microsoft/mcw-implementing-azure-virtual-desktop-in-the-enterprise

Implementing Azure Virtual Desktop in the enterprise

Implementing Azure Virtual Desktop in the enterprise

NOTE: This workshop is archived and no longer being maintained. Content is read-only.

Contoso Healthcare, headquartered in Los Angeles, California, is a national healthcare provider with a network of affiliate hospitals and doctor’s offices located throughout North America. These locations continue to grow through acquisition. The nature of their business requires a high level of security of personal identifiable information (PII) for their employees.

Contoso currently has approximately 250 workstations within their environment with business applications for non-clinical users from the Developer, Finance, and Knowledge departments. Contoso is currently supporting existing data centers in California and Northern Virginia with VMware for the server control plane and a partial deployment of Citrix virtual desktop infrastructure. These locations are connected with a private WAN connection and a backup VPN over broadband.

August 2022

Target audience

• Infrastructure Specialists
• Cloud Solution Architects
• Account Technology Specialists

Abstracts

Workshop

In this workshop, you will gain experience designing solutions for Azure Virtual Desktop utilizing Microsoft 365 and Azure technologies.

The following components will need to be determined as part of the solutions. The first will consist of Microsoft 365 subscription that will be required to deliver the security requirements, Azure Active Directory, applications, and Windows licensing to users. Next, the Azure infrastructure that is required to support the Azure Virtual Desktop environment will need to be configured. Finally, the networking requirements will need to be determined for connectivity to the current on-premises infrastructure for application servers, and proper access to the user desktops and on-premises network with high security and limited latency.

At the end of this workshop, you will be better able to leverage various Microsoft 365 and Azure technologies together to build a secure, complex and robust Azure Virtual Desktop infrastructure.

Whiteboard design session

In the whiteboard design session, you will work in groups to design an Azure Virtual Desktop solution using Microsoft 365 and Azure technologies. Your solution will consider the necessary Microsoft 365 subscription required for Windows 10 Enterprise multi-user licensing, as well as the Azure Active Directory and security needs for a healthcare provider. You will need to determine how to connect Azure to the current VMware and Citrix on-premises infrastructure and the connections needed to connect this infrastructure to Azure for application access. Finally, you will need to design the Azure Virtual Desktop solution utilizing Azure virtual machines with availability and scalability to handle 24x7 operations without performance degradation.

At the end of the whiteboard design session, you will be better able to design a solution that leverages Microsoft 365 and Azure technologies together to build a secure and robust Azure Virtual Desktop infrastructure.

Continue to the Whiteboard design session documents folder.

Hands-on lab

In this hands-on lab, you will implement an Azure Virtual Desktop (AVD) infrastructure and learn how to set up a working AVD environment end-to-end in a typical Enterprise model. At the end of the lab, attendees will have deployed an Azure Active Directory Tenant with Azure AD Connect to an Active Directory Domain Controller running in Azure. You will also deploy the Azure infrastructure for the Azure Virtual Desktop Tenant(s), Host Pool(s), and session host(s). Then you will connect to an AVD session utilizing different supported devices and browsers. You will publish desktops and remote apps. Finally, you will configure user profiles and FSLogics with Azure file shares. Finally, you will configure monitoring and security for the Azure Virtual Desktop infrastructure and understand the steps to manage the gold images.

At the end of this hands-on lab, you will be better able to build a secure and robust Azure Virtual Desktop infrastructure.

Continue to the Hands-on lab documents folder.

Azure services and related products

• Azure Virtual Desktop
• Microsoft 365
• Azure Active Directory
• Azure Networking
• Azure Virtual Machines

Related references

• MCW

Help & Support

We welcome feedback and comments from Microsoft SMEs & learning partners who deliver MCWs.

Having trouble?

• First, verify you have followed all written lab instructions (including the Before the Hands-on lab document).
• Next, submit an issue with a detailed description of the problem.
• Do not submit pull requests. Our content authors will make all changes and submit pull requests for approval.

If you are planning to present a workshop, review and test the materials early! We recommend at least two weeks prior.

Please allow 5 - 10 business days for review and resolution of issues.

mcw-implementing-azure-virtual-desktop-in-the-enterprise's Issues

cannot find AVD-MSIX.vhd file

Hello,

In the section MSIX, I can not find the AVD-MSIX.vhd in the resources. Could you point me to the link please ?

Thanks

Lab Guide UI and functional Updates

1. Exercise 1, Task 3, Step 3: After entering Password, the instruction for enabling “user must change password at next logon” is not given. Instruction has to be updated.

2. Exercise 4, task 5, step 6: For creating VM Image, details are not given properly in instruction. When I followed the details in screenshot and tried to create image, the Image was not created as shown in lab guide. The UI for creating Image has changed as shown below.

