Create a profile container with Azure Files and Azure AD DS
This article will show you how to create an FSLogix profile container with Azure Files and Azure Active Directory Domain Services (AD DS).
This article assumes you've already set up an Azure AD DS instance. If you don't have one yet, follow the instructions in Create a basic managed domain first, then return here.
Add Azure AD DS admins
To add additional admins, you create a new user and grant them permissions.
To add an admin:
Select Azure Active Directory from the sidebar, then select All users, and then select New user.
Enter the user details into the fields.
In the Azure Active Directory pane on the left side of the screen, select Groups.
Select the AAD DC Administrators group.
In the left pane, select Members, then select Add members in the main pane. This will show a list of all users available in Azure AD. Select the name of the user profile you just created.
Set up an Azure Storage account
Now it's time to enable Azure AD DS authentication over Server Message Block (SMB).
To enable authentication:
If you haven't already, set up and deploy a general-purpose v2 Azure Storage account by following the instructions in Create an Azure Storage account.
Once you've finished setting up your account, select Go to resource.
Select Configuration from the pane on the left side of the screen, then enable Azure Active Directory authentication for Azure Files in the main pane. When you're done, select Save.
Select Overview in the pane on the left side of the screen, then select Files in the main pane.
Select File share and enter the Name and Quota into the fields that appear on the right side of the screen.
Assign access permissions to an identity
Other users will need access permissions to access your file share. To do this, you'll need to assign each user a role with the appropriate access permissions.
To assign users access permissions:
From the Azure portal, open the file share you created in Set up an Azure Storage account.
Select Access Control (IAM).
Select Add a role assignment.
In the Add role assignment tab, select the appropriate built-in role from the role list. You'll need to at least select Storage File Data SMB Share Contributor for the account to get proper permissions.
For Assign access to, select Azure Active Directory user, group, or service principal.
Select a name or email address for the target Azure Active Directory identity.
Get the Storage Account access key
Next, you'll need to get the access key for your Storage Account.
To get the Storage Account access key:
From the Azure portal sidebar, select Storage accounts.
From the list of storage accounts, select the account for which you enabled Azure AD DS and created the custom roles in steps above.
Under Settings, select Access keys and copy the key from key1.
Go to the Virtual Machines tab and locate any VM that will become part of your host pool.
Select the name of the virtual machine (VM) under Virtual Machines (adVM) and select Connect
This will download an RDP file that will let you sign in to the VM with its own credentials.
When you've signed in to the VM, run a command prompt as an administrator.
Run the following command:
net use <desired-drive-letter>: \\<storage-account-name>.file.core.windows.net\<share-name> /user:Azure\<storage-account-name> <storage-account-key>
<desired-drive-letter>with a drive letter of your choice (for example,
- Replace all instances of
<storage-account-name>with the name of the storage account you specified earlier.
<share-name>with the name of the share you created earlier.
<storage-account-key>with the storage account key from Azure.
net use y: \\fsprofile.file.core.windows.net\share HDZQRoFP2BBmoYQ=(truncated)= /user:Azure\fsprofile
Run the following commands to allow your Azure Virtual Desktop users to create their own profile container while blocking access to the profile containers from other users.
icacls <mounted-drive-letter>: /grant <user-email>:(M) icacls <mounted-drive-letter>: /grant "Creator Owner":(OI)(CI)(IO)(M) icacls <mounted-drive-letter>: /remove "Authenticated Users" icacls <mounted-drive-letter>: /remove "Builtin\Users"
<mounted-drive-letter>with the letter of the drive you used to map the drive.
<user-email>with the UPN of the user or Active Directory group that contains the users that will require access to the share.
icacls <mounted-drive-letter>: /grant email@example.com:(M) icacls <mounted-drive-letter>: /grant "Creator Owner":(OI)(CI)(IO)(M) icacls <mounted-drive-letter>: /remove "Authenticated Users" icacls <mounted-drive-letter>: /remove "Builtin\Users"
Create a profile container
Now that your profiles are ready to go, let's create a FSLogix profile container.
To configure a FSLogix profile container:
Sign in to the session host VM you configured at the beginning of this article, then download and install the FSLogix agent.
Unzip the FSLogix agent file you downloaded and go to x64 > Releases, then open FSLogixAppsSetup.exe.
Once the installer launches, select I agree to the license terms and conditions. If applicable, provide a new key.
Open Drive C, then go to Program Files > FSLogix > Apps to make sure the FSLogix agent was properly installed.
If there are multiple VMs in the host pool, you'll need to repeat steps 1 through 5 for each VM.
Run Registry Editor (RegEdit) as an administrator.
Navigate to Computer > HKEY_LOCAL_MACHINE > software > FSLogix, right-click on FSLogix, select New, and then select Key.
Create a new key named Profiles.
Right-click on Profiles, select New, and then select DWORD (32-bit) Value. Name the value Enabled and set the Data value to 1.
Right-click on Profiles, select New, and then select Multi-String Value. Name the value VHDLocations and set enter the URI for the Azure Files share
\\fsprofile.file.core.windows.net\shareas the Data value.
Assign users to a session host
Now you'll need to assign users to your session host.
To assign users:
Run Windows PowerShell as an administrator, then run the following cmdlet to sign in to Azure Virtual Desktop with PowerShell:
Import-Module Microsoft.RdInfra.RdPowershell #Optional Install-Module Microsoft.RdInfra.RdPowershell $brokerurl = "https://rdbroker.wvd.microsoft.com" Add-RdsAccount -DeploymentUrl $brokerurl
When prompted for credentials, enter the same user that was granted the TenantCreator, RDS Owner, or RDS Contributor role on the Azure Virtual Desktop tenant.
Run the following cmdlets to assign the user to the remote desktop group:
$tenant = "<your-wvd-tenant>" $pool1 = "<wvd-pool>" $appgroup = "Desktop Application Group" $user1 = "<user-principal>" Add-RdsAppGroupUser $tenant $pool1 $appgroup $user1
Like the earlier cmdlets, make sure to replace
<user-principal>with the relevant values.
$pool1 = "contoso" $tenant = "contoso" $appgroup = "Desktop Application Group" $user1 = "firstname.lastname@example.org" Add-RdsAppGroupUser $tenant $pool1 $appgroup $user1
Make sure your profile works
Now all you have to do is make sure the profile you created exists and works as intended.
To verify your profile:
Open a browser and go to the Azure Virtual Desktop web client.
Sign in with the user account assigned to the Remote Desktop group.
Once the user session has been established, open the Azure portal and sign in with an administrative account.
From the sidebar, select Storage accounts.
Select the storage account you configured as the file share for your session host pool and enabled with Azure AD DS.
Select the Files icon, then expand your share.
If everything's set up correctly, you should see a Directory with a name that's formatted like this:
If you're looking for alternate ways to create FSLogix profile containers, check out the following articles:
- Create a profile container for a host pool using a file share.
- Create an FSLogix profile container for a host pool using Azure NetApp Files
You can find more detailed information about concepts related to FSlogix containers for Azure files in FSLogix profile containers and Azure files.