If you’re curious and want to dive deeper into how all this works, I highly recommend checking out the Azure Virtual Desktop architecture page on the Microsoft Architecture Center. It’s a treasure trove of information! Here you can find the Azure Virtual Desktop for enterprise page including a Visio diagram that you can download and edit.

Table of Contents

1. AVD Lab Setup
2. High level diagram of the Lab Setup
3. LAB Guided Steps
4. Domain Controller
5. User Profile Disks
6. Create the DirSync server
7. Join the Storage Account to the Active Directory Domain Services
8. Create the File Share for the User Profile Disks
9. Configure the FSLogix through Group Policy
10. Create the Image
11. Create the Host Pool
12. Assign user to the host pool application group
13. User access
14. Update Image
15. Auto scale & Start VM on connect
16. Scaling plan
17. Session Limits & Stop the VMs automation
18. Authentication & Security
19. User experience & Security
20. Monitoring

AVD Lab Setup

We will create an Azure Virtual Desktop environment for 50 remote users that will work in a Pooled session host architecture. What that means? Pooled session hosts means that we will deploy a pool of 7 session hosts (Virtual Machines) where users will be load balanced to any session host in the host pool.

The operating system will be Windows 11 multi-session with Office 365 preinstalled. We will select an Azure marketplace image; we will edit it to do any customizations we need and then we will create a custom image and use it for our AVD deployment.

To store the user profiles we need a persistent storage outside the hosts (virtual machines). We will store the images to an Azure File Share of a Storage Account and we will use the FXLogix tool to manage the profile containers.

High level diagram of the Lab Setup

LAB Guided Steps

Create three Resource Groups, one for Identity, one for Networking and one for the AVD, that will include the AVD Resource, the hosts and the private endpoints, and create the corresponding Virtual Networks. The AVD-Resources Virtual Network will have two subnets, one for the Hosts and one for the Private Endpoint. Finaly peer the identity & resources networks with the networking virtual network.

#create resource groups
az group create -n AVD-Identity-RG -l germanywestcentral
az group create -n AVD-Networking-RG -l germanywestcentral
az group create -n AVD-Resources-RG -l germanywestcentral

#create virtual networks
az network vnet create -n AVD-Identity-VNET -g AVD-Identity-RG --address-prefix 10.56.0.0/24 --subnet-name domain --subnet-prefixes 10.56.0.0/24
az network vnet create -n AVD-Networking-VNET -g AVD-Networking-RG --address-prefix 10.56.1.0/24 --subnet-name AzureFirewallSubnet --subnet-prefixes 10.56.1.0/26
az network vnet subnet create -g AVD-Networking-RG --vnet-name AVD-Networking-VNET -n AzureFirewallManagementSubnet --address-prefixes 10.56.1.64/26
az network vnet create -n AVD-Resources-VNET -g AVD-Resources-RG --address-prefix 10.56.2.0/24 --subnet-name hosts --subnet-prefixes 10.56.2.0/26
az network vnet subnet create -g AVD-Resources-RG --vnet-name AVD-Resources-VNET -n privatelink --address-prefixes 10.56.2.64/26

#create vnet peerings
# Get the id for vnet-1.
vNet1Id=$(az network vnet show -g AVD-Networking-RG --name AVD-Networking-VNET --query id --out tsv)
# Get the id for vnet-2.
vNet2Id=$(az network vnet show -g AVD-Identity-RG --name AVD-Identity-VNET --query id --out tsv)
# Get the id for vnet-3.
vNet3Id=$(az network vnet show -g AVD-Resources-RG --name AVD-Resources-VNET --query id --out tsv)
# peer vnet-1 to vnet-2
az network vnet peering create --name networking-to-identity -g AVD-Networking-RG --vnet-name AVD-Networking-VNET --remote-vnet $vNet2Id --allow-vnet-access
# peer vnet-1 to vnet-3
az network vnet peering create --name networking-to-resources -g AVD-Networking-RG --vnet-name AVD-Networking-VNET --remote-vnet $vNet3Id --allow-vnet-access
# peer vnet-2 to vnet-1
az network vnet peering create --name identity-to-networking -g AVD-Identity-RG --vnet-name AVD-Identity-VNET --remote-vnet $vNet1Id --allow-vnet-access --allow-forwarded-traffic
# peer vnet-3 to vnet-1
az network vnet peering create --name resources-to-networking -g AVD-Resources-RG --vnet-name AVD-Resources-VNET --remote-vnet $vNet1Id --allow-vnet-access --allow-forwarded-traffic

# Create an Azure Firewall Basic and add an allow network rule for the LAN
az network public-ip create --name "azfwpip" --resource-group "AVD-Networking-RG" --location "germanywestcentral" --sku "Standard"
az network public-ip create --name "azfwmpip" --resource-group "AVD-Networking-RG" --location "germanywestcentral" --sku "Standard"
az network firewall create -g AVD-Networking-RG -n AVDFirewall --sku AZFW_VNet --tier Basic --vnet-name AVD-Networking-VNET --conf-name avdIpConfig --m-conf-name avdmIpConfig --m-public-ip azfwmpip --public-ip azfwpip
az network firewall network-rule create --collection-name Net-Coll01 --destination-addresses 10.0.0.0/8 --destination-ports '*' --firewall-name AVDFirewall --name Allow-LAN --protocols Any --resource-group AVD-Networking-RG --priority 200 --source-addresses 10.0.0.0/8 --action Allow
az network firewall network-rule create --collection-name Net-Coll01 --destination-addresses '*' --destination-ports '*' --firewall-name AVDFirewall --name Allow-Internet --protocols Tcp --resource-group AVD-Networking-RG --source-addresses 10.0.0.0/8
az network firewall nat-rule create --collection-name Nat-Coll01 --priority 300 --dest-addr '4.185.80.0' --source-addresses '*' --destination-ports '3389' --firewall-name AVDFirewall --name rdptodc --protocols Any --resource-group AVD-Networking-RG --translated-address 10.56.0.4 --translated-port '3389' --action Dnat