3. Exercise 5, task 1 & Exercise 6, task 1: There is an UI update for creating the hostpool which ask for “Domain to join” details as shown in the below image and those details are not updated in the lab guide.

   Instructions and screenshot has to be updated.

4. Exercise 5, task 1 & Exercise 6, task 1: The use need to select Validation environment inside Basics tab as yes. It is not mentioned in the lab guide and giving it as no will result in unavailability of session hosts

Exercise 5 Task 1 - Please clarify if it is a Pooled or a Personal desktop host pool

In Exercise 5, as per the Task 1 header, we need to create a personal desktop host pool. Whereas the task description specifies the creation of pooled desktop host pool.
Host pool creation screenshot specifies a picture with Personal selected. But as per the instructions, the required OS image is Windows 10 Enterprise multisession + M365 apps. This OS image option is available only for Pooled desktop and not for Personal desktop.
So, please clarify if we need to create a Personal or a Pooled desktop host pool in Exercise 5.

List of issues with the instructions.

Before HOL:

Deploying the Azure Infrastructure to AD DS, Task 2 Step 6:
Purchase is no longer used in Azure. It should direct users to Review + Create and then Create.

HOL Step by step Guide

Ex 2 Task 2 Step 5 and 6: There is no list of users to add.

Ex 3 Task 3 Setup : "From a Domain Joined Computer" (Assuming this means the DC VM that was created in the Deploying Azure Infrastructure to AD DS section).
Need to clarify where this step needs to be completed from.
Also the prerequisites indicate a synced account required with specific permissions.
Need instructions on how to add the Global Admin role to the WVD Admin account that was setup during the Azure AD Sync exercise.

Ex 3 Task 4 Step 13 (Minor) Screenshot is old Azure interface. portal has changed.

Ex 3 Task 5 Step 3 Screenshot is from File Share Properties.

Ex 3 Task 5 Step 10 List of Permissions should be included.

Ex 4 Task 5 Step 6 Must add instructions to choose NO on share image to share image. (Otherwise you must create a gallery).

Ex 6 Task 1 Step 5 Instructions are incorrect regarding using the image created earlier. Instructions at the end of Ex 4 indicate you will be using the sysprepped image you created however it is unclear in this step. Setting the number of VMs to 2 to remain under quota limit for Azure pass.

Ex 6 Task 3 The order of tabs is backwards for Application Group. Applications appears after Basics, then Assignments

Facing issues in understanding few steps and there are few content/ screenshot updates.

1. We have added new "avdadmin" user and added to DomainAdmin group in E1>T3. We have a note to use it for Hostpool Domain Join but it is better to mention the note while creating Hostpools at in Ex5>T1>S5 & Ex6>T1>S6

2. In E2>T1 we are adding 7 Users to groups(AVD Pooled Desktop User | AVD Remote App All Users | AVD Persistent Desktop User). In Ex5>T3>S6 we have added AVD Pooled Desktop User on Market Place Image App Group and in Ex6>T3>S9 added AVD Remote App All Users + AAD DC Admin to Custom Image App Group but in Ex7>T1>S2 better to mention clearly which account need to be used. If user's which is part of 7 created users, need to clearly mention on obtaining user password.

3. In Ex4>T3>S8: Script failing to bring up the UI to install Apps.

4. While creating both Hostpools it is not clear which Vnet to be selected.

5. In Ex4>T6 it is mentioned to refer Ex6 for Hostpool creation. It is creating confusion, we don't require this as it is clearly instructed in Ex6. (Hence we end up performing exercise 6 two times)

6. In Ex6>T3>S5: Placed wrong screenshot.

7. Was not able to get Desktop Client App due to issue faced in preparing image using script.

2021 Q4 proposed updates

MCW WVD WDS Update proposals
• Screen capture protection (public preview) - prevent data being exfiltrated by clients using screen captures
• Start virtual machine on connect (public preview) - Built-in functionality useful for personal desktops to allow VMs to be shutdown and start up when a user logs in to save on compute costs
• RDP Shortpath (preview) - connect to backend over private network for lower latency after authenticating via public portal
• RBAC Roles for WVD - Integrate in RBAC Desktop Virtualization * roles for management team roles
• MSIX App Attach via Azure Portal - allow applications to be centrally managed and stored without having to regularly update hosts and can now be managed via the portal and start menu settings.
• Ensure specifically calling out WVD integrations of Azure Security baseline, Monitor, and Defender Endpoint

