Tag Archives: Azure Virtual Desktop

Enhanced Host Pool Management for Azure Virtual Desktop is Now GA: How to Set It Up

Posted on by
Reply

Microsoft has announced that enhanced host pool management for Azure Virtual Desktop is now generally available. In short: you can now create a host pool with a session host configuration, and the platform takes over the work of creating and updating session hosts for you. I set it up in my own tenant, and in this post I will walk through the setup step by step, including two gotchas the wizard will not warn you about.

What actually changes

With a standard host pool, you deploy session hosts yourself and keep them updated yourself. A host pool with a session host configuration flips that model:

  • Session host configuration: one definition of what every session host should look like: image, VM size, OS disk, network, domain join and the local admin credentials.
  • Session host management policy: how changes roll out: batch size, logoff behavior and the time zone used for scheduling.
  • Session host update: when you change the image or configuration, Azure Virtual Desktop replaces the session hosts for you, batch by batch.
  • Autoscale can create and delete session hosts based on demand, not just start and stop them.

There is also no registration token to manage anymore: the service handles agent registration itself.

Before you start

  • Only pooled host pools support session host configuration.
  • You choose the management approach when the host pool is created. An existing host pool cannot be converted, and you cannot switch back.
  • The local administrator credentials for the session hosts must come from Azure Key Vault: the wizard only offers Key Vault references, not inline username and password fields.

Step 1: Prepare the Key Vault

Create a Key Vault with two secrets, one for the VM admin username and one for the password. Do this before you open the host pool wizard: the wizard caches the vault list when it loads.

If your vault uses the access policy permission model, you must also grant the Azure Virtual Desktop service access to read secrets:

az keyvault set-policy -n kv-tm-avd-prod-001 \
  --object-id <AVD-provider-object-id> \
  --secret-permissions get list

Step 2: Basics

In the Azure portal, go to Azure Virtual Desktop, select Host pools and select Create.

Azure Virtual Desktop host pools list in the Azure portal with the Create button

Pick Pooled, and set Create Session Host Configuration to Yes. This is the decision that enables the whole feature set. Set your load balancing algorithm and max session limit as usual.

Create a host pool Basics tab with Create Session Host Configuration set to Yes

Step 3: Session hosts

You can set the number of session hosts to 0 and still define the full configuration. That is exactly what makes this approach nice to prepare in advance, since autoscale or a later update can create the hosts. I used the Windows 11 Enterprise multi-session 25H2 image with Microsoft 365 Apps, Trusted launch, a name prefix, my virtual network and Microsoft Entra ID join.

Session hosts tab with zero session hosts, name prefix and virtual machine location

At the bottom of the tab, the virtual machine administrator account is referenced from Key Vault: two dropdowns for the vault and secret holding the username, and two for the password.

Virtual machine administrator account referenced from Azure Key Vault secrets in the host pool wizard

Step 4: Management

The wizard assigns a system-assigned managed identity to the host pool and shows exactly which roles it will get, including Desktop Virtualization Virtual Machine Contributor on the session host resource group and Key Vault Secrets User on the credential vault. You need Owner or User Access Administrator rights for these role assignments to succeed.

Management tab showing the managed identity and role assignments including Key Vault Secrets User

Step 5: Review and create

Validation checks the configuration, and the deployment creates the host pool, the application group and the session host configuration.

Review and create tab with validation passed

On the host pool overview you can now see Uses Session Host Configuration: Yes, and the toolbar has new Start, Restart and Stop commands that operate on the whole pool.

Host pool overview showing Uses Session Host Configuration Yes and the new Start, Restart and Stop commands

Two gotchas from my deployment

  1. Key Vault access: portal validation passed, but the deployment failed with UnableToAccessKeyVaultSecret. The role assignments the wizard creates are Azure RBAC, so if your vault runs the access policy permission model, the Azure Virtual Desktop provider has no access. Grant it an access policy as shown in step 1 and redeploy.
  2. VM size restrictions: my subscription had no access to Standard_D2as_v5 in West Europe, which also only surfaced at deployment time. Check availability first with: az vm list-skus -l westeurope –query "[?name=='Standard_D2as_v6'].restrictions"

Read the GA announcement and the host pool management approaches documentation for the full details, including how session host update handles drain, logoff and rollback.

Enhancing Your Security Posture in Windows 365 and Azure Virtual Desktop

Posted on by
1

Setting up a virtual computing environment offers plenty of benefits for most organizations. But, businesses also need to understand the potential security issues involved and how best they can address them. Recently, Microsoft has been working on enhancing security measures for Windows 365 and Azure Virtual Desktop (AVD) clients. In addition to that, one of the key goals is to address the complexities that organizations often have to deal with regarding security policy management.

