the question comes up very often when i speak with customers about
how do we secure wbd to make sure that we're thinking about this holistically
we need to cover five major areas first is to understand the virtual desktop
service itself and what it requires and how we can secure that
second is going to bring us to the area of network security
and those two topics are very closely related the next area to think about is
identity security how do we control the fact that we've got a service
that's globally accessible from any device anywhere
but still secure it when our users go to login that those identities have not
been compromised another area to think about
is the security of our virtual machines in the cloud
these would be the session hosts in wvd how do we protect those and monitor them
appropriately and lastly is the area of client device
security because we can be using wvd from any device you can have somebody
accessing virtual desktop from their personal mac
device anywhere down to a computer at the local library so we
want to help you through all of these processes so that you can run wvd
as secure as you need to in your environment so for the next few minutes
we're going to dig into the service itself as well as network
security as we kick off this micro series of
securing windows virtual desktop
i'm Dean Cefola and this is the azure academy with the new spring
update now in public preview the docs have also been updated
so i want to take a look at those quickly as we get started today
and from the main page of the azure docs we'll scroll down and open windows
virtual desktop and now you can see the docs have been
divided into the fall and the spring release the spring release of course
being the new arm management interface and i have received
a lot of questions on our overview video of the spring
release so if you didn't check out that video
go click on it up here at the top because we will be working with that
today but as i was saying i've received a lot of questions around
migration how do i get from the fall release into the spring release
or something like i can't see my my current virtual desktop resources in the
new portal what's going on know that this is a top
priority for the virtual desktop product team and we will be hearing more about
this soon so just stay tuned and i would suggest for all of you who
are still using the fall release that you use this opportunity using and
learning the new portal so that when those migration tools are
in place that you'd be able to move over quickly
and that you would have little to no interruption of the service you're
providing for your end users now with that said we're going to go
back to the link of what is virtual desktop and if we scroll down a little
bit we'll see the table that addresses all of the networking requirements
around the wvd service so whatever it is that we do to secure our
network all of these things still need to be accessible now looking
over at the right side we've got a column here for service tags
now service tags in azure relate to our network security groups and basically
they're a collection of ips and ip ranges related to a
specific service so if you're using third-party tools
other than what i'm going to show today that's perfectly fine but when you
do you need to make sure that you can hit
all of these url wildcards from any one of those other toolsets so that you can
still access wbd now what happens if your security
department requires you to have specific ip addresses or not use
wildcard urls first of all this is not recommended
in wvd and here's why the wvd service is highly resilient
scalable and also self-healing so if something goes wrong in the wbd
service in the region that you're in the service will fail
over into another region or another url now it's always great to point out what
other people do in the community to help everyone learn
more about azure so say hi everyone to ralph zomerman
he's a cloud solution architect at microsoft and he's written a blog which
you can find at blog.azureinfra.com
and he's got a lot of stuff across many topics one of them being windows virtual
desktop and firewalls he covers the process here for
how to build the firewall and use it to secure
the urls that we were just looking at as well as an updated
note that the azure firewall now supports fqdn
tags so a lot of these items that were initially here have been scratched off
the list and we'll cover more about what this means in a moment but if you scroll
down just a little bit more you get down to this section about being
more restrictive now let me flip over to one of my vms
and in the windows event viewer we've opened the application
log and you will find in here a event id 3701 source is the wbd
agent and this shows the particular urls for wvd
that you are in communication with so if there is some kind of
issue in the current region then the system would automatically
fail over through dns rerouting to another region you may get another
url and if you are only specifically whitelisting
these urls directly then when something happens that new url
may not be white listed for you and you would experience an outage though it is
highly recommended that you only use the wild cards and then finally he covers a
section down here how to set up your own proxy in case that's a method that you
want to implement as well as some required ports here for your active
directory connections so a great blog to go and check out not only on this topic
but many others back in the main page of the
azure docs we'll scroll down to our networking section
