if you're serious about working with Windows virtual desktop in Azure then
you really need to consider FSLogix. FSLogix is a set of solutions that can
enhance your ability to handle your VMs by specifically separating your user
profiles or your office profiles from the VM itself so that way your users
especially in a non persistent environment and move around from VM to
VM but carry their user experience with them but up until now when you wanted to
implement this in Azure you had a couple options you could use NetApp files or
you could build out your own file server with something like storage spaces
direct or you could use the azure storage accounts by leveraging blob
storage and finally you could have used as your files with Azure Active
Directory domain services and we have done a video on that as well and I've
got that linked up here on the top right if you're interested in that go check
that out but today we're looking at how we can
implement FSLogix with a new twist now things as you know are constantly being
improved in Azure and one of those things that the Microsoft storage
product team has been working on for a while is to enable Active Directory
authentication or those azure file shares so for the next few minutes we're
gonna dig into this new feature of Azure files and then we're going to leverage
it or FSLogix with Windows virtual desktop
I'm Dean Cefola and this is the Azure Academy so we've got a lot to cover
today so let's go right over to the Azure docks and the short link to get
here again is a kms /as your docks and if it's been a while since you've looked
at the docks you may notice that the interface here has been redesigned and
so we've got some overview topics here the architecture Center as well as the
cloud adoption framework and a link to Microsoft learn where you can also build
your skills great content over there and then as we scroll down the page we've
got these featured items like Linux and Windows virtual machines cognitive
services functions aks and we are planning a new series on aks so
subscribe so you don't miss that and then down the left side of the screen
we've got the table of contents where you can browse by all of our different
products and then at the bottom here we have different languages and tools that
you can use as well as links for the sovereign clouds we'll scroll back up
and go to our storage link and within storage again we have multiple options
will be using file storage and over on the table of contents will go under
how-to guides will go to secure then we'll scroll down here to enable Active
Directory authentication and authorization so this is a brand new
feature that's been enabled in the cloud again allowing us to use Active
Directory instead of azure ad domain services to be able to work with Azure
files now because the feature is in preview there are a few things that you
just need to take note of here in this box the account that you're using must
be one that is synced from Azure Active Directory using Azure ad Connect and
we've done a video on as your ad connect if you miss that you can click on that
up here and aside from that the other thing that I'll call out here in the
prerequisites is that that as your active directory you're syncing with
must also be directly associated with your Azure subscription now over on the
right there is also a workflow overview and this is basically the process that
we're going to go through today so you can read through that and there's some
other code that's here in this doc that we're going to go back and reference so
let's get right into it and at the top here we'll click
to read a resource and at the bottom I'll click for a storage account and
then we need to put this in a resource group and I'll set up a new one for this
and we'll call it ADAuth-FSLogix-WVD and then we need a name for our
storage account and we'll call it adfslogixwvd000 and I'll put this in
the central us because according to the docks
east us where I usually put stuff is not currently available for this feature we
will choose our standard performance and if you need higher IOPS up to 100,000
you can choose premium I will be using a b2 storage account and
locally redundant storage on a hot access tier and we'll hit next and it's or is
where we could set up a private endpoint if you want to use that and we have a
video on private endpoints but I'll just leave it for all and networks at this
point and next and if you need larger file shares say up to 100TB
and you can check this button here in this particular case though I
don't need that so I'll just leave it disabled but I do want a secure transfer
and so we'll hit next and then add our tags and we've added our cost Center so
we know who's paying for this what application this is related to FSLogix
in this case and the environment is my lab so we'll hit next and our validation
looks good so you can download the arm template down here if you like and we'll
hit create or a storage account is now set up and so if you look under
configuration we have that flag here for the identity based access for file
shares this is where you would turn on the Azure Active Directory domain
services if you wanted to use that and you can see that we have here an active
directory and you can click that link and go to our Docs and read about how
authentication works to a storage account but we are going to go back to
the docs here and click the link on the right to enable ad authentication for
your account that we just created and we need to download a prerequisite here
this is a PowerShell module that we're going to use to execute all the rest of
the code on the page and you can see I've already
downloaded this file from github and I'll just extract everything right to
here and there's our files so let's take note of this directory and open
PowerShell as an administrator and I've navigated already to that file location
and now on the right on my script pane I will copy over the code that was in the
