Tommy is working as a Senior Cloud Consultant with more than 20 years of experience. Since 10 years his focus is on Microsoft Azure especially on Azure Governance, Azure Network, Azure Security, Azure IaaS, PaaS and my favorite Azure Virtual Desktop.
Tommy is Co-Founder and organizer of “Azure Meetup Schwerin” – a Germany based Azure Community.
This post will be a short guide through all steps without HCI Setup.
After you have deployed your HCI Cluster successfully you will have your cluster resources within the azure portal. Once you click on that cluster you will find the following overview.
As you can see as well all prerequisites are met. These prerequisites are:
Now you can click on “DEPLOY” to start a custom deployment:
most of the informations are clear, but these 3 were a bit tricky for me 😉
LOCATION
The location you will find within your Azure ARC resources. (Azure Portal > Azure Arc > Custom Location > Properties > ID
IMAGE
To finde the Image id it is required to add at least one image to azure stack.
You have three options to add an image:
The easiest way to get started is to add an azure marketplace image. I have already added “Windows 11” and “Windows Server” to my list. After adding an image go to azure portal > azure stack hci > vm image > “windows11” now copy the url from your browser – that must look like this:
https://portal.azure.com/#DOMAIN/resource/subscriptions/SUB_ID/resourceGroups/RG-NAME/providers/microsoft.azurestackhci/marketplaceGalleryImages/IMAGE-NAME/overview
remove /overview at the end und copy that url to your custom deployment.
NETWORK
Go to Azure Stack HCI > Your HCI Stack > virtual networks > and copy the browser URL that must look like this: https://portal.azure.com/#@DOMAIN/resource/subscriptions/SUB_ID/resourceGroups/RG-NAME/providers/Microsoft.AzureStackHCI/clusters/CLUSTERNAME/virtualnetworks
and add your virtual network name to the end like this:
https://portal.azure.com/#@DOMAIN/resource/subscriptions/SUB_ID/resourceGroups/RG-NAME/providers/Microsoft.AzureStackHCI/clusters/CLUSTERNAME/virtualnetworks/NETWORKNAME
My first deployments failed and I wasn’t sure why. After I checked the deployments within my resource group and checked my inputs to the last failed one
I found that my VM tries to get access to the following URL. That was blocked so I copied that script and created my own https url as a workarround.
To change that URL only “redeploy” of one of the last deployments gives you the option to change that URL
After that deployment I had my VM up and running on my azure stack hci. It was domain joined but the avd agent was mising. I installed that avd agent manually. Now I was able to see that host within the azure portal.
and here we go I was able to get a connection
I have already written a post about how to deploy AVD with AzureAD joined VMs
(https://tech-guys.blog/2021/11/10/azure-virtual-desktop-and-azuread-joined-vm/)
Addition to AzureAD joined VMs we need an Azure Storage Account, an Azure File share as well to save our FSLogix Profiles. This post will guide you to all steps.
At time of writing AzureFiles and AzureAD Kerberos functionality is still in preview (https://docs.microsoft.com/en-us/azure/virtual-desktop/create-profile-container-azure-ad)
for my lab I only use SKU standard but for prod environments I always use and recommend premium storage. Microsoft created insights on sizing and designing fslogix solutions for enterprises here: https://docs.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop-fslogix
Connect-AzAccount -Tenant $tenantId -SubscriptionId $subscriptionId
$Uri = ('https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version=2021-04-01' -f $subscriptionId, $resourceGroupName, $storageAccountName);
