(music)
- Today, I'll walk you through all the steps
to configure Azure Virtual Desktop
with the enterprise-grade configurations you'll want
in place for secure authentication, improved connectivity,
flexible user data, and service resiliency.
This is part three in our series on the service.
And if you're watching this,
we'll assume you've got a basic deployment
of Azure Virtual Desktop up and running already,
or general knowledge of the Azure Virtual Desktop service.
If not, I'd encourage you to check out
the first two episodes in the series
which introduce the service and walk you through basic setup
at aka.ms/AVDMechanicsSeries.
So, let's start with your options for secure authentication.
First, you can use on-prem directory services,
with Azure Virtual Desktop, in environments
with hybrid Azure Active Directory joined hosts.
Alternatively, you can use
Azure Active Directory joined hosts
if your directory is running entirely in the cloud.
Now, these options are configured
when you set up new host pools in Azure Virtual Desktop.
In either configuration, you can achieve Single Sign On
and passwordless authentication to the host
using the new Azure AD authentication for remote desktop.
This means that, by simply signing into your device,
you'll already have the required authentication established.
So, I'll open Start, and connect
to my Azure Virtual Desktop host.
Now, if you've tried this before, notice here
that I'm not prompted for a second sign-in,
and it seamlessly establishes the connection
to my remote desktop.
Now, for this next part, while I'm in the session,
if I need to connect to an app or service
that requires multifactor authentication,
Azure Virtual Desktop enables that
using the new Web Authentication or WebAuthn redirection.
So, I'll open a site to test this, WebAuthen.io.
And just to prove that the command is sent
to my local computer, I'll make the window
to my remote desktop smaller - there we go,
and now I'll be able to overlap the authentication popup.
So, I'll hit Authenticate on the site,
and you'll see this even allows you
to use passwordless authentication to access apps and sites.
And this is the reason I resized the remote desktop window,
because this pop-up could look
like it's in the remote host, but it's not.
And as I drag it to the right,
you'll see the window is from my local device.
Now, in this case, I'll enter my local device pin,
and then I'll use the FIDO key,
I've enrolled with my fingerprint.
And in a few seconds, I'm securely logged
into the site with the authentication strength required
by my organization.
Now, beyond authentication,
reliable and efficient connectivity to the service
is important to ensure
the user experience is highly responsive with low latency,
so the remote desktop or app feels local.
Now, for that, we recommend RDP Shortpath.
And let me explain why.
Normally, when you access VMs in Azure over RDP,
the connection goes through a gateway.
RDP Shortpath uses the more reliable UDP protocol.
This establishes a direct network connection
between the client device and the destination VM host
in Azure, bypassing the gateway.
RDP Shortpath is the connection type
used by Azure Virtual Desktop, and this is by default.
Now, something really important to point out here
is that you need your devices to allow UDP connections,
so don't block them.
Equally, your network and firewalls
should also allow UDP connections
and should permit traffic from STUN servers
or can use TURN traffic.
We've got more details on this at aka.ms/AVDconnectivity.
Now, with your authentication and connectivity options
sorted, let's move on to another core aspect
commonly deployed with enterprise configurations,
which is connecting users to their profile data seamlessly,
using FSLogix profile containers.
Here, user profiles are stored in Azure
as virtual hard disc files,
and then are mounted when a user signs in
and unmounted when they sign out.
So, let me walk you through how you'll set up FSLogix
profiles to get everything working.
Now, for detailed step by step guidance,
check out aka.ms/FSLogix,
but I'm going to walk you through the high level steps.
First, FSLogix profiles use SMB file shares
to store profile containers
with the appropriate permissions configured
For Azure Virtual Desktop, you can use either Azure files
or Azure NetApp files.
And using either option, these services
need to be configured to work
with the same active directory domain service's
authentication, which can be run on premises
or in Azure, used by your host VMs.
Additionally, Azure files
can also use Azure Active Directory Kerberos authentication
for hybrid identities for Azure AD joined hosts.
The FSLogix app needs to be installed
or present in the host image.
And to configure FSLogix,
you'll need to add a few registry settings
in HKEY_LOCAL_MACHINE for FSLogix profiles
to enable it, set its behavior, size in megabytes,
location in the file share, and volume type.
Now, this can be done using scripts, group policy,
or using Microsoft Intune,
and we have configuration service provider
support coming soon.
Now, cloud cache is an optional configuration
which is used to mitigate short-term
or intermittent connectivity problems
with the remote storage providers.
So, here, you'll add registry settings
in the same location for CCD locations,
along with recommended settings for clear-cache-on-logoff
and healthy providers required for register.
In this case, you're replacing
the VHD location settings path with the CCD locations,
which supports both SMB and Azure Page Blog paths,
allowing updates to both.
Now, as you configure FSLogix profile containers,
our recommendation is to keep your settings
as simple as possible to avoid complexity
and operational overhead.
Now, another important topic we're managing
in an enterprise grade desktop virtualization service
is resiliency, to ensure users can access
fully functional desktops and apps,
even in cases when a zone is unavailable.
Now, you can use the same Azure availability zone options
for your session hosts as you would
for your business-critical VMs
in Azure Virtual Desktop host pools.
For cases where you can't risk users losing access
to pooled session host VMs,
you can use Azure Availability Zones
combined with a calculated over-provisioning strategy
for resilience.
So, for example, if you are using three availability zones
with host VMs equally distributed across them,
normally, you'd have a few host VMs in reserve.
So, by adding an over-provisioning strategy,
you would intentionally add to the total number
of host VMs by a third or more.
Then, in the event that one zone's unavailable,
users can be redirected to available host VMs
in the remaining two zones.
And this is also an advantage
of using stateless shared host VMs
over personal dedicated host VMs.
The high levels of resilience for personal hosts
are also configurable using Azure Site Recovery,
where you can have a replica
for selected host VMs in a separate data center.
Then, in the event of an outage,
you can failover to the replica host VM.
Now, beyond the session host VMs,
this is also important when configuring
your FSLogix containers in the service.
So, here, you'll want to configure Zone Redundant Storage
so that FSLogix user profile containers can be reached
if a zone is unavailable.
Now, as you provision storage in Azure files,
you'll select the zone-redundant storage option
so that replica profile containers
stay in sync across zones.
And you can learn more
about your available configuration options
at aka.ms/FSLogixHA.
Azure Virtual Desktop offers significant flexibility
and control to set up your environment
based on your organization's needs.
For instance, if your organization
or a subset of your users require
highly secure virtual desktops,
you can use Confidential Computing VMs in Azure,
which uses a trusted execution environment
to extend encryption protections
to your sensitive data while it's in use.
And this also ensures that no one
outside of your trust boundary,
not even Microsoft datacenter personnel,
can access any information stored or running in these VMs.
Now, in order to use Confidential Compute
when provisioning your host pools
in Azure Virtual Desktop, for the security type,
you'll choose confidential virtual machines
with secure boot enabled.
And for the virtual machine size,
you'll select DC or EDC series virtual machines
with AMD Secure Encrypted Virtualization support.
So, with that, I've highlighted
a few of the most common and recommended
configuration options for an enterprise deployment
to help provide a secure low latency, flexible,
and resilient experience with Azure Virtual Desktop.
And again, this is the third in our series on Mechanics
for Azure Virtual Desktop.
So, check out the complete playlist
at aka.ms/AVDMechanicsSeries.
Be sure to subscribe to our channel
for future updates, and thanks for watching.
(brief music)