Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,820 questions
AVD with on-premises AD integration access issues
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 55.00000000000001%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EL%3C/text%3E%3C/svg%3E)
lk777
1
Reputation point
Hi,
I have deployed Azure Virtual Desktop with the on-premises AD integration via Site-to-Site IPsec VPN. Virtual machines joined a local domain. I can't connect to AVD neither via web nor Remote Desktop client. I have tested AVD with Azure AD before this hybrid integration and it worked. Does this hybrid setup require any additional routing changes or/and network security group adjustments?
Thanks.
Azure Virtual Desktop
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 8%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJV%3C/text%3E%3C/svg%3E)
Johan Vanneuville 91 Reputation points MVP2022-12-16T17:31:19.877+00:00 What error message do you get?
-
lk777 1 Reputation point
2022-12-16T18:10:12.44+00:00 More details :
-
lk777 1 Reputation point
2022-12-16T18:33:14.467+00:00 But I can connect to the Session Hosts (VMs) via RDP to the internal IP addresses.
-
Johan Vanneuville 91 Reputation points MVP
2022-12-18T09:39:44.027+00:00 What version of OS are you running?
How many hosts do you have in that pool. Is the issue with all of them? Otherwise try to join the device again in your domain. -
lk777 1 Reputation point
2022-12-19T20:33:44.907+00:00 I took some time to figure out. This kind of AD - AAD integration requires UPN matching. I had to add x.onmicrosoft.com domain in my AD environment and then changed domain part of the user logon name (AVD user). I wanted to avoid any Federation integration, so that was the only option with the password hash synchronization (AD Connect).
SSO AAD requires a Kerberos Server object in the on-prem AD.
I couldn't find any single document that covers this, I believe, a common scenario.The Site-to-Site VPN reliability is sooo bad. It makes me nervous. After the AWS experience with VPN and Workspaces I do not know if I still want this MS stuff.
-
Prrudram-MSFT 28,191 Reputation points Moderator2022-12-22T06:32:32.87+00:00 @lk777 ,
UPN matching is mentioned here: Prerequisites for Azure Virtual Desktop | Microsoft Learn
Let me know if you still looking for any help here
Sign in to comment
Sign in to answer