in this video I'm deploying a Windows a virtual desktop host pool using a
service principle
hello my name is Travis and this is Ciraltos in my last
video I walked through deploying a Windows virtual desktop host pool using
a username as the owner in this video I'm gonna deploy a host pool using a
service principle instead of a user account to authenticate to Windows
virtual desktop but first if you find these videos helpful please take a
second to subscribe also click the bell icon to get notifications of new content
what is a service principle to answer that first to understand that Azure ad
separates authentication and authorization separating these functions
makes it possible to use native Azure ad accounts or an account synchronized
from Windows ad or even an external account like Gmail all to access the
same resources in Azure ad an application and Azure should not be
confused with what you may typically think of as an application an Azure
application object is the representation of an application registration in Azure AD
it provides authentication for the application just like users have objects
and AD so do applications that need access to Azure resources an Azure
service principle provides authorization it defines the access policy for users
and applications users and applications have service principles that define
access an application registration is a combination of azure AD application
objects and the service principle providing both authentication and
authorization in this video I set up a service principle by creating the
application and azure ad this is a non interactive account used with the
Windows virtual desktop service this way the account is restricted to only the
service it needs access to and won't use a fully privileged user ID let's cover
the reasons why to use a service principle first user account should use
MFA especially any accounts with elevated privileges but the account that
authenticates to Windows virtual desktop services cannot use MFA there's also a
simpler reason not to use a user account what if the user leaves widow
virtual desktop is a pass offering that means it's a multi-tenant service this
is the account used to authenticate the host pool to the Windows virtual desktop
service that could lead to all sorts of problems if the account is disabled or
removed a user account set up like a service account could be used but that's
more access than needed for Windows virtual desktop service principles
provide only the access needed to proceed you will need a Windows virtual
desktop tenant set up along with the RDS and Azure PowerShell modules installed
if you don't have that set take a look at the video to get set up the task in
this demo artist set up the application registration in PowerShell walkthrough
the host pool deployment with the service principle and lastly test the
connectivity so with that let's get started
buckle up everyone it's demo time so in this demo we are going to create a
service principle to use for Windows virtual desktop there are actually two
types of service principles a password based and a certificate based we're
gonna use the password based so the first thing I'm going to do is run these
commands and I'll make all these commands available probably on my blog
I'll put a link to it in YouTube as well I'm not going to type these for some
reason the more I type the worse I get at it I'm gonna start by going over the
modules needed I already mentioned that we need the Microsoft Rd infra Rd
PowerShell module and I set that up in my last video but you also need the
azure ad module now in my I think in my slide I might have put that you needed
the AZ or Azure RM that doesn't hurt but really what I think I meant was you need
the azure ad and make sure it's an updated version I was trying to do this
with a outdated version and one of the commands wouldn't work I'm just gonna
get the module to make sure we have them
okay so it seems like I'm missing a couple here so let's just try to import
them and see if they're available
okay it looks like on this computer I don't have the azure AD module so let
me just install that quick here all I'm doing is opening up a new power shell
window running as administrator and I'll install that module that's finished
let's go over and run this again now if I do a get-module I should see those two
modules the Rd PowerShell module and the azure ad there they are
great now that all the prerequisites are met I'm gonna create an azure ad context
and assign it to a variable I'll just run this command that's going to give me
a login prompt so I'm gonna log in now and I'm gonna login with an onMicrosoft
account so a native cloud account as I mentioned in one of my other videos I
normally use an external gmail account to administer my subscription but in
this case I need either an account replicated from Active Directory or a
native cloud account the next step is going to create the service principle
it's actually a command new Azure ad application it's technically the azure
ad application registration of the service principle I'm gonna give it the
name of Windows virtual desktop service principle so I've got that highlighted
and I'll hit f8 you can also right-click and code and do run selection that
command just created the service principle and application registration
in Azure ad let's hop over and take a look at it Here I am in Azure ad and if
