Index

1. Add RDS Tenant
2. Add Service Principal
3. Assign permissions
4. Deploy WVD through marketplace
5. Open HTML5 webclient
6. Add users to your desktop

I see a lot of people struggle deploying Windows Virtual desktop. Most people face this error message:

VM has reported a failure when processing extension 'dscextension'. Error message: \\\"DSC Configuration 'FirstSessionHost' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_ScriptResource failed to execute Set-TargetResource functionality with error message: User is not authorized to query the management service

This is because you need to create a service principal with the correct permissions. A normal user will work as well, but it’s failing too many times for people.
Following these steps should get you through the deployment.

Keep in mind that the user deploying your WVD VMs to your domain, also needs the Owner role on your Azure Subscription! Because it needs to be able to run some Powershell DSC commands.

NOTE: User ‘Cloudcrusader’ suggests in the comments that it should work with the ‘Virtual Machine Contributor’ role only as well.

Start fresh. Delete all WVD tenants created before. Check if a tenant still exists with Get-RdsTenant.

This post is not going to help you, configuring WVD with AAD DS. It should be possible though, someone was able to configure it succesfully using this post.

Remember, don’t use an MFA enabled account. It doesn’t work.

Also try: Get-RdsDiagnosticActivities. Others succeeded finding the root cause with that command

I have deployed WVD multiple times already, so that’s how I know this works. If it doesn’t work for you, let me know, maybe I can help you.

Run through step one of the Microsoft documentation:
https://docs.microsoft.com/en-us/azure/virtual-desktop/tenant-setup-azure-active-directory

Add RDS tenant

Run these commands to add the RDS tenant.

1
2
3
4
# Don't change the deploymenturl

Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com"

# Use any name for your tenant, get your ID from Azure portal > Azure Active Directory > Properties > Directory ID. To get your SubscriptionID, go to Azure Portal > All services > subscriptions > click the subscription where the VM's will reside and copy the subscription ID:

New-RdsTenant -Name YourTenantName -AadTenantId YourAzureADTenantID -AzureSubscriptionId YourSubscriptionID

Add Service Principal

Next, follow these steps. Never change the Default Tenant Group, as per the Microsoft docs.

1
2
3
4
5
6
7
8
9
10
11
12
13
$myTenantGroupName = "Default Tenant Group"

$myTenantName = "tenantname" #As you used in the previous step

$hostpoolname = "Hostpoolname"



# create the service principal:

$aadContext = Connect-AzureAD

$svcPrincipal = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName "Windows Virtual Desktop Svc Principal"

$svcPrincipalCreds = New-AzureADApplicationPasswordCredential -ObjectId $svcPrincipal.ObjectId



# Don't change the URL below.

Add-RdsAccount -DeploymentUrl "https://rdbroker.wvd.microsoft.com" 

Set-RdsContext -TenantGroupName $myTenantGroupName

New-RdsHostPool -TenantName $myTenantName -name $hostpoolname

Assign permissions

Now below is the most important step, that’s where you assign the service principal permissions to the RDS environment. If you do this correctly, you can deploy the WVD template from the Azure Marketplace, without errors.

1
New-RdsRoleAssignment -RoleDefinitionName "RDS Owner" -ApplicationId $svcPrincipal.AppId -TenantGroupName $myTenantGroupName -TenantName $myTenantName -HostPoolName $hostpoolname

Go to the Azure Portal and open the app just created and create your own key:
Azure Portal > app registrations > Windows Virtual Desktop Svc Principal > Settings > Keys.
Create your own key and save the value During the next step, deploying Windows Virtual Desktop from the marketplace, in step 3 of that template you need this password.

Deploy WVD through marketplace

Next step is to follow this Microsoft doc:
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace
You should be able to get passed the error as mentioned above, also with help from these screenshots below.

If you keep No selected below Specifiy domain or OU, it’s going to try joining the domain behind the @, used below AD domain join UPN. So in the example below it will use yourdomain.com. If your domain is ad.yourdomain.com, set Yes below the Specifiy domain or OU.

Finally, your deployment is succesful as you can see in the screenshot below. It took about 9 minutes for the DSCextension completed, per VM:

Open HTML5 webclient

Now go to the HTML5 client to open your desktop: https://rdweb.wvd.microsoft.com/webclient/index.html

Add users to your desktop

As a final step, add users to your desktop:

1
Add-RdsAppGroupUser -TenantName $myTenantName -HostPoolName $hostpoolname -AppGroupName $appgroupname -UserPrincipalName upn

The post How-to deploy Windows Virtual Desktop in Azure appeared first on Erjen Rijnders.

Index:

1. Security and Compliance center
2. Service Encryption
3. Advanced E-Discovery
4. Windows Virtual Desktop, RDMI & Windows 10 Multi-User

Security and Compliance center

Microsoft covers a big part protecting us from malicious tools and attackers, but there is still a part that we must do. And I can tell you that it is the most important part, like activating MFA, encrypting sensitive data etc. This slides covers what Microsoft does and what you have to do.

So about the part that we are responsible of, Microsoft provides us multiple tools. How do AIP and OME help with compliance? Check this slide.

There are certain scenario’s that you don’t want that Microsoft manages your key. Some regulatory reasons might require you to manage your key so the security is end-to-end. BYOK might be sufficient since you can store your own key in Azure Key Vault. If that isn’t even good enough you have the HYOK where you store it on-premises. Keep in mind that this option is much less flexible. You only have access to your secured documents as long as you can reach the on-premises key for decryption. Here is an overview of licensing.

Here is a great overview of BYOK. It makes clear that it is as flexible as the Microsoft-managed keys, but it does give you more overhead since you need to manage the key now.

Some good insights when using BYOK.

Service Encryption

Some good news, if we use the Microsoft-managed keys or BYOK, we will have service encryption in Exchange Online, starting to rollout in January 2019 (already available in SharePoint). Once we create a Data Encryption Policy (DEP), It will encrypt our data at storage level. This is required if you want to meet compliance.

Advanced E-Discovery

With the advanced E-Discovery set in Office 365 by using the analytics, we can further minimize the data. It will deduplicate data for example and only present us with relevant data. We are also presented now with a much better E-Discovery dashboard. We see what kind of data the hold holds, but we are also able to communicate with the persons in a specific hold, make searches in it etc. Great improvement!

Now creating a Legal Hold is doable, but not that easy. But it will be! Here is a great overview of how it is now and how it will be very soon.

So these are some great new features! For sure you will see a more in-depth bog when it’s available.

Windows Virtual Desktop, RDMI & Windows 10 Multi-User

Now also a little bit of info about Windows Virtual Desktop, as I can imagine you want to see some updates about this as well. One of the bigger announcements is Windows 10 Multi-User within Windows Virtual Desktop, so you will connect to shared hardware. If you spin up a Windows Virtual Desktop, you can decide how many users you want to connect to that VM which makes it a lot cheaper. There will be a Windows Desktop Calculator soon which gives some recommendations of this, based on the chosen size.

Automatic scaling will be available as well. You can auto scale based on two methods: Breath Mode and Depth Mode. The Breath Mode needs reserved instances so turning off a Virtual Desktop doesn’t help you. However, this can still be cheaper, that’s something you need to calculate. The Depth Mode is based on activity. If no users are logged in anymore in a Virtual Desktop, it will automatically turn off the VM and it will save you money. On the other hand if it’s too busy, it will spin up some new VM’s.

Windows Virtual Desktop will be available through the Azure Marketplace.

The post Microsoft Ignite day 5 appeared first on Erjen Rijnders.