Auto Deallocation for Unused Azure Virtual Desktop Personal VMs

Microsoft

Auto-Deallocation method for Azure Virtual Desktop VM that has not been used for a specific period has been introduced in various places. I would like to introduce another scenario. But this is suitable for use in a Personal Pool environment only. Please note that it is difficult to use in a pooled VM environment that allows multi-session.

 

Conditions and Methods of VM Deallocation

When the Windows Shutdown state (VM Stopped) is detected by Azure Monitor, the VM is deallocated by Azure Automation. What is important here will be the conditions and method of shutting down Windows. I implemented Shutdown action with Disconnect Trigger and Delay Task using task scheduler. I also needed another task scheduler to reset this triggered Shutdown task when the user reconnects to the VM before shutdown.  The scenario below is an example, and the ‘idle time’ and ‘delay task time’ can be changed as desired by referring to the configuration snapshot.

PyungraeCho_40-1630523845946.png

A. When user Disconnect:

    - Scheduler1 is started because 'Disconnect' status is triggered.

    - After 30 minutes, Windows Shutdown (VM Stopped)

    - 'VM Stopped' status detected and VM deallocated within 5 min.

B. When the user log off:

    - Logoff after running tsdiscon.exe by logoff script

    - Scheduler1 is started because 'Disconnect' status is triggered.

    - After 30 minutes, Windows Shutdown (VM Stopped)

    - 'VM Stopped' status detected and VM deallocated within 5 min.

C. When the user shuts down Windows:

    - 'VM Stopped' status detected and VM deallocated within 5 min.

D. When Idle status occurs for more than 15 minutes after connection:

    - Session is disconnected by AD policy related disconnection for idle session

    - Scheduler1 is started because 'Disconnect' status is triggered.

    - After 30 minutes, Windows Shutdown (VM Stopped)

    - 'VM Stopped' status detected and VM deallocated within 5 min.

E. When a user reconnects before 30 minutes after 'Disconnect' occurs:

   - Scheduler2 starts because 'Connect' status is triggered

   - Scheduler2 resets (disable & enable) Scheduler1. Scheduler1 ends the task to be performed and starts trigger detection again.

F. When the user restarts Windows

  - Only Windows restart is performed normally. (This is the action the user wants)

If 'shutdown' or 'deallocation' command is registered in the logoff script of personal VM, the user could not connect to the VM after restarting Windows. This is because restart involves the logoff phase. This issue occurred when installing software that required a restart or manual Windows update task .

 

Now let's share a screenshot for the configuration.

 

1. Azure Automation Account

- Create an Azure Automation Account and import the module.

PyungraeCho_59-1630524311370.png

PyungraeCho_42-1630523845971.png

 

 2. Azure Monitor

- Monitor Service Health → Resource Health

PyungraeCho_43-1630523845979.png

- The most important thing in setting an alert rule is the condition. The resource health event matching 'Unavailable' shows the Windows shutdown (VM Stopped) status or unavailable for an unexpected reason. 

PyungraeCho_0-1631333583360.png

- Add Action group, connect with the Automation Account created earlier, and use the built-in 'Stop VM' runbook.

PyungraeCho_60-1630524460789.png

PyungraeCho_61-1630524488593.png

PyungraeCho_47-1630523846007.png

PyungraeCho_48-1630523846015.png

PyungraeCho_62-1630524554350.png

PyungraeCho_63-1630524582433.png

 

3. Scheduler 1 (Shutdown after 30 minutes when User ‘Disconnect’ is triggered)

- Set as below in AD GPO or client scheduler.

PyungraeCho_51-1630523846028.png

PyungraeCho_52-1630523846037.png

PyungraeCho_53-1630523846043.png

 

4. Scheduler 2 (Disable & Enable Scheduler 1 when User ‘Connect’ is triggered)

- Set as below in AD GPO or client scheduler

PyungraeCho_54-1630523846051.png

PyungraeCho_55-1630523846060.png

PyungraeCho_56-1630523846069.png

 

5. Logoff Script

- Set as below in AD or Local GPO. tsdiscon.exe is located under the system32 folder. Just copy this file to your GPO folder. This logoff script creates a Disconnet state just before logoff so that it triggers on Scheduler 1.

PyungraeCho_57-1630523846075.png

 

6. Disconnect for Idle Session

- If the idle state is maintained for a specific time, the AD policy is set so that the session is automatically disconnected.

PyungraeCho_58-1630523846081.png

 

I hope this method will help many people, and I would appreciate any feedback.

