Setup Azure Virtual Desktop "AVD" and FSLogix Complete Step by Step Guide and Demo

[@thunderkit717]

This is the most complete AVD's production environment tutorial I have ever seen. Thank you very much...truly appreciate your share

[@CloudInspired]

Thanks glad you like it. Spread the word!..

[@sergiorivas1857]

This video moves fast so if this is your first time configuring FSLogix get ready to pause a lot. However, its perfect. Helped me resolve the issue that other videos couldn't.

[@CloudInspired]

Glad it helped you Sergio!

[@tenzinnamgyel1588]

This is precisely what I've been searching for.

[@CloudInspired]

Thanks Tenzin, glad it helped you!

[@asadmohd8355]

Excellent , AVD detail in half an hour :)👍

[@CloudInspired]

Thank you! 👍

[@PrinceJohn84]

Excellent video. Thanks a lot for sharing! 👍

[@CloudInspired]

Thanks John! Glad you enjoyed.

[@mornebotha9220]

Thank you this was a very good Video.

[@CloudInspired]

You are very welcome Morne!

[@yulaw3289]

super useful, keep going... thank you!

[@CloudInspired]

Thanks Yu, Glad it was helpful!

[@topcatuk2000]

Great video, thanks for sharing

[@CloudInspired]

Your welcome!

[@roni44ify]

I’ve got a question about setting up FSLogix with my AVD environment. I currently have 6 resource groups, and each one will contain multiple AVD host pools. I’m trying to figure out the best approach for configuring FSLogix in this setup. Storage Account Setup: Should I create one large storage account and then assign a file share to each resource group with AVD host pools? Or is there a better way to structure the storage accounts for performance and manageability across multiple resource groups? User Access to File Shares: What’s the recommended way to assign users to each file share? Are there any best practices on permissions or group assignments for FSLogix profiles, especially with multiple resource groups? Users Accessing Multiple Host Pools Across Resource Groups: What would happen if a user has access to multiple host pools located in different resource groups? How should I set up FSLogix in that case to ensure smooth profile management?

[@CloudInspired]

Hi Rafał, The ug-uks-wvd group in this demo contains the AVD users and has the Storage File Data SMB Share Contributor role to access the storage resource in Azure. Permissions are also granted and set at the Windows security level for access. The FSLogix VHD location is specified for the Azure storage path that was created and accessed as specified in the GPO. You could create different groups to divide your storage and apply permissions accordingly to the Azure storage as above. There is a Microsoft doc for User profile management for AVD with FSLogix profile containers which outlines best practices and permissions learn.microsoft.com/en-us/azure/virtual-desktop/fslogix-profile-containers

[@FedererAmazingClass]

I'm assuming your Windows server in this example is on the same subnet as the storage subnet or have a VPN to the network because I don't see how else you're able to connect to the cloud storage over a private network. I didn't think about this when I started following your steps.

[@CloudInspired]

Windows session hosts are located in Azure and connect to the storage private endpoint using Microsoft network routing.

[@FedererAmazingClass]

@@CloudInspired I meant the active directory server, not the session hosts.

[@CloudInspired]

Domain controller is located in Azure and uses vnet peering to connect to cloud storage

[@FedererAmazingClass]

@@CloudInspired Thank. This makes more sense. Do you have a video that explains how to build AVDs with FSLogix without domain controllers? (cloud services only)

[@parasole]

Thank you very much for your video. Does it mean I can run the Filehybrid script on any Azure server/client (image) that is joined in the domain?

[@CloudInspired]

Hi Daniele, thanks for your comment. AzFilesHybrid script can be run and connects to Azure using the Connect-AzAccount command from client/server that has .Net Framework 4.7.2 or higher and has Azure PowerShell modules installed.

[@WSFrazier]

Might have missed it in the video, but you didn't talk about enabling share-level permissions on the fileshare once the storage account is AD joined and before you start setting the ACL's in windows.

[@CloudInspired]

Hi Wesley, the Azure portal was used and shown in the video to assign the built-in roles to the Entra identity of a user for granting share-level permissions.

[@roni44ify]

I have set up an Azure File Share and assigned the necessary Storage File Data SMB Share Contributor role. I installed FSLogix on the VM, but when I log in as a user with FSLogix enabled, the share doesn't map. Additionally, when I try to manually map the Azure share, access is denied. What could I have missed?