MCW WVD HOL Update proposals
• Configure Azure Automation to autoscale pooled pool
o Deploy automation and Logic App
o Login to pool and use app to artificially use CPU load
• RBAC Roles for WVD
o Add management accounts to Desktop Virtualization RBAC rules
• MSIX App Attach via Azure Portal - allow applications to be centrally managed and stored without having to regularly update hosts and can now be managed via the portal and start menu settings.
o Create basic MSIX app from MSI using packaging tool
o Convert MSIX app to MSIX image (VHD) using MSIXMGR
o Store MSIX VHD on Files Share
o Configure Host VMs to use MSIX
o Add MSIX app to start menu
o Login and validate app works
• Azure Security baseline, Monitor, and Defender Endpoint for WVD integration
• Rolling update of pool using Image Gallery
o Import disk directly into an image gallery
o Deploy from image gallery (instead of directly from managed image)
o Log user(s) into initial image
o Create VM from image and update (additional tool)
o Sysprep VM and add as new version to gallery
o Add new host to host pool (uses new image automatically)
o Set old host to drain logins
o Log out and log in with account to see new app
o Kick out user from old host
o Delete old hosts

Before the HOL updates?
• Image as BtHOL? – remove image building time from actual WVD lab for sake of time
o Have them do the initial Image and Image Gallery prior to the HOL and move it to the Before the HOL

• or –
  o Include Shared Image Gallery in template and copy over a base image as part of template
  • Either of them could allow the student to not have to spend more time in the lab focusing on WVD but still do the syspreping for the rolling update change above.

issues found while performing Exercise 8

1. Exercise 4: Create a golden image for AVD, Task 3: prepare AVD Image, step 10 where Microsoft Teams and Edge is not getting installed.

2. Exercise 3, task 3, step 8: The zip file is extracted in AzFilesHybrid\AzFilesHybrid hence the command should be

"cd C:\Users\ADAdmin\Documents\AzFilesHybrid\AzFilesHybrid" instead of "cd C:\Users\ADAdmin\Documents\AzFilesHybrid\AzFilesHybrid"

MSIX doesn't work

Hello

I followed the MSIX steps but it doesn't work.
Here is the message when I want to add a VHD package.
Error: The MSIX Application metadata expand request failed on all Session Hosts that it was sent to. Session Host: win10custom-0, Error: Error accessing virtual disk at ≤\MYSTORAGE.file.core.windows.net\avdfiles\MSIX\AVD-MSIX.vhd

There is no steps in the workshop that make us mount the File Share to the session hosts.
Also the session hosts are not a member of any groups, therefore they don't have permissions on the file share.

Could you please update the workshop ?

Many thanks

Incorrect terminology

Abstract and learning objectives

WVD is the service name, we don't publish windows virtual desktops, we just publish desktops and apps.

What is the purpose of ODFC folder ?

Hello

The workshop makes us create ODFS folder in the File Share but we don't use it later on. What is the purpose of this folder ?

Thanks

Pre-requisites: ARM Template throwing error

Before Hands-on-Lab: Task 2: On deploying the template, it gives an error saying: The template resource 'NSGs' at line '177' and column '5' is invalid. The nested deployment has api-version '2019-10-01', which is not supported in api-version '2016-09-01' used to deploy the template. Please use api-version '2017-05-10' or later to deploy the template. Or use an older api-version for the nested deployment in the template.

Can you please provide me the Asset Location as from the template I'm not able to access it.

Also, can you please confirm how much time it take for Task 3 in Exercise 4 to run because for me it's taking more than an hour and maybe it's stuck:

Can you please have a look into both issues.

Thanks,
Seerat Arora

Teams and Edge not installing from "WVD Image preperation tool"

Exercise 4: Create a golden image for AVD, Task 3: prepare AVD Image, step 10 where Microsoft Teams and Edge is not getting installed.
the issue is with "WVD image Preparation Tool" tool, even if we select Teams and Edge installation in the tool, Teams and Edge doesn't get installed on the VM.

Issues with Lab Guide

In Exercise- 3> Task- 3> Step 20, I was not able to find the Active Directory Domain Services enabled option.

In Exercise- 4> Task- 5> Step- 6, The UI to create an image has changed.

Could not connect to resources.

I configured all the resources and when I go to https://rdweb.wvd.microsoft.com/arm/webclient/index.html I can see the list of apps and a personal desktop listed

However when trying to launch any of them I receive this error:

The VMs are running and objects in AD are also created.

Can you please advise? Error doesn't provide any clues.

Thanks

Shouldn't use master/slave terminology

Throughout the doc 'master' image is used. As gold image is used within the industry interchangeably with master image and doesn't have the same negative connotations so we should use gold instead of master.

Content Update Required

Hi,

The following content needs to be updated. Please have a look into this.

• Exercise 3: Task 3: Step 1: In Setup. Link Address provided does not have ' : ' after https as shown in the screenshot below. It should be - https://github.com/Azure-Samples/azure-files-samples/releases

• Exercise 3: Task 4: Step 15: Screenshot given for other two roles is incorrect.

Thanks.