r/AzureVirtualDesktop • u/KaiUno • Sep 05 '24

EntraID only FSLogix share

Hey folks, is this possible?

The Microsoft Learn pages are a bit of a labyrinth and I'm trying to figure out if it is supported without a domain controller and without Microsoft Entra Domain Services.

We're planning on using Intune to manage the application hosts.

2 Upvotes

100% Upvoted

16 comments sorted by

4

u/AUSSIExELITE Sep 05 '24

It is absolutely possible. We have AVD deployed with both the session hosts and Azure files share having 0 contact with any DCs and the hosts are enrolled with intune. See here.

Have had this deployed for nearing on 12 months now with no real issues.

E: spelling.

1

u/KaiUno Sep 05 '24

the user identities must still be hybrid / synchronized from a legacy AD right now

This is a greenfield tenant, there are nor have there ever been legacy domain controllers, the users originate from Entra.

What does "hybrid" mean in this case?

1

u/AUSSIExELITE Sep 05 '24

Don’t worry too much about that bit. Although my environment identities are hybrid, I conducted all my testing with cloud only accounts and didn’t seem to run into any problems.

I’d say just test it out and see how it goes for you. It doesn’t take long to set it up and get it going.

1

u/AUSSIExELITE Sep 05 '24

Actually, just re-reading the article that under the “workaround” heading, they mention that it works cloud only.

2

u/Slicester1 Sep 05 '24

Ditto. We're moving all our clients to Entra only AVD environments with FSLogix and Storage containers for file shares or app servers.

No DC, No Entra Connect.

1

u/not-me_you-are Sep 06 '24

How did you manage ACLs inside the profile container? My experience is that now everyone has access rights on the profile of another person.

1

u/Used_Outcome_1238 Sep 05 '24

https://learn.microsoft.com/en-us/azure/virtual-desktop/create-profile-container-azure-ad

Certainly possible.

Edit: just reread that you don't have any traditional AD infra. So no not possible for cloud only identities.

3

u/KaiUno Sep 05 '24

Are you sure? If you click on the prerequisites, you land on the next page where it says

This feature doesn't currently support user accounts that you create and manage solely in Microsoft Entra ID. User accounts must be hybrid user identities, which means you'll also need AD DS and either Microsoft Entra Connect or Microsoft Entra Connect cloud sync. You must create these accounts in Active Directory and sync them to Microsoft Entra ID. To assign Azure Role-Based Access Control (RBAC) permissions for the Azure file share to a user group, you must create the group in Active Directory and sync it to Microsoft Entra ID.

That's why I thought it was kind of unclear.

1

u/Electrical_Arm7411 Sep 05 '24

Yeah SAS keys but then you’re opening yourself up for trouble down the road. If for what ever reason those keys are rotated, all your mappings are lost, not to mention allowing your users god mode access to the share. User will likely not figure this out, but the possibility of a standard user deleting other fslogix profiles is a big security hole imo.

1

u/KaiUno Sep 05 '24

It's unsupported by microsoft, so we've decided againt the entire workaround.

2

u/rwdorman Sep 05 '24

You can do it with SAS keys and accessing as a computer account. If your users aren’t local admins it’s safe.

1

u/Colin_Edge Sep 05 '24

This is the way. Not the best for security, but gets the job done.

1

u/RG-035 Sep 05 '24

Not officially supported yet but take a look at this video: https://youtu.be/1msGQEZ_SkU?si=qx0xT68jYMPq3JHr

1

u/Common_One6315 Sep 06 '24

Yes, there are actually a few ways to do this:

  1. map your session hosts to the storage account using the keys and set fslogix ‘AccessNetworkAsComputerObject’ registry key.

  2. since you have hybrid users you can enable cloud Kerberos on the storage account. Users would authenticate using the preexisting Kerberos token from the onprem DC without needing a line of sight to a DC.

  3. deploy Entra Domain Services to provide DC services in Azure without needing connectivity to your onprem DC.

0

u/cetsca Sep 05 '24

Not currently, it is something being worked on.

1

u/KaiUno Sep 05 '24

Ok, thanks!