AZ-140 - Azure Virtual Desktop
Planning
Network requirements:
- Remote Desktop Protocol bandwidth requirements Azure Virtual Desktop - Azure | Microsoft Learn
- Azure Virtual Desktop Experience Estimator | Microsoft Azure
- https://www.azurespeed.com/
Questions:
- How many clients do I have?
- How many hours per day on average?
- What's the region for the end-users location?
- AVD Experience Estimator
Prerequisites
Prerequisites for Azure Virtual Desktop | Microsoft Learn
- Required URL List Required URLs for Azure Virtual Desktop | Microsoft Learn
- Required URL Check Use the Required URL Check tool for Azure Virtual Desktop | Microsoft Learn
Identity Services
AD vs ADDS vs Entra ID
The following table summarizes identity scenarios that Azure Virtual Desktop currently supports:
Identity scenario | Session hosts | User accounts |
---|---|---|
Azure AD + AD DS | Joined to AD DS | In Azure AD and AD DS, synchronized |
Azure AD + AD DS | Joined to Azure AD | In Azure AD and AD DS, synchronized |
Azure AD + Azure AD DS | Joined to Azure AD DS | In Azure AD and Azure AD DS, synchronized |
Azure AD + Azure AD DS + AD DS | Joined to Azure AD DS | In Azure AD and AD DS, synchronized |
Azure AD + Azure AD DS | Joined to Azure AD | In Azure AD and Azure AD DS, synchronized |
Azure AD only | Joined to Azure AD | In Azure AD |
Is ADDS needed for AVD?
- Yes, if active directory is needed online
- No, if Azure AD Join standalone can be used
Azure AD Joined devices notes
- Azure Virtual Desktop (classic) doesn't support Azure AD-joined VMs.
- Azure AD-joined VMs don't currently support external identities, such as Azure AD Business-to-Business (B2B) and Azure AD Business-to-Consumer (B2C).
- Azure AD-joined VMs can only access Azure Files shares for hybrid users using Azure AD Kerberos for FSLogix user profiles.
- The Remote Desktop app for Windows doesn't support Azure AD-joined VMs.
RDP Shortpath
https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath
The following diagram gives a high-level overview of the network connections when using RDP Shortpath for public networks where session hosts joined to Azure Active Directory (Azure AD):
Configuration
- Configure RDP Shortpath - Azure Virtual Desktop | Microsoft Learn
- Session hosts
- Managed networks: Enable RDP Shortpath, Open port 3390
- Public networks: GPO
- Windows Clients
- GPO: Turn off UDP on Client: Disabled
- Intune: Administrative template: Turn off UDP on Client: Disabled
- Teredo Support
- While not required for RDP Shortpath, Teredo adds extra NAT traversal candidates and increases the chance of the successful RDP Shortpath connection in IPv4-only networks.
- Session hosts
Verify RDP Shortpath is working
Links:
- Configure RDP Shortpath - Azure Virtual Desktop | Microsoft Learn
- Troubleshoot RDP Shortpath for public networks - Azure Virtual Desktop | Microsoft Learn
-
RDP Private
-
If TURN is used, the transport protocol is UDP (Relay)
If STUN is used, the transport protocol is UDP
Monitor and troubleshoot network connectivity
- Log Analytics
- Network Watcher
-
For every region with vNet a Network Watcher is created (NetworkWatcherRG)
-
Let us monitor and troubleshoot network issues
-
IP flow verify
-
NSG diagnostics
- Returns all NSGs for source-destination pair
-
Next hop
- Hops from Source to Destination
-
Effective security rules
-
- Network Interface
- Insights
- Metrics
Storage for AVD user data
FSLogix for User Data Storage
- FSLogix recommended
- Stores data in single container
- Is dynamically attached using vhd/vhdx
- User profile shows like normal profile
- Additional folders can be added to the user profiles
Operating system replacement reasons:
- Upgrade OS
- Replacement VM
- Pooled
Azure Files
Azure Files integration with Entra Domain Service
- Azure Files supports AD authentication
- Azure Files is a premium solution due to cost and administrative overhead
Requirements:
- Must be in the same region as the session host VMs
- Permissions should match permissions of Requirements - Profile Containers
- Each host pool VM must be built of the same type and VM based on the same master image
- Each host pool must be in the same group to aid management, scaling and updating
- For optimal performance, storage solution and the FSLogix profile container be in the same data center location
- The storage account containing the master image must be in the same region and subscription where the VMs are being provisioned
Files shares
- Enable Active Directory authentication with “Azure AD Kerberos”
- Azure AD Kerberos allows using Kerberos authentication from Entra ID-joined clients. User accounts must be hybrid identities.
