[Music]
Coming up we are going to take a first look at updates to Remote Desktop
Services now with deeper cloud integration from endpoints and
authentication through to back-end infrastructure we're going to show you
new service architecture options that will help improve security and
authentication we're going to show you simplified setup and management that's
going to leverage app services and a very transformative app delivery and
user experiences and I'm joined by Scott Manchester from the RDS team Scott
welcome to Microsoft Mechanics Live thanks for having me back Simon thanks
to all you for showing up we got standing-room-only out here it's nice to
get around oh cool yeah last time you're on the show you
showed us some pretty awesome graphics improvements what are you and
the team been working on since then and since doing all that scale work for you
did as well yeah Simon we have not been sitting back on our heels here we've
been very busy since the last time we're out here we've continued our focus on
cloud optimizations we've expanded our app and desktop delivery options and
we've hardened our security posture how cool security is one of the main reasons
that people who using Remote Desktop Services yeah that's right and now it
gets even better with our latest generation of remote desktop services we
can now take advantage of modern authentication with Azure Active
Directory Integration and this gives you advantages like
conditional access policies, multi-factor authentication and integration with
other SaaS apps like Office or Workday and obviously if anybody is using Office
365 they already have Azure Active Directory setup yeah that's right if
you've already got an an Active Directory setup you can leverage that
with this new RDS modern infrastructure and also we can take inputs from the
intelligent security graph so if let's say you're connecting up to a deployment
you have a non-enrolled device we can dynamically assign conditional access
policies so now let me tell you about how the modern infrastructure changes
things if we take a look at a traditional RDS infrastructure rules
each role each server role would be joined to the domain and these
components would need to be on the same network as your application and desktop
host your session hosts and VDI instances and here because your RD web
and RD gateway role are both domain joined and public
facing they're vulnerable to attack now with the modern infrastructure roles we
can isolate the infrastructure components from the application and
desktop hosts in the internet internet facing roles like RD web and RD gateway
are no longer joined to the domain and because of this we can now support
multi-tenant deployments and notice also in my infrastructure there's no more RDVH
role we brought the VDI management capabilities directly into our
connection broker but we've also added a new role you'll notice there's a
diagnostic role we can now leverage this new diagnostic role to troubleshoot
end-to-end connectivity problems and finally the application and desktop host
no longer require inbound ports so we now establish an outbound port on port
443 to maintain that connectivity between the clients and the endpoints
and if I'm hearing all of that right that actually means that those
architectural changes are gonna give you a ton more capabilities for running this
infrastructure outside of your own on-premises network yeah that's right
absolutely our hosters are really going to love this because now I can
support these multi tenant deployments and they're really gonna love it when I
can deploy this up into Azure let's talk about the clients yeah let's talk about
the clients first then I'll tell you guys about all the azure value problem
so I mentioned in the intro that we're continuing to vest in a remote desktop
clients so we're adding new capabilities and functionality to all of our clients
iOS Android Mac and Windows we're also introducing our new html5 client
now this HTML5 client will work with your traditional RDS 2016 roles but it
will also work with our new RDMI or remote desktop modern infrastructure
roles it's actually built-in we also support the new Windows 10 s edition now
while we're talking about the clients also want to mention that we're going to
be bringing in this Azure Active Directory Integration to all of these
clients as well and we'll show you a demo of that in a minute
okay that's got a little bit out so obviously we've got all these kind of
amazing things that we've been working on with clouds go can you show us a
little bit around what it is that you've actually been been building here sounds
great yeah absolutely let's uh let's take a look at that so first off let me
show you a security demo so what I have set up here is I have a remote desktop
client that's been enlightened with our Azure Active Directory support so I'm
right at the point in time where this would be a one-time process a user would
go through to add the subscription to this client so I've got applications and
desktops that my IT admin have set up and I'm about ready to add this user to
that deployment so I've put in the URL I'm gonna hit subscribe here now just
like in a normal deployment I can provide my username and password so I'll
just provide that
right
I keep forgetting that I'm so glad that I have people in the audience that know
I'm going to hear all right so user name and password or provided
here but because my IT admin was savvy they'd not only set up single factor
authentication but they also set up multi factor on things should I click
the button here so I had a choice of what multi-factor authentication and
you'll see now that it'll populate the list of applications that I have here so
very cool there it is multi-factor authentication to get