azure documentation and now what we're gonna do is run the first command here
which will set our execution policy so that we'll be able to run this script
then we'll run the second command here which is one of the files that we
downloaded and that's going to go and discover all of the files in that
directory where we just downloaded the code and move them to the appropriate
location and now we'll run the import for that new PowerShell module and
that'll just take a moment and you've got to run these next two commands to
connect to your Azure subscription so first you'll have to replace your
subscription ID in this field and this can be found in either under any one of
your resources you've got a subscription ID at the top here so just click the
copy link I'll paste that in here and run these commands and log in ok so now
I'm logged in and now I want to run this last file which is going to set up my
storage account for Active Directory authentication so we've plugged in those
variables and one thing to be aware of that is called out in the docs if you're
putting it somewhere where there is a password reset policy then you will have
to be aware of that and reset the password for the account otherwise
you're going to lose access when that password expires now you can also add
other parameters here so I'll add a switch here for the domain and we should
be good to go so let's run this command and that has completed successfully and
now when we look at my OU where I set this up I've got a new computer
object and when we open that object up it's got a description here of computer
account object for Azure storage account and it's lists my storage account name
back in the azure portal if we look at our storage account configuration we can
scroll down a little bit here Active Directory has been enabled and the
domain that we are joined to is also listed here we just completed the
section in a name ad authentication for your account and
what we completed was step number two executing the ad enablement script now I
want to make sure that you understand that if you have done that successfully
and you are seeing that feature flag turned on this next section you can
actually skip in the documentation and that's called out here in this note
block so we can go right here to step number three confirm that this feature
is enabled so we'll copy on this block and now we just need to update our
variables here for our resource group name and our storage account name then
we can run that command and then run our next two commands together and we see
the ad feature flag has been turned on and we see our domain information back
in the documentation we're ready to go to the next step which is assign access
permissions to an identity and this is where we have to do two things we have
to grant as your are back permissions and we also have to set up NTFS
permissions for our shares go back in our storage account we'll go to access
control and an access control will go to role assignments and we're going to add
a role assignment and the role that we will select here is going to be the SMB
file share or elevated contributor and that is again our admin account and
there's my WVD admin so I'll save that and then we'll add another permission
here and that'll be for the SMB file share contributor for my FSLogix users
which are the users group wvd users and we'll save that and we can scroll down
and see that yes those permissions are now successfully applied so now we need
to do the NTFS side of the equation so we'll go back to the overview screen and
open our file share and in our file share we'll click the connect button
select the drive that we want to map to I'll pick the u-drive and then we can
click the copy button here to take our code block to our system to complete the
map I've pasted this into a notepad now this will work and certainly you can use
that if you like I'm going to show you another method and this is where we will
use the command net use declare our drive letter give it the path to the
azure files share and then give it our and username and of course your third
way to do it is through Windows itself and you would do that in Windows File
Explorer you click to map a network drive that you are a drive letter and
put in the path and then you would select the box here for connect using
different credentials when you hit finish you'll be prompted this needs to
be the storage account name and the format for that would be a sure slash
the storage account name and the password would be the storage account e
will hit OK for that so now that our drive is mapped we'll test it here by
just creating a folder real quick and then if we go back to asher and we'll
close our little connect window and hit refresh and there is our WVD folder and
just to make sure we can see stuff the other direction we'll remove that
directory and then it is gone from our map drive so now that we've got this
drive mapped we have to set the NTFS permission so we'll right click on the
drive and go to properties and we'll go to the security tab and we'll press edit
so what we want to do here is click Add and if all goes well in the from this
location box you should see your domain name if instead you see the azure
storage account name then the permissions have not worked quite as
they should but not to worry there is a workaround you can actually just do this
from a command line interface and give it the drive letter with the slash grant
permission and then you put in the user name that you want to grant access to or
the group and you would do that by domain backslash group name and then
both of them should end with the colon and then a F in the parentheses like you
see here if the prior step in our code here had been done to see that the
storage account was associated with the domain you won't have this problem but
just in case you do there's a workaround for you but since my environment is
working just fine I'm going to put in my users and I'm gonna check my name so
we'll select those and hit OK and now I'll grant my wvd admin full control on
