Windows Virtual Desktop technical (2020 spring update – ARM-based model public preview) deployment walkthrough. It covers all you need to know and beyond!


Click here if you are looking for instructions for the non-ARM based – 2019 fall release of Windows Virtual Desktop.

The new Windows Virtual Desktop (WVD) Azure Resource Manager (ARM) based model is now in Public Preview available for everyone – and the interest is enormous. It addresses a lot of customer feedback, such as extra management (GUI) capabilities, AAD group support, metadata location changes and more… WVD can be a good fit for different kind of scenario’s to enable remote working.

“An Elastic Compute Resource hosted in the cloud and available anywhere in the world on any device”

In this article, I’d like to cover the deep(er) technical points, while some are just not part of the public message but still way too important not to share. It’ll hopefully help you as consultant or architect to bring the technical (and functional) message around Windows Virtual Desktop – ARM-based to your customers 😊! Continue reading…

Note: The Windows Virtual Desktop spring update is based on ARM and the previous functionality of the service in the Azure Portal was non-ARM so pre-existing information will need to be migrated into the console using tools that we (Microsoft) will be releasing shortly.

Table of Contents

Click on the title to jump to that spot in this article:

The Desktop-as-a-Service market is growing

Gartner expects that by 2023, 30% of all the on-premises VDI users will access a workspace in the cloud using DaaS!

The yearly VDI Like A Pro survey lists Windows Virtual Desktop as number one as response to the question below. With remote working more popular than ever due to the current circumstances this is still unexpected. This yearly research is a global initiative for and by the entire EUC community and answers independently how the market looks like.

Note: Please help. You can still participate in the VDILIKEAPRO 2020 survey here.

New Azure Portal – Dashboard

The new landing page for Windows Virtual Desktop in the Azure portal looks like this. It’s very slick and steps are dramatically simplified. Previous steps such as consent, and PowerShell creation of the tenant are all gone! Learn more about it later on in this article.

Differences between WVD non-ARM and ARM

The new Management portal integration is completely build on ARM, which means that permissions can be managed via role-based access control (RBAC). All the deployment objects of WVD e.g. host pools, workspaces etc are objects within your Azure subscription. This makes it easier to manage and automate your environment.

See below the most important differences and changes of WVD non-ARM current and ARM future also called the 2020 spring release!

Differences from a more high-level component architecture. One important name change is the switch from tenant to Workspace.

User session management

With the new ARM-based – spring update release of Windows Virtual Desktop being available. We also have the option to do more user session troubleshooting directly from the Azure Portal. The users menu option gives us the option to search for users, see their active sessions, application assignment, and send them messaging during maintenance work.

This allows helpdesk employees to do some first line of support for Windows Virtual Desktop from the Azure Portal.

Custom RDP Settings (via the portal)

Previously in the non-ARM version of Windows Virtual Desktop, you had to activate RDP settings via PowerShell. In the new ARM-based model it’s possible to do this directly from the Azure Portal menu (GUI).

New PowerShell Modules

As part of this release, WVD now also integrates into the AZ PowerShell module. Command are now with e.g. Get-AzWvdDesktop instead of Get-RDSDesktop. This leaves up to still create all the Windows Virtual Desktop components completely automated via PoSH. ARM templates for doing the Workspace (tenant), host pools and application group deployments automated are coming soon. More information can be found here.

Windows Virtual Desktop and Azure Log Analytics

The main purpose of leveraging Public Cloud is not saving money. It’s around leveraging platform services to adopt as much as services to create the digital workspace for your business.

One of those platform services in Azure is Log Analytics, the service to gather metrics in your environment and bring them down to one single pane of glass dashboard. Log Analytics gives you all the information about sessions. This includes e.g. bandwidth and latency for every single user and session on your site. This can be relevant for troubleshooting or just monitoring purposes, and it doesn’t require any additional investments.

There a lot’s of new metrics and integrations possible now within Windows Virtual Desktop directly from the Portal. Here is a list of custom queries you can use. 

  • Diagnostics information gives you insights on:
    • Management Activities:
      • Understand when modifying Windows Virtual Desktop objects (e.g. creating host pools) using APIs or PowerShell are successful.
    • Feed:
      • Understand if a user can successfully subscribe to a workspace.
      • Understand if the users see all resources published in the remote desktop client.
    • Connections:
      • Understand when a user has initiated a connection and when it is completed.
    • Host Registration:
      • Understand if the session host has been successfully registered with the service at connection time.
    • Errors:
      • Understand for any of the activities above in an issue that happened. As this is a separate table this information needs to be joined with the activities.

