Chapter 8: Azure AD Join for Azure Virtual Desktop

In this chapter, we will look at Azure Active Directory (Azure AD) join for Azure Virtual Desktop. Using Azure AD join for Azure Virtual Desktop has many benefits for organizations, including Single Sign-On (SSO), virtual machines just using one identity provider, and being able to avoid some of the complexities associated with having an Active Directory domain controller.

It is important to note that other services may still require an Active Directory Domain Services environment for access to applications and Server Message Block (SMB).

In this chapter, we will take a look at the following:

• Prerequisites for Azure AD join for Azure Virtual Desktop
• Deploying an Azure AD-joined host pool
• Enabling user access
• Configuring local admin access

Prerequisites

It is important to note that there are a few limitations when using Azure AD join for Azure Virtual Desktop at the time of writing. As you may know, many Microsoft services, third-party platforms, and others require access to an Active Directory environment for authentication and user/group permissions. Therefore, it is important to assess your organization's current requirements to ensure that Azure AD join is a suitable solution:

• Azure AD join is only supported when using Azure Virtual Desktop for Azure Resource Manager. The classic version of Azure Virtual Desktop is not supported.
• The session hosts must be Windows 10 Enterprise Version 2004 or later.
• Azure AD-joined VMs don't currently support external users.

  Important Note

  Azure AD join is different from an Active Directory Domain Services controller in that the session host Virtual Machines (VMs) are automatically joined with the Azure AD tenant of the subscription that deploys the VMs....

Deploying an Azure AD-joined host pool

In this section, we will look at deploying a host pool using Azure AD join.

Before we get started, I want to cover the use of FSLogix profile containers with Azure AD join. When using Azure AD join, there are a few slight differences compared to the traditional way when using Active Directory Domain Services. The following link takes you to the Microsoft documentation detailing how to configure FSLogix profile containers with Azure Files and Azure AD. Please note this feature is in preview at the time of writing: https://docs.microsoft.com/azure/virtual-desktop/create-profile-container-azure-ad.

Let's now move on and look at the creation of an Azure AD-joined host pool:

1. We first need to navigate to the Azure Virtual Desktop service to get started.
2. Proceed to create a new host pool.
3. Within the host pool creation screen, under the Virtual Machine tab, in the Domain to join section, select Azure Active Directory:
...

Enabling user access

Before users can sign in to the session hosts within the Azure AD-joined host pool, you must configure the required permission using Role-Based Access Control (RBAC). First, we need to add the required users and Azure AD groups to the host pool default desktop application group. We also need to add the Virtual Machine User Login RBAC role.

Important Note

The Virtual Machine User Login RBAC role is not an Azure Virtual Desktop role. This is required to enable access to sign in to a VM. The Azure role enables logon by applying the DataAction permission.

Depending on your requirements and host pool deployment, you may want to review the scope for this role. For example, assigning an Azure AD group at the resource group level may make more sense than assigning the RBAC role for each user per VM.

Important Note

It is not advised to set the Virtual Machine User Login RBAC role at the subscription level; you would essentially give all assigned users the...

Configuring local admin access

To give the user local admin access to a VM, you will need to assign the Virtual Machine Administrator Login role to the VM using the same process as shown in the Enabling user access section.

Important Note

It is recommended that you only assign users to the required VMs when assigning the Virtual Machine User Login role. For example, if you assign this role to a group at the subscription level, all users within the group would have local admin rights to all the VMs. This is not a recommended approach.

You can add the required user to the Virtual Machine Administrator Login role as shown in the following screenshot:

Figure 8.14 – Virtual Machine Administrator Login role assigned to the VM

Once you have added the required permissions, you should see the user account now logs in as an administrator:

Figure 8.15 – User logging in as an administrator

This brief section looked...

Summary

This chapter looked at the Azure AD join feature for Azure Virtual Desktop. First, we looked at the prerequisites, then we studied deploying an Azure AD-joined host pool, and we finished off the chapter by looking at applying the required permissions and setting the custom RDP property for access on devices that are not Azure AD-joined or hybrid domain-joined. In the next chapter, we will take a look at creating and managing Session Host images.

Questions

1. Which command would you use to check to see whether a session host is Azure AD-joined?
2. What is the minimum version of Windows 10 that you can use with Azure AD join?
3. After deploying an Azure AD-joined host pool, what are the two things you need to do regarding permissions?
4. What custom RDP property should you assign when using a macOS device with an Azure AD-joined host pool?

Answers

1. dsregcmd /status
2. Windows 10 Enterprise build 2004
3. Add the Azure AD group to the default desktop application group. Then, add the Virtual Machine User Login role for the Azure AD group within the host pool resource group.
4. targetisaddjoined:i:1