I Ran Hybrid AVD For Years: 5 Steps To Finally Ditch Active Directory

Summary

The video demonstrates how to convert a hybrid Azure Virtual Desktop (AVD) setup into a cloud-native environment that does not depend on Active Directory domains. The main components are Entra ID-joined session hosts and Azure Files storage authenticated through Entra Kerberos.

Main Setup Steps

1. Create an Entra ID directory profile in Nerdio and enable Intune enrollment for the cloud hosts.

2. Set up Azure Files for FSLogix profiles.

   • Create a file share and configure share-level access for cloud-joined users.
   • Use premium storage for production. Zone-redundant storage may be suitable for zone-based deployments.
   • Configure file and folder access in place of domain-based NTFS permissions. Grant administrators full control and assign appropriate access to FSLogix users.

3. Enable Entra Kerberos access for the storage account.

   • Grant the required API consent and add the specified tag to the storage app’s manifest.
   • Exclude the relevant storage resource from MFA in Conditional Access policies. The presenter says this targeted change is needed because of an authentication limitation affecting FSLogix cloud sign-ins.

4. Configure FSLogix and RDP profiles in Nerdio.

   • Create an FSLogix profile linked to the Entra ID-joined share. Exclude administrators so they can sign in to troubleshoot if FSLogix fails.
   • Configure application, logging, and optional profile-redirect settings.
   • Create an RDP properties profile to reuse with cloud-joined host groups. The presenter notes that two settings are essential for those hosts.
   • The presenter provides recommended FSLogix and RDP settings in a GitHub repository.

5. Deploy and validate a cloud-joined host group.

   • Select the Entra directory, FSLogix and RDP profiles, network, image, VM configuration, and Entra user group.
   • Apply an autoscaling profile and enable autoscaling.
   • Sign in with a cloud user, confirm the file share opens and the FSLogix profile disk is created, then inspect the mounted disk and its permissions.

Once validated, FSLogix can carry user settings across new cloud-joined hosts. The presenter also refers viewers to a separate video about autoscaling.

Guides and Resources

• Step-by-step tutorial: Entra ID directory, Azure Files and FSLogix configuration, application consent and manifest changes, Conditional Access adjustments, host deployment, and testing.
• GitHub repository: Recommended FSLogix settings, profile redirects, and cloud-join RDP properties.
• Microsoft documentation: Entra Kerberos and configuring clients to retrieve Kerberos tickets for Azure Files.
• Related video: A guide to AVD autoscaling.

Speaker and Source

The presenter shares experience running hybrid AVD and demonstrates the configuration in Nerdio Manager for Enterprise. Nerdio Manager for Enterprise is the channel/source; the presenter also references a GitHub repository and Microsoft documentation.