# Create a Route Table (for the lab I created one route table to route all traffic to the Azure Firewall.) and associate it to the identity and resources subnets.
az network route-table create --name Firewall-rt-table --resource-group AVD-Networking-RG --location germanywestcentral --disable-bgp-route-propagation true
az network route-table route create --resource-group AVD-Networking-RG --name route-to-firewall --route-table-name Firewall-rt-table --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address 10.56.1.4
RTiD=$(az network route-table show -g AVD-Networking-RG -n Firewall-rt-table --query id --out tsv)
az network vnet subnet update -n hosts -g AVD-Resources-RG --vnet-name AVD-Resources-VNET --route-table $RTiD
az network vnet subnet update -n privatelink -g AVD-Resources-RG --vnet-name AVD-Resources-VNET --route-table $RTiD
az network vnet subnet update -n domain -g AVD-Identity-RG --vnet-name AVD-Identity-VNET --route-table $RTiD

# create NSG (for the lab I will create just and allow lan rule)
az network nsg create -g AVD-Networking-RG -n AVD-NSG
az network nsg rule create -g AVD-Networking-RG --nsg-name AVD-NSG -n AllowLan --priority 100 --source-address-prefixes 10.0.0.0/8 --source-port-ranges '*' --destination-address-prefixes 10.0.0.0/8 --destination-port-ranges '*' --access Allow --protocol '*' --description "allowlan"
az network nsg rule create -g AVD-Networking-RG --nsg-name AVD-NSG -n AllowLanOut --priority 101 --source-address-prefixes 10.0.0.0/8 --source-port-ranges '*' --destination-address-prefixes 10.0.0.0/8 --destination-port-ranges '*' --access Allow --protocol '*' --description "allowlan" --direction Outbound
NSGId=$(az network nsg show -g AVD-Networking-RG --name AVD-NSG --query id --out tsv)
az network vnet subnet update -g AVD-Identity-RG -n domain --vnet-name AVD-Identity-VNET --network-security-group $NSGId
az network vnet subnet update -g AVD-Resources-RG -n hosts --vnet-name AVD-Resources-VNET --network-security-group $NSGId
az network vnet subnet update -g AVD-Resources-RG -n privatelink --vnet-name AVD-Resources-VNET --network-security-group $NSGId

Domain Controller

# Create a network interface with private ip address due to DNS requirements
az network nic create --resource-group AVD-Identity-RG --name "DCNic" --vnet-name "AVD-Identity-VNET" --subnet "domain" --private-ip-address "10.56.0.4"
# Create a virtual machine
az vm create --resource-group AVD-Identity-RG --name "DCVM" --image "win2022datacenter" --size "Standard_D2s_v3" --admin-username "azureuser" --admin-password "your-password" --nics "DCNic"

Login to the VM and promote to Domain Controller & DNS server. In case you have an on-premises Active Directory environment that you want to use, then you will need a hybrid connectivity (ExpressRoute or VPN) and instead of creating a new Domain, you will need to add this server as an additional domain controller. There are plenty of guides to create an Active Directory domain, like this Install Active Directory Domain Services (Level 100) | Microsoft Learn .

After the promotion, and once the DNS role is ready, change the DNS settings of all Virtual Networks to the private IP address of the ADDS/DNS server.

# Set DNS servers on VNets
az network vnet update --resource-group AVD-Identity-RG --name AVD-Identity-VNET --dns-servers "10.56.0.4"
az network vnet update --resource-group AVD-Networking-RG --name AVD-Networking-VNET --dns-servers "10.56.0.4"
az network vnet update --resource-group AVD-Resources-RG --name AVD-Resources-VNET --dns-servers "10.56.0.4"

User Profile Disks

Create one Storage Account with a Private Endpoint and a Private DNS Zone that is needed to access the Storage Account endpoint. In case of an Enterprise Scale deployment, the Private DNS Zones will be located in a centralized location. The Storage Account name needs to be globally unique.

# Create storage account
az storage account create --name avdupd916 -g AVD-Resources-RG -l germanywestcentral --sku 'Standard_LRS' --allow-blob-public-access false --public-network-access Disabled --https-only true

# Get the Storage Account ID
storageAccountId=$(az storage account show -n avdupd916 -g AVD-Resources-RG --query id --output tsv)

# Get the Subnet ID
subnetId=$(az network vnet subnet show -g AVD-Resources-RG -n privatelink --vnet-name AVD-Resources-VNET --query id --out tsv)

# Create the private endpoint
az network private-endpoint create --name avdupd916files --resource-group AVD-Resources-RG --vnet-name AVD-Resources-VNET --subnet $subnetId --private-connection-resource-id $storageAccountId --group-ids file --connection-name avdupd916filesconnection

# Create the private DNS zone
az network private-dns zone create --name 'privatelink.file.core.windows.net' -g AVD-Resources-RG

# Create the private DNS zone group
az network private-endpoint dns-zone-group create --name avddnszonegroup --endpoint-name avdupd916files --private-dns-zone 'privatelink.file.core.windows.net' -g AVD-Resources-RG --zone-name 'privatelink.file.core.windows.net'

#Create a VNET link to the identity VNET
IDVnetId=$(az network vnet show -g AVD-Identity-RG --name AVD-Identity-VNET --query id --out tsv)
az network private-dns link vnet create -g AVD-Resources-RG -n fileslinktoid -z privatelink.file.core.windows.net -v $IDVnetId -e False

Create the DirSync server

# Create a network interface
az network nic create --resource-group AVD-Identity-RG --name "DSNic" --vnet-name "AVD-Identity-VNET" --subnet "domain"
# Create a virtual machine
az vm create --resource-group AVD-Identity-RG --name "DSVM" --image "win2022datacenter" --size "Standard_D2s_v3" --admin-username "azureuser" --admin-password "your-password" --nics "DSNic"

Sync the AD DS users using DirSync

Go to the Microsoft Entra Connect / Connect Sync / and download the Microsoft Entra Connect. Install it to the DirSync server and complete the express installation. After this process the AD DS users will be synced to the Entra ID.