Once more – What is Windows Virtual Desktop?

People that follow my blogs know that I explained the services and benefits earlier. However, for the people who didn’t catch that yet, here is a short run-over.

“Windows Virtual Desktop, or WVD in short – is a born in the cloud Desktop-As-a-Service platform service offering on top of the Microsoft Azure Cloud. All the infrastructure services, such as brokering, web access, load-balancing, management and monitoring is all setup for you as part of the control plane offering. It also gives you access to the new Windows 10 Enterprise multi-session Operating System – which is completely optimized for the sake of Office 365 ProPlus services, such as Outlook, OneDrive Files on Demand (per-machine), Teams etc.“

The only responsibility in terms of management effort is the golden images on top of Azure Infrastructure-As-a-Service (IaaS). The rest is all managed for you through the Azure service SLAs. Sounds pretty cool, right?

Let’s first start with the things you might not know about it

  • Windows Virtual Desktop gives you the only multi-session Windows 10 experience, including compatibility with Microsoft Store and existing Windows line-of-business apps, while delivering cost advantages.
  • Allows you to virtualize both Full desktops and RemoteApps.
  • You can also use to for persistent Windows 10 – single user virtual desktops.
  • WVD will support Windows 7 virtual desktops and is the only way you can safely run Windows 7 after its End of Life on 14 January 2020. Windows 7 desktops on WVD will be the ONLY systems that receive free extended security updates.
  • Customers with the following license SKUs are entitled to use WVD with no additional charge apart from Azure compute, storage, and network usage billing:
    • To run Windows 10 multi-session, Windows 10
      • Microsoft 365 F1, E3, E5, A3, A5, Business
      • Windows 10 Enterprise E3, E5
      • Windows 10 Education A3, A5
      • Windows 10 VDA per user
    • To run Windows 7
      • Microsoft 365 E3, E5, A3, A5, F1, Business…Windows E3, E5, A3, A5
    • To run Windows Server 2012 R2, 2016, 2019
      • Remote Desktop Services (RDS) Client Access License (CAL) with active Software Assurance (SA)
  • Windows Virtual Desktop session host VMs are not exposed to the internet directly. They can run using a private IP address and run isolated from other workloads or even the internet. The reverse connect technology allows the VMs to be accessed
  • When a user connects to the WVD service, the use of Azure Active Directory (AAD) as the identity provider allows you to leverage additional security controls like multifactor authentication (MFA) or conditional access;
  • Deeply integrated with the security and management of Microsoft 365, such as Intune Modern Management
  • From a best practices point of view; Make sure all Azure resources are in the same region
  • All the Nvidia vGPU / and the recently announced AMD EPIC CPU/GPU graphical enhanced N-Series virtual machines on Azure are supported with Windows Virtual Desktop.
  • Citrix is adding their own Citrix Cloud stack as well to Windows Virtual Desktop, read more about this here.
  • VMware Horizon Cloud is now also available as extension to Windows Virtual Desktop, read more about this here

The architecture behind it all

The first step that you must do is creating the Azure Managed image, or golden image in VDI terms (or use one pre-build from the gallery). Most often, this will be based on the new Windows 10 Enterprise multi-session Operating System, which is now available from the Azure Marketplace. After enrolling the server, you can start installing the application on the machine. When you’re done, you must capture the machine as an image to use as a base for your Windows Virtual Desktop deployment.

The Microsoft-managed control-plane is a completely redesigned infrastructure that leverages native Azure platform services to scale automatically. Think about Azure front-door as a global load-balancer for the RDP connection, Azure App Services in Azure for hosting the infrastructure services, and Azure SQL DB for hosting the RDS Brokering databases. Leveraging these services is the main reason why this service is so cost-effective, which is the purpose of the Cloud and what it’s built for!

WVD User connection Traffic Flow

To give you a better understanding of how Windows Virtual Desktop connections work, I’m sharing the traffic flow (the traffic flow requires the following network URL and protocol access). This is also useful for troubleshooting purposes.