Azure NetApp Files
Overview
- Azure native, first-party, enterprise-class, high performance file storage service
- NAS volumes for which you can create NetApp acounts, capacity pools, service and performance levels
- Supports SMB and NFS
- Builtin HA, data protection and disaster recovery capabilities
- Service levels can be changed anytime
- Support for Availability Zones
- SLA 99.99
- Snapshot copies
- Integrated Backup
- Data replication between regions AZs
- Supports RBAC, AD, Entra Domain Services, LDAP and Azure Policy
Plan host pools and sessions hosts
Supported OS with licenses:
Operating system | User access rights |
---|---|
• Windows 11 Enterprise multi-session • Windows 11 Enterprise • Windows 10 Enterprise multi-session • Windows 10 Enterprise | License entitlement: • Microsoft 365 E3, E5, A3, A5, F3, Business Premium, Student Use Benefit • Windows Enterprise E3, E5 • Windows VDA E3, E5 • Windows Education A3, A5 External users can use per-user access pricing by enrolling an Azure subscription instead of license entitlement. |
• Windows Server 2022 • Windows Server 2019 • Windows Server 2016 • Windows Server 2012 R2 | License entitlement: • Remote Desktop Services (RDS) Client Access License (CAL) with Software Assurance (per-user or per-device), or RDS User Subscription Licenses. Per-user access pricing is not available for Windows Server operating systems. |
Supported identity scenarios:
Identity scenario | Session hosts | User accounts |
---|---|---|
Azure AD + AD DS | Joined to AD DS | In Azure AD and AD DS, synchronized |
Azure AD + AD DS | Joined to Azure AD | In Azure AD and AD DS, synchronized |
Azure AD + Azure AD DS | Joined to Azure AD DS | In Azure AD and Azure AD DS, synchronized |
Azure AD + Azure AD DS + AD DS | Joined to Azure AD DS | In Azure AD and AD DS, synchronized |
Azure AD + Azure AD DS | Joined to Azure AD | In Azure AD and Azure AD DS, synchronized |
Azure AD only | Joined to Azure AD | In Azure AD |
Defining Host Pool Types
- Collection of Azure Session Hosts
- Azure Virtual Agent runs on Hosts
- Need to be sourced by an image
- Same image for all machines in host pool
- Resources controlled by App pools
- Two types:
- Personal
- Assigned to an individual user
- Dedicated desktop
- Pooled
- User load balanced between Sessions Host. MultiSession Host possible
- Personal
App Groups used by Host Pools
- Logical grouping of applications installed on session hosts in the host portal
- Remote app: User access an app remotely. Only available with pooled pool
- Desktop: Available for pooled and personal
- Pooled host pools have a preferred app group type for conflicts
Workspaces
- Logical group of application groups
- Application groups need to be associated to a workspace for users to see the remote apps and desktops
User sessions
- Active
- User is signed and connected
- Disconnected
- Inactive but not signed out yet
- User closes remote session
- User will be redirected to their disconnected session
- Pending
- Reserves spot on the pooled virtual for the user
- sign-in can take from 30 seconds to five minutes
Implement host pools
UI
- vNet DNS Server set to custom
- Create host pool in Azure
- Basics
- Preferred app group type: Desktop, RemoteApp (Rail)
- Host pool type: Personal, Pooled
- Load balancing algorithm:
- Breadth-first: Across all available session hosts
- Depth-first: Assignment to highest number of sessions but has not reached max
- Max session limit
- Virtual Machines
- Name prefix (Intune devices: Less or equal 63 characters)
- Security type
- Image: Image options include “+ Microsoft 365 Apps”
- Number of VMs
- OS disk type: Standard HDD, Standard SSD, Premium SSD
- Public Inbound Ports
- 80,443, 3389
- Domain to join: Active Directory, AAD
- AD: Needs user with AD Join permission
- AD: Domain and OU can be specified
- VM Administrator
- Custom Configuration
- Providing location of ARM template (inline deployment script, desired state, custom script extension)
- Workspace
-
Register desktop app group
-
- Basics
Configure
- Create a scaling plan
- Basics
- Schedules
- Ramp-up
- Start time
- Load balancing algorithm: depth-first, breadth-first
- Minimum percentage of hosts %
- Capacity threshold %
- Peak hours
- Start time
- algorithm
- Capacity threshold
- Ramp-down
- Start time
- algorithm, percentage, capacity
- Force logoff users
- Delay time before logging out users and shutting down VMs (min)
- Notification message
- Ramp-up
