- Welcome to Microsoft Mechanics.
To help you meet the needs of your remote workers,
I'm going to share with you recent updates that we've made
to our managed Windows Virtual Desktop service in Azure,
that gives you a more efficient, productive
and secure approach to desktop virtualization.
Now, we first will look at the new WVD Admin Portal,
now in public preview, and how we've expanded the service
around the globe as well as additional security capabilities
with service tags and more.
So Windows Virtual Desktop is a desktop
and app virtualization service running on Azure.
And if you're new to Windows Virtual Desktop,
check out our intro at aka.ms/WVDPlaylist.
Now to improve the admin experience,
we've taken many of the tasks that were previously available
across PowerShell and Azure Active Directory,
as well as in our host pool provisioning
resource manager templates
and we've brought all that
into a single unified portal in Azure.
Now this results in some notable improvements
to the admin experience for creating a host pool,
managing app groups,
role-based access controls,
and also monitoring the service.
Now we're going to start first
with creating a host pool of virtual machines.
Now this is the foundation
for creating a dedicated workspace
for your users to access published resources.
Now we'll do that first in the new WVD Admin Portal.
We'll select create a host pool.
That's going to give us a few options,
like the subscription and resource group,
and also our host pool name.
Now here is where we can select the location
for the host pools metadata to be stored
in order to meet your performance
and also data sovereignty needs.
And I'll walk through the rest of the steps here as well.
So we can select the host pool type,
personal or pooled
and the load balancing algorithm,
breadth or depth,
which I'll talk to in a moment.
Now we can also create the VMs themselves.
On the past we had to do this
in the Resource Manager templates.
Now we can do that right here.
So we can go ahead and select our resource group,
our region, this is where the VMs are running,
different for our metadata selection we made earlier.
The number of VMs that we want and the name prefix.
The image that we're going to select from,
in this case I'm going to use the virtual desktop's version,
which allows for multi-session,
and then we give a couple more details.
Also like the 80 domain join account
that we'll be using for automated domain join.
Now here I can select the workspace
that I want to assign to my host pool.
So here I'm going to drop down the list
of available workspaces.
I'll select the one I want,
0302WS,
then I'll click next.
And you can also see that we can apply tags.
Now this is important for identifying those VMs
as we log into them.
So to add a tag,
we can go ahead and add from the selection
of drop-downs here
and you can see I've added a couple of tags,
but I only need one tag in my case.
So I'll delete and just leave the one tag.
Once we've created all those different fields
and filled those in,
we'll go ahead and review and create
and look at the different fields and parameters
that we've entered in
and we can see everything that we've done there.
And finally, when we're ready to create that host pool,
we just hit review and create in the bottom left.
So once you've provisioned your VMs,
you can start building application groups
and assigning users to apps and desktops in this workspace.
Now application groups are a collection of apps,
or the entire desktop from a host pool,
that you can assign to users
and now even Azure Active Directory groups.
And by the way,
this was all only done via PowerShell until now.
So here I'm going to go click into an application group.
I'll select, in my case the accounting apps group
and once I do that you can see first the applications
that I've assigned to the group
and I've done this all through the GUI,
couple of apps there,
and the assignments,
I can also assign,
not only the user level as we can see here,
but I can also assign groups,
and in my case I've assigned the accountant's group.
So that's what you do for WVD apps and users,
but let's look at our admin roles.
So additionally related to identity management,
all of your role-based access controls
that were previously only in Azure Active Directory
can be managed here as well.
So to do that you go into a host pool
and if you click on the host pool name,
you can go into access control
and you'll be able to see all
of the roles that were assigned to this host pool.
So here you can see everything
from log analytics contributor,
monitoring contributor,
the owners and also the WVD session host administrator,
all assigned through ARVAC.
Further, we can also do more reporting
through log analytics.
So here, if I log into monitoring through log analytics,
I can see the health
of my entire Windows Virtual Desktop service
through log analytics using Azure Monitor.
Now another area we've been working on
is the foundation to scale out
your virtual machines using Azure automation.
Now you'll remember
that we can scale out using breadth mode
which optimizes performance per user
or depth mode which optimizes at a per-VM utilization level
and you can use a combination of both modes if you'd like.
Now before I get into the demo itself
just to set some context here,
the way to get this all running in your own tenant
is to use a PowerShell script
that we published at aka.ms/wWVDautoscaling.
That's going to inject everything
into your Azure automation account.
Let me show you what that does.
So here, first the logic apps.
So if I go into the Logic Apps that get injected in,
we can see within the logic app itself
if I go into the designer,
it's a simple logic app with two steps.
Here you can see that we have one step for the recurrence.
That's basically the pulling cycle.
In our case, we've got an interval of 15 minutes
and also the web hook that it runs
as part of that scaling exercise.
Well let's look and see what that actually runs as well.
So if we go into our Runbook for WVD automation,
we'll go ahead and look at the edited version
of the PowerShell script that's going to run.
So if I scroll down to about line 380 or so,
just to show a couple of things
that we can follow along with.
You'll see that we're going to look and see
that our start VM is meeting minimum requirements on top.
It's going to check that the number of VMs meet
that minimum or not
and if it then passes that gate,
it will look and see whether or not the host is healthy.
Then it can look at the number of connections
and start VMs until it's satisfied
with the number of VMs that are running in the service.
So that's how you can scale your environment
to meet user demands,
but Microsoft itself has been expanding
the WVD service globally
and has more instances at WVD across geographies.
Now this brings data sovereignty for WVD metadata
and will also reduce latency for your users.
Now we're going to continue building out
these locations over time.
But let's switch gears and talk about security.
Now the WVD architecture by design doesn't require you
to open any inbound ports to your VM network.
Only outbound port 443 needs to be open.
This what we call reverse connect.
We've now added a new capability called service tags,
and these are really name-value pairs
that allow you to categorize resources
that are part of a network security group.
Importantly, because IP addresses can change
with every session logon,
service tags give you that consistent and secure way
of letting permitted traffic through despite
those address changes.
That was a quick tour of the latest updates
to Windows Virtual Desktop.
To learn more,
you can check out the recent WVD virtual event
on demand at aka.ms/WVDVirtualEvent.
And of course,
keep watching Microsoft Mechanics for
the latest tech updates.
Thanks for watching.
(electronic music)