Connecting from your virtual machine in Azure to your Host Pool (session hosts in Azure Infrastructure-As-a-Service) works differently with Windows Virtual Desktop. It uses Reverse Connect, which means that no inbound ports need to be opened on the VM to setup the RDP connection. Once the connection flow proceeds, bidirectional communication between your session hosts/host pool will go over port https (443). This port is almost always open from the inside to the outside, so it’s perfect for a remote connection to Windows Virtual Desktop!

Windows Virtual Desktop is a global load-balanced service via Azure front-door. This means that the traffic flow below always goes via the nearest management control-plane/service location – which you can see in the middle bucket below.

The service is globally available with management plane in:

Central US, East US, West US 2, North Europe, West Europe, India, Singapore, Australia, and South America – as of 01.05.2020.

See below in more depth how the traffic flow works.

  • User launches RD client which connects to Azure AD, Azure MFA, user signs in, and Azure AD returns token
  • RD client presents token to Web Access, Broker queries DB to determine resources authorized for user
  • User selects resource, RD client connects to Gateway
  • Broker orchestrates connection from host agent to Gateway
  • RDP traffic now flows between RD client and session host VM over connections 3 and 4

Windows Virtual Desktop service network access requirements

To make this traffic flow possible – you need to have at least firewall rules / NSGs / service tags in place for the following network addresses – otherwise WVD won’t work correctly. When you use an ExpressRoute with force-tunnelling to your local gateway, make sure to configure the routing tables correct, as described for KMS in this article. Within configuring this – your virtual machines won’t be able to communicate to our Azure KMS server. There’s also the option to use Azure Service Tags with all the URLs/Ports pre-configured and auto-updated for you – this could make your life a lot easier.

Note: If you don’t arrange access at the VNET level to the URLs/Ports below – your deployment most likely will fail! 

To connect from the client – endpoint location. The following network access is required to setup the session to the WVD service.

Measure your latency – tools

We can use the online Experience Estimator tool to measure your latency to the nearest control-plane location (as described above) – without deploying a host pool. The tool is web-based and can be found here. The tool measures to the nearest control-plane the latency and as well from the control-plane to the (over the Azure backbone) Azure datacenter region you select to deploy your host pools in.

Another option is to use the latest WVD Windows Client and request for the details of the connection!

Manage Windows 10 multi-session via Endpoint Manager (MECM)

Microsoft Endpoint Configuration Manager (previously known as SCCM) supports Windows 10 Enterprise multi-session since build 1906. Keep in mind that Operating System filtering based on this new Operating system isn’t integrated into the product yet and will require a customer WMI query with the following information below.

WMI query: (select * from Win32_OperatingSystem where OperatingSystemSKU = 175)

What about GPUs?

Windows Virtual Desktop – supports graphics acceleration, check out for more information Choose your graphics rendering technology. Azure has other graphics acceleration deployment options and multiple available GPU VM sizes. Learn about these at GPU optimized virtual machines sizes – especially the new Nv4 virtual machines enhanced by a AMD EPIC CPU/GPU are interesting to test due to the fact it supports GPU-P and Premium SSD. More info here.

MSIX app attach – app delivery of the future

MSIX (without app attaches) is a Windows app package format that provides a modern packaging experience to all Win32, UWP, and Windows apps. It’s a new way of doing application virtualization compared to technologies such as App-V.

Adding the app to attach technology makes MSIX more compliant for virtualized desktop environments such as Windows Virtual Desktop. The main challenge within DaaS/VDI around application delivery is around the images and how the apps come into the image. Separating the applications from the image to update and assign applications without doing an image update sounds like the solutions, right? Well, that’s exactly what MSIX app attach can accomplish…

See below the most important benefits:

  • Less re-imaging
  • Same package format across your entire organization
  • No repackaging needed, most likely ISVs will provide packages to customers
  • Applications are indistinguishable from app in the OS image

Learn in one of my latest new blogs more about the process to enrol and use MSIX app attach with Windows Virtual Desktop.

Windows Virtual Desktop – ARM-based portal enrolment process

In the next steps, I’ll explain how you enrol Windows Virtual Desktop from scratch with a customer created Windows 10 Enterprise multi-session image among tips and tricks.

Pre-requisites for Windows Virtual Desktop

The following requirements are needed for the use of Windows Virtual Desktop on Azure.

