in greek mythology Kerberos also known as Cerberus was the three-headed dog that guarded
the gates of the underworld so why would an authentication protocol be named for a dog
i'm Dean Cefola and this is the azure academy azure active directory is a modern authentication
protocol it uses things like saml and oauth but a traditional active directory uses ntlm
and Kerberos now the Kerberos authentication protocol is named for that three-headed dog
because this protocol has three different components now when i open up a command prompt
here i can type in the command k list and i can see all of my Kerberos ticking and if we look
here at the very last ticket you'll see that my client is the user cyborg the application in this
case is a CIFS share which is a file server and at the bottom we see the kdc and that's
my domain controller so Kerberos is kind of old news right so why are we talking about this well
remember i said azure active directory uses these new identity services like oauth and saml well to
help all of us modernize and get past a lot of our old dependencies on Kerberos that tie us down to
traditional infrastructure azure active directory now has a new Kerberos service and because azure
active directory is a multi-tenant cloud identity service this is being implemented differently than
in your traditional domains now as of this recording the Kerberos realm in azure active
directory is in preview so things are going to improve as we go now to make this all work you're
going to need three different things just like the Kerberos process itself we'll need our virtual
machines to be azure ad joined and then we'll need to configure a few things on them we of course
need the service that we're going to access in this case that's going to be azure files and we're
going to use it for our FSLogix profiles in azure virtual desktop and then we'll need to configure
an azure active directory application which is going to function as our service principle so
azure ad can talk to our file share and complete the Kerberos authentication process now for your
user accounts during the preview they still need to be hybrid users meaning that they need to be
synced from your traditional active directory over to azure active directory using azure ad connect
so we're not at that 100 cloud only experience yet where we can just depend on the cloud services
but we're getting close to the end of that journey so stick with us and we'll get there before you
know it okay so the first thing that we need to get all this working is a storage account
that was easy now just make sure that this storage account is not currently using ad authentication
either to a traditional domain or azure ad domain services the two things are not compatible
with Kerberos at this time now that we have a storage account we need to create that azure ad
application so that azure id has something it knows how to talk to then we're gonna have to
set up all the right api permissions to make that communication work and thankfully that process
has already been scripted out for you here in the azure documentation what i've done here is copied
all of these different powershell blocks and put it into vs code and then i can just run the script
and once it's done successfully you should see at the bottom there that success password is set up
for whatever the name of your storage account is and if you go over to your storage accounts
and look at your file shares you see that you've got a banner here at the top that shows azure ad
Kerberos is set up so now for the api permission over in azure active directory on the left we
want to go to app registrations find your storage account open it and then we want to set your api
permission go ahead and click to add a new permission and then we want to select from the
Microsoft graph a delegated permission select open id and then you want to select that and the one
right under it click to add your permissions at the bottom and now we need to add one further
permission which is also under the Microsoft graph and that is the user dot read so just type
that into your search select it add it and then we have one final step we have to do to authenticate
and this step needs to be completed by someone with the global administrator permissions because
allowing the Kerberos realm into your azure active directory tenant impacts the tenant as a whole so
therefore it has to be done by a global admin so just click to add admin consent for your three
permissions and we're good to go so speaking of permissions we have to set the permissions on our
file share so all of our users can access it for the share level go back to your storage account
and then go to access control and then take a look at your role assignment notice that we
have granted already the virtual machine login rights for our admin and our standard AVD users
this is needed on any azure ad joined system so that people can log on to the machine we're
going to want to mirror those same permissions for our file share so click to add permissions
at the top and add a role assignment in the search box over there in the middle type smb
and then you want to select first here the elevated contributor role this is that admin level
role that can change ntfs permission click next and then in the middle of the screen you want to
click to choose a member and then from the picker here choose your virtual desktop administrator
select add at the bottom and then review and add the assignment now let's repeat and add a regular
users group add a role assignment type smb and this time we want the share contributor this will
give them the rights to do whatever they want on the file share but they can't change permissions
click next and select your members and choose your standard FSLogix or virtual desktop users group
add and then review and assign that role now you see at the bottom here i've got four different
roles the share contributor and the vm user logins match and then the admin login and the elevated
contributor match now there are two ways to set our directory level permissions the command line
way and the windows explorer way if you choose the command line way you would do that with ICACLS and
it would look something like this there's a whole bunch of commands and switches that you can do to
set the permissions exactly as you want but since this is a video we'll do the more visual way and
use the windows shell now to use the windows way at this point in the preview we actually have to
run another powershell command to give us that shell experience because it's not built in and
native just yet but it will be soon over in the azure docs you'll see this large block of code
which you'll copy and just put into powershell and you're going to need some specific powershell
modules on your system for this to work like active directory az.accounts az.storage and
azure ad now i've added above that powershell code that we pasted three different variables just to
make my life easy and that's for resource group name storage account name and domain name that
way you can edit those variables and just run this command on different shares or different
domains over and over now once you executed all of that code you can open your file explorer
and go to your new file share right click on the background and go to properties the security tab
and then the advanced button at the bottom now we have three specific permissions that we should be
setting at our directory level so our users can't impact each other this is found here in
the FSLogix documentation and i'll link to this in the video description back in our permissions we
need to change our creator owner role so it only has modify access and at subfolders and files only
then you can add a new permission and thanks to that powershell we just ran the picker shows our
domain as our location i'll type in the name of my users group which for me is WVDUsers
click the check name and it's all good and these folks are going to need to modify at this
folder only and finally the admin role who should have full control over this folder subfolders and
files click apply and you're good to go and the third part of our three-headed dog is to configure
our session host virtual machine and because this is a windows 11 multi-session system FSLogix has
already been installed for me so all i need to do is set up my FSLogix configuration in the registry
speaking of policies we do need a specific group policy to be enabled on our clients to allow
communication through Kerberos in the cloud now if you're using windows 11 this policy is
already on your systems but if you're using windows 10 then you must have the kb5007253
update and that's linked in the documentation when you have all that you should see this policy on
your client just enable that and then there's one last thing and that is a registry key you see when
you use azure active directory with a roaming profile solution like FSLogix the credential
keys are stored in your credential manager and they must belong to the profile that's currently
loading this is what lets your profile log on to many different vms instead of being limited to
just one now once you've completed all of that go ahead and log out of any active sessions in
virtual desktop and this will make sure that you have your latest azure ad primary refresh token
and when you log back in you'll see FSLogix is starting up and after that login is complete
go ahead and open a command prompt and type in the command k list and at the bottom you can
see a sift share and this is for our FSLogix user profiles and the user here is cyborg the server or
application is a storage account and the kdc is the new azure ad Kerberos realm
herberos.microsoftonline.com and if we check out the status of our machine with the command
d s r e g c m d space forward slash status we can see our system is azure ad joined only
this is not joined to a traditional domain at all everything is coming through azure active
directory and back in azure ad if you scroll down on the left there for your sign in logs
you can see for me that the third one down is cyborg logging onto a
storage account so click that and you can see the three different components of Kerberos our client
is cyborg the application is my storage account and the kdc token issuer is azure ad
and all of that is done using the Kerberos agent you see there at the bottom so we are really close
to the 100 cloud experience so be sure that you're subscribed and you've clicked the notification
bell so you don't miss anything in this series as we go all cloud which you can see right over there
so thanks for joining me for this video and i'll see you in the next one happy learning