Join the Storage Account to the Active Directory Domain Services

The Storage Account needs to be joined to the Active Directory Domain Servers in order to support domain user permissions and SSO. The process is described in this article: Enable AD DS authentication for Azure file shares | Microsoft Learn

• Login to the DirSync server
• install the latest .Net Framework Download .NET Framework | Free official downloads (microsoft.com)
• download the AzFilesHybrid module.
• Run Join-AzStorageAccount script, changing the required parameters.

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
# Navigate to where AzFilesHybrid is unzipped and stored and run to copy the files into your path
C:\temp>.\CopyToPSPath.ps1 
# Import AzFilesHybrid module
Import-Module -Name AzFilesHybrid
# Install the Az module and Connect to Azure
Install-Module Az
Connect-AzAccount
# Define parameters
$SubscriptionId = "********-****-****-****-********"
$ResourceGroupName = "AVD-Resources-RG"
$StorageAccountName = "avdupd916"
$SamAccountName = "avdupd916"
$DomainAccountType = "ComputerAccount"
$OuDistinguishedName = "OU=UPD,OU=AVDResources,DC=myavdd,DC=com"
# Select the target subscription for the current session
Select-AzSubscription -SubscriptionId $SubscriptionId 
# Register the target storage account with your active directory environment under the target OU 
Join-AzStorageAccount -ResourceGroupName $ResourceGroupName -StorageAccountName $StorageAccountName -SamAccountName $SamAccountName -DomainAccountType $DomainAccountType -OrganizationalUnitDistinguishedName $OuDistinguishedName

After this process, a computer object will appear at the specified OU and the Storage Account, at the File Share settings will have the identity-based access as Configured.

Create two Groups. One for the AVD Admins and one for the AVD Users. In my case is AVDAdmins and AVDUsers. Wait until the users and groups are synced to the Microsoft Entra ID.

Create the File Share for the User Profile Disks

Create the File Share and Add the Admins Group to the “Storage File Data SMB Share Elevated Contributor” Role of the Storage Account and the Users Group to the “Storage File Data SMB Share Contributor” Role.

• “avdadmins” the “Storage File Data SMB Share Elevated Contributor” role
• “avdusers: the “Storage File Data SMB Share Contributor” role

# changing to PowerShell cause the Azure Cli caused me some problems. | Create the File Share
New-AzRmStorageShare -ResourceGroupName AVD-Resources-RG -StorageAccountName avdupd916 -Name updhare

# Back to Azure Cli | Provide access to the synced groups to the file share. To add a group you will need the object id of the group.
# avdadmins = ********************-0d5db5b092f8
az role assignment create --role "Storage File Data SMB Share Elevated Contributor" --assignee-object-id ********************-0d5db5b092f8 --assignee-principal-type Group --scope "/subscriptions/********************/resourceGroups/AVD-Resources-RG/providers/Microsoft.Storage/storageAccounts/avdupd916/fileServices/default/fileshares/updshare"
# avdusers = ********************-5e934d6f5c7d
az role assignment create --role "Storage File Data SMB Share Contributor" --assignee-object-id ********************-5e934d6f5c7d --assignee-principal-type Group --scope "/subscriptions/********************/resourceGroups/AVD-Resources-RG/providers/Microsoft.Storage/storageAccounts/avdupd916/fileServices/default/fileshares/updshare"

Assign NTFS permissions to the share

# mount the share to a member server to take a drive letter
net use Z: \\avdupd916.file.core.windows.net\updshare
icacls Z: /remove "Authenticated Users"
icacls Z: /remove "Builtin\Users"    
icacls Z: /remove "Creator Owner"
icacls Z: /grant "avdusers:(M)"
icacls Z: /grant "Creator Owner:(OI)(CI)(IO)(M)"

Configure the FSLogix through Group Policy

Download the FSLogix zip and copy the admx and adml files to the correct location based to your setup. Here for more info. Open the Group Policy Management. Create a new GPO and link it to the AVD Hosts OU. If the admx/adml files are copied correctly you should see the FSLogix settings under Computer Configuration / Policies / Administrative Templates

Settings to configure:

FSLogix / Profile Containers:

1. Enabled = Enabled
2. VHD Locations: \avdupd916.file.core.windows.net\updshare
3. DeleteLocalProfileWhenVHDShouldApply = Enabled
4. LockedRetryCount = 3
5. LockedRetryInterval = 5
6. ProfileType = Normal

FSLogix / Profile Containers / Container and Directory Naming

1. VolumeType = VHDX
2. SIDDirNameMatch = %username%.%userdomain%
3. SIDDirNamePattern = %username%.%userdomain%
4. VHDNameMatch = %username%
5. VHDNamePattern = %username%

Create the Image

Create a VM from the marketplace. I chose a Windows 11 multi-sesison image with MS apps.

# Create a network interface
az network nic create --resource-group AVD-Resources-RG --name "ImageNic" --vnet-name "AVD-Resources-VNET" --subnet "hosts"
#find the image name
az vm image list --location germanywestcentral --publisher microsoftwindowsdesktop --offer office-365 --all --output table
# Create a virtual machine
az vm create --resource-group AVD-Resources-RG --name "ImageVM" --image "MicrosoftWindowsDesktop:office-365:win11-23h2-avd-m365:22631.3447.240409" --size "Standard_D2s_v3" --admin-username "vmadmin" --admin-password "*********" --nics "ImageNic"

This image already has Microsoft 365, Teams, Edge, OneDrive in a multi-session installation and the FSLogix app to control the user profile disks. Install whatever application is needed and do any configuration, like language etc. I will install 7-zip & VLC Player just for the customization.