  • Azure Subscription
    • Azure Active Directory setup
    • Azure AD Connect
  • Entitled for licensing
  • Admin permission to enable resource provider on subscription
  • Admin with privilege to create VMs
  • (optional) custom image
  • Domain controller
    • This AD must be in sync with Azure AD so users can be associated between the two
    • VMs must domain-join to Active Directory
    • Optional: Azure AD Domain Services (in replacement for domain controller)
  • Profile Containers network share on Azure Files or Azure NetApp Files (See here our recommended Azure Managed options)
  • VNET pre-created with connection to the domain
    • Network must route to a Windows Server Active…Directory (AD). See here all the required ports and URLs. – same for the endpoints/client access, find them here.
    • Optional: Networking/on-prem connectivity – express route, VPN, etc.

Create an custom Windows 10 multi-session image

Note: You can skip this step and start here if you want to use a Microsoft prepared image with Windows 10 multi-session + Office 365 ProPlus. 

We start with the creation of a custom Azure Managed image (right now based on Windows 10 Enterprise multi-session, however Windows 7 and Server 2012 R2 and higher is supported as well). This image can be used during the new Azure Portal enrolment process to make sure all our new session hosts based on Windows 10 Enterprise multi-session includes all our agents and corporate applications.

During this enrolment we go through different the range of layers, including applications, incorporating language components, and tailoring system settings to adhere to Azure recommendations – to effectively make it customer and end-user ready. Let’s start.

We start with the creation of a custom Azure Managed image(right now based on Windows 10 – multi-session, however Windows 7 and Server 2012 R2 and higher is supported as well). This image can be used during the new Azure Portal enrolment process to make sure all our new session hosts based on Windows 10 Enterprise multi-session include all our agents and corporate applications.

Note: When you want to use a prepared (E.g. Windows 10 multi-session + Office 365 ProPlus) image from the Azure Gallery – please skip these steps and continue here.

Go to Virtual Machine

Click on + Add

Click on Browse all images

Select Windows 10 Enterprise multi-session + Office 365 ProPlus

Once the virtual machine is enrolled and up and running:

Connect – your VM-Image – through Azure Bastion – or RDP to the machine – this can be internally or externally.

Once you are logged on to your master image. Now we can add our agents to the image, such as the FSLogix Apps Agent, plus your own agents and line of business (LOB) – applications.

Install OneDrive Per-Machine

By default, the OneDrive sync client installs per user on Windows, meaning OneDrive.exe needs to be installed for each user account on the PC under the %localappdata% folder. With the new per-machine installation option, you can install OneDrive under the “Program Files (x86)” directory, meaning all profiles on the computer will use the same OneDrive.exe binary.

You can download the new per-machine version of OneDrive below:

https://go.microsoft.com/fwlink/?linkid=2083517

Make sure to re-install the application by using the following command.

OneDriveSetup.exe /allusers

Also, when running this on a multi-session environment, this means that on that same session host, all the different user-profile – OneDrive versions will update simultaneously – which can get messy in terms of network throughput. This is also solved with the per-machine version.

The per-machine version will update itself by a service/account which injects itself during the installation. Therefore, you always need to run the installation as local administrator with UAC privileges.

OneDrive Known Folder Move – modernize your profile

Recently, the OneDrive team added Known Folder Move functionality support to OneDrive, which is very useful to create the same end-user experience for our users on Windows Virtual Desktop as they would have on a Modern Desktop with all profile folders, such as My Documents, Pictures, Favorites, Desktop, etc. redirected to OneDrive. Also, with the use of OneDrive Files On-Demand, you’ll be able to save storage space from your profile folders due to the possibility to work with tiering for your hot and cold data.

While using Known Folder Move on different devices or VDI environments in conjunction with the same OneDrive account. You ensure to always have your Office 365 documents on the same location, everywhere you go! Even on your mobile device, without any notice 😊

Activating Kown Folder Move is relatively easy. You can use the manual approach by opening the OneDrive client from the Start menu and click on Update Folders.

You can also use the automated approach

Enabling this policy sets the following registry keys:

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptIn"="1111-2222-3333-4444"

(where “1111-2222-3333-4444” is the AzureAD Directory – tenant ID, which you can find in the Azure Portal – under the properties menu of your Azure AD tenant)

In the end, your profile folders will look like this, and are completely in sync with your OneDrive account.