- Assign scaling plan to host pool
- Session hosts need to be shut down
- Host pool
- RDP properties
- Connection information
- Azure AD authentication: on/off
- Alternate shell
- KDC proxy name
- Session behavior
- Device redirection
- Display settings
- Advanced
- Like from .rdp file
- Connection information
- Properties
- Start VM on connect
- Validation environment
- Friendly Name, Description
- Algorithm
- Max session limit
- Scheduled agent updates
- RDP properties
Licensing
- Licenses are automatically applied by the deployment
- Only when using PowerShell or CLI for deployment the licenses need to be added manually
Images
Golden Image manually
- Reference VM required
- Stopped (deallocated) required to take image (capture)
- Create an image
- Image needs to be shared to Azure compute gallery
- compute gallery needs to be selected
- Two states
- Generalized: this images requires hostname, admin user and other settings on first boot
- Specialized: this images has all settings doesn’t need parameters
- Image definition
- Includes OS type, VM generation, security type, VM architecture, NVMe option, Publisher, Offer, SKU
- Version number
- Exclude from latest
- End of life date
- Replication
- Can be replicated to different regions. Newest version can be replicated to subregions and only the main region has all versions
- Required to deploy VMs in different regions to the same host pool
- Image needs to be shared to Azure compute gallery
Golden image with Azure VM Image Builder
- Uses PowerShell and CLI to build images quickly
- Makes sense in large environment
- Uses json, kind of a recipe
- Integrated with RBAC
Modify Session Host Image
- Automatic Windows Update should be disabled
- End of life date available for image
Create session host
- Open host pool
- Create registration key
- Has expire date
- Total machines → Add
- Basics
- Default settings
- Virtual Machines
- Location
- Availability options
- Availability zones
- Security type
- Image
- Domain to join
- AD / AAD
- UPN
- Password
- Custom configuration
- Basics
Plan and implement image storage
Troubleshooting
Session slow
From within the current session, use Performance Monitor to display the values of all the RemoteFX Graphics(*)\Frames Skipped/Second counters.
License missing
$vm = Get-AzVM -ResourceGroup <resourceGroupName> -Name <vmName>
$vm.LicenseType = "Windows_Client"
Update-AzVM -ResourceGroupName <resourceGroupName> -VM $vm
# Run the following cmdlet to see a list of all session host VMs that have the Windows license applied in your Azure subscription:
$vms = Get-AzVM
$vms | Where-Object {$_.LicenseType -like "Windows_Client"} | Select-Object ResourceGroupName, Name, LicenseType
Teams optimization
Use Microsoft Teams on Azure Virtual Desktop - Azure | Microsoft Learn
# Enable media optimization for Teams
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Teams" -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Teams" -Name IsWVDEnvironment -PropertyType DWORD -Value 1 -Force
Install the Remote Desktop WebRTC Redirector Service
- Sign in to a session host as a local administrator.
- Download the Remote Desktop WebRTC Redirector Service installer.
- Open the file that you downloaded to start the setup process.
- Follow the prompts. Once it's completed, select Finish.
Parameter | Purpose |
---|---|
ALLUSER=1 | Used in virtual desktop infrastructure (VDI) environments to specify per-machine installation. |
ALLUSERS=1 | Used in both non-VDI and VDI environments to make the Teams Machine-Wide Installer appear in Programs and Features under the Control Panel and in Apps & Features in Windows Settings. The installer lets all users with admin credentials uninstall Teams. |
Content Sharing:
To enable content sharing:
- On your session host VM, from the start menu, run Registry Editor as an administrator.
- Go to
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\WebRTC Redirector\Policy
. - Add the ShareClientDesktop as a DWORD value.
- Set the value to 1 to enable the feature.
Anti-Virus
Exclusions
Exclude Files:
%ProgramFiles%\FSLogix\Apps\frxdrv.sys
%ProgramFiles%\FSLogix\Apps\frxdrvvt.sys
%ProgramFiles%\FSLogix\Apps\frxccd.sys
%TEMP%\*.VHD
%TEMP%\*.VHDX
%Windir%\TEMP\*.VHD
%Windir%\TEMP\*.VHDX
\\storageaccount.file.core.windows.net\share\*\*.VHD
\\storageaccount.file.core.windows.net\share\*\*.VHDX
Exclude Processes:
%ProgramFiles%\FSLogix\Apps\frxccd.exe
%ProgramFiles%\FSLogix\Apps\frxccds.exe
%ProgramFiles%\FSLogix\Apps\frxsvc.exe