Finish setup#
Finish setup makes the tenant-wide changes Azure Virtual Desktop needs. It runs straight after Deploy, or later from the host pool list. It asks for its own consent, for this tab only.
Each change shows the settings before and after, and waits for you to type APPLY. Press Stop to skip it: it becomes a task on the Ready page. If one step fails, the others still run.
| Step | What changes |
|---|---|
| RDP sign-in | Turns on Microsoft Entra authentication for RDP on the Windows Cloud Login app, once per tenant, so people sign in to Entra joined hosts with their work account. |
| Storage app (FSLogix) | On the storage account's own Entra app: admin consent for openid profile User.Read, the private-link identifier URIs, and for cloud-only the kdc_enable_cloud_group_sids tag. Nothing else on the app is touched. |
| Conditional Access (FSLogix) | Adds the storage app to the excluded apps of policies that require MFA or an authentication strength for all resources. Entra Kerberos to Azure Files can't do MFA, so profiles wouldn't mount otherwise. Nothing else in those policies changes. Policies on devices, blocks and admin roles are listed for you to review instead. |
| FSLogix permissions | Sets the profile share's folder permissions from a running session host, through the private endpoint, using that VM's managed identity with a temporary role. The role and the command are removed afterwards; the storage firewall is never opened. |
| Host check | Each host is Entra joined, enrolled in Intune, and on a Windows build that supports cloud-only FSLogix. |
People still sign in to the desktop with MFA. The Conditional Access exclusion only covers the session host reaching profile storage on their behalf.
Ready#
The Ready page lists what was done, what still needs a person (for example, reviewing a listed Conditional Access policy, or testing a sign-in), and how people connect: Windows App, or its web client.
Remove the deployer's access#
When you're done, Remove the deployer's access deletes AKC AVD Deployer's service principal from your tenant, and with it the consent you gave. Nothing you deployed depends on it. You can add it again later by signing in.