Azure Virtual Desktop (AVD) is a strategic solution for modernizing application and desktop delivery, providing a scalable, secure, and fully integrated Desktop-as-a-Service platform within the Microsoft ecosystem. In this context, Microsoft Entra ID plays a central role in enabling a consistent, streamlined, and secure identity model for accessing resources. Please see Azure Virtual Desktop – Manage Azure Virtual Desktop host pools and session hosts using the Azure portal (Microsoft Entra ID) – Part 02, and Azure Virtual Desktop – Set Up Azure Virtual Desktop Insights Monitoring – Part 03.
In this first part of the series, we will focus on the initial deployment of host pools and session hosts directly from the Azure Portal using Microsoft Entra ID as the identity provider. The goal is to guide you step by step through the creation of the foundational infrastructure required to deliver desktops and applications to end users, with a strong emphasis on configuration best practices and key architectural decisions.
This article serves as the starting point for building a robust, production-ready AVD environment, laying the groundwork for the subsequent stages of configuration, optimization, and operational management.
Prepare the Azure subscription for deployment of an Azure Virtual Desktop host pool
Open a web browser and navigate to the Azure portal, https://portal.azure.com. In the “Welcome to Microsoft Azure” dialog box, click Maybe Later; if an Azure recommendations pop-up appears, close it by clicking X.
In the Azure portal, search for and select Virtual networks, then click Create +. On the “Create virtual network” page, in the Basics tab, configure the required settings and select Next.
Enter the basic details as shown below
On the Security tab, accept the default settings
Accept the default settings
Create a Virtual Network
- Name: Your–vnet
- IP range: 10.20.0.0/16
Specify the subnet
Configure subnet:
- Name: hp1-Subnet
- Range: 10.20.1.0/24
Review and create Virtual Network
Create Entra ID Groups
Groups to create:
AVD-DAG-XXXX → Desktop users
AVD-RemoteApp-XXXX → RemoteApp users
Actions:
Add users to each group
Please see Disaster Recovery Test Checklist: What to Capture Before You Start, Upgrading Azure AD Connect to Microsoft Entra Connect Sync, and PCI Driver Error: Connection to Deployment Share could not be made.
Deploy an Azure Virtual Desktop host pool
Create Host Pool: Basic configuration:
- Name: YourResourceGoup-hp1
- Type: Pooled
- Load balancing: Breadth-first
| Setting | Value |
|---|---|
| Subscription | XXX-XXX-XXXX |
| Resource group | XXX-XXX-RG |
| Host pool name | XXXX-LinkState-hp1 |
| Location | Azure region (East US) |
| Validation environment | No |
| Preferred app group type | Desktop |
| Host pool type | Pooled |
| Load balancing algorithm | Breadth-first |
Note: With the Breadth-first load balancing algorithm, the “max session limit” parameter is optional, meaning you don’t have to define a maximum number of sessions per host.
On the Session Hosts tab of the Create a host pool page, set the specified options, then click Next: Workspace, keeping all other settings at their defaults.
| Setting | Value |
| Add virtual machines | Yes |
| Resource group | Defaulted to same as host pool |
| Name prefix | sh–vdi–random |
| Virtual machine type | Azure virtual machine |
| Virtual machine location | the name of the Azure region where you want to deploy your Azure Virtual Desktop environment |
| Availability options | No infrastructure redundancy required |
| Security type | Trusted launch virtual machines |
| Image | Windows 11 Enterprise multi-session, Version 23H2 + Microsoft 365 Apps – Gen2 |
| Virtual machine size | Standard DC2s_v3 |
| Number of VMs | 2 |
| OS disk type | Standard SSD |
| OS disk size | Default size (128GiB) |
| Boot Diagnostics | Enable with managed storage account (recommended) |
| Virtual network | XXX-vnet11e |
| Subnet | hp1-Subnet |
| Network security group | Basic |
| Public inbound ports | No |
| Select which directory you would like to join | Microsoft Entra ID |
| Enroll VM with Intune | No |
| User name | Your User Name |
| Password | Your Password |
| Confirm password | Your Password |
On the Workspace tab, set Register desktop app group = No, then go to Review + create and click Create.
| Setting | Value |
| Register desktop app group | No |
Wait for the deployment to finish; it may take around 20 minutes.