Install Teams Per-Machine

To install Teams per-machine installation, create the following registry key in the image

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Teams\IsWVDEnvironment]
Type: REG_DWORD Value: 1

Download Teams and run the command below

msiexec /i <msi_name> /l*v < install_logfile_name> ALLUSER=1

If everything ran perfect you will see Teams showing up in the Program Files directory.

Audio and Video aren’t that optimal – you still can use Teams within WVD for chat, presence and screen sharing. Wait for our Teams AV Redirection client – comes next month. See also our public roadmap here.

Add language packs

Make sure to following the steps in this article to add additional languages to the Azure Managed Image.

https://docs.microsoft.com/en-us/azure/virtual-desktop/language-packs

Add FSLogix Profile Container as a profile delivery solution

Note: If you are interested in how you could Azure Files or Azure NetApp Files within WVD. Please consider one of the two articles below in addition to this blog. You can find ALL the differences between the two options here

In general IOPS between 5 and 15 (depending on workload/amount of Office 365 applications) per user’s FSLogix Profile Container, with ~10x during sign in and sign out is adequate to use as a rule of thumb – preferred below the 5 ms (the lower the better). 

Download the FSLogix agent and install it in your Windows Virtual Desktop image – virtual machine. FSLogix is available for download here

Install the FSLogixAppsSetup agent in the image

Wait for the installation to be finished…

The configuration part of FSLogix Profile Container can be performed in either registry settings or group policy files. The most simple and effective method is using the registry settings below.

Open regedit.exe and browse to “HKEY_LOCAL_MACHINE\Software\FSLogix\Profiles”

Create a REG_SZ value name “VHDLocations” and enter new Azure Files network file share path (e.g. \\fslogixwvddemo.file.core.windows.net\fslogixprofiles)

Create a DWORD value name “Enabled” and give it value 1.

Create a DWORD value name “DeleteLocalProfileWhenVHDShouldApply” and give it value 1. The one deletes existing local profiles before logon – this avoids errors.

Create a DWORD value name “FlipFlopProfileDirectoryName” and give it value 1. The one changes the folder name to USERNAME-SID which is much easier during troubleshooting or maintenance search-related work.

Tip: The most important settings for the usage of FSLogix Profile Container are the Enabled and VHDLocations registry setting. There are some other settings that I default recommend to enable. The VolumeTypesetting changes to disk type to VHDX. You can provide more maintenance tasks via PowerShell with VHDx so I advise changing that from default VHD to VHDx.

Note: If you are using Windows 10 Enterprise single and multi-session or Windows Server 2019, you don’t have to enable the RoamSearch setting. The Search DB is already stored in your user profile.

See here all the other advanced registry settings for FSLogix Profile Container. The example below is with Azure Files.

Make sure to configure the following Antivirus exclusions for FSLogix Profile Container.

  • Exclude Files: 
    • %ProgramFiles%\FSLogix\Apps\frxdrv.sys
    • %ProgramFiles%\FSLogix\Apps\frxdrvvt.sys
    • %ProgramFiles%\FSLogix\Apps\frxccd.sys
    • %TEMP%\*.VHD
    • %TEMP%\*.VHDX
    • %Windir%\TEMP\*.VHD
    • %Windir%\TEMP\*.VHDX
    • \\server\share\*\*.VHD
    • \\server\share\*\*.VHDX
  • Exclude Processes
    • %ProgramFiles%\FSLogix\Apps\frxccd.exe
    • %ProgramFiles%\FSLogix\Apps\frxccds.exe
    • %ProgramFiles%\FSLogix\Apps\frxsvc.exe

Finalize (sysprep) the Windows 10 multi-session image

Sysprep (Generalize) your image and shut down the virtual machine.

Note: You can also perform this action directly from the Azure portal – during the Managed image capturing process.

To wrap the Windows 10 Enterprise multi-session image up and start the host pool enrolment process from the Azure Marketplace, we must shut down the virtual machine to release the image.

Capture the custom – Azure Managed – image


Create a Azure managed (custom) image from the VM in the Azure portal. Click on Capture

Note: The benefits of using an Azure Managed Image is that everything that you install will be used as the baseline for the enrolment later during the Azure Marketplace procedure. All the virtual machines you select to enrol will include all the same software as you now install. For 500 virtual machines that save a lot of post-installation work. Of course you can use your own automation solution and build images from scratch and add your software afterward (post-installation) – it’s all up to you! 