 

 

22 Replies

Hi @PyungraeCho 

 

This is a great post.

 

I was only looking for deallocation after a VM is shut down by a user and I found exactly what I needed.

 

All worked perfectly.

 

Thank you.

Thanks for your reply.

Hi, @PyungraeCho

This can be used with VMS running windows server? There's some cost on this procedure like creating an Azure Automation Account?

Thank you,
Wilson

Hi, @Galafassi
Yes. It doesn't matter if it's a Windows client or a server. As you know it will cost a bit like Azure Automation.

@PyungraeChoI'm doing some tests but aparently the Alert is not flagged everytime i manually shutdown the VM. Only sometimes...

The 5min you mention "- 'VM Stopped' status detected and VM deallocated within 5 min." this 5min is an Azure parameter? In my testes sometimes after 10min nothing happened.

Hi, @Galafassi
First, 5 minutes is a general result that I have tested. It is not an accurate threshold. And sometimes if the VM does not respond, it is also difficult to predict the cause. Didn't you miss tsdiscon.exe on the logoff script? If it is not, to check whether there is a problem with the VM or Azure Monitoring, additional case analysis seems to be required. Sorry...

Just tested : working well !

@PyungraeCho Hi,

The process worked great until recent WVD agent updates making WVD status as 'Shutdown' rather than 'Unavailable'. 

https://learn.microsoft.com/en-us/answers/questions/1193772/what-is-the-different-between-shutdown-u...

Just curious if WVDs can be ''Stopped (Deallocated)' directly from 'Shutdown' status. 

@PyungraeCho  I received an email about "Migrate your runbooks to managed identities in Azure Automation by 30 September 2023"

 

This is something related to this scripts? Something to do?

 

Regards,

Wilson

 

Yes, you have to take care.
Because my env is personal AVD VMs, I decided to change it by the new feature for AVD Auto-scaling : https://jlou.eu/avd-solo-start-and-stop/

@jlou65535 Hello,

 

I've configured an scaling plan for my personal pool but never shutdown the virtual machines.

I had followed your link https://jlou.eu/avd-solo-start-and-stop/ but machines never shutdown.

I have an AVD personal pool wit 10 VMs. I've create a scaling plan and associated to the pool.

My scaling's plan configuration is:

  • Ram-up --> 07:00 AM, start vm on connect active. Don't turn VMs on at start time. Disconnect setting and log og settings in shutdownn 0 minutes.
  • Peak hours --> 08:00 AM, start vm on connect active. Disconnect setting and log og settings in shutdown 0 minutes.
  • Ramp-down --> 03:00 PM, start vm on connect active. Disconnect setting and log og settings in shutdown 0 minutes.
  • Off.peak hours --> 03:30 PM, start vm on connect active. Disconnect setting and log og settings in shutdown 0 minutes.

Whether I disconnect the user session or close the windows avd client the VMs never shutdown and put in the deallocated state.

How can I fix it? .

Thanks in advance.

Hello,

Did you configure the RBAC role named "Desktop Virtualization Power On Off Contributor" for Azure Virtual Desktop app ?

Best,

JL

Yess, but doesn't work. Machines keeps alive.

Could you please double check the AVD application ID ? (9cdead84-a844-4324-93f2-b2e6bb768d07)

For each schedule phase, could you please try with :
- Disconnect settings - When disconnected for (min) : 10 minutes
- Log off settings - When logged off for (min) : 5 minutes

In a AVD virtual machine activity log, could you see any "Deallocate Virtual Machine" succeeded or failed operations ?

Best,

JL
Hi,

I'll try your recommendation and give you feedback.

When you say double check the AVD application ID ? (9cdead84-a844-4324-93f2-b2e6bb768d07) what does it means?. I don't understand.

Thanks.

Best,
There is many Azure app about Azure Virtual Desktop / Windows Virtual Desktop.
Just take a look if you chose the right AVD app for RBAC role by clicking on it and check the Application ID ;)

JL

@jlou65535 

Hello,

Ok, I understand now. But the only app I can see is Windows Virtual Desktop Client, with the following application id fa4345a4-a730-4230-84a8-7d9651b86739 no 9cdead84-a844-4324-93f2-b2e6bb768d07 as you recommend.

 

Best,

That app fa4345a4-a730-4230-84a8-7d9651b86739 is a legacy app as said here :
https://robjanssen.it/2021/11/15/conditional-access-for-avd-azure-virtual-desktop/

The right one should be named Azure Virtual Desktop with 9cdead84-a844-4324-93f2-b2e6bb768d07

JL