Take a snapshot of the VM disk before performing sysprep. You will need this snapshot when you need to do any updates and customizations to this image. After the sysprep you will no longer be able to spin an Azure VM. It is recommended to stop/deallocate the VM to take the snapshot. Open the Disk resource and press + Create Snapshot

Generalize the image with sysprep

C:\Windows\System32\Sysprep\sysprep.exe /oobe /generalize /shutdown

Capture the VM to create the Image. This is done by the Azure Portal, at the VM Overview blade, press Capture. Since the sysprep makes the OS unusable, select to delete the VM after creating the image. I like using the Azure compute gallery to store the images and versions, so I will select to add the image to a gallery.

• Share image to Azure compute gallery: Yes
• Automatically delete this virtual machine after creating the image: Yes
• Azure compute gallery: AVDACG
• Operating system state: Generalized
• Target VM image definition: win11-23H2
• Version number: 0.0.1
• Source virtual machine: imagevm

Create the Host Pool

At the Azure Portal, go to the Azure Virtual Desktop and Create a host pool

Basics: Select the subscription, the Resource Group, the Host Pool Name, location for the metadata, I will create an environment for Desktops, in a Pooled host pool type, so there will be no dedicated VMs per users.

Virtual Machines: Select to add Virtual Machines. Give a prefix up to 12 characters, since AVD will add -## numbering. Select the image from the shared image gallery and how many VMs will be spined in total. At he networking select the network that is prepared for the hosts. For domain join add the UPN of the user (not domain\user, you need user@domain.com), enter the domain name and the OU distinguished name. Finaly add details for the local admin user.

Workspace: Register the host pool to a workspace.

Advanced: Enable the diagnostic settings. You will need to have prepared a log analytics workspace.

When the process is complete you will see two computer accounts at you active directory

and at the Azure Portal / Azure virtual Desktop / host pool will see the two hosts ready to connect

Go to Azure Monitor and enable the monitor for the host virtual machines.

Assign users access to the Azure Virtual Desktop hosts

For the users to be able to see the session and connect, they need to be assigned access to the application group of the specific host pool. Go to the Azure Virtual Desktop / Host Pools / YourHostPool / Application Groups / YourApplicationPool Assignments and add the AVD Users group.

User access

AVD Web Access: https://aka.ms/avdweb

AVS Client for Windows, MacOS, iOS, Android, ChromeOS & Thin Clients: https://aka.ms/avdclient

after the first login, the folder that stores the User Profile Disk will appear at the Azure File Share

Disk Management run as administrator, see the attached VHDX User Profile Disk.

Update Image

There are some options here. If we need to change the OS version, either from Windows 10 to 11, or from a version of 11 to another like 22H2 to 23H3, then create a new VM the marketplace with the target version, customize, capture and add it to the gallery as a new version. If you need to make changes to the existing image, create a VM from the image snapshot, customize and add it to the gallery as a new version.

In my lab I will create a VM from the snapshot just to see the process. Find the disk snapshot at the Azure Portal and press +Create Disk.

Open the disk and Create VM

Once the VM is ready do any customizations and run Sysprep, the same way we run it for the initial image, then Capture the VM and select to add it to the gallery as a new version. I selected the same gallery, the same VM image definition, since it is still win11, and I changed the version number.

• Share image to Azure compute gallery: Yes
• Automatically delete this virtual machine after creating the image: Yes
• Azure compute gallery: AVDACG
• Operating system state: Generalized
• Target VM image definition: win11-23H2
• Version number: 0.0.2
• Source virtual machine: imagevm

The process of updating the host pool

• Add new hosts to the host pool, selecting the latest image

Once the new hosts are ready & Available at the host pool, select the old hosts and turn n drain mode, in order to stop accepting new sessions. After that point all new sessions will go to the new hosts. Once the old hosts are empty, remove them from the pool and delete the VMs.

After log off / log on:

Auto scale & Start VM on connect

There are two options to save a lot of money by using auto scale and start VM on connect. With auto scale, you can have one host running 24/7 and the rest stopped. Once the host reach the max session limit, the AVD will start the next host, until it reaches the maximum hosts created for this host pool. Combining the auto scale with the start VM on connect, even the first host can be stopped, and it will start when the first user will try to logon. With a Scaling Plan, you can have the hosts start and stop based to a schedule, like weekdays and working hours.

Some requirements

You must have a configured Max Session Limit parameter for that host pool & enable the Start VM On connect (if you need this feature too). Those options are at the Host Pool Properties.

you must assign the Desktop Virtualization Power On Off Contributor RBAC role to the Azure Virtual Desktop service principal l with your Azure subscription as the assignable scope. Go to the Subscription / Access Control (AIM, Add role assignment, select Role: “Desktop Virtualization Power On Off Contributor”, select member the service principal “Azure Virtual Desktop” and assign.

At this point, you can stop/deallocate the VMs from the Azure portal and then try to access the SessionDesktop with one user. The user will see a message stating that the VM is starting, and it may take up to 5 minutes and at the host pool you will see the first VM starting. For the LAB, I configured the max sessions to 1, so once I try to login with the second user, I will see the same message and it will start the second VM. If you need at least one VM to stay running, you can add a resource lock and make is read-only so the automation will not be able to deallocate it.

Scaling plan

Create a Scaling plan. Go to the Azure Virtual Desktop, under Manage select Scaling plans and Create a scaling plan. At the scaling plan you select a General configuration, like weekdays, select a presentence of the host to ramp-up a specific hour, to spin the VMs to be ready for your users in order to don’t wait 5 minutes for the VM to start on connect, select the peak hours, where most of your users are working, then select the Ramp-down, where a percentage of the hosts will stop. Here you can select if you will force log off the users or it will wait for the last user to log off. You can learn more here.