By doing so, Microsoft intends to provide clients with a robust suite of new security features. The new features will offer greater infrastructure protection.

Common security risks in virtual computing

Businesses are constantly dealing with various threats to their infrastructure and data breaches can be some of the most damaging. From huge financial losses to potential legal ramifications, data breaches pose serious threats to companies. Some organizations might even find it hard to bounce back from if left unprotected.

Another of the biggest challenges that businesses deal with on a daily basis is insider threat. What makes this such a tough issue to deal with is that it encompasses both negligent as well as malicious users. This kind of problem serves to highlight the importance of the new features Microsoft is launching. These latest features aim to strengthen identity and access management protocols.

Organizations can also get punished for a lack of due diligence. If one makes the mistake of engaging a virtual computing services provider without a full understanding of the security they have in place, it can end up being extremely costly.

Working with platforms, like Azure Virtual Desktop (AVD) and Windows 365, gives you the advantage of integrated services into the Microsoft security ecosystem. Not only do you get excellent security but you also get compliance with the appropriate regulations.

Ensuring security by default

One of the key things that Microsoft is doing to counteract security threats is putting in place features that provide security by default. This can be achieved by embedding Microsoft-recommended security settings right at the beginning when creating Cloud PCs or virtual machines. Putting in place measures like these serves to make security an integral part of these virtual services. It also provides you with robust security straight out of the box

SIMPLICITY with Azure Virtual Desktop

Implementing security by default also simplifies things by reducing the need for manual configurations. This allows you to have more productive time. IT admins will have even less to worry about, thanks to one of Microsoft’s newer updates. This update works by restricting Port 3389 by default on all newly provisioned and reprovisioned Windows 365 Cloud PCs. This update goes a long way in getting virtual services to the goal of automated, built-in security.

FLEXIBILITY with Azure Virtual Desktop

Despite the need for default security, Microsoft still appreciates that there may be times when IT admins may need to override these settings. For instance, think of a situation where IT admins have to customize security for their virtualization deployment to accommodate different devices and varying work models.

In anticipation of such scenarios, Microsoft gives clients the flexibility to override these security settings when the need arises. Ultimately, the key is to offer businesses solutions that are easy to use but not at the cost of improved security. Thus, the new features will simplify securing identity, data, and access. They’ll do so while simultaneously giving organizations the choice, flexibility, and control necessary to maintain a robust security structure.

Secure identity

Considering the threat landscape that businesses have to deal with, it’s extremely important to have the right technologies and processes to safeguard access to resources. Comprehensive solutions are necessary to secure identities ensuring that the right individuals get the right access at the right time.

Not only that, but end-users expect a seamless user experience that makes things easier for them. Needless to say, it’s equally or maybe even more important to have processes that curb malicious access.

FACILITATING SECURE ACCESS

In keeping with the goal of improved identity security, Microsoft recently preview launched Passkey support in Microsoft Entra for macOS and iOS devices with single sign-on and password-less authentication.

With this update, users can expect the end-to-end user experience to become more streamlined. Coupled with improved phish-resistant password-less security for Windows 365 and Azure Virtual Desktop, this launch will undoubtedly give organizations stronger identity processes.

Given that many individuals view Passkeys as not only easier to use but more secure than passwords, this move by Microsoft is bound to be very welcome. As a method of authentication reliant on cryptographic techniques combined with biometrics such as fingerprints, Passkeys can be a significant upgrade over conventional password-based authentication.

RE-AUTHENTICATION

In addition, clients can also look forward to new features. These include faster re-authentication (public preview) that will leverage sign-in frequency in Microsoft Entra Conditional Access policies. This is something that will give IT admins the necessary control to enforce secure, timely reauthentication based on their needs.

Users must re-authenticate only when needing to authenticate to a resource and also when a new access token is needed. Once a connection has been established, they won’t be prompted even if the connection lasts longer than the configured sign-in frequency.

Users also need to re-authenticate if a network disruption occurs that forces the session to be re-established after the configured sign-in frequency. Unfortunately, on unstable networks this probably means more frequent authentication requests.

Wrap up about Windows 365 and Azure Virtual Desktop

The threat landscape is constantly evolving thus creating new risks that organizations have to be prepared to face. With malicious actors working nonstop to expose vulnerabilities, businesses cannot afford to be lax in their approaches to data security. This is why Microsoft is committed to ensuring that clients using the Windows 365 and Azure Virtual Desktop platforms regularly receive new high-end security tools and updates. By doing so, organizations like yours can mitigate the risk of dangerous data breaches and financial losses with fortified security postures.