in this episode i'm going to help you
set up fslogix and msix app attach
storage running on azure files with
azure private link
roll the intro
i'm dean sefola and this is the azure
academy so here's our scenario for today
we've got
5 000 users we need to support in
windows virtual desktop and that's
broken down
into three different kinds of users that
are spread across
three regions now the best practice for
fslogix is to have
one file share per host pool and since
we have three different regions with
three different kinds of users and we'll
have
three different host pools but we need
two
file shares for fslogix we also need to
make sure that one
third of our users can be online at the
same time
from each of the individual regions
because we have a follow the sun
model and on the security authentication
side of things we are going to be using
azure private link to isolate our wbd
session host within a region
to their own file share so that nobody
else can access it
and the authentication piece is going to
be handled by active directory
integration
with our azure files account followed by
setting up all the azure files
permissions on that share and the ntfs
windows permissions
for least privileged access and that
also means that we're going to have to
update our network security groups and
our spokes
to be able to communicate with private
link so now that you know what's going
on today let's go build us some storage
accounts
now we're going to need users to access
our storage account so i'm just running
azure ad connect with the express
settings and this is not normally
recommended in a production environment
but since this is just our lab for the
az-140 test
express is good enough because it'll
just sync everything across
into azure and over here in the azure
portal in the users section you can see
there are all of our users so azure ad
connect is working
but we also have groups and they're all
called wbd
underscore users underscore whatever the
region is
and that's so we can have our storage
account by private link to the subnet
where the host pools are located
isolated to just those user profiles
okay so let's just go click on the plus
in the top and you can scroll down to
the bottom and select
storage accounts we want to choose the
wvd resource group first in the east us
then we have our name for the storage
account now names and storage accounts
can be a little tricky
because you can't use any special
characters it's only
letters and numbers and then the next
thing to think about is the length of
the name
so you can have 24 characters in a
storage account normally
however because we are doing the active
directory authentication
integration for our storage accounts
your name needs to be
15 characters or less because that's a
standard active directory netbios
limitation
so i'm going to call mine stor and then
put in the region
eus and then have something at the end
it could be your alias
or the first part of your email address
or just anything you want i'm using
az140 now one more thing about storage
account
names they need to be globally unique
that means when i create this storage
account your storage account cannot have
the same name now we still want to
follow the same naming convention here
so we're all on the same page
so at the end of your storage account
don't use az140
use something else and just be sure
again that you stay under that 15
character limit
then we have the particular region
selected east us in this case
and then we have our performance options
and this is either standard or premium
and we also know from our scenario that
we need one
third of our users to be online at the
same time
so one-third of 2000 users is about 660
users
and that number times 50 is 33 000.
now with standard the maximum
performance you can get
out of a single file share is ten
thousand iops
so we need to go with premium when you
choose premium you have your account
kind and you need to select that as file
storage
then for your replication options you
have two choices locally redundant and
zone redundant
in this case local redundancy is just
fine because we're going to be using
cloud cache to replicate our storage
between
our different regions so let's hit next
for our networks
here in the networking section you can
see we've got three different options up
top
and by default all storage accounts are
accessible
from the internet and that's what's
included with all networks
now that doesn't mean that your data is
out there and exposed to the internet
we still have things like sas tokens to
secure our storage accounts
but it has to do with where the endpoint
is that the clients communicate with
when it's set for public endpoint that
means that there is a ip address out
there on the public internet
that your storage account will respond
to if you choose the middle option
that would be public endpoints from
inside selected networks
where you want to isolate it to on-prem
or to azure virtual networks
but that's not good enough in this case
because we don't want just any old v-net
to be able to access our storage
we want only one specific subnet to be
able to get there
so we need the private endpoint and when
we do that we've got a new section here
that we've got to fill out
so over there on the left click add and
then you get this blade here that we
need to fill out
starting with their subscription and
resource group
this should be of course for our wbd
spoke in
the east us location and then our name
i'm going to use priv and then put in
the abbreviation for the region
eus and then end it with az140
just so i know that it's related to this
storage account
the storage subsystem in this case your
only option is file because this is a
premium account
and then we have our network now for the
network we want this to be our
spoke wvd network since we want that to
be isolated to our session hosts in the
eus
then we have the private dns
configuration at the bottom
this is going to help your systems be
able to locate the storage account
and we definitely want to use that in
our solution so go ahead and hit ok at
the bottom
so let's hit next for data protection
now the only thing here that relates to
azure file storage
is soft delete all the rest of these
things here are for blob storage