Once the scaling plan is created, select Next: Host pool assignments and assign the Schedule to one or more host pools.

Session Limits & Stop the VMs automation

One thing that is recommended is to configure the Session limits for the Remote Desktop Session Hosts. You can use the same GPO as the FSLogix settings, as it is computer configuration too. Open the GPO and go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits.

Set time limit for disconnected sessions: End a disconnected session = 30 minutes. Keep in mind that setting this after 30 minutes the disconnected session will be logged off.

If you want to trigger the Hosts to Stop/Deallocate once there are no active sessions, you can leverage Azure Automation account. There are plenty of guides like this: How to automate AVD VM shutdown based on usage and disconnected state? – Microsoft Q&A

The specific guide creates a runbook that runs a PowerShell script that queries the hosts for active sessions. If a host has no active sessions, then it stops the VM. First create a managed identity and assign the “Desktop Virtualization On Off Contributor” Azure role at the Hosts Resource Group. I altered it to check all the Session Hosts in a Host Pool:

#Please enable appropriate RBAC permissions to the system identity of this automation account. Otherwise, the runbook may fail

# Authenticate to Azure with user assigned managed identity
try
{
    "Logging in to Azure..."
    Connect-AzAccount -Identity
}
catch {
    Write-Error -Message $_.Exception
    throw $_.Exception
}

# Set the Azure subscription ID, resource group name, and VM name
$subscriptionId = "*************-360a051fbe3d"
$hostPoolName = "AVDPooledHP"
$resourceGroupName = "avd-resources-rg"
$myADDSDomain = ".myavdd.com"

$sessionhosts = Get-AzWvdSessionHost -ResourceGroupName $resourceGroupName -HostPoolName $hostPoolName
foreach ($sessionhost in $sessionhosts) {
$splitText = $sessionhost.name.Split("/")
$hostName = $splitText[1]
$vmName = $hostName.Replace($myADDSDomain, "")
# Get the connected user count
$connectedUserCount = Get-AzWvdSessionHost -ResourceGroupName $resourceGroupName -HostPoolName $hostPoolName -Name $hostName | Select-Object -ExpandProperty Session
# Check if the conditions are met and deallocate the VM
if ($connectedUserCount -eq 0 ) {Stop-AzVM -ResourceGroupName $resourceGroupName -Name $vmName -Force}
}

Authentication & security

Microsoft Entra ID provides some security features that can help secure the access to the Azure Virtual Desktop. One of those features is the Conditional Access Policies. Conditional Access Policies are essentially if-then statements used to enforce organizational security policies. They bring together various signals (like user or group membership, IP location, device information, etc.) to make access decisions. For example, if a user wants to access a resource, they might be required to complete an action like multifactor authentication.

Add a Policy to require MFA to access Azure Virtual Desktop

1. From the Azure Portal go to Microsoft Entra ID / Security / Conditional Access / Create new policy
2. Users: Select the group that includes the avd users. Mine is “avdusers” group.
3. Target resources: Include / Select apps / Select / Azure Virtual Desktop

• 4. Conditions: Client Apps / select Browser and Mobile apps and desktop clients

5. Access Controls: Grand / Grand access / Require multi factor authentication

6. Session: It is not required but you can select the frequency that the user will be required to re-authenticate. You can select a periodic authentication and select some hours or some days or you can select every time.

Find out more here: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access – Azure | Microsoft Learn

User experience & Security

Many settings can be set directly from the Host Pool RDP Properties, like Device Redirection, Display Settings and Session behavior. Some other security settings, like Screen capture protection and Watermarking must be set by the GPO or Intune, by using the AVD Administrative Template. Once you install the templates the policy settings will be available under Azure Virtual Desktop administrative template is available, browse to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Azure Virtual Desktop.

• Screen capture protection in Azure Virtual Desktop – Azure | Microsoft Learn
• Watermarking in Azure Virtual Desktop | Microsoft Learn

In addition, the Hosts can be hardened by using GPO or/and Intune.

Monitoring

Azure Virtual Desktop Insights have plenty of information about Connection Reliability, Diagnostics, Performance, Users, Utilization, Clients and alerts out-of-the-box. You can customize the Insights dashboards and you can create a Workbook that fit your needs.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Virtual Desktop (AVD) LAB appeared first on Apostolidis Cloud Corner.

Recently I created a Bicep code to create an Azure Virtual WAN with 2 Hubs, Azure Firewalls, and spoke VNETs & VMs, to use it for PoCs, Labs, and Tests. You can find it at my repo: https://github.com/proximagr/VWAN

The script deploys:

• One Log Analytics workspace
• Four VETS, two on each Azure Region.
• one VWAN with two VWAN HUBs, each on a different Azure Region.
• Two Azure Firewalls inside the VWAN Hubs, each on a different Azure Region. The Azure Firewalls have diagnostic settings sending all logs to a log analytics workspace.
• Two Azure Firewalls outside the VWAN Hubs, each on a different Azure Region. The Azure Firewalls have diagnostic settings sending all logs to a log analytics workspace.
• Four VMs, Ubuntu, one in each VNET

You can choose to:

• deploy VWAN or not
• deploy Azure Firewall inside the VWAN Hubs
• deploy VMs or not
• deploy Azure Firewall outside the VWAN Hubs or not
• how many Public IPs will be created and attached to the Azure Firewalls
• The Azure Firewall SKU between Basic and Standard

The script does NOT deploy the connections between the VWAN Hubs & the VNETS. Once the VWAN Hubs are ready, with Hub Status “Succeeded” and Router Status “Provisioned”, create the connections manually. This is because to create a connection the VWAN Hub Router Status must be “Provisioned” and currently, the is no way of getting this Status.