the share and the wvd users will need modify permissions and we'll hit apply
and ok what we should be able to do now is go to any other VM that's in
environment and we should be able to log on with a user that's a member of that
wvd users group we should be able to map the share without entering credentials
I've logged on to a different VM in my environment with the account Superman I
can just go to my address bar now and should be able to go right to that share
without credentials and there we go and now we're ready to set up FSLogix
so there's one optional step that I'll show you as we're working with this but
to do that we're going to need DFS so we have done a video covering DFS and I'll
link that in the top here basically we have to set up a namespace which I have
already done and then once you have your namespace set up then you can right
click and add a new folder and give that folder a name I'll call mine FSLogix
and then we'll click Add for a folder target and here you can add your Azure
file share and again that is \\\file.core.windows.net\
whatever your share name is and then hit OK and then hit OK to complete
that process and there it is so now if I go to my DFS and I have that map to my Z
Drive then I can go right into FSLogix and then I can create a new folder in
here call it DFS which then shows up right in the azure portal a so just an
optional step that you can do if you want to hide that particular namespace
certainly not a requirement for FSLogix but because it is applicable to
the new storage account authentication thought I'd put it out there and then I
want to take you out to one other link and that would be https://aka.ms/FSLogix &
that'll take you to the main FSLogix documentation page under the how-to
guides we'll click this first link to install the FSLogix agent and this is
where you can download the agent from and I'll have this linked in the video
description so that you can find that easily I've logged on to one of my wvd
session hosts now and I have downloaded the latest agent so I'll extract that
and I'll just copy it down to my desktop and then we'll go into the x64 folder
release and the FSLogix apps setup alright and the entire install is check
the box and click install that took about one minute of real time
but of course I spread that up in the video here I'll close out of that window
now in order to set up FSLogix we have a registry key that we have to do so an
H key local machine will go into software the FSLogix folder and we
need to add a new registry key here I've already done that and exported it so I
can reuse it across all of my systems so I'll just double click my exported
registry file and hit run and then we'll add that to our system now I've added
more than just the two required keys here although we do have enabled set to
one and a VHD location pointing at my new FS logic share and these other
entries that are here you can look in the docs to see if those are applicable
to you and then one more thing we want to look at is under computer management
and that's that include exclude group so if we go under groups here then we can
set our include and exclude and this is important because as especially an
administrator who needs to be on the system's but I don't want my profile in
FSLogix I'm going to set myself to be excluded and I'll repeat that for the
office and user profiles together and then on the include side by default we
do have everyone so I'll remove that because I just want my wvd users group
to be added for this and then I'll repeat that again for the profiles we've
rebooted now and I've pulled up the task manager so you can see my admin account
is the only one that is logged in no other user has been logged in yet on
this machine so here's the web client and I'm logged in with the user
Gomora let's login to WVD and provide my credentials and hit submit
and we can CFSLogix is starting up for us and the first time you log in with
any user even without FSLogix it does take longer because it has to create
your entire profile and then FSLogix will of course store that wherever
you're pointing your share and in our case that is as your files so if we pull
up the task manager here and we'll go to the users we can see both of our users
are logged in and back from my administrator login we can see
amaura has successfully logged on and has the FS logic older or the profiles
and you can tell that from the local underscore Gamora here also if we go
to the disk management utility and we can see that Gamora 's profile is
loaded on and that is from FSLogix because this is a VHD that is mounted
onto the system and back from my DFS servers point of view if I go to the
shared drive two FSLogix we've got our folders here for gamora's user profile
and office profile and those are redirected out to Azure files to our
file share the FSLogix folder and we can see gamora's directories are here as
well so hope that you've enjoyed looking at this brand new feature that I know
I've been waiting for for a long time and I'm super excited about this and the
potential it's gonna have for Windows virtual desktop with FSLogix as well
as other files share solutions so hit me up in the comments and tell me how
you'll be using this new feature or how you're using FSLogix and if you
thought this video was good please do click that thumbs up icon and while
you're down there subscribe to the Azure Academy if you haven't done that already
join us here at our community where we're all just trying to learn about
Azure and help each other out and if you'd like to receive an email notifying
you when our new videos come out which is roughly once a week you can click on
the email notification as well so if you're looking for something more you
can check out our latest video up here or one that's suggested just for you at
the bottom and if you have any comments about our new look please feel free to
share them with me I'm looking for feedback as always thanks for joining us
and happy learning