AVD RDP Shortpath and Private Link work best when you deploy both

Connectivity is one of the first hurdles I run into on Azure Virtual Desktop (AVD) projects. The design has to balance performance and security without piling on complexity nobody needs. Plenty of the tenants I review still rely on traditional reverse proxies, VPNs or open ports, even though Microsoft offers much better options today. AVD RDP Shortpath and Private Link are now at the core of any modern AVD network design. The practical questions are when each one makes sense, how you check which path a session is really taking, and how DNS and troubleshooting fit in. Below is what I've found matters for a resilient setup that performs well.

RDP Shortpath moves session traffic onto UDP for managed and public networks

The concept is straightforward. Rather than tunneling all Remote Desktop traffic through the central Azure Gateway, RDP Shortpath sets up a direct UDP connection between client and session host. Audio and video get noticeably better and latency drops, provided your network lets the traffic through. Microsoft separates "Managed Networks" from "Public Networks" (details). On a managed network, for example when client and host sit in the same LAN or can reach each other over a site-to-site VPN, Shortpath uses direct UDP. On a public network, such as mobile users without a VPN, the STUN/TURN mechanism takes over. That makes UDP possible even through NAT and firewalls, although it isn't always as reliable.

You enable RDP Shortpath in the Azure portal under AVD Host Pool → Settings → RDP Properties. There you can switch on Shortpath for Managed Networks and, since more recently, Shortpath for Public Networks, each on its own. Your session hosts must accept inbound UDP, so check the host firewall as well as the NSGs. Public network Shortpath additionally needs outbound access to the Microsoft TURN servers.

Private Link keeps the AVD control plane inside your VNet

Shortpath improves the Remote Desktop traffic itself. AVD Private Link has a different job: it secures the connection to the AVD service, meaning the control plane endpoints for feed, workspace and host pool registration (overview). Without Private Link, your session hosts reach the Microsoft endpoints over the public internet. With it, those endpoints are injected straight into your private Azure VNet. For regulated industries that must avoid direct internet exposure, this is often the deciding factor.

You deploy Private Endpoints per resource type as you need them, for feed, workspace and host pool. Every endpoint needs its own private DNS zone (for example, 'privatelink.wvd.microsoft.com'). Whether requests from session hosts actually reach these endpoints depends entirely on getting DNS right. I see this go wrong again and again in projects that skip proper documentation and testing.

The Remote Desktop client shows which connection path is in use

A question I get from admins all the time is "How do I know Shortpath is really being used?" You'll find the answer in the connection information of the Remote Desktop client (Windows, web or macOS). Once you're in a session, click the connection icon. It tells you whether the session runs over "RDP Shortpath (UDP)" and whether it was detected as "Managed Network" or "Public Network". If all you see is "Reverse Connect (TCP)", something is off. In most cases a firewall is blocking UDP, or DNS isn't resolving Private Link the way you intended.

Practical tip: Test Shortpath from different locations, networks and client types. That's the only way to find out where routing or firewall rules still need work.

AVD Insights helps with troubleshooting and monitoring

Every AVD project eventually gets the "It's slow" or "The connection keeps dropping" tickets. That's when Azure Virtual Desktop Insights earns its place as the central monitoring view in the Azure portal (it requires Azure Monitor integration). The host pool has to be connected to a Log Analytics workspace with AVD diagnostics enabled. I find the session details view the most useful part. For each session it shows whether Shortpath was used, which tunnel type it ran on and whether there were any disconnects. Using the Insights search, you can filter for sessions that didn't use Shortpath, which narrows down DNS or network problems quickly.

Here's a typical query for connection details (Log Analytics workspace → Logs, role: Monitoring Reader):

AVDConnections
| where ShortpathUsed == true
| project UserPrincipalName, ShortpathType, ConnectionStartTime

The diagram shows how Shortpath and Private Link fit together

With this many paths and services involved, it's easy to lose the overview. The diagram traces the flow from client to session host and the different routes traffic can take:

flowchart TD
    Client["AVD Client"] -->|"Feed/Workspace/Host Pool Lookup"| PrivateLink["AVD Private Link Endpoint"]
    PrivateLink -->|"Service Connection"| SessionHost["AVD Session Host"]
    Client -->|"Shortpath UDP (Managed/Public)"| SessionHost
    Client -->|"Fallback TCP (Reverse Connect)"| SessionHost

Figure: Connection paths between AVD client, Private Link and session host.

Shortpath and Private Link are not an either-or decision

You don't have to pick between Shortpath for managed or public networks and Private Link. Ideally you enable both, Shortpath for performance and Private Link for control plane security, compliance and keeping traffic internal. In projects with strict security or regulatory requirements (finance, healthcare), Private Link is nearly always mandatory, and it removes a lot of the usual firewall exceptions for MS endpoints. If your environment is fully internal and every client can reach the hosts directly, Shortpath for managed networks on its own already makes a real difference. For mobile users, Shortpath for public networks (STUN/TURN) is becoming more and more useful, but plan for careful testing and monitoring.

If you want to go deeper into practical AVD hardening, have a look at my post Azure Virtual Desktop security: Practical hardening in the field.

Performance and security are no longer opposites in AVD

The best AVD deployments I come across have one thing in common. The teams dealt with DNS, firewall rules and monitoring early and documented every path properly. AVD RDP Shortpath Private Link won't work miracles, but it's a technical detail that lifts both performance and security a step in daily operations. Stay disciplined about monitoring and connection checks, and you'll always know how traffic really flows through your network. You'll also catch issues before they turn into real problems.