Set up Azure resources, assign roles, and licenses
After you establish the network and any directory connections your design requires, you can provision the Azure services required for your Azure Virtual Desktop virtual machines (VMs).
Create Azure resources
When you go to provision an Azure Virtual Desktop, you can create a new resource group to contain its resources. But you'll need other resources before you can provision Azure Virtual Desktop. You need a virtual network; domain information and domain-join credentials apply only to domain-joined session hosts. As part of your preparation, create the following resources in Azure:
Resource group - One or more resource groups to contain and group Azure resources.
Virtual network - A virtual network is needed for the host pool provisioning process, which is part of the Azure Virtual Desktop deployment. Domain-joined session hosts need DNS and network connectivity to their domain controllers. Microsoft Entra joined session hosts don't require domain connectivity solely for service access, but applications might need it. Allow outbound access to the current required FQDNs and endpoints for Azure Virtual Desktop.
Consider using Azure Firewall with your virtual network to help you lock down your environment and filter outbound traffic.
Storage account - A storage account in Azure to store virtual disk files used with FSLogix profiles and to synchronize or provision file share services for Azure Virtual Desktop session hosts. You can also use Azure NetApp Files or Storage Spaces Direct.
Azure accounts - Administrator, user, and system accounts required to manage services. In large organizations, it's a good idea to assign administrator roles to different people and establish multiple people per role. If you're just starting out or you have a small IT department, these can be the same person.
To learn how to create these resources, see the learn more section at the end of this module.
Assign Azure roles
Azure Virtual Desktop uses Azure role-based access control (RBAC) to manage Azure resources, rather than requiring a Microsoft Entra Global Administrator role:
- Azure RBAC roles - Grant permissions to manage Azure Virtual Desktop and supporting resources at the required scope. Assigning Azure roles requires separate role-assignment permissions.
- User administrator - Creates users and manages user access in Microsoft Entra ID. This directory role doesn't grant Azure resource-management permissions.
Other accounts or roles depend on the deployment:
- Organizational ID - For AD DS domain-joined session hosts, provide an account with delegated permission to join computers to the domain or organizational unit. Domain Admins membership isn't required when these permissions are delegated. For Microsoft Entra Domain Services, follow the managed-domain join requirements, including membership in the AAD DC Administrators group. Azure-hosted session hosts can instead be Microsoft Entra joined, without AD DS domain-join credentials. Follow the Microsoft Entra joined session-host requirements for device join and user access.
- Subscription Contributor or Owner - Both roles include the subscription-level
*/register/actionpermission needed to register the Azure Virtual Desktop provider. Subscription Owner isn't the only option.
Check your account's Azure RBAC assignments before deployment. Creating a Microsoft Entra tenant doesn't automatically grant the Azure resource permissions needed for deployment. See Built-in Azure RBAC roles for Azure Virtual Desktop.
Assign licenses to Azure Virtual Desktop users
The final step in managing your user accounts and access is to make sure your initial Azure Virtual Desktop users are licensed. You can assign licenses to users in the Users area of the Microsoft 365 admin portal, or you can script it using the Microsoft Graph PowerShell module.