Skip to content

Before you start#

Access#

AVD Deploy needs an Andy Kemp Consulting account with access to it: talk to Andy. Everything it deploys runs in your own subscription and is billed to you by Microsoft.

To see it first, the live demo is the same page on a made-up tenant.

What you need#

  • An Azure subscription with vCPU quota for the session host size in your region. The Desktops page shows the free vCPUs in each region.
  • Licences that include Azure Virtual Desktop for your users, such as Microsoft 365 E3, E5 or Business Premium, or Windows Enterprise E3 or E5.
  • Entra ID P1 for Conditional Access, and for the optional Intune device group (dynamic groups need it).
  • Intune, to manage the session hosts.
  • For hybrid identities: users synchronised from Active Directory, and the storage account set up for hybrid Entra Kerberos.

Decisions to make#

  • Pooled or personal desktops. Pooled desktops are shared, multi-session hosts with FSLogix profiles. Personal desktops give each person their own host, with a local profile; the first person to sign in to a free desktop keeps it.
  • Microsoft 365 Apps or Intune (pooled). Microsoft's multi-session image with Microsoft 365 Apps, or plain Windows 11 with apps deployed from Intune.
  • Cloud-only or hybrid (pooled). Cloud-only FSLogix with Entra Kerberos is in preview from Microsoft.
  • A new network or an existing one. An existing network must be in the same region, with DNS that resolves the storage account's private endpoint.
  • A prefix. It names the host pool and session hosts. If devices from an earlier deployment use the same names, delete them or pick another prefix (see Troubleshooting).

Roles#

AVD Deploy uses only your own sign-in. You don't need Global Administrator.

To You need
Deploy into a new resource group Owner on the subscription, or Contributor plus Role Based Access Control Administrator.
Deploy into an existing resource group The same, on that resource group.
Turn on scaling (first time in a subscription) Rights to assign roles on the subscription, once.
Create the Entra groups Groups Administrator or User Administrator.
Finish setup Cloud Application Administrator; with FSLogix also Conditional Access Administrator.

Resource providers (Microsoft.DesktopVirtualization, Microsoft.Compute, Microsoft.Network, Microsoft.KeyVault, and Microsoft.Storage for FSLogix) are registered for you if your role allows it.

The first sign-in asks you to consent to AKC AVD Deployer reading your directory and using Azure Resource Manager as you. It asks again, only when needed:

  • Group.ReadWrite.All when your design creates groups;
  • the Finish setup permissions (Application-RemoteDesktopConfig.ReadWrite.All, Device.Read.All, and with FSLogix Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.ConditionalAccess).

These are delegated: the page can only do what your own roles allow.