now soft delete is enabled by default on
your file shares and i'll show you how
you can disable it if you want to
since this is just our lab but if you
wanted to enable it you just check the
box and then tell it how many days you
want to retain
data after you've deleted it and of
course soft delete is so that you can
recover it without having to go to your
azure backups
we don't need to make any changes here
on the advanced screen so hit next and
add your tags
these are just the standard tags i've
used throughout this series
that would be the application the
environment the owner and most
importantly the cost center
and when you're ready go ahead and
create now i'm not going to walk you
through
provisioning the other two storage
accounts it's the same process just with
different names so pause the video if
you need to go ahead and get that done
and then when you're ready i'll meet you
in your storage account okay so my stuff
is finished there's my three storage
accounts
each one in their appropriate region so
let's click on east us
and you can see the only service that's
available here is file storage
that's because it's a premium files
account now over on the left you can
click on networking
and at the top you'll see its selected
networks has been chosen
but there are no networks actually
picked but switch over to the
private endpoints configuration tab and
that's where you'll find your private
link
instance and it is set to auto approve
now go ahead and click right over here
where it has the private endpoint
and that'll take us over here to the
private link blade
starting at the top we've got our
virtual network which shows our wbd
spoke and then we have a network
interface
so the way private link works is you
actually get a azure network
card and that card has an ip address
that represents
the service azure files in this case
inside your virtual network that's how
we're going to write our nsg rules in a
few minutes
then over on the left we have the dns
configuration
and this is that azure private dns zone
that we set up in the process
and that shows that we've got a fully
qualified domain name
for our azure files representation as
well as a private ip address
and one last thing if you go to the
search at the top we want to do a look
up
private dns zones and just click that
then you should have at least
one instance of an azure private zone
and that should be located in our
network resource
group and here you can see all of our
private dns
records for the east u.s japan and
uk and then what makes the magic happen
is over there on the left the virtual
network link
and this is where that private dns zone
gets registered with the individual
azure virtual networks
in our hub and our spokes so this way
we'll be able to use
one private dns account for all of this
information
now remember i told you before that soft
delete is enabled by default and
up here in the middle you can change
that when you click on it you'll get
this blade here and you can just
disable by flipping the toggle right
there and then just hit save at the
bottom
so the next thing to do is create a file
share so go ahead and hit the plus file
share at the top and when you do you get
this blade here at the side
give your file share a name to keep them
all consistent i'll use
share then the region of eus and then
az140
so i know that it's related to this same
storage account
and then we have the size of the share
now size in premium is directly tied to
performance
so i've chosen a 10 terabyte share so
the baseline
io when we do 10 terabytes is around 10
000.
and that's great because that's my
steady state number but when i have all
those login log
offs i'll be using this burstable number
that goes up to thirty thousand
so i should be fine when you've got that
set up hit create at the bottom
now just one more thing to keep in mind
is that premium storage
accounts bill based on the size of the
file share
so the clock is now ticking now because
these file shares can be dynamic
what you may want to do is adjust the
size of the share
smaller so that you would be billed less
until you're ready to start ramping
things up with all of your users and you
can do that just by clicking the three
dots over here and then clicking
chain size and performance and the
smallest size that we can create here is
100 gigabytes
and so that's what i'll set mine to
because i'm going through this as a
video process for all of you
so that way i don't burn all of my azure
credits and then just hit update at the
bottom
and our size has been updated just be
sure that you put it back to the right
size
before you start onboarding your users
now that we have a share
we need to get authentication going so
go ahead and click the link over there
where it says active directory
not configured now at the bottom of that
screen you'll see
identity based access for file shares
and it calls out
azure active directory domain services
and there's just a button to go ahead
and easily enable that
do not click that button we're not using
azure ad
domain services in this case we're using
a regular domain controller
so what you need is the link at the very
bottom how to domain
join this storage account and that'll
open up a link over here on the side
that's actually the azure dock and you
can click the link up here at the top
and that'll just expand it out into a
new window and make it a little more
readable
and what you'll want to do is click on
this link for part one and you're gonna
scroll down just a little bit to this
download azfiles hybrid module now we're
gonna access our domain controllers over
azure bastion so go ahead and copy that
link
then back in the azure portal go find
your domain controller that's in east us
and then hit the connect button at the
top from there you'll want to click on
bastion and then click on the use
bastion button
and because we're logging on to a domain
controller provide the appropriate
credentials
and then hit connect now when you do a
new tab will open you'll be logged on
and pick up right where you left off
once again browsing the internet from a
domain controller is not a best practice
but because this is our lab and we don't
have an administrative server we're
doing it from here but anyway go ahead