[@CloudInspired]

Hi Rafal, sounds like a permissions issue on the Azure File Share as you are unable to manually map a share. Did you re-check permissions as in this set of MS documents? learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions

[@HarryQ-g7t]

Thank you for this great video! May I ask is this tutorial for pure cloud environment?

[@CloudInspired]

Hi Haonan thanks for your comment. Domain Controllers in this AVD demo are in the Azure cloud and Microsoft Entra ID and AD DS synchronized. However check out supported identity scenarios below. There are also several network requirements you need to meet to successfully deploy Azure Virtual Desktop. One of which is join session hosts to the domain, therefore if your Domain Controllers are not in Azure you need connectivity to them. Best to check out all the prerequisites for Azure Virtual Desktop below that covers different scenarios learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites?tabs=portal

[@HarryQ-g7t]

@@CloudInspired Hey there, thank you so much for your detailed response! I will check the settings as you suggested, however, if it is possible to configure FSLogix on AVD totally on native cloud (e.g., no domain controller, no AADS, no Entra Domain Service, etc.)? Thank you!

[@CloudInspired]

No problem Haonan, glad to help you! To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID. PowerShell scripts will also need to be run to join the storage account to your domain.

[@HarryQ-g7t]

@@CloudInspired Thank you so much, that's very clear answer! Now we are trying to implement FSLogix on pure cloud AVD so need to avoid on-prem things haha

[@CloudInspired]

OK best of luck hope it all goes well

[@celestial_sphere3]

Will fslogix profiles only apply to users in the ug-uks-wvd group, since it is tied to the Storage File Data SMB Share Contributor Role? Asking because I'd like to have fslogix only apply to only a subset of users first for testing purposes. Thanks for the video!

[@CloudInspired]

Hello, yes the ug-uks-wvd group in this demo contains the AVD users and has the Storage File Data SMB Share Contributor role to access the storage resource in Azure. Permissions are also granted and set at the Windows security level for access. The FSLogix VHD location is specified for the Azure storage path that was created and accessed as specified in the GPO. If you require selected users for FSlogix testing, you could create a test group and apply permissions accordingly to the Azure storage as above.

[@crawler97]

Im so thankful for your video since it answered almost all my questions! The only part im having problems with is the dns config of my private endpoint. Since im not aware of a seperate dns server in my company my endpoint is registered with a ".windows" fqdn. Is it neccessary to create a seperate dns server or is there a workaround? kind regards

[@CloudInspired]

Hi Paul, Glad it answered all your questions and thanks for your comment. There are options to configure your DNS settings for private endpoints listed in this Microsoft article which should help. learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration

[@BGS-IT]

Thanks for the video - Very concise and clear. However, when trying to mount the drive, I'm met with authentication failure - permission denied. Did anyone else have this and know a way around it?

[@CloudInspired]

Hello, have you double checked the SMB permissions on azure file share that hosts user profiles for users those will be signing in learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions

[@lostinpa-dadenduro7555]

Is there any way to avoid the second login when connecting to the AVD windows 10 desktop ? I have a project where we have a local AD and various servers that can’t go away. Those are being moved as is to azure virtual servers using the replication appliance. Users are all synced to Entra and what not. They want the Azure windows 11 multisession virtual desktops to be domain joined to the “local” AD. And of course if I show them they have to login twice to get into a desktop session, they will get all salty on me.

[@CloudInspired]

Hello, you would need to Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID authentication. Details are here learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on

[@fbifido2]

is it possible in 2024-OCT to have a 100% cloud only AVD with FSLogix ???

[@CloudInspired]

Check out the prerequisites for Azure Virtual Desktop learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites To use FSLogix profile containers with AVD you will require a AD DS domain or Microsoft Entra Domain Services where a AVD host pool with session hosts are joined. Security groups will also be needed, if you're using AD DS, this must be synchronized to Microsoft Entra ID.

[@gonzalomarsilli5741]

subscribed! great content, will appreciate a lot if you can make chapters on your videos, thank you

[@CloudInspired]

Welcome aboard!