone.
• Profile shares readable by all users: wrong FSLogix ACLs or account key mounts expose every user's cookies and cached tokens.

Practitioner checklist

• Enforce phishing-resistant MFA and Conditional Access on every gateway, StoreFront and Windows App entry point, and remove password-only paths.
• Subscribe to NetScaler and platform security bulletins, and include "terminate all sessions" in the gateway patch runbook.
• Build golden images from a template pipeline, patch monthly, version in a gallery and keep the previous version for rollback.
• Remove local admin from all multi-session hosts; give admin users personal desktops or Cloud PCs.
• Default clipboard, drive, printer and USB redirection to off, with documented exceptions per group.
• Enable screen capture protection and watermarking for host pools or delivery groups that handle sensitive data.
• Apply the recommended FSLogix NTFS and share permissions and use private endpoints for Azure Files.
• Inventory Cloud Connectors, image build identities, domain join and broker service accounts, with owners and scoped rights.
• Restrict session host egress and block direct RDP except through just-in-time access.
• Forward gateway, broker, identity and session host logs to the SIEM and track the metrics above monthly.

Standards and references

• Microsoft Learn: Security recommendations for Azure Virtual Desktop
• Microsoft Learn: Windows 365 security
• Microsoft Learn: Screen capture protection in Azure Virtual Desktop
• Microsoft Learn: Configure SMB storage permissions for FSLogix
• Citrix: Security considerations and best practices for Citrix Virtual Apps and Desktops
• Citrix: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2023-4966 and CVE-2023-4967
• MITRE ATT&CK: T1133 External Remote Services
• AWS: Restrict WorkSpaces access to trusted devices

Related NHI Mgmt Group resources: Remote Access Identity Guide · Endpoint Security Guide · Conditional Access Guide · Token and Session Security Guide · Edge Device Security Guide