The VMs are for testing & troubleshooting. Ubuntu Linux, without Public IP. I usually use the Serial console.

Deployment Commands for Azure Cli:

create the Resource Group az group create –name ResourceGroupName –location PreferedLocation

deploy the bicep script and answer the questions interactively az deployment group create –resource-group ResourceGroupName –template-file main.bicep

deploy the bicep script with the required parameters and choose true false az deployment group create –resource-group ResourceGroupName –template-file main.bicep –parameters numberOfFirewallPublicIPAddresses=1 adminPassword=’#########’ adminUserName=’######’ deployVWAN=true addFirewallToVWAN=true deployFirewall=true deployFirewallBasic=true deployVMs=true

Deployment Diagram

VWAN Lab: https://github.com/proximagr/VWAN

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Bicep: Azure Virtual WAN Playground appeared first on Apostolidis Cloud Corner.

Changes:

• • Shows the disk capacity of the VM and asks how many disks to add.
  • Prompts for the size of every disk
  • Checks for empty Luns to add the disks

# 1. You need to login to the Azure Rm Account

Login-AzAccount

# 2. The script will query the Subscriptions that the login account has access and will promt the user to select the target Subscription from the drop down list
 
$subscription = Get-AzSubscription | Out-GridView -Title "Select a Subscription" -PassThru
Select-AzSubscription -SubscriptionId $subscription.Id

# 3. The script will query the available VMs and promt to select the target VM from the VM list
 
$vm = Get-AzVM | Out-GridView -Title "Select the Virtual Machine to add Data Disks to" -PassThru

# 4. I set the storage type based on the OS disk. If you want to spesify somehting else you can cahnge this to: $storageType = StandardLRS or PremiumLRS etc.

$storageType = $VM.StorageProfile.OsDisk.ManagedDisk.StorageAccountType

# 5. Enter how many data disks you need to create

$VMdiskCapacity = ($VM.StorageProfile.DataDisks).Capacity
 
$diskquantity = Read-Host "How many disks you need to create? Max Capacity" $VMdiskCapacity "."

# 6. The script will promt for disk size, in GB

$diskSizeList = @()
for($i = 1; $i -le $diskquantity; $i++)
{
    $disk = (Read-Host "Disk " $i " Size")
    $diskSizeList += $disk
}
$diskSizeList

# 7. check for exisiting disks

$existinglun = @()
for($i = 0; $i -lt $VMdiskCapacity; $i++) {
    $existinglun += ($VM.StorageProfile.DataDisks)[$i].Lun
}

# 8. disks creation

for($i = 0; $i -lt $diskquantity; $i++)
{
$diskName = $vm.Name + "-DataDisk-" + $i.ToString()
$diskConfig = New-AzDiskConfig -AccountType $storageType -Location $vm.Location -CreateOption Empty -DiskSizeGB $diskSizeList[$i]
$DataDisk = New-AzDisk -DiskName $diskName -Disk $diskConfig -ResourceGroupName $vm.ResourceGroupName
for ($j = 0; $j -lt $VMdiskCapacity; $j++) {
    if ( $null -eq $existinglun[$j] ) {
        $nextLunIndex
        for ($k = 0; $k -lt $VMdiskCapacity; $k++ ) {
            $nextLunIndex = $k
            for ( $m = 0; $m -lt $VMdiskCapacity; $m++ ) {
                if ( $k -eq $existinglun[$m] ) {
                    $nextLunIndex = -1 
                    break 
                }
            }
            if ($nextLunIndex -ne -1 ) {
                break
            }
        }
        Add-AzVMDataDisk -VM $vm -Name $DiskName -CreateOption Attach -ManagedDiskId $DataDisk.Id -Lun $nextLunIndex
        $existinglun[$j] = $nextLunIndex
        break
    } 
}
}
Update-AzVM -VM $vm -ResourceGroupName $vm.ResourceGroupName

You can download the script from: https://github.com/proximagr/automation/blob/master/Add-DataDisks-DIffSize_v3.ps1

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure VM | Add Multiple Data Disks v2 appeared first on Apostolidis Cloud Corner.

I had a request to run VMWare Workstation Player on an Azure VM for some testing and labs. Challenge accepted!

UPDATE: Since version 15.5, VMware Workstation & Player Supports Host Hyper-V Mode. Find out more here & here

Demo environment:

Azure VM Standard E4s_v4 Gen 1 running Windows 10 2004 Enterprise 

I tested it also with Windows 10 20H2 Enterprise, and since the Hyper-V mode is supported, it should run at all Windows Client & Server OSs that support nested virtualization and to all E_v4 & D_v4 Azure VM Serries.

To enable the Hyper-V Mode Support we need first to enable Hyper-V at the Windows Host via the add/remove features GUIor PowerShell

Via PowerShell Run:

Enable-WindowsOptionalFeature -Online -FeatureName HypervisorPlatform -All
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

and restart

Installed VMWare Workstation Player 16.0 free for non-commercial use, download from here: VMware Workstation Player – VMware Customer Connect

After the installation, I opened the VMWare Workstation Player and I managed to set up and run a Windows 10 VM.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post VMWare Workstation Player on Azure VM for testing appeared first on Apostolidis Cloud Corner.

Recently MIcrosoft Azure anounched the preview feature “Shared Disk”. The Shared Disk can be attached at two Azure MVs at the same time. The purpose is to create SQL Server Failover Cluster Instances (FCI), Scale-out File Server (SoFS), File Server for General Use (IW workload), Remote Desktop Server User Profile Disk (RDS UPD) and  SAP ASCS/SCS. More or less we can have a failover cluster at Azure VMs like haveing an on-premises failover cluster with shared storage.

At this post I will demostrate step-by-step how to create a Failover Cluster in Azure with two Azure VMs and a Shared Disk.

Since this is a preview feature at the time I am wroting this post, we need to sign up for our preview.