Create an Azure Virtual Desktop Application Group (RemoteApp – Office)
Auto-created group: hp1-DAG
Assign group: AVD-DAG-XXXX
Navigate back to the Azure Virtual Desktop | Application groups page, select + Create.
| Setting | Value |
|---|---|
| Subscription | XX-XXXX-XXXX |
| Resource group | azXXX-XXe-RG |
| Host pool | XXX-XX-hpX |
| Application group type | Remote App |
| Application group name | XXX-XX-hpX-Office365-RAG |
On the Applications tab of the Create an application group page, select + Add applications.
You can proceed with creating the Application Group once the VMs in the host pool are online.
On the Add application page, configure the required settings, then click Review + add, and finally select Add.
On the Add application page, configure the required settings, then click Review + add, and finally select Add.
| Setting | Value |
| Application source | Start menu |
| Application | Word |
| Display name | Microsoft Word |
| Description | Microsoft Word |
| Require command line | No |
Proceed to publish the following applications: Excel and PowerPoint.
On the Applications tab, select Next: Assignments. Then add Microsoft Entra users or groups, choose the AVD-RemoteApp group, and click Select.
Return to the Assignments tab and select Next: Workspace. On the Workspace tab, configure the required setting, then choose Review + create.
| Setting | Value |
| Register application group | No |
Wait for the Application Group creation to complete (less than 1 minute). Next, you will create an application group using a file path as the application source.
Create Azure Virtual Desktop | Application groups (Utilities) CMD
| Setting | Value |
|---|---|
| Subscription | XXX-XXX-XXXX |
| Resource group | XXX-XXe-RG |
| Host pool | XXX-XX-hpX |
| Application group type | RemoteApp |
| Application group name | XXX-XX-hpX-Utilities-RAG |
Configuration:
| Setting | Value |
| Application source | File path |
| Application path | C:\Windows\system32\cmd.exe |
| Application identifier | Command Prompt |
| Display name | Command Prompt |
| Description | Windows Command Prompt |
| Require command line | No |
On the Applications tab, go to Next: Assignments, then add Microsoft Entra users or groups. Select the AVD-RemoteApp-XXXXXX group you created and confirm with Select.
On the Workspace tab of the Create a workspace page, specify the following setting and select Review + create:
| Setting | Value |
| Register application group | No |
Create the application group after passing the validation
Note: Wait for the Application Group to be created; it should take less than 1 minute.
Please see Steps to Fix the “Invalid OS GUID” Error in MDT, Faulting SecHealthUI: Resolve Windows Defender Notification, and How to Update Your AMD Radeon Display Adapter Driver.
Create an Azure Virtual Desktop workspace
In the Azure portal, go to Azure Virtual Desktop → Workspaces, then click Create. On the Basics tab, set the required options and select Next: Application groups
| Setting | Value |
|---|---|
| Subscription | XXX-XX-XXXX |
| Resource group | XXX-XXe-RG |
| Workspace name | XXX-XX-LinkkState-wsX |
| Friendly name | XXX-XX-LinkkState-wsX |
| Location | Azure region (same as previous deployment or nearest region) |
On the Application groups tab, set Register application groups = Yes, then on the Workspace tab click + Register application groups.
| Setting | Value |
| Register application groups | Yes |
On Add application groups, select the + next to the listed application groups (Desktop, Office365 RemoteApp, Utilities RemoteApp), then click Select.
Back on the Application groups tab, select Review + create, then on the next page click Create.
Provide access permissions to Azure Virtual Desktop Host Pools
With Microsoft Entra joined session hosts, users and admins must be assigned Azure RBAC roles: Virtual Machine User Login for sign-in access and Virtual Machine Administrator Login for local admin privileges.
On the Role tab, search for Virtual Machine User Login, select it from the results, then click Next.
On the Members tab, choose User, group, or service principal, click Select members, choose the AVD-RemoteApp-XXXXXX group you created, and confirm with Select.
On the Members tab, click Next. On Assignment type (Preview), set it to Active, then select Review + assign.
On Review + assign, confirm by selecting Review + assign. Then go to Access control (IAM), add a new role assignment, search for Virtual Machine Administrator Login, select it, and click Next.
On the Members tab, choose User, group, or service principal, select the AVD-DAG-XXXXX group, then proceed. Set Assignment type = Active, and click Review + assign to complete the role assignment.
This completes the first part of the Azure Virtual Desktop guide. See you in part two as referenced above.
