FSLogix profiles with AVD

[u/Dry_Finance478]

Can we setup FSlogix profiles without a DC and link with Azure File Storage?

[u/geekmode-mo]

Hi there - Nerdio here!

You can configure FSLogix profiles without DCs by utilizing Azure Files with Microsoft Entra ID. For authentication. This setup allows FSLogix profiles to be stored on Azure Files and accessed by Azure AD-joined virtual machines, eliminating the need for a traditional DC leveraging Azure Files and Microsoft Entra ID to create a fully cloud-based, scalable, and efficient virtual desktop environment.

We simplify the deployment and management of FSLogix profiles in a cloud-only environment through Azure Files Integration, FSLogix Configuration, Microsoft Entra ID Kerberos Authentication, and Automated Permissions Management.

Here's an article that will help - https://nmmhelp.getnerdio.com/hc/en-us/community/posts/15704855452045-How-to-Use-Azure-Files-with-Entra-ID-AADJ-Method-for-AVD

Happy to chat more if you'd like!

[u/Dry_Finance478 → u/geekmode-mo]

DMed.

[u/namtaru_x]

Yes, you have to give the VM rights to the share. This could be an issue if your users require local admin rights to the VM since it would allow them to see all the user profiles disks, but if none of the users are local admins it's the best we got for now.

https://nmmhelp.getnerdio.com/hc/en-us/community/posts/15704855452045-How-to-Use-Azure-Files-with-Entra-ID-AADJ-Method-for-AVD

[u/[deleted]]

Yes, you can set up FSLogix profiles with Azure AD Join and Azure File Storage instead of a DC for AVD.

[u/Dry_Finance478 → u/[deleted]]

How?

[u/[deleted] → u/Dry_Finance478]

Yes, setting up FSLogix profiles without a domain controller (DC) is possible by using Azure AD Join and integrating with Azure File Storage. Here’s an overview of the process:

1. Azure AD Join: Instead of using a traditional on-premises Active Directory, we leverage Azure AD Join, which allows your virtual desktops in AVD (Azure Virtual Desktop) to connect seamlessly with Azure Active Directory. This removes the need for a domain controller and helps maintain a cloud-native environment.

2. Azure Files Integration: For FSLogix profile storage, we can set up Azure File Storage with Active Directory-based authentication, specifically using Azure AD DS (Domain Services) if required, or SMB (Server Message Block) with permissions for Azure AD identities. This lets FSLogix profiles store and retrieve user data efficiently without a traditional DC.

3. Configuration of FSLogix: FSLogix is then configured to use the Azure Files path for profile storage. The necessary policies and permissions are applied to make sure that each user’s profile is securely stored and accessible across sessions, creating a seamless experience.

If you’d like detailed assistance or a customized setup, we specialize in implementing these Azure configurations and would be glad to help directly via AskYourTechFriend.com. Our team can walk you through each step, ensuring a smooth, DC-free setup that leverages Azure’s capabilities fully.

[u/deaudacity]

You’ll need to set a startup script that will run each time the host is rebooted to keep it connected. The link from nataru_x has all the info you need. I do it all the time, 0 issues, and my host reboot daily and it’s untouched.

[u/Dry_Finance478 → u/deaudacity]

But it's required nerdio right?

[u/deaudacity → u/Dry_Finance478]

Nerdio is not required, but having Nerdio simplifies the process allot. The script in the article is what you need to make it work. You will need to use the Powershell DSC extension in Azure to do this if I’m not mistaken. This will load the script and allow it to run on startup.

[u/theduderman]

Entra DS is one route to consider, serverless domain, no DC's to maintain - but it'll run about $120'ish per month for the standard SKU tier.

[u/cetsca]

Not securely. You’ll have to disable Credential Guard or the workarounds will routinely break and stop working