Once we have the confiration that the Shared Disk preview is enabled at our Subscription, we can proceed and create our Shared Disk. Currently this can be done only by using an ARM Template, in order to define the “maxShares”: “[parameters(‘maxShares’)]” disk property. This property defines in how VMs can this Disk be attached.

Other limitations of the preview are:

• Currently only available with premium SSDs.
• Currently only supported in the West Central US region.
• All virtual machines sharing a disk must be deployed in the same proximity placement groups.
• Can only be enabled on data disks, not OS disks.
• Only basic disks can be used with some versions of Windows Server Failover Cluster, for details see
• Failover clustering hardware requirements and storage options.
• ReadOnly host caching is not available for premium SSDs with maxShares>1.
• Availability sets and virtual machine scale sets can only be used with FaultDomainCount set to 1.
• Azure Backup and Azure Site Recovery support is not yet available.

From the Azure Portal search and open the “Template Deployment”

\

Select the “Build your own template in the editor”

And paste the Shared Disk Json at the template

The Shared Disk Json:

{ 
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "dataDiskName": {
      "type": "string",
      "defaultValue": "mySharedDisk"
    },
    "dataDiskSizeGB": {
      "type": "int",
      "defaultValue": 1024
    },
    "maxShares": {
      "type": "int",
      "defaultValue": 2
    }
  },
  "resources": [
    {
      "type": "Microsoft.Compute/disks",
      "name": "[parameters('dataDiskName')]",
      "location": "[resourceGroup().location]",
      "apiVersion": "2019-07-01",
      "sku": {
        "name": "Premium_LRS"
      },
      "properties": {
        "creationData": {
          "createOption": "Empty"
        },
        "diskSizeGB": "[parameters('dataDiskSizeGB')]",
        "maxShares": "[parameters('maxShares')]"
      }
    }
  ] 
}

After the Template Deployment is comleted you will see a normal disk at the Resoruce Group.

Create the VMs

Create both VMs like any normal Azure VM creation. I created wto Windows Server 2016 VMs. Both VMs must be added to the same availability set (Fault Domain = 1), in order to add them behing an internal load balancer and they must be added to the same Proximity Placement Group.

To create a Proximity Placement Group, just create a new resource, search for “Proximity Placement Group” and press create. Just provide a name for the PPG and the location, that must be the same as the Disk.

And select it at the VM creation wizard:

Attach the Sahred Disk to Both VMs

When attaching the Shared Disk to the VMs you will see the “disk shares used” This reports in how many VMs this disk is attached.

Once the VMs are ready we can start the Failover Cluster process. We need to add both VMs to the Domain. Then go tot he Disk Management and bring the disks online, GTP on both servers. The next step is to enable the Failover Clustering feature on both VMs. This can be easily acomplished using the below command:

Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools –ComputerName SDVM01
Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools –ComputerName SDVM02

Restart both VMs

Lets start the Failover Cluster Wizard. Select both Azure VMs and validate with running all tests.

The report should have sucess to all Storage Related Stuff. Only the Cluster IP will fail, since it cannot allocate an Azure IP.

So we will not create the Cluster uning the GUI wizard. We will create the cluster unsing the new-cluster command to spesify the cluter IP. But first lets create the Cluster IP Load Balancer.

To enable the Cluster IP we need to create an Internal StandardLoad Balancer with Static IP. Add both VMs to the Backend pool of the load balancer.

And Run this command to one of the two VMs:

New-Cluster -Name cluster1 -Node SDVM01,SDVM02  -StaticAddress 192.168.0.10

The cluster is ready and we can now we can add the Disk to the Cluster

righ click at the Cluster Disk 1 and select “Add to cluster shared volumes”

Wait untill the disk is online

‘

and check the C:\ClusterStorage path for the “Volume1” link.

open the Volume1 and create a file, just to cehck that it is working

To have a more stable cluster, add a Quorum. At the cluster name, right click and select More Actions / Configure Quorum settings.

Since we are on Azure we will configure an Azure Storage account for quorum. Select the “Advanced Configuration”

and select the “Configure CLoud Witness”.

Create an Azure Storage Account

add the Storage Account to the Virtual Network of the VMs, to secure it

And once the Storage Account is ready, copy/paste the name and the Key to the Culster Quorum wizard.

Now we have a full failover cluster

Server 1:

Server 2:

Now we can deploy SQL Server FCI, File Server, etc.. !!!!

More info abuot the Shared Disk: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-shared-enable

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Failover Cluster with Shared Disk – Step by Step appeared first on Apostolidis Cloud Corner.

Disk Snapshot is a powerful tool to manage Azure VMs. It’s simple to create and can help the administrators in various tasks. It’s a fast and efficient way to have a crash-consistent Disk of a Virtual Machine, before performing tasks, updates, configuration changes, application installations, etc. Of course the last line of defence is the Azure Backup, but using the Snapshot you don’t need to wait the whole Backup / Restore times. With snapshots there are two main options to recover the VM. One is using the “swap OS Disk” functionality, which gives you the ease to swap the Operating System disk with one click. The other option is to create a new VIrtual Machine. Beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

Snapshot

The first step is to create a snapshot from the Virtual Disk. Open the Azure VM, go to Disks, select the OS Disk and press “Create Snapshot”. You don’t actually need to stop the VM. Windows Server operating system stays fully consistent, but no one can guarantee the consistency of any databases currently running. Think of it like the Hyper V CheckPoint functionality. We make checkpoints all the time and we revert to them even in production.

The Create snapshot screen will open. Fill in a name and disk account type (Standard / Premium) and press create.

At this point I will create a folder at the VM for revision

Create a Disk

To make the snapshot functional, we need to create a Managed Disk resource.

At the Create managed disk wizard, select the Region that the Snapshot resides. Then select “Source type” Snapshot and select it. At the Size, select a disk size at least the same as the source disk.