we'll also quickly look at the azure firewall and we have covered the
firewall a few times as well you can go check out one of our videos
up here to learn more about deploying the azure firewall under the
concepts section we've got our fqdn tags now these are
application rule related tags and we've got a table here with all the current
fqdn tags one of which is now windows virtual desktop this is a
newly released feature allowing virtual desktop to be protected
through the azure firewall and there is a specific link here
for how we're going to go about this we'll scroll down a little bit and
here's the basic graphic of how this is going to work so
the firewall is going to act as a security hub
which means that you can control traffic flow to your on-prem
network as well as other things in your azure virtual network and things that
face the internet like wbd but when our clients connect
to the wvd service they're out there somewhere in the world
and that could be on your internal network or on the public internet
they're going to communicate with the wvd
service they need to then pass through the firewall in order to be able to get
to your internal resources like your domain
controllers or your file shares for your fslogix
profiles and we need to secure that flow from beginning to end the
firewall will also allow us to do some monitoring tracking and threat
analytics based on how you configure it okay enough theory
let's get to work first thing we're gonna do to kick it off today is look at
a resource group that i already have for
my network and we've got several items here
first we'll go into our virtual network and
notice first of all that my dns servers in this network have been set up to use
custom dns pointing at my private ip for my domain controller under the
subnet section i've got a subnet for the azure firewall
as well as a subnet for our wvd session hosts
back in the resource group let's dive into the network security group
and this currently just has a default configuration and we need to set this up
for virtual desktop let's go on the left here to our outbound security rules and
then we'll go to add a new rule source is going to be our virtual
network the source port range we're going to leave as
star then our destination is going to be set to use a service tag
and there are a long list of service tags here some of them are
just related to a service while others are specific
to a service in a region and we can use this filter box here to find what we're
looking for so i just type in desktop and then we can select windows virtual
desktop and we want to configure our destination
port as 443 using the tcp protocol for our
priorities i'm going to make this priority 1000
just in case i need to add other rules to be more restrictive later
on and the naming convention i use is if this is allow or deny then
what the service is and what the direction is
so allow wvd outbound and in my description i've just put that the
intention of this is to be able to get to the wbd
url wildcards so we'll hit add all right and we're going to add two more
and we use the same basic pattern virtual network from any port going to
the service tag of azure cloud on port 443 pcp allowed
with a priority of 1010 the name is allow azure cloud outbound and for
this one i've just put the url that we're getting all this from
as my description because there is a limit of 140 characters so i can't list
every url specifically we'll hit add for that two down one to
go this is going to be slightly different than the other two rules
because our destination is going to be an
ip address rather than a service tag and this ip address is the documented
public ip of the kms service for azure and it's
going to use port 1688 and in my description i've given it
kms.cor.windows.net which is the url that that ip address resolves to we'll
click add now that we've completed the virtual desktop settings in the nsg i've
also added a setting to allow the inbound and
outbound traffic to my domain controller subnets
and other private domain services so in the new virtual desktop
admin portal we're going to go into my existing host pool
and this host pool does not yet have any session hosts in it so we'll go to
generate a registration token and i'll just make that valid through
the end of the month now we'll go to session hosts here on the left
and then go to add at the top and build ourselves a session host
and all this information is hard coded because we're building into an existing
host pool we'll hit next and because this is the first
virtual machine that we're building we have some more choices
first at the top i'm going to change the resource group that i'm building this in
i have a special one here for my host pool vms this is in the east us
and i'll change my size to my b2ms favorite i'll just be building one vm
right now and i've got a prefix in here of wvd05
since it's the month of may and we'll hit the drop down here
for the image type and there is only the choice for a
gallery or storage blob and the storage blob would be where you have a vhd file
sitting in a storage account and so if you choose that option then
you provide the uri to get to that storage account so
then the question came up of well how do i use my custom
images so for that you go to gallery which by
default gives you the choice of three images your custom images can be
found under clicking browse for all images and
disks then you've got the choice of any image
that's in the marketplace of course wbd only supports windows images and for the
specifics you can go see the documentation but at the top here we