access to my Remote Desktop deployment think of the possibilities now how you
can further secure your remote desktop environments by using these capabilities
so lots of new innovation there that's pretty cool but what was actually
happening behind the scenes there what was going on as all of that
authentication was doing because maybe these folks don't really know let's walk
through that process a little bit so you guys understand how this actually works
so in our deployment here in this example it's in steady state I've
deployed the infrastructure up into Azure and my application and desktop
hosts can live in a separate network and you can see that we also have set up our
aad so we can support that secure authentication and in steady state all
of my application desktop hosts maintain an active connection into the deployment
so we can ascertain the resource availability so let's go through a
typical connection sequence so let's say a user on our client wants to get access
to a line of business application that my IT admin has set up for me so before
the user gets access to that list of apps you saw that process that I must
provide my credentials once I've established my my a Tall authentication
I can provide that that token to my Rd web client I get the list of
applications from there the user can then select a specific application that
they want to launch once they get that once they've selected the application
they want to launch so here you can see in the diagram that they they go through
the ADOL
Auth they get that list of apps they click the one that they they want
to execute well then take that a tall token that we
get and we'll present it into the infrastructure will validate that it's
that it's active and then we'll convert that token to a certificate and this is
the critical component because this allows me to have single sign-on
experience all the way into my application and desktop hosts and once
I've provided that connectivity that inbound connection then we'll be routed
through the Gateway to my endpoint and now the user can launch the application
so through simple setup on your part you can now support a single sign-on
experience plus all the value-add of a ad and the capabilities you have to
enable multi-factor authentication there or other conditional access policies so
in this configuration of the application and desktop host domain joyed yeah so
nothing really changes and the way you set up your session host servers and
your VDI instances they're still domain joint as they were before but now you
don't have to have that open inbound port on three on port 3389
and I'm sure your your CTOs will be glad that you don't have to you know go
beg to open that firewall port anymore we use that outbound four four three
connection now to enable that that communication to flow so that's the
security side of things that we said we're going to cover covered what about
the implement infrastructure that you've built on Azure yeah so back to that so
we mentioned that hosters are really going to love this because you have the
ability now to deploy all of these infrastructure roles into Azure as PA's
roles so I actually had that on my desktop here if we can bring that up so
this is actually my personal subscription into Azure and what I have
pin to the dashboard here is a resource group which is our new remote desktop
modern infrastructure so let me drill into this a little bit and what I'm
gonna do is I'm gonna sort by type because I want you to notice something
here I want you to notice what's here but also what's not here so this is a
full remote desktop modern infrastructure deployment into Azure and
there's not a single VM in it everything here is running as Azure pass
so if I go down the list let's take a look at what we have so here's our new
Diagnostics roll here's the broker the gateway the RD web all of them running
as an azure app service I've got the policies around those app services
I've got a key vault and this is where I store all the certificates from my
deployment and then I've got a sequel database that's running as an Azure PaaS
service and as you know the database maintains the state of my deployment
which users are assigned to which applications and also what the current
state like who's assigned on which VM now the cool thing is that all of these
infrastructure rules are now stateless and this gives me the ability now to
have that scalability we talked about right so I want to drill in and show you
example of how scalability works now that these things are running is PaaS
roles PaaS roles so I'm gonna drill into our gateway so I'm guessing that this is
gonna let you automatically expand and contract maybe the size of you
deployment you're stealing my thunder Simon that's exactly right so let's
drill into this here and I'm gonna scroll down here into this list I'm
gonna find the scale out policies here so now that this is deployed as a as a
path service in Azure I can set some very simple policies that allow this
thing to scale in and scale out to conserve my cost because I don't want to
stand up you know the size of the infrastructure I need for the maximum
time I want this thing to dynamically adjust as my workloads go up and down
some of you guys have probably written some really complex PowerShell scripts
and have done some complex things to try to support this I'm gonna make this so
easy for you guys so you guys are gonna have to go find something else to do in
that time that you were spending doing that in the past so I said two policies
here so the first policy here is basically stating when my gateway role
exceeds 70% CPU utilization add another instance and then after that
stabilized and the workloads expand across that if I also if that ever goes
beyond 70% install another one and I've said a min and max parameters
