Might have missed it in the video, but you didn't talk about enabling share-level permissions on the fileshare once the storage account is AD joined and before you start setting the ACL's in windows.
Hi Wesley, the Azure portal was used and shown in the video to assign the built-in roles to the Entra identity of a user for granting share-level permissions.
Thanks for the video - Very concise and clear. However, when trying to mount the drive, I'm met with authentication failure - permission denied. Did anyone else have this and know a way around it?
Hello, have you double checked the SMB permissions on azure file share that hosts user profiles for users those will be signing in learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
Im so thankful for your video since it answered almost all my questions! The only part im having problems with is the dns config of my private endpoint. Since im not aware of a seperate dns server in my company my endpoint is registered with a ".windows" fqdn. Is it neccessary to create a seperate dns server or is there a workaround? kind regards
Hi Paul, Glad it answered all your questions and thanks for your comment. There are options to configure your DNS settings for private endpoints listed in this Microsoft article which should help. learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration
Will fslogix profiles only apply to users in the ug-uks-wvd group, since it is tied to the Storage File Data SMB Share Contributor Role? Asking because I'd like to have fslogix only apply to only a subset of users first for testing purposes. Thanks for the video!
Hello, yes the ug-uks-wvd group in this demo contains the AVD users and has the Storage File Data SMB Share Contributor role to access the storage resource in Azure. Permissions are also granted and set at the Windows security level for access. The FSLogix VHD location is specified for the Azure storage path that was created and accessed as specified in the GPO. If you require selected users for FSlogix testing, you could create a test group and apply permissions accordingly to the Azure storage as above.
Is there any way to avoid the second login when connecting to the AVD windows 10 desktop ? I have a project where we have a local AD and various servers that can’t go away. Those are being moved as is to azure virtual servers using the replication appliance. Users are all synced to Entra and what not. They want the Azure windows 11 multisession virtual desktops to be domain joined to the “local” AD. And of course if I show them they have to login twice to get into a desktop session, they will get all salty on me.
Hello, you would need to Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication. Details are here learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Check out the prerequisites for Azure Virtual Desktop learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID.
Hi Haonan thanks for your comment. Domain Controllers in this AVD demo are in the Azure cloud and Microsoft Entra ID and AD DS synchronized. However check out supported identity scenarios below. There are also several network requirements you need to meet to successfully deploy Azure Virtual Desktop. One of which is join session hosts to the domain, therefore if your Domain Controllers are not in Azure you need connectivity to them. Best to check out all the prerequisites for Azure Virtual Desktop below that covers different scenarios learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites?tabs=portal
@@CloudInspired Hey there, thank you so much for your detailed response! I will check the settings as you suggested, however, if it is possible to configure FSLogix on AVD totally on native cloud (e.g., no domain controller, no AADS, no Entra Domain Service, etc.)? Thank you!
No problem Haonan, glad to help you! To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID. PowerShell scripts will also need to be run to join the storage account to your domain.
@@CloudInspired Thank you so much, that's very clear answer! Now we are trying to implement FSLogix on pure cloud AVD so need to avoid on-prem things haha
Excellent video. Thanks a lot for sharing! 👍
Thanks John! Glad you enjoyed.
super useful, keep going... thank you!
Thanks Yu, Glad it was helpful!
Might have missed it in the video, but you didn't talk about enabling share-level permissions on the fileshare once the storage account is AD joined and before you start setting the ACL's in windows.
Hi Wesley, the Azure portal was used and shown in the video to assign the built-in roles to the Entra identity of a user for granting share-level permissions.
Thanks for the video - Very concise and clear. However, when trying to mount the drive, I'm met with authentication failure - permission denied. Did anyone else have this and know a way around it?
Hello, have you double checked the SMB permissions on azure file share that hosts user profiles for users those will be signing in learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
Im so thankful for your video since it answered almost all my questions! The only part im having problems with is the dns config of my private endpoint. Since im not aware of a seperate dns server in my company my endpoint is registered with a ".windows" fqdn. Is it neccessary to create a seperate dns server or is there a workaround? kind regards
Hi Paul, Glad it answered all your questions and thanks for your comment.
There are options to configure your DNS settings for private endpoints listed in this Microsoft article which should help.
learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration
Will fslogix profiles only apply to users in the ug-uks-wvd group, since it is tied to the Storage File Data SMB Share Contributor Role? Asking because I'd like to have fslogix only apply to only a subset of users first for testing purposes. Thanks for the video!
Hello, yes the ug-uks-wvd group in this demo contains the AVD users and has the Storage File Data SMB Share Contributor role to access the storage resource in Azure. Permissions are also granted and set at the Windows security level for access. The FSLogix VHD location is specified for the Azure storage path that was created and accessed
as specified in the GPO. If you require selected users for FSlogix testing, you could create a test group and apply permissions accordingly to the Azure storage as above.
subscribed! great content, will appreciate a lot if you can make chapters on your videos, thank you
Welcome aboard!
Excellent , AVD detail in half an hour :)👍
Thank you! 👍
This is precisely what I've been searching for.
Thanks Tenzin, glad it helped you!
Is there any way to avoid the second login when connecting to the AVD windows 10 desktop ?
I have a project where we have a local AD and various servers that can’t go away. Those are being moved as is to azure virtual servers using the replication appliance. Users are all synced to Entra and what not.
They want the Azure windows 11 multisession virtual desktops to be domain joined to the “local” AD. And of course if I show them they have to login twice to get into a desktop session, they will get all salty on me.
Hello, you would need to Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication. Details are here learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
is it possible in 2024-OCT to have a 100% cloud only AVD with FSLogix ???
Check out the prerequisites for Azure Virtual Desktop learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID.
Thank you for this great video! May I ask is this tutorial for pure cloud environment?
Hi Haonan thanks for your comment.
Domain Controllers in this AVD demo are in the Azure cloud and Microsoft Entra ID and AD DS synchronized.
However check out supported identity scenarios below.
There are also several network requirements you need to meet to successfully deploy Azure Virtual Desktop.
One of which is join session hosts to the domain, therefore if your Domain Controllers are not in Azure
you need connectivity to them.
Best to check out all the prerequisites for Azure Virtual Desktop below that covers different scenarios
learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites?tabs=portal
@@CloudInspired Hey there, thank you so much for your detailed response! I will check the settings as you suggested, however, if it is possible to configure FSLogix on AVD totally on native cloud (e.g., no domain controller, no AADS, no Entra Domain Service, etc.)? Thank you!
No problem Haonan, glad to help you! To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID. PowerShell scripts will also need to be run to join the storage account to your domain.
@@CloudInspired Thank you so much, that's very clear answer! Now we are trying to implement FSLogix on pure cloud AVD so need to avoid on-prem things haha
OK best of luck hope it all goes well
This is the most complete AVD's production environment tutorial I have ever seen. Thank you very much...truly appreciate your share
Thanks glad you like it. Spread the word!..
Thank you this was a very good Video.
You are very welcome Morne!
Great video, thanks for sharing
Your welcome!