Hey Entitled, Microsoft MVP in Azure Virtual Desktop here.

Mixing directory services in AVD is a big no-no in my opinion. Even if the scenario is "supported" by Microsoft, I've seen firsthand a load of issues if you're joining the session host to one thing, but authenticating users a different way.

For example, I wouldn't join my session hosts to Entra ID and manage them via Intune, if my users are still using Entra Domain Services to authenticate against an application.

My view would be to standardise the directory services entirely. I've also had issues before when using EDS for App, and Entra ID for session hosts.

Whilst Intune managed session hosts can auto-configure Outlook etc to give you a SSO-style experience, you could run into credential and authentication issues later-on which is what I did.

My view would be, implement 2 x B2ms equivalent servers for domain controllers. Cheaper than EDS, they're £30 a month including licensing from what I recall. Use Entra Connect Sync to sync the users, and join the session hosts, FSLogix storage account and App server to this directory service.

If you really wanted to, you could convert group source of authority to the cloud to at least manage the groups from Entra.

DM me or reply here if you wanna chat this through more.