Back in March, we released the public preview of Windows Virtual Desktop, a cloud-based desktop and app virtualization service that supports multi-session Windows 10 experiences, Remote Desktop Services (RDS), and Office 365 ProPlus. Today I wanted to share some guidance on how to set up FSLogix profile containers on Azure Files with Azure Active Directory (Azure AD) Domain Services authentication, a scenario also available in public preview as of the date of this post.
For the purposes of this step-by-step guide, I’m going to assume that you already have a set of virtual machines (VMs) that are part of a Windows Virtual Desktop environment. If not, you can find information on how to get started with Windows Virtual Desktop on the Tech Community or through our official technical documentation on Docs.
This post will walk you through the process of:
First, you’ll need to log in to the Microsoft Azure Portal with an account that has contributor or administrator permissions.
From the sidebar, select All services, type “domain services” in the search box, select Azure AD Domain Services, and hit Enter.
In the Azure AD Domain Services window, select Create.
This will start the wizard for configuring an Azure AD Domain Services deployment.
For step 1, Basics:
For step 2, Network, configure a virtual network or select an existing one. Our recommendation is to create a new one by selecting Create new and entering the following information:
For step 3, Administrator group, select the Azure AD users that are going to be managing the Azure AD Domain Services configuration.
For most deployments, there is no need to change any of the information in step 4, Synchronization. The default values should suffice.
In step 5, Summary, you will see a summary of your configuration, similar to that shown below.
Click OK to continue. This will start the deployment in Azure. If it is not automatically shown, you can click on the Notifications icon in the global controls bar to view deployment progress, as shown here:
Once the deployment has completed, navigate to Azure AD Domain Services and confirm that Azure AD Domain Services is running.
To add additional administrators, we are first going to create a new user and then grant permissions to that user. To do this:
Now it’s time to enable Azure AD Domain Services authentication over Server Message Block (SMB). For more details on this process, see the Azure Storage Documentation.
First, navigate to the Microsoft Azure Portal, select All services from the sidebar, and select Storage accounts.
Next, click Add to start the Create storage account wizard. Enter the following details:
Select Review + create.
This will trigger validation of the input, as shown below.
Once the account has passed validation, select Create. This will start the deployment.
Once the deployment has completed, proceed to the next step by selecting Go to resource.
Select Configuration from the left pane, then enable Azure Active Directory authentication for Azure Files (Preview) in the main pane. Confirm this change by selecting Save.
Once saved, select Overview in the left pane, then Files in the main pane.
Select File share and enter the Name and Quota.
Copy and paste the following information into Notepad or other plain text application:
{ "Name": "<Custom-Role-Name>", "Id": null, "IsCustom": true, "Description": "Allows for read, write and delete access to Azure File Share over SMB", "Actions": [ "*" ], "NotActions": [ "Microsoft.Authorization/*/Delete", "Microsoft.Authorization/*/Write", "Microsoft.Authorization/elevateAccess/Action" ], "DataActions": [ "*" ], "AssignableScopes": [ "/subscriptions/<Subscription-ID>" ] }
Replace <Custom-Role-Name> with AADDCpreview and replace <Subscription-ID> with the subscription I in which the storage account is located.
Note: To get the subscription ID, navigate to the Microsoft Azure Portal, select All services from the sidebar, and select Subscriptions from the Everything menu.
Save the file as CustomRole.JSON.
Open Windows PowerShell as an administrator.
In PowerShell,
Login-AzureRmAccount
New-AzureRmRoleDefinition -InputFile "C:\temp\CustomRole.json"
$FileShareContributorRole = Get-AzRoleDefinition "<role-name>"
$scope = "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/fileServices/default/fileshare/<share-name>"
New-AzRoleAssignment -SignInName <user-principal-name> -RoleDefinitionName $FileShareContributorRole.Name -Scope $scope
$FileShareContributorRole = Get-AzureRmRoleDefinition "AADDCpreview"
$scope = "/subscriptions/1783ee2d-7d93-47ee-afc1-1ce9f7dc7678/resourceGroups/profiles/providers/Microsoft.Storage/storageAccounts/fsprofile2/fileServices/default/fileshare/share"
New-AzureRmRoleAssignment -SignInName "adele.vance@airlift2020outlook.onmicrosoft.com" -RoleDefinitionName $FileShareContributorRole.Name -Scope $scope)
From the Microsoft Azure Portal sidebar, select Storage accounts. From the list of storage accounts, select the account for which you enabled Azure AD Domain Services and created the custom roles in steps above.