$json = @{properties=@{azureFilesIdentityBasedAuthentication=@{directoryServiceOptions="AADKERB"}}};
$json = $json | ConvertTo-Json -Depth 99
$token = $(Get-AzAccessToken).Token
$headers = @{ Authorization="Bearer $token" }
try {
Invoke-RestMethod -Uri $Uri -ContentType 'application/json' -Method PATCH -Headers $Headers -Body $json;
} catch {
Write-Host $_.Exception.ToString()
Write-Error -Message "Caught exception setting Storage Account directoryServiceOptions=AADKERB: $_" -ErrorAction Stop
}
New-AzStorageAccountKey -ResourceGroupName $resourceGroupName -Name $storageAccountName -KeyName kerb1 -ErrorAction StopInstall-Module -Name Az.StorageInstall-Module -Name AzureAD
$tenantid = "yourid"
$subscriptionid = "yourid"
$resourceGroupName = "rg"
$storageAccountName = "name"
#set password between storage account and azuread
$kerbKey1 = Get-AzStorageAccountKey -ResourceGroupName $resourceGroupName -Name $storageAccountName -ListKerbKey | Where-Object { $_.KeyName -like "kerb1" }
$aadPasswordBuffer = [System.Linq.Enumerable]::Take([System.Convert]::FromBase64String($kerbKey1.Value), 32);
$password = "kk:" + [System.Convert]::ToBase64String($aadPasswordBuffer);
#connect to tennant
Connect-AzureAD
Set-AzContext -Subscription $subscriptionid
$azureAdTenantDetail = Get-AzureADTenantDetail;
$azureAdTenantId = $azureAdTenantDetail.ObjectId
$azureAdPrimaryDomain = ($azureAdTenantDetail.VerifiedDomains | Where-Object {$_._Default -eq $true}).Name
#generate service principal names
$servicePrincipalNames = New-Object string[] 3
$servicePrincipalNames[0] = 'HTTP/{0}.file.core.windows.net' -f $storageAccountName
$servicePrincipalNames[1] = 'CIFS/{0}.file.core.windows.net' -f $storageAccountName
$servicePrincipalNames[2] = 'HOST/{0}.file.core.windows.net' -f $storageAccountName
#create app
$application = New-AzureADApplication -DisplayName $storageAccountName -IdentifierUris $servicePrincipalNames -GroupMembershipClaims "All";
#create service
$servicePrincipal = New-AzureADServicePrincipal -AccountEnabled $true -AppId $application.AppId -ServicePrincipalType "Application";
$Token = ([Microsoft.Open.Azure.AD.CommonLibrary.AzureSession]::AccessTokens['AccessToken']).AccessToken
$Uri = ('https://graph.windows.net/{0}/{1}/{2}?api-version=1.6' -f $azureAdPrimaryDomain, 'servicePrincipals', $servicePrincipal.ObjectId)
$json = @'
{
"passwordCredentials": [
{
"customKeyIdentifier": null,
"endDate": "",
"value": "",
"startDate": ""
}]
}
'@
$now = [DateTime]::UtcNow
$json = $json -replace "", $now.AddDays(-1).ToString("s")
$json = $json -replace "", $now.AddMonths(6).ToString("s")
$json = $json -replace "", $password
$Headers = @{'authorization' = "Bearer $($Token)"}
try {
Invoke-RestMethod -Uri $Uri -ContentType 'application/json' -Method Patch -Headers $Headers -Body $json
Write-Host "Success: Password is set for $storageAccountName"
} catch {
Write-Host $_.Exception.ToString()
Write-Host "StatusCode: " $_.Exception.Response.StatusCode.value
Write-Host "StatusDescription: " $_.Exception.Response.StatusDescription
}Result is an app with the name of our storage account:
and you can see on your storage account a hint that kerberos is enabled.
now you can assign API permissions to that app:
1st we need openid permissions
2nd we need User permissions
after adding it is important to click “Grant admin consent”. For this you need right permissions within AzureAD.
To allow an User to create profile container we need to assign RBAC Roles to the Storage account.
Storage File Data SMB Share Contributor for all AVD Users and “Elevated Contributor” to a Group or Users that need Admin Permission.
For me it was quiet confusing where I have to set these permisions and which system I have to use. In my Lab I have one Windows VM with AD DS and ADConnect installed that I used to run that scripts.