on this so it minimizes one instance in Max is 5 but I could change those things
as well so very simply I've just set these simple parameters and when my
Gateway gets you know burdened with buttmunch users logging in it just
simply adds another instance now what I've done also is I've set the scale in
policy so that was my scale out my scale in policy says however many instances I
have of that app service running when the average workload across all of them
gets below 30% remove one and then it stabilizes and if it's still
below 30 you can remove another so what happens now
you know 2:00am in the morning everybody's done working the system will stabilize
down to a single instance of these roles Monday morning 9 o'clock everybody is
logging in as that log in storm happens we simply just install more instances of
the Gateway and the broker and web role and then as that stabilizes it just
shrinks back down and this gives you the most opt
we'll cost model now for your deployment and this becomes so simple for you now
to manage and maintain you set these parameters once and you're done the
system will simply take care of itself and because they're all running is as
your path services you're not patching these VMs anymore either just simply
just runs on its own from this point forward it's pretty incredible you've
taken all of the cool stuff that we can do in the cloud about removing the
patching making things much easier and simpler to run and scale all by moving
from I as instances over to pass instances that's the kind of thing
that's really going to change the way that people are able to use remote
desktop services that's right that really leverages the power of the cloud
and the power of the web as well so with that maybe there's to be a good time to
show one of the new innovations we've done as well so I mentioned that we've
been making investments in the road desktop clients what I'd like to show
you now is our new HTML5 experience so what I have here is any it could be any
HTML5 browser running on any device and I'm accessing remote desktop 2016
deployment that I have in my Azure service so I've installed this client
now know if you've already got a 2016 deployment there was a patch that was
released a number of months ago to your gateway that enables this capability and
will provide these bits that allow you now to host an HTML5 client experience
in your deployment we'll make those available to you early next year so I've
got this set up now I've got a handful of apps that I've made available through
this this feed and I could have also enabled if this was an RDMI deployment
our next generation I could have enabled multi-factor authentication through this
HTML5 client as well so here's all the apps that I've made available even a
full desktop but I want to show you a little bit of what the experience is I
just navigate around so I even got things like be able to pin the apps to
the sides it works pretty well now you can see we're running in a pretty low
resolution here and I'm taking up a lot of the Chrome or a lot of the work space
with the chrome of the desktop and such so let me do this let me go into
full-screen mode and I can even I can even hide this little app bar here by
just hitting this little up arrow and now I get the full you know desktop
experience running inside of a browser and if you just walked up to this
machine you'd probably be hard-pressed even though this is actually just
running in a browser now imagine the scenarios where this could be useful for
you imagine if you had a kiosk type situation and you had a lot of workers
rotating through accessing that kiosk they can simply login to the browser
here provide their credentials and then had this great remoting experience
another scenario Simon I were talking about if I Simon I went on a vacation
somewhere and I forgot my laptop I could just grab his machine open up his
browser and get access to a line of business app so if there was some work I
needed to get done log into the browser get that work done
real quick and in my session so very cool and in terms of deployment
obviously there's no work on your side now if you have seasonal workers people
that you know you spend a lot of time getting them all set up only to have
them leave a couple months later really great solution there for seasonal
workers since there's really no setup no touch points for you guys thank you
definitely some people in the real native they work through that before oh
yeah that's that's a big thing for anybody this morning audience is a it is
a very impactful thing you have made some amazing changes that that
phenomenal html5 client just really works well I think we're about done and
we need to start thinking about wrapping up and you and I need to go and plan
that vacation that's right is there anything that these folks need to know
so that they can maybe get involved and learn a little bit more yeah absolutely
I'm sure you guys are excited to get your hands on this I can tell by the the
audience here there's a lot of interest in this space so we want to make this
available to you guys as soon as possible we want you guys to start
building out your own dev environments start experimenting with this and
playing with this and giving us feedback so we're gonna make all of these both
the remote desktop modern infrastructure roles and the HTML5 client available
through the windows insider program for business so if you guys haven't already
signed up for the WIB or Windows Insider for Business program please do
that we'll make these things available sometime early next year we'll make all
of this accessible to you guys cool ok that is about all we have time for on
Microsoft Mechanics life thank you all very much for being in here in person
and thank you very much for watching we will see you next time
[Music]