Azure Virtual Desktop is a desktop and app virtualization service that runs on Azure. Here are some of the key highlights

In our setup, we create a resource group, AD-RG, for deploying Active Directory VM and do the following

We also create a resource group, AVD-RG, for Azure Virtual Desktop

Post which we will be able to access the pooled session host and access the applications published using Remote Desktop Client from Microsoft.

Sizing of session hosts

Microsoft provides a general guideline on how to choose the right sizing depending on your workload.

Workload type

For example, if we have a medium usage (like browsing, using office apps, etc.) session host, we can choose the second row as our baseline.

Since we can have a maximum of 4 users per vCPU, effectively, it is 4*8 = 32 Users (since the Azure Instance has 8 vCPUs)

Session host virtual machine sizing guidelines for Azure Virtual Desktop and Remote Desktop Services | Microsoft Learn

Prerequisite and Assumptions

  1. Availability of a user account with Azure Global Admin and subscription owner-level credentials to deploy services in a respective subscription.
  2. Admin access to install and configure applications within AVD.
  3. Users have devices capable of running remote desktop clients.
  4. Microsoft 365 Subscription with a domain added, and the licenses eligible for Azure Virtual Desktop are purchased.
  5. Licensing Azure Virtual Desktop | Microsoft Learn

Azure Virtual Desktop Architecture

Azure virtual desktop architecture

Active Directory Domain Services Setup

Azure infrastructure setup

  1. Resource Group Creation
    1. Create an Azure resource group named ActiveDirectory-RG to organize and manage Active Directory VM resources.
    2. Create an Azure resource group named AVD-RG to organize and manage AVD session hosts.
  2. Virtual Network Design: Design a secure virtual network with subnets for Active Directory VM and AVD hosts. We will create a VNET peering between AD and AVD VNets

Active Directory (AD) deployment

Azure AD Connect setup

Azure virtual desktop configuration

Virtual network setup

Storage account creation

Connect the storage account with the active directory

Configure required permissions in the Azure portal and File Share permission

Create a session host


Review create

Enter the domain administrator UPN and Password. It will be used to join the session hosts to the Active Directory Server.

Connect to the session host via the AD server (using a private IP address) and use the File Share

Open Command Prompt as an Administrator and enter the following cmdlets

net use z: \\yourchoice.file.core.windows.net\avduserprofile N6Qeq3g4tp6G8BOKsIeTTMb8OrvGxIEwe6c0loGDcTofFeEVz09TgxqDdCRGdBpdHaUk111YSkVV+AStQFnyXw== /user:Azure\yourchoice
icacls z: /grant "yourdomain\AVDUsers:(M)"
icacls z: /grant "Creator Owner:(OI)(CI)(IO)(M)"
icacls z: /remove "Authenticated Users"
icacls z: /remove "Builtin\Users"

Open PowerShell as an Administrator to add FSLogix profile container permissions

$regPath = "HKLM:\SOFTWARE\FSLogix\profiles"
New-ItemProperty -Path $regPath -Name Enabled -PropertyType DWORD -Value 1 -Force
New-ItemProperty -Path $regPath -Name VHDLocations -PropertyType MultiString -Value \\yourchoice.file.core.windows.net\avduserprofile -Force

Reference: FSLogix Profile Container Configuration

Connect to the session host via the AD server and create a self-signed certificate

$cert = New-SelfSignedCertificate `
    -CertStoreLocation Cert:\LocalMachine\My `
    -DnsName "YOURDOMAIN" `
    -Type CodeSigningCert `
    -Subject "MSIXApps" `
    -notafter (Get-Date).AddYears(20) `
    -Verbose
$cert
$secPassword = ConvertTo-SecureString -String 'yourpassword' -Force -AsPlainText
$certPath = "Cert:\LocalMachine\My\$($Cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath 'C:\tools\MSIX-CodeSigning.pfx' -Password $secPassword

Upload the certificate to the Session Host

Local machine

File to import

Private key protection

Certificate store

Completing the certificate import wizard

Connect the session host to the Fileshare for accessing the application package

This can be validated by

  1. Downloading the PSExec
    1. https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  2. Next, open CMD as an administrator and type the following command:
    1. psexec.exe -s -i powershell.exe
  3. Once the new window appears, type this command:
  4. Test-path -path “\\yourchoice.file.core.windows.net\avduserprofile”
  5. It should return True
    Return true

We must also disable the automatic updates by

# Disable Microsoft Store automatic update
If (!(Test-Path "HKLM:\Software\Policies\Microsoft\WindowsStore")) {
    New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsStore" -Force
}
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsStore" -Name AutoDownload -PropertyType DWORD -Value 2 -Force
# Disable content delivery automatic download
If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager")) {
    New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Force
}
New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" -Name PreInstalledAppsEnabled -PropertyType DWORD -Value 0 -Force
# Disables content delivery automatic download
If (!(Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Debug")) {
    New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Debug" -Force
}
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Debug" -Name ContentDeliveryAllowedOverride -PropertyType DWORD -Value 2 -Force

Use the MSIX Packaging tool and MSIXMgr

Reference

Pre-requisite to install: Latest downloads for the Windows App SDK

MSIX Packaging Tool

MSIX to CIM convertor

Adding the Application from File Share to the Session Hosts

Below are the file paths added for various applications

Connecting to Session Host