From MS Documentation I found:
The system you use to configure the permissions must meet the following requirements:
Connect-AzAccount -Tenant $tenantId -SubscriptionId $subscriptionId
$AdModule = Get-Module ActiveDirectory;
if ($null -eq $AdModule) {
Write-Error "Please install and/or import the ActiveDirectory PowerShell module." -ErrorAction Stop;
}
$domainInformation = Get-ADDomain
$Domain = $domainInformation.DnsRoot
$domainGuid = $domainInformation.ObjectGUID.ToString()
$domainName = $domainInformation.DnsRoot
$domainSid = $domainInformation.DomainSID.Value
$forestName = $domainInformation.Forest
$netBiosDomainName = $domainInformation.DnsRoot
$azureStorageSid = $domainSid + "-123454321";
Write-Verbose "Setting AD properties on $storageAccountName in $resourceGroupName : EnableActiveDirectoryDomainServicesForFile=$true, ActiveDirectoryDomainName=$domainName,
ActiveDirectoryNetBiosDomainName=$netBiosDomainName, ActiveDirectoryForestName=$($domainInformation.Forest) ActiveDirectoryDomainGuid=$domainGuid, ActiveDirectoryDomainSid=$domainSid,
ActiveDirectoryAzureStorageSid=$azureStorageSid"
$Uri = ('https://management.azure.com/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}?api-version=2021-04-01' -f $subscriptionId, $resourceGroupName, $storageAccountName);
$json=
@{
properties=
@{azureFilesIdentityBasedAuthentication=
@{directoryServiceOptions="AADKERB";
activeDirectoryProperties=@{domainName="$($domainName)";
netBiosDomainName="$($netBiosDomainName)";
forestName="$($forestName)";
domainGuid="$($domainGuid)";
domainSid="$($domainSid)";
azureStorageSid="$($azureStorageSid)"}
}
}
};
$json = $json | ConvertTo-Json -Depth 99
$token = $(Get-AzAccessToken).Token
$headers = @{ Authorization="Bearer $token" }
try {
Invoke-RestMethod -Uri $Uri -ContentType 'application/json' -Method PATCH -Headers $Headers -Body $json
} catch {
Write-Host $_.Exception.ToString()
Write-Host "Error setting Storage Account AD properties. StatusCode:" $_.Exception.Response.StatusCode.value__
Write-Host "Error setting Storage Account AD properties. StatusDescription:" $_.Exception.Response.StatusDescription
Write-Error -Message "Caught exception setting Storage Account AD properties: $_" -ErrorAction Stop
}reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1On my Sessionhost I configured FSLogix like this:
Because I used that host already with my test account I already had a local profile. Within my first test it was not working, but with allowing FSLogix to delete lcoal profile than I was able to login and my profile container was created.
To be honest I had some trouble to get this working. Maybe it was one of my reboot to solve this 😉
Thanks for reading
When a Virtual Machine is running we have to pay for using CPU and RAM. When we are able to turn off (deallocate) a Virtual Machine then we can save costs.
With “Start on Connect” feature we can allow end users to turn on AVD Hosts and if they log off we can deallocate our hosts again. The result can be that we save costs!
I will go through all task to enable that feature.
First of all we need to have a custom role that will be used to start our hosts.
Subscription > Access control > add > custom role
Now we can create a role assignment. I did this on my Ressource Group “rg-avd” where my host is located.
our next step is to look for our new created custom role. if you can not find this, please try to refresh your session.
next part is to define members – here we need to find “Windows Virtual Desktop”
If you can not see any member then your user must be assigned to the security administrator role.
Let’s try if its working. My pool only one host and this host is deallocated.
Lets start our SessionDesktop:
Our Client will wait until one host is up and connected to the avd service.
Within the activity logs we can check who initiated the start of my host.
It was initiated by “Azure Virtual Desktop” as designed .
Thats it and thx for reading
When you are migrating VMs from on-premise to Azure, you always have to evaluate the needed availability of several VMs. Your decisions in terms of VM size, storage tiers, and pricing options do rely on this evaluation. In my current migration of on-prem Remote Desktop Services to Azure Virtual Desktop, we have a Remote App that is used quite irregularly. Sometimes once per week, sometimes one to two days, and sometimes not a single time in a week. So we will go with Pay as you Go for these needed VM’s. We can deal with this behavior easily in Azure Virtual Desktop (planned shutdown and start on connect), but that’s only the frontend VM. In my scenario, I have some additional backend VMs which hold some services needed for the running application (licenseservice and some webservices for the DMS integration). We don’t need to run the backend VMs if nobody uses the frontend application, so I want to link the running state of these VMs with each other.
The Frontend VM will be triggered by AVD’s “Starts on Connect” feature, and the needed backend server will be automatically started and deallocated depending on the Frontend VM.
I know there are solutions using EventGrid + Logic App + Azure Automation. But as you may already know, serverless Azure Functions are simply more efficient in terms of scaling and pricing.
In my setup how-to, I decided to simplify the setup with two single VMs. It shouldn’t be hard for someone to adjust, because in the end, you only have to tag the dependent VMs with the same value.
So let’s start …
We created two resource groups for testing. In my example, I created one named “Lab_init” and one “Lab_triggered” ? This way, we can define which VM can trigger the start process by putting them into this resource group.
I’m going with Ubuntu this time, but it doesn’t really matter. We only want to start and stop, so go with whatever you prefer.