Create the image. Enter the Name and Resource groupYou can provide your own versioning in the name.

Note: If the enrolment fails based om the Managed Image your created, it could be that the VM on Azure didn’t pick up the Generalized status on the VM level. You can force this by running the PowerShell command below.  

Set-AzVm -ResourceGroupName $rgName -Name $vmName -Generalized

Create an Azure Shared Image Gallery (SIG)

Note: The step below is optional. You could deploy a host pool based on a Azure managed image (only) as well. However, to make host pool – image management a lot easier in case you need to update your session host – the steps below are recommended.

You also have the option to use the Azure Shared Image Gallery (SIG) within Windows Virtual Desktop as source for your images. You can share your images to different users, service principals, or AD groups within your organization. Shared images can be replicated to multiple regions, for quicker scaling of your deployments. Read more about it here.

  • Managed global replication of images.
  • Versioning and grouping of images for easier management.
  • Highly available images with Zone Redundant Storage (ZRS) accounts in regions that support Availability Zones. ZRS offers better resilience against zonal failures.
  • Sharing across subscriptions, and even between Active Directory (AD) tenants, using RBAC.
  • Scaling your deployments with image replicas in each region.

Additional tips and tricks. If you are not aware of Azure Image Builder, please have a look here. I also recommend to watch this Ignite session. The process works pretty simple and could simplify how you do update and image management today as you can easily create new images based out our Azure Marketplace gallery which receives all the latest updates directly after patch Tuesday. In this (below steps) article we use the manual approach via the Azure Managed image creation process.

More info on automation scripts for FSLogix and templates for AIB can be found here: https://aka.ms/azvmimagebuildertesting.

Let’s start the creation of the shared image out of a Azure Managed Image

Look for Shared image galleries in the Azure menu

Click on Add

Create the Gallery

Click on Review + create

Click on Create

Open the new created Gallery

Click on + Add new image definition

Fill in the required information as similar below

Click on Next: Version

Note: EMS stands for (Windows 10) Enterprise multi-session. 

Give in a major/minor patch number for doing proper versioning. Take over the settings as below based on your pre-created Azure Managed image.

Select the different regions you want to make this image available in. You can select multiple when your WVD deployment is global! Pretty cool though.😊

Click on Next: Publishing options

Note: The image version name should follow Major(int).Minor(int).Patch(int) format. For example: 0.0.1, 1.5.13. Also, make sure the setting “Exclude from latest” stays on No.

The following settings are optional and just recommendation that we not going to use as we define the size via the host pool enrolment process of Windows Virtual Desktop.

Click on Review + create

Click on Create

Your Shared Gallery image(s) (SIG) will now be created and distributed across the different regions and ready to use as source for the next steps!

Perform the Microsoft.DesktopVirtualization resource provider registration

Open the Azure Subscriptions services menu

Open the Azure subscription where you are going to deploy your Windows Virtual Desktop environment

Click on Resource providers

Search for the Microsoft.DesktopVirtualization – provider and click Register

Confirm the registration. There must be a green checkbox next to the Microsoft.DesktopVirtualization provider as in the screenshot below.

Now we are done with the pre-steps. We can now start with the enrolment process.

Create your host pool

Now we come to the point where we can use our master image as baseline of our deployment. A host pool is a collection of session hosts (right now based on Windows 10 – Multi User, however Windows 7 and Server 2012 R2 and higher is supported as well). We can use them later to assign our Desktops and Published Apps to.

Search for Windows Virtual Desktop in the Azure menu

Create a host pool

Click on Create a host pool

Choose your subscription, metadata location and host pool properties

Click on Next: Virtual Machines

Note: Metadata locations are only active in the USA at the moment. Europe will be added soon. You can deploy continue deploying while having the metadata in the US (e.g. East US 2) and deploying your virtual desktops in West Europe. Make sure that your Managed Imaged is deployed in the same region as the Workspace/metadata. 

Using Windows 10 single session? Make sure to change the host pool type to personal.

VM details

First click on Yes

Give in the VM details –select the size and image for your enrolment 

Note: You can deploy in West Europe, this Azure datacenter location is where you deploy your virtual desktop – session hosts in. This is independent of the metadata location.