I go to application registrations and down at the bottom is my Windows virtual
desktop service principle so that has been created earlier I mentioned that
there's two ways to create a service principle either password based or
certificate based and that we're doing a password based service principle this is
the step that will create that password it's going to create the password and
then assign it to the service principle creds variable next I'm going to run
three commands and they're going to output some
information the first is the application ID so this is my application ID for the
service principle the next one is the service principle creds value so this is
the actual password so there's the password and next is the Tennant ID so
there it is those are the three pieces of information we need to deploy Windows
virtual desktop with the service principle but we're not done yet we
still need to assign the service principle rights into our Windows
virtual desktop tenant so the first thing I'm going to do is connect to the
Windows virtual desktop tenant running that command will give me a login prompt
these login prompts are popping up behind windows it's kind of annoying but
I've gotten used to trying to find the blinking icon in the taskbar I'm gonna
use the same native Azure account I used before to sign into RDS and next I'll
just get my RDS tenant to make sure everything looks good there it is I'm
going to assign the tenant name value to my tenant name next we'll create the new
role assignment defining it as RDS owner for the application ID of the service
principle we just set up and the tenant name we just logged into that's it we've
assigned the correct permission the next step isn't a requirement this is just
verifying that we can sign into Windows Remote Desktop with the service
principle credentials we just set up this step is going to create a PS
credential object and assign it to a variable using the service principle
that we just set up and the next we'll log in with that account from here I can
run commands against my Windows virtual desktop deployment there it is so that's
working as expected at this point we've set up the service principle and we've
given it the permissions it needs to be able to deploy a host pool so let's go
over and deploy a host pool and this is going to be just like before only with a
couple different names I'm not sure why they're showing to here but it doesn't
seem to matter which one you select I'm going to crate I'll start with my
subscription that is pay-as-you-go next is resource
group I've got one that's already set up here host pool 2rg you could also create
a new one if you needed to I'm gonna deploy this to central US
I'm gonna call this host pool too I'll leave it as pooled and add the user
who's going to connect click Next I'm going to change it to light 15 and
change that size down to something a little more economical and give it a
prefix of let's call it temp HP to
virtual machine settings all this is pretty much what I did in my last video
I'm going to specify an account here that has rights to add these virtual
machines into the domain I will specify an OU and a domain under configure
virtual networks I'm going to select an existing network and a subnet and
remember that if you leave it as create new this will not work next I'll specify
my tenant name and here's the difference between my last video I'm going to
switch this to service principle and if you remember earlier in this video I
said that there's three pieces of information you're going to need this is
where you need it so let me just pull that up so here we're gonna need the app
ID for the service principle and that's the app ID property so all I have to do
is run this that will give me the app ID the next is a password which is going to
be the dot value property of the service principle credentials and I just happen
to have all these values all these variables still loaded from the session
earlier in the video last is the tenant ID GUID there it is
so I'm going to copy this first one I'll hop back to the portal paste that in
then I'll copy the password and the last is the tenant ID that's all we need to
set up the service principle let's review and create and hopefully this
will review okay alright validation passed and I'll click create
I'll pause here will this crates and come back in a minute I'm back in the
host pool has been provisioned so this is host pool too let's see if I can
login I'm just gonna open up an incognito window and I'll go to the web
client that's Rd web wvd Microsoft comm slash web client I'm here I'm gonna sign
in as the user who I set up with access
here we are the user has access to to host pools host pool one is the host
pool I set up in the previous video host pool two is the one I set up just now
I'll allow access I'll sign in finally Here I am at the desktop that's it for
the demo in this demo I set up the service principle gave it the roll
assignments for a Windows virtual desktop and then deployed a host pool
with the service principle that's it for the demo I hope you found this useful in
understanding what a service principle is and how to use it with Windows
virtual desktop if you enjoyed these videos please don't forget to hit
subscribe and click the bell icon to get notifications of new content thanks for
watching
you