Under Settings, select Access keys and copy the key from key1.
Note: If the key contains the “/” symbol, hit the Refresh icon to generate a new key.
Navigate to the Virtual Machines tab and locate any VM that is going to be part of your hostpool.
Click on the name of the VM under Virtual Machines (adVM) and select Connect.
This will download an RDP file that allows you to connect to the VM via the credentials specified during VM creation.
Once remotely connect to the VM, run Command Prompt as an administrator.
Execute the following command, making the modifications noted below:
net use <desired-drive-letter>: \\<storage-account-name>.file.core.windows.net\<share-name> <storage-account-key> /user:Azure\<storage-account-name>
Modifications to this command should be as follows:
Here’s an example of what the command will look like:
net use y: \\fsprofile.file.core.windows.net\share HDZQRoFP2BBmoYQ=(truncated)= /user:Azure\fsprofile)
Execute the following command to grant full access to the Azure Files share:
icacls <mounted-drive-letter>: /grant <user-email>:(f)
Modifications to this command should be as follows
Here’s an example of what the command will look like:
icacls y: /grant alexwilber@airlift2020outlook.onmicrosoft.com:(f)
Now it’s time to configure the FSLogix profile container. For more details on this process, see Set up a user profile share for a host pool.
While still remotely logged in to the session host VM, download and install the FSLogix agent (.zip file, 166 MB. Unzip the downloaded file and navigate to x64\Releases and execute FSLogixAppsSetup.exe.
Note: if there are multiple VMs in the host pool the below configuration must be done for each VM.
Once the installer launches, select I agree to the license terms and conditions. If applicable, provide a new key. Select Install.
Navigate to C:\Program Files\FSLogix\Apps to confirm that the FSLogix agent was properly installed.
Run Registry Editor (RegEdit) as an administrator.
Navigate to Computer\HKEY_LOCAL_MACHINE\software\FSLogix, right click on FSLogix, select New, then Key. Create a new key named Profiles.
Right click on Profiles, select New, and select DWORD (32-bit) Value. Name the value Enabled and set the Value data to 1.
Right click on Profiles, select New, and select Multi-String Value. Name the value VHDLocations and set enter the URI for the Azure Files share (\\fsprofile.file.core.windows.net\share) as the Value data.
Run Windows PowerShell as an administrator and log in to Windows Virtual Desktop through PowerShell by executing the following command:
Import-Module Microsoft.RdInfra.RdPowershell (Optional) Install-Module Microsoft.RdInfra.RdPowershell $brokerurl = "https://rdbroker.wvd.microsoft.com" Add-RdsAccount -DeploymentUrl $brokerurl
When prompted for credentials, enter the same user that was granted the Tenant Creator role or RDS Owner/RDS Contributor role on the Windows Virtual Desktop tenant.
Execute the following commands to assign the user to the remote desktop group:
$tenant = "<your-wvd-tenant>" $pool1 = "<wvd-pool>" $appgroup = "Desktop Application Group" $user1 = "<user-principal>" Add-RdsAppGroupUser $tenant $pool1 $appgroup $user1
Here’s an example of what the command will look like:
$pool1 = "airlift2020" $tenant = "airlift2020" $appgroup = "Desktop Application Group" $user1 = "debra.berger@airlift2020outlook.onmicrosoft.com" Add-RdsAppGroupUser $tenant $pool1 $appgroup $user1)
You are now ready to verify that the profile was created.
To do this:
This short video demonstrates the end user experience once all configuration steps in this document have been completed. For more detail on FSLogix profile containers and Azure Files from a conceptual perspective—as well as information on why Azure Files is a preferred method for storing user profiles, performance insights, and best practices—see our Windows Virtual Desktop documentation.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.