Swap OS Disk

Now that we have created the managed disk, it’s time to use the Swap OS Disk functionality. We have proceeded with the Azure VM’s updates, software updates, configuration changes, and finally we need to roll back those changes. Go to the VM’s Disks and press “Swap OS Disk”

at the “Swap OS Disk” wizard, select the managed disk that we created.

In the background, the Azure Platform will stop, deallocate the VM and it will re-crate it with the selected OS disk. As you see at the next screenshot the OS disk is the managed disk that we created from teh snapshot.

I Started the VM and logged in. The folder I created after the snapshot of course is missing 🙂

New Azure VM

The other option is to create a new Virtual Machine using the Snapshot. As I wrote before, beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

To create a VM from the Snapshot, just open the Managed Disk that you created from the Snapshot and press Create VM.

The Create a virtual machine wizard will open, and at the Operating System Image section, it will have selected the image from the disk. This process is identical to creating a new Hyper V VM from an existing virtual disk.

Follow the Create a virtual machine wizard exactly the same as creating any Azure VM.

More e-apostolidis.gr posts about managed disks: https://www.e-apostolidis.gr/tag/managed-disks/

Read more at: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/managed-disks-overview#managed-disk-snapshots

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Portal | Playing with Disk Snapshot appeared first on Apostolidis Cloud Corner.

Now we can restore an Azure VM directly with managed disks with a truly single-click operation.

In addition, we can restore only the unmanaged disks to a storage account and the process will create a template for us to create the VM  on a later time.

So, at the recovery services vault, select a VM to restore and you will see two main options.

Create New: to create a new Virtual Machine with managed disks or to restore the disks with the ARM Template

Replace existing: To restore the VM in-place, replacing the current VM.

At both options you will need to select a Staging storage account, in order to restore the VHD files. Those file will be auto-converted to managed disks by the process.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post New Azure VM Restore Experience appeared first on Apostolidis Cloud Corner.

Microsoft has revamped the UI around creating a new Azure VM. The information is now much more compact. Way less scrolling. And it’s easier to move along the dozens and dozens of options.

Its not only about UI. You will see much more options available at the VM creation, like adding data disks!!!

Also there is no need anymore to go through all the options, you can “Review & Create” the VM at any step since you have completed all the required fields or just accept the defaults.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post New UI for the Azure VM Creation Wizard appeared first on Apostolidis Cloud Corner.

Lets see how easy it is to monitor and create an alert, in order to be notified when your VMs are restarted, when they start, stop, get high CPU usage, memory and much more.

First navigate to the Azure Portal https://portal.azure.com, and then click the Monitor button.

You will be navigated to the Monitor blade. At the center of the screen you will see three mail buttons, each starts a wizard.

Click the “Create Alert” under the Explore monitoring essentials, the first of the three buttons.

The create rule wizard will start. First you need to Select target.

Select the subscription, at the Filter resource type select Virtual machines and select the VM from the Resource list.

Once you press the target VM you will see a preview of the selection and the available signals.

After the alert target, select the criteria

At the configure signal login blade, select the signal from the list. I have selected the Restart Virtual Machine.

Once you select the signal you can select the severity level and also you will see the preview of the condition.

After that give a name and a description for the alert. Also select the resource group where the alert will be saved and if you want the alert to be enabled upon creation.

The next step is to create an action group. The action group is the list of accounts to get the notifications when the alert is triggered. The notification can be email, SMS, Push Notifications and Voice call. You can add many action groups and many action in each group.

Now the alert is ready. Once the alert is triggered you will be notified. At this example I added an email alert and once the VM restarted I received the following email:

More Microsoft Azure guides at Apostolidis IT Corner

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Monitor & Alert for your Azure VM appeared first on Apostolidis Cloud Corner.

Have you checked the update management system for your Azure and On-Premises server that supports both Windows and Linux operating systems? And it is completely free! Please find the full list of supported operating systems and prerequisites here: https://docs.microsoft.com/en-us/azure/operations-management-suite/oms-solution-update-management#prerequisites.

Lets get started. The easiest way is to start from an Azure VM. Go to the VMs blade and find “Update management”. You will see a notification that the solution is not enabled.

Click the notification and the “Update Management” blade will open. The “Update Management” is an OMS solution, so you will need to create a “Log analytics” workspace, you can use the Free tier. If you don’t have a Log analytics workspace the wizard will create a default for you. Also it will create an automation account. Pressing enable will enable the “Update Management” solution.

After about 15 minutes, at the “Update Management” section of the VM you will see the report of the VM’s updates.

After that process the Automation Account is created and we can browse to the “Automation Accounts” service at the Azure Portal. There click the newly created Automation Account and scroll to the “Update Management” section. There we can see a full report of all VMs that we will add to the Update Management solution. To add more Azure VMs simply click the “Add Azure VM” button.

The Virtual Machines blade will open and will list all Virtual Machines at the tenant. Select each VM and press Enable.

After all required VMs are added to the Update Management solution click the “Schedule update deployment” button. There we will select the OS type of the deployment, the list of computers to update, what type of updates will deploy and the scheduler. More or less this is something familiar for anyone that has worked with WSUS.

Press the “Computers to Update” to select the Azure VMs for this deployment from the list of all VMs enabled.

Then select what types of updates will deploy.

If you want to exclude any specific update you can add the KB number at the “Excluded updated” blade.

And finally select the schedule that the update deployment will run.

Back to the “Update Management” blade, as we already said, we have a complete update monitoring of all Virtual Machines that are part of the “Update Management” solution.

You can also go to the “Log Analytics” workspase and open the “OMS Portal”

There, among other, you will see the newly added “System Update Assessment” solution.

and have a full monitoring and reporting of the updates of your whole environment.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Update Management appeared first on Apostolidis Cloud Corner.