Now we get to the funny part.
param($eventGridEvent, $TriggerMetadata)
# Make sure to pass hashtables to Out-String so they're logged correctly
# $eventGridEvent | Out-String | Write-Host
$tAction = ($eventGridEvent.data.authorization.action -split "/")[-2]
$tVmName = ($eventGridEvent.data.authorization.scope -split "/")[-1]
$tSubscriptionId = $eventGridEvent.data.subscriptionId
# preflight check
Write-Host "Check trigger action"
if (($tAction -ne "start") -and ($tAction -ne "deallocate")) {
Write-Warning "Unsupported action: [$tAction], we stop here"
break
}
Write-Host "##################### Triggerinformation #####################"
Write-Host "Vm: $tVmName"
Write-Host "Action: $tAction"
Write-Host "Subscription: $tSubscriptionId"
Write-Host "Get information about trigger vm"
$context = Set-AzContext -SubscriptionId $tSubscriptionId
if ($context.Subscription.Id -ne $tSubscriptionId) {
# break if no access
throw "Azure Function have no access to subscription with id [$tSubscriptionId], check permissions of managed identity"
}
$tVm = Get-AzVM -Name $tVmName
$bindingGroup = $tVm.Tags.bootbinding
if (!$bindingGroup) {
Write-Warning "No tag with bootbinding found for [$tVmName], check your tagging"
break
}
# main
Write-Host "Query all subscriptions"
$subscriptions = Get-AzSubscription
foreach ($sub in $subscriptions) {
Write-Host "Set context to subscription [$($sub.Name)] with id [$($sub.id)]"
$context = Set-AzContext -SubscriptionId $sub.id
if (!$context) {
# break if no access
Write-Warning "Azure Function have no access to subscription with id [$tSubscriptionId], check permissions of managed identity"
return
}
# get vms with bootbinding tag
$azVMs = Get-AzVM -Status -ErrorAction SilentlyContinue | Where-Object { ($_.Tags.bootbinding -eq $bindingGroup) -and ($_.Name -ne $tVmName) }
if ($azVMs) {
$azVMs | ForEach-Object {
Write-Host "VM [$($_.Name)] is in same binding-group, perform needed action "
$vmSplatt = @{
Name = $_.Name
ResourceGroupName = $_.ResourceGroupName
NoWait = $true
}
switch ($tAction) {
start {
Write-Host "Start VM"
$_.PowerState -ne 'VM running' ? (Start-AzVM @vmSplatt | Out-Null) : (Write-Warning "$($_.Name) is already running")
}
deallocate {
Write-Host "Stop VM"
$_.PowerState -ne 'VM deallocated' ? (Stop-AzVM @vmSplatt -Force | Out-Null) : (Write-Warning "$($_.Name) is already running")
}
Default {}
}
}
}
}
Now let’s test our configuration
As you can see, there is most likely a time difference of 3 minutes between the boottimes, so keep that in mind. In my AVD scenario, it doesn’t really matter, because we have some buffer until the user logs in and starts the application. We never had problems with that.
Hope it can be usefull for somebody, feel free to a adjust
I’ve got an interesting challenge from one of my customers.
Long story short, we have hybrid ad joined devices (for no really good reason, I know 😉 ), but only “User Driven Provisioning” via Windows Autopilot is available (at the moment).
But mobile devices get shared regularly for weekend tasks, the customer wants to allow every user to use the company portal on these devices.
The only way to accomplish this at the moment is to remove the primary user from the device in the MEM Admin Portal, because this will “convert” the device into a shared device.
So he wants me to automate this when a new device gets enrolled in intune via Windows Autopilot.
In the past, I’ve often used Azure Monitor with Alerts and Runbooks to perform tasks like this.
But since I’ve dug a little bit into Azure Functions in my last project, I decided to go with an alternative approach this time. (Because Azure Functions are so damn awesome and a shout-out to Laura Kokkarinen, her blog post helps me a lot: Link )
We create two Event Hubs in our new namespace, one for operational logs and one for the filtered enrollment events (we will get into that later).
Return to the MEM Admin Portal and configure log forwarding.
Note: Now is a good time to enroll a test device, so you have some log entries to play with.
Let’s take a look at the logstream. We navigate back to our event hub namespace and open our previously selected event hub.
We now create a new Azure Function App with your favorite runtime stack. I usually go with Powershell and my demo code is also written in Powershell (so if you want simple copy and paste –> select Powershell Core).
The rest of the settings are good by default, and the serverless plan is the most beaty one :-). Application Insights give us a historical view.
param($eventHubMessages, $TriggerMetadata)
# Write-Host "PowerShell event hub trigger function called for message array: $eventHubMessages"
$eventHubMessages | ForEach-Object {
# get Intune device id
$jsonOut = $_ | convertto-json
Write-Host "Processing event: $jsonOut"
$deviceID = $_.properties.IntuneDeviceId
Write-Host "DeviceID: $deviceID"
try {
# request accesstoken from managed identity
Write-Host "Trying to get authentication token from managed identity."