and click the link right over there and
download the zip file
and once that's finished go ahead and
extract all the contents
and then you want to copy the path where
all of these files are and go into
powershell and to make things easy for
yourself go ahead and switch directories
to wherever that was
and you should see that you've got three
files in there then flip back to the
azure docs and scroll down just a bit
until you find this very large
powershell block and then copy all of
that code
and just paste that back here into
powershell and we've just got a couple
quick
edits to make so i've added my
subscription id
resource group name and the name of the
storage account and we'll just scroll
down a little bit
you can see that we're referencing those
as variables and then we have this
domain account type and i've chosen to
use a computer account here
instead of a service account the next
line is optional
and this is for specifying an ou
to create the computer object in and
same thing with encryption type this is
optional as well
this determines how kerberos off is done
i'll leave those
up to you i'm actually going to delete
both of them because in this lab it
doesn't matter
so go ahead and highlight lines 1
through 30 and then just
execute that code and when you do you'll
see this warning that we are changing
the execution policy
in order to run this particular script
that's okay to do because one this is
our lab
and two after this powershell session
closes the policy will go back to normal
so go ahead and hit yes to all
and then the files will be copied to the
appropriate places and you'll be asked
to sign in to azure and after that it'll
run the script to join your storage
account which will just take a moment so
that looks like a good output so if you
go back to the azure storage account and
then in the configuration section of the
blade at the bottom
we've now got two different
identity-based options
azure ad domain services which is now
grayed out
and then under that active directory
domain services
which is now enabled showing which
domain we are joined to
and just to verify everything go to the
file share
and at the top it now says active
directory is configured
so it all looks good now we need to
assign the permissions
and there's two layers to this azure
files and windows ntfs
now because of how azure ad connect
functions your domain admin account that
you're logged in with
will not sync over to azure that's just
the security feature in
azure ad connect so to get around this
for our storage account permissions
we're going to take
adam warlock and give him the rights of
domain admin
and then we can finish the rest of this
back in the azure file share
go over there to access control then at
the top we want to click the add button
and then select add role assignment when
you do you get this pop out here and you
want to choose your role
at the top and scroll all the way down
until we find
the storage file data smb share elevated
contributor
then you need to select your user that
you want to have those elevated
contributor rights
now in this case i'm going to choose
adam warlock then go ahead and add
another role assignment this time we
want the share
contributor and because this is the east
u.s go ahead and search for that wbd
users
usa group and when you're done you
should have two different permissions
assigned
now it's the elevated contributor that
will have the rights to set the ntfs
permissions
but in order to do that we have to map
our drive first
so at the bottom on the left let's go
back to our file share then you want to
click those three dots again and this
time
select connect and if all goes well the
authentication method should be active
directory and you'll have a box of code
right here go ahead and copy that and
then we want to go back to our domain
controller in the azure portal
and then in the bastion connect settings
go ahead and log
in with adam warlock and just open your
powershell ise again
and paste in your code and then go ahead
and run it and that'll just take a quick
second to run and you should have a new
z
drive map so right click on that and go
to properties
and then go to the security tab and
click edit now you should see that adam
warlock is already here and he's got
special permissions
that's what that elevated contributor
role did for us but now
go ahead and click add and when you do
you'll be able to search for the right
thing that you need
in this case we're looking for wvd users
groups and you want the one for usa
and when you've added that just hit ok
and you'll get this warning about
setting permissions and
yes we want to continue now that you've
added the group click on advanced
and you want to set the creator owner
rights to have access of modify applying
to
subfolders and files only adam warlock
is our administrator so he should have
full control over this file
subfolders and files and finally the wvd
users usa group should have modify
access on this folder only and that sets
up the least privilege
access rights according to the fslogix
docs which are linked in the description
below
and the last piece of the puzzle are our
network security groups in the spokes
so we've created here rule 180
and that's to allow smb outbound and
that's on port
445 on the tcp protocol
from the virtual network which would be
the spoke to
a specific ip address and that's the one
of our private link 10.1.0
for the east u.s now i've got some
homework for you so don't run away on me
just yet
we need to set up the other two storage
accounts in japan
and uk and we need to create the file
shares and private link and all of that
stuff
keep in mind though that in japan we
will not be using fs logics
but we will be using msix app attach so
be sure to create that in japan
uk and in the us and repeat all of these
processes
so you go and complete that homework so
you're ready for the next episode
speaking of which we'll next be getting
into making our
images for our session host so that
we're ready to deploy
our host pools and all this stuff is in
the az140 study guide series
right here at the bottom and you can
always catch the latest azure academy
video
at the top thanks for joining me today
and i will catch you in our next episode
happy learning