Support for Entra ID External ID to sign in to spoke host pools

[SvenAelterman]

Just an update to the default Windows 11 version for spoke session hosts.

[Copilot]

Pull request overview

This PR updates the default Windows 11 version for Azure Virtual Desktop session hosts and makes the Active Directory OU path optional during domain join operations. However, there's a disconnect between the PR title which mentions "Support for Entra ID External ID" and the description which only mentions a Windows version update.

Changes:

• Updated default Windows 11 SKU from 23H2 to 25H2 for session hosts
• Made the Active Directory OU path optional using the safe navigation operator

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
shared-modules/virtualDesktop/sessionHosts.bicep	Updated default Windows 11 image SKU from win11-23h2-avd-m365 to win11-25h2-avd-m365
shared-modules/compute/virtualMachine.bicep	Applied optional chaining operator to adOuPath field in domain join extension settings

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

shared-modules/compute/virtualMachine.bicep:182

• domainJoinInfo's adOuPath is an optional property (string?), and sessionHosts.bicep passes an object that may omit it. With ouPath: domainJoinInfo.?adOuPath, the extension settings can emit "ouPath": null, which is likely to fail schema validation or extension execution. Prefer omitting the ouPath setting entirely when it is not provided.

    settings: {
      name: domainJoinInfo.adDomainFqdn
      ouPath: domainJoinInfo.?adOuPath
      user: domainJoinInfo.domainJoinUsername
      restart: 'true'

shared-modules/compute/virtualMachine.bicep:180

• The PR description says this is "just an update to the default Windows 11 version", but this file also changes the AD domain join extension settings (ouPath handling). Either update the PR title/description to mention the domain join behavior change, or split it into a separate PR so reviewers and release notes match what is actually changing.

      name: domainJoinInfo.adDomainFqdn
      ouPath: domainJoinInfo.?adOuPath

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

shared-modules/virtualDesktop/sessionHosts.bicep:38

• The PR title/description indicate Entra ID External ID sign-in support and/or only a Windows 11 default version bump, but this PR also changes domain-join behavior (ouPath) and adds VS Code/devcontainer editor recommendations. Please align the PR title/description with the actual scope (or split these changes into separate PRs) to avoid review and release-note confusion.

  publisher: 'microsoftwindowsdesktop'
  offer: 'office-365'
  version: 'latest'
  sku: 'win11-25h2-avd-m365'
}

shared-modules/compute/virtualMachine.bicep:181

• adOuPath is optional (nullable) in activeDirectoryDomainInfo, so domainJoinInfo.?adOuPath can evaluate to null when the caller omits the property. Passing a null value for ouPath can cause deployment/runtime issues for JsonADDomainExtension, and the repo docs describe the default as an empty string. Consider coercing the value to a string (e.g., ?? '') to preserve the existing default behavior.

      name: domainJoinInfo.adDomainFqdn
      ouPath: domainJoinInfo.?adOuPath
      user: domainJoinInfo.domainJoinUsername