have my items and this is where your azure
custom images would be located or anything from the shared image gallery
scrolling down i've got my virtual network selected
here no public ip address required and i'm setting the network security group
to none because it's already attached to my
subnet and with my domain information entered i'll hit next and
put in my tags and the tags help us to know who's
paying for this what application this is related to
and what the environment is and of course you can add many more
and we'll hit next here and then you can review this process and hit
create and it looks like everything built successfully let's try to log
in i've got my wvd app open and we'll go like our sign in for our new desktop
and there we go got our profile all loaded and everything looks good
and if i pull up the file explorer i've got my z drive
mapped to my dfs server and i can browse all of that space
and it all looks like my domain join was successful as well
so with our nsg configuration we can now communicate with all of our domain
services as well as the virtual desktop service so an nsg is just an access
control list it's not intelligent like a
firewall is so if this is the only thing that you
need in your environment in order to secure it
you're good to go but we're gonna kick it up a notch and take a look at the
azure firewall and in our firewall we'll go to our rule
set and we'll go to our application rules and we'll click to add a new app
rule and we'll give our rule a name of wbd set it for a
priority of 1000 and allow it and then in the rule set
we've got a fqdn tag over here on the right for
windows virtual desktop that we've selected
back in the document we're just looking at there's a few other urls that we need
to have access for so i'll copy this first one
and we'll create a new target fkdn for this
we'll just call it xt blob or any ip address
coming through on the https protocol do that target url and we'll repeat this
for the other two now you can further restrict this if you
have multiple subnets that are using your firewall
by declaring exactly what your source ip range is and i've also added an fqdn tag
for windows diagnostics and windows updates as well
and when you've added everything that you want then go ahead and click add
now that that application rule is done we also need to add a network rule
because the application rules only work off of
http https and ms sql and we need to open
that 1688 port for the kms so we'll give it the name of
azure kms set a priority of 1001 and set the
action to be allowed and the rule itself will be given the
name of kms from our source subnet ip range going to a
specific ip destination using the kms address
and port 1688. we'll hit add on that one so now that we've got our firewall fully
configured what we want to do is disconnect
our nsg and just rely on our firewall back in our resource group we'll open
our virtual network go to subnets and go to our wbd
subnet now what we're going to do is disassociate the nsg
and now we want to switch over to using our firewall so we need to add our route
table and we'll hit save and while that's
saving i'm going to go to my virtual machine here and we're going to restart
our vm that way we're sure that we're picking
up all of our new ip settings and just to remind you the traffic flow
from our custom route table says all traffic goes to the firewall so in
order for us to communicate back to our domain controller our firewall settings
need to be correct and back in our firewall we'll just go
to our rules here and under our network rules and i've also got a rule here for
all traffic flow going into my domain controller subnet
so we pull up our client now and go to login
and our connectivity still works pulling up a file explorer
and i can still get out to the share and we can pull up cmtrace or install any
one of these other apps and access our files from dfs which means our full
connectivity to our domain is all working so i hope
you've enjoyed this first video in this micro series
on wvd security and seeing how easy it is that you can secure
your network but still enable access to the wvd
service through our service tags in the nsgs or through the azure firewall which
will give you some more threat analytics and metrics and of
course you can attach this to other services like azure sentinel or
the azure security center and we'll dig into some of those
in the future videos so if you thought that this video was good
please go ahead and click that thumbs up icon and let me know you can also give
me some comments down below if you have any questions on this or
anything else across wvd or anything else in azure as
well as leave me some suggestions of some other videos that you'd like to see
us make we'll be happy to do that and while you're down there if
you haven't done so already go ahead and click that subscribe button and join us
here at the azure academy where we're all just trying to learn
more about azure and if you'd like to receive an email notifying you when our
new videos come out which is about once a week you can go ahead and click that
notification bell as well we have been running some
premieres on our videos when they're releasing
so feel free to set the reminder on those premieres if you're interested
in that and if you're looking for something more over here on the right
we've got our latest video up here on the top as
well as a video that we've selected just for you to help you keep learning
about azure hope you've enjoyed this video and stay
tuned for the next one in this micro series
on wvd security and we'll see you then happy learning