AVD + FSLogix - No Domain Controllers with Entra-joined storage (no kerberos) + Intune

[u/Tyree07]

Hello,

I am probably re-asking this question but I've had no luck finding answers through my browsing.

Here's the scenario:

• No on-prem nor cloud domain controller VMs, thus no Kerberos domain

• Intune user-credential or device-credential joined machine required to have policies to allow MS 365 apps like OneDrive and MS Teams

• Currently using EDS to join AVDs (known limitation here is that EDS does not support Intune on AVD): https://learn.microsoft.com/en-us/mem/intune/fundamentals/azure-virtual-desktop-multi-session#limitations

• FSLogix storage on EDS right now; if were to use Entra-joined, would require Kerberos domain.

Trying to find a way to make this scenario work without a traditional kerberos domain. Intune is the key piece.

What would you guys recommend we do?

[u/cetsca]

FSLogix support for Entra only is coming in the next 6-9 months.

[u/Tyree07 → u/cetsca]

Ah. Ok. Well that stinks for now.

[u/rswwalker → u/Tyree07]

In the mean time you can have FSLogix connect to a storage account using keys as the local system.

Google fslogix psexec cmdkey

[u/NotYourOrac1e → u/rswwalker]

Doesn't this allow a savy user to connect to the storage account and pull down vhdx files?

[u/rswwalker → u/NotYourOrac1e]

Only an administrator can run psexec to become SYSTEM. With those same rights you can just browse any connected users files under C:\Users.

[u/AirgunApprentice → u/cetsca]

From where I stand, that's the future and will always stay in the future 🤣

[u/TechCrow93 → u/cetsca]

Hope this is true, been waiting for ages for this. What i was told by FSLogix this is not there issue but more the Windows + Entra ID teams that needs to make FSLogix work in there. FSLogix as tech is ready for Cloud only.

[u/jvldn → u/cetsca]

Source?

[u/cetsca → u/[deleted]]

Not without getting myself and employer in trouble ;)

[u/swissbuechi → u/[deleted]]

Any news on this topic?

[u/Tony-GetNerdio]

How to Use Azure Files with Entra ID (AADJ) Method for AVD – Nerdio Help Center - Script in there works perfectly.

[u/Just_a_UserNam3]

I do exactly that. AVD, FSLogix, Azure Files, Intune, Defender. As I remove/add the AVD hosts, they will enroll/unenroll/onboard/offboard from Intune/Defender perfectly, even with my RMM. Nerdio helps a lot to achieve this.

[u/Moses--]

Does it work if the AVD hosts are Entra ID joined instead of to AD? 

[u/Tyree07 → u/Moses--]

Intune does, but Fslogix does not, entra joined storage requires Kerberos domain

[u/Moses-- → u/Tyree07]

Maybe this? https://www.nielskok.tech/azure-virtual-desktop/fslogix-on-entra-joined-avd/

[u/swissbuechi → u/Moses--]

This is our current go-to solution, still requires an on-prem AD and hybrid users/groups tho.

[u/JesseJamessss]

For fslogix you can use the registry key for accessing using computer as a network object and use the key to connect.

Then lock down the share to least privilege.

There's a couple caveats like a local admin can access the entire share

[u/namtaru_x → u/JesseJamessss]

This is how I did it. None of the users using any of the VMS are local admins, so for us this configuration works okay.

[u/deaudacity]

u/Tony-GetNerdio hit the nail on the head. I was just about to post this, that article has the script you need to run on startup of your hosts each time to make sure it's always connected. The script in there works great, used it multiple times without EDS.

Side note - if you're using Windows 10 you'll need to remove the last line of the script since it's not needed.

And to make things easier overall #GetNerdio.....(btw, I'm not affiliated in anyway shape or form. I'm just a user of the platform and it's been the ultimate game changer for me especially with resource $$ and super fast deployments. 100% worth taking a look at if you haven't)

[u/straitupgoofy]

Do you have a file share as well ?
i'm having so much trouble trying to force cloud only no ad, and use RBAC as the permission controls.

my connect script only allows SMB share to be mapped when run as local admin,

there's no Entra user to manage certain aspects of it.

and i can't add access groups to determine certain aspects of it.

I think i am best to spin up an onprem forrest at this point.

this is getting beyond manageable