Note: Session hostnames cannot exceed 10 characters due to the auto-count prefix that comes extra.

Note: The following three articles lists the maximum suggested number of users per virtual central processing unit (vCPU) and the minimum VM configuration for each workload. This could be helpful to see what your first estimation of VMs as part of your host pool.

Select your image type

Skip this step here if you are not using a custom image, and decided to go for one of the Marketplace images (Microsoft prepared). You must install apps, and agents such as FSLogix and OneDrive afterwards.

Click on Browse all Images

Important decision to make when using custom image(s) – read carefully!

1: My image. You cannot instant update host pools created based on Azure Managed images (images under My images) as part of the host pool. So in case of an image update, you have to re-create the host pool. 

2: Shared images(SIG). It’s most likely that you want to keep using the existing host pool due to the fact of all the Remote Applications and Desktops – Applications groups and assignments. This is the part where the Azure shared image gallery (SIG) comes in very handy due to the support for versioning, read the benefits again here. It will automatically pick and select the latest image version.

Once you need to update your existing host pool, you only have to deploy new session host VMs and drain old VMs and your host pool is up to date again! I’ll explain how you update the image later on here.

Select our custom created Windows 10 Enterprise multi session Azure Managed image / or the one from the shared image gallery (SIG)

Note: as mentioned above, the shared images have more benefits in terms of updating and replicating images across different regions.

Network and security

Provide the properties for your Azure Virtual Network to join your session hosts in.

Note: Make sure that the DNS servers of your Azure VNET are pointing to the domain controllers DNS servers to make sure the FQDN can be resolved!

Note: Also make sure that all the URLs below are reachable from that VNET!

Administrator account

Enter in a service account to join your session hosts to your AD (Kerberos – ADDS) domain

Click on Next: Workspace

Create the Workspace

The Workspace is the new name for tenant. We can now create this directly do this in the Azure Portal instead of using PowerShell before!

Click on Yes and Create new

Give in a name for your Workspace (tenant)

Click on Ok

Click on Review + Create

Start the enrolment

Review your settings – click on Create to start the deployment

Create and Assign Remote Applications (to AAD Groups!)

The process of publishing applications has become easier as well. First you must create a application group based on Remote app as type.

Select your host pool and resource group properties

Select either a user or Azure AD group to make it more Dynamic. Yes we support Azure AD groups!

Add your (Remote) application from the start menu from the session host to publish

Select your Workspace

You can also easily adjust existing host pools (RemoteApp) and add new Applications on the fly!

Add session hosts to existing host pool

Great enhancement. Since the new ARM based Portal release – you are able to expand host pools easily based on existing images.

Note: The designated ARM templates that can do this will follow later.

Click on + add in the host pool

Follow the requirements and add extra machines to the host pool!

Note: This procedure works for as well Azure managed images and shared images.

Update the host pool images – create a new image version (SIG only)

Note: This process only applies to the host pools with source Shared images (shared image gallery – SIG) only. When you decided to create the host pool with My images as source (Azure Managed). You must re-create the host pool based on the updated image.

The maintenance process of your Windows Virtual Desktop environment is just as important as the enrolment process. The prior created Azure Managed Image – we used as custom image can be used again to use as baseline to provide the extra updates on top. .

First you need to apply your updates to your image. This obviously could be anything, such as LOB application updates, agents or just the FSLogix client as example.

You can create a new Virtual Machine from the Virtual Machines (IaaS) menu (not the host pool this comes later) with the previous version (or another version if you want to revert more changes) – and spin that machine up.

Select the source version  it will automatically pick the latest version.

After the VM enrolment is done, install all the updates on the VM. This can be done automated or manually (use RDP or Azure Bastion to secure remote into the VM – image)

Now we need to sysprep (generalize) the machine and make sure to capture it again as image.

Go back to your Shared image gallery

Open your existing shared image, for me that’ll be WIN10-EMS

click on + add version

This is the most important part. Make sure to select the new Azure Managed image (from the last capture process) as source with (of course) a new versioning number to make sure the host pool enrolment picks the latest newest version as default.

Select the End of life date and DC locations (if any) to make this new image available in as well.

Click on Review + create

Note: Make sure that the option, Exclude from latest is set to NO. If this setting isn’t configured in the right manner – the host pool process will not pick the latest version as source!

 Click on Create

We can start with adding sessions hosts to the designated host pool.