$authToken = Receive-MyMsiGraphToken
#Invoke REST call to Graph API
Write-Host "Call Microsoft Graph to remove primary user from device."
Remove-MyPrimaryUser -IntuneDeviceID $deviceID -AuthToken $authToken
}
catch {
Write-Error $_
}
}As you might see, I use 2 helper functions in this example. “Receive-MyMsiGraphToken” and “Remove-MyPrimaryUser”, we add this function to the “profile.ps1”. The “profile.ps1” file loads every time the function does a cold start.
function Receive-MyMsiGraphToken {
$Scope = "https://graph.microsoft.com/"
$tokenAuthUri = $env:IDENTITY_ENDPOINT + "?resource=$Scope&api-version=2019-08-01"
$splatt = @{
Method = "Get"
Uri = $tokenAuthUri
UseBasicParsing = $true
Headers = @{
"X-IDENTITY-HEADER" = "$env:IDENTITY_HEADER"
}
}
$response = Invoke-RestMethod @splatt
$accessToken = $response.access_token
if ($accessToken) {
return $accessToken
}
else {
throw "Could not receive auth token for msgraph, maybe managed Identity is not enabled for this function"
}
}
function Remove-MyPrimaryUser {
param (
$AuthToken,
$IntuneDeviceID
)
$splatt = @{
Method = "DELETE"
Uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$IntuneDeviceID')/users/`$ref"
UseBasicParsing = $true
ContentType = "application/json"
# ResponseHeadersVariable = "RES"
Headers = @{
'Content-Type'='application/json'
'Authorization'= 'Bearer ' + $AuthToken
}
}
$result = (Invoke-RestMethod @splatt).value
if ([string]::IsNullOrEmpty($result)) {
return $true
}
else {
throw "Removing primary user from device ('$IntuneDeviceID') failed"
}
}Now we have everything in place, for our final part. We have to add some permissions to our Azure Function App.
# replace with your managed identity object ID
$miObjectID = "place your object id here"
# MS Graph app ID
$appId = "00000003-0000-0000-c000-000000000000"
# replace with the API permissions required by your app
$permissionsToAdd = @(
"DeviceManagementManagedDevices.ReadWrite.All"
)
Connect-AzureAD
$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"
foreach ($permission in $permissionsToAdd) {
$role = $app.AppRoles | Where-Object Value -Like $permission | Select-Object -First 1
New-AzureADServiceAppRoleAssignment -Id $role.Id -ObjectId $miObjectID -PrincipalId $miObjectID -ResourceId $app.ObjectId
}
# Restart app after changing permissionWe reset and reenroll our test device/VM and take a look. After some time, we should see the message received by our “newenrolleddevice” logstream.
Since some time it is possible to join a Windows VM to Azure AD directly. Now this is also possible with Azure Virtual Desktop.
This Blogpost will show all my steps until I am possible to login to my Windows 10 System.
First of all we need some basic informations such as pool name.
next to the basics we need to define: VM Size, VM Availability, Image type and the number of VMs.
addition to that we can use an existing network or we are able to create a new one.
After these Settings we need to define which domain we want to join. Her we can now choose between Active Directory and Azure Active Directory.
I have chosen AzureAD.
During the host pool creation it is possible to create a assignment to a workspace. I have created tech-guy-workspace as a new one.
With AzureAD joined devices we need to create a role assignment and a app group assignment. With each host pool one default app group will be created. In my test lab it is called “tech-guys-personal-pool-DAG”.
within this app group we are able to assign users
2nd task is to assign rbac role to at least the virtual machine to that we want to login. I prefer to assign that role to my resource group that I have that assignment for all future host as well.
there are 2 roles we need to consider about.
As it says the first role is useful when you want to login and want to have admin privileges on that machine. second group is only for your users that they are able to login without admin permission. In my lab I assigned my test user to “virtual machine user login” and my cloud only user “virtual machine administrator login” role.
To access host pool VMs, your local computer must be:
Host pool access uses the Public Key User to User (PKU2U) protocol for authentication. To sign in to the VM, the session host and the local computer must have the PKU2U protocol enabled. For Windows 10 version 2004 or later machines, if the PKU2U protocol is disabled, enable it in the Windows registry as follows:
and here we go.
If you need to use an other client rather than the windows one, than you need enable the RDSTLS protocol. Just add a new custom RDP Property to the host pool, targetisaadjoined:i:1. Azure Virtual Desktop then uses this protocol instead of PKU2U.
ist cool
Powered by WordPress & Theme by Anders Norén