Go to your host pool that was previously configures with shared images (SIG) as source.

Click on + Add

Note: We are adding extra machines to the host pool. Make sure to put the older versions in drain mode, or remove them to make sure new user sessions are logging on to the new image version.

Click on Virtual Machines

Enter in the Number of VMs to add/update to the host pool (based on the new image – it’s greyed out but it will use the latest version out of the My images / or shared image gallery – that’s why the numbering and latest setting is so important while creating the host pool).

Select your Azure Virtual Network (VNET) and AD join service account credentials.

Click on Review + create

Click on Create

Post-enrolment host pool automation (optional) 

Note: You can also add machines manually to the host pool by installing the WVD Agent and bootloader on your virtual machine – during the installation it will ask for a token. You can request (or create a new one) via this PoSH command Export-AzWVDRegistrationInfo to create a new registration token – or Get-AzWvdRegistrationInfo to export an existing token. Download the Windows Virtual Desktop Agent and bootloader the Windows Virtual Desktop Agent Bootloader here. You can use the silent (automated) commands below to install the WVD agents without manual interaction in each VM! One for the WVD agent and the other one for the WVD bootloader agent.

WVD Agent command

Start-Process -FilePath "msiexec.exe" -ArgumentList "/i $AgentInstaller", "/quiet", "/qn", "/norestart", "/passive", "REGISTRATIONTOKEN=$RegistrationToken", "/l* C:\Users\AgentInstall.txt" -Wait -Passthru

Bootloader command

Start-Process -FilePath "msiexec.exe" -ArgumentList "/i $AgentBootServiceInstaller", "/quiet", "/qn", "/norestart", "/passive", "/l* C:\Users\AgentBootLoaderInstall.txt" -Wait -Passthru

Change the name of your Workspace

It could be helpful and more customer friendly to change the name of the Windows Virtual Desktop environment to Windows Virtual Desktop like in the example below, or your customer name. I’ll explain how you can do that.

Go to your Workspace properties in the Azure Portal and change the Friendly Name

Change the name of your Virtual Desktops

The same for your Virtual Desktop names. There’s also an option to change them something custom such as Session Desktop as example below.

Go to the Application Group and open the properties

Change the friendly name to anyone you like

Install the Windows Virtual Desktop Client

To run your Windows Virtual Desktop – Full Desktops or RemoteApps directly from the client and/or start menu, you must install the WVD Client.

Download the WVD client below

http://aka.ms/wvd/clients/windows 

Start the WVD Client – Desktop app

Click subscribe with URL

Enter the following ARM-based – https://rdweb.wvd.microsoft.com/api/arm/feeddiscovery – URL.


Enter a user that has a desktop or apps applied.

Click on Next

Enter your credentials

Provide Azure MFA (if activated).

Note: When you use Azure MFA you might want to take a look at one of my other articles here as well to enforce or whitelist Azure MFA for your end-users for the Windows Client. 

Your RemoteApps and Desktops are ready to use!

Use the HTML5 Web portal

WVD can be accessed without a client or agent from a web browser, which can be beneficial when you need to do some work without having your own device with you.

To access the RDWeb portal, please go to the short link https://aka.ms/wvdarmweb or https://rdweb.wvd.microsoft.com/arm/webclient in full length.

Logon with your credentials.

Azure MFA can be added to this as well. Azure AD Conditional Access features are supported!

If you get access, you’ll see all your Desktops and RemoteApps

We are inside our Windows 10 multi-session – session host, including OneDrive, Teams and Outlook – everything just works 😊!


Some extra information regarding client supports; Windows Virtual Desktop supports the following clients as of today.

This URL goes directly to the official Microsoft download page to download the WVD client.

  • Windows 10
  • Windows 7
  • Android
  • Chromebook*
  • Samsung DeX
  • HTML5 Web client on Windows, macOS and Linux
  • Linux SDK – zero /thinclients (via IGEL Next-gen OS)
  • Which basically means every device is supported with a HTML5 browser installed.

Keep in mind to open up the URLs and ports below from your client network environment to make WVD work.

See here a comprehensive troubleshooting overview and what to do when for feedback and support!

https://docs.microsoft.com/en-us/azure/virtual-desktop/troubleshoot-set-up-overview

Hope to see you back soon – and feel free to leave a comment if you’ve any questions.