Deploy Azure Virtual Desktop

Artikkel
10/22/2024

Important

The following features are currently in preview:

Azure Virtual Desktop on Azure Stack HCI for Azure Government and for Azure operated by 21Vianet (Azure in China).
Azure Virtual Desktop on Azure Extended Zones.
Managing session hosts using a session host configuration. This limited preview is provided as-is, with all faults and as available, and is excluded from the service-level agreements (SLAs) or any limited warranties Microsoft provides for Azure services in general availability. To register for the limited preview, complete this form: https://forms.office.com/r/ZziQRGR1Lz.

For legal terms that apply to Azure features that are in beta, in preview, or otherwise not yet released into general availability, see Supplemental Terms of Use for Microsoft Azure Previews.

This article shows you how to deploy Azure Virtual Desktop on Azure, Azure Stack HCI, or Azure Extended Zones by using the Azure portal, the Azure CLI, or Azure PowerShell. To deploy Azure Virtual Desktop, you:

Create a host pool.
Create a workspace.
Create an application group.
Create session host virtual machines (VMs).
Enable diagnostic settings (optional).
Assign users or groups to the application group for users to get access to desktops and applications.

You can do all these tasks in a single process when using the Azure portal, but you can also do them separately.

When you create a host pool, you can choose one of two management approaches:

Session host configuration (preview) is available for pooled host pools with session hosts on Azure. Azure Virtual Desktop manages the lifecycle of session hosts in a pooled host pool for you by using a combination of native features to provide an integrated and dynamic experience.
Standard management is available for pooled and personal host pools with session hosts on Azure or Azure Stack HCI. You manage creating, updating, and scaling session hosts in a host pool. If you want to use existing tools and processes, such as automated pipelines, custom scripts, or external partner solutions, you need to use the standard host pool management type.

For more information on the terminology used in this article, see Azure Virtual Desktop terminology. For more information about the Azure Virtual Desktop service, see Azure Virtual Desktop service architecture and resilience.

Tip

The process covered in this article is an in-depth and adaptable approach to deploying Azure Virtual Desktop. If you want to try Azure Virtual Desktop with a more simple approach to deploy a sample Windows 11 desktop, see Tutorial: Deploy a sample Azure Virtual Desktop infrastructure with a Windows 11 desktop or use the quickstart.

Select a button at the top of this article to choose between host pools using standard management or host pools using session host configuration to see the relevant documentation.

Prerequisites

Review the Prerequisites for Azure Virtual Desktop for a general idea of what's required and supported, such as operating systems (OS), virtual networks, and identity providers. It also includes a list of the supported Azure regions in which you can deploy host pools, workspaces, and application groups. This list of regions is where the metadata for the host pool can be stored. However, session hosts can be located in any Azure region. For more information about the types of data and locations, see Data locations for Azure Virtual Desktop.

For a general idea of what's required and supported, such as operating systems (OSs), virtual networks, and identity providers, review Prerequisites for Azure Virtual Desktop. That article also includes a list of the supported Azure regions in which you can deploy host pools, workspaces, and application groups. This list of regions is where the metadata for the host pool can be stored. However, session hosts can be located in any Azure region and on-premises with Azure Stack HCI. For more information about the types of data and locations, see Data locations for Azure Virtual Desktop.

For more prerequisites, including role-based access control (RBAC) roles, select the relevant tab for your scenario.

Azure portal
Azure PowerShell

In addition to the general prerequisites, you need:

The Azure account you use to create a host pool must have the following built-in role-based access control (RBAC) roles or equivalent as a minimum on the resource group or subscription to create the following resource types. If you want to assign the roles to a resource group, you need to create this first.

Resource type RBAC role

Host pool, workspace, and application group Desktop Virtualization Contributor

Session hosts (Azure) Virtual Machine Contributor

For ongoing management of host pools, workspaces, and application groups, you can use more granular roles for each resource type. For more information, see Built-in Azure RBAC roles for Azure Virtual Desktop.
Assign the Azure Virtual Desktop service principal the Desktop Virtualization Virtual Machine Contributor role-based access control (RBAC) role on the resource group or subscription with the host pools and session hosts you want to use with session host update. For more information, see Assign Azure RBAC roles or Microsoft Entra roles to the Azure Virtual Desktop service principals.
A key vault containing the secrets you want to use for your virtual machine local administrator account credentials and, if you're joining session hosts to an Active Directory domain, your domain join account credentials. You need one secret for each username and password.
- You need to provide the Azure Virtual Desktop service principal the ability to read the secrets. Your key vault can be configured to use either:
  - The Azure RBAC permission model with the custom role you created assigned to the Azure Virtual Desktop service principal.
  - An access policy with the Get secret permission assigned to the Azure Virtual Desktop service principal.
- The key vault must allow Azure Resource Manager for template deployment.
An Active Directory domain that you can join session hosts to. Joining session hosts to Microsoft Entra ID isn't supported, but you can use Microsoft Entra hybrid join.
Don't disable Windows Remote Management (WinRM) when creating session hosts using the Azure portal, as PowerShell DSC requires it.

In addition to the general prerequisites, you need:

The Azure account you use to create a host pool must have the following built-in role-based access control (RBAC) roles or equivalent as a minimum on the resource group or subscription to create the following resource types. If you want to assign the roles to a resource group, you need to create this first.

Resource type RBAC role

Host pool, workspace, and application group Desktop Virtualization Contributor

Session hosts (Azure) Virtual Machine Contributor

For ongoing management of host pools, workspaces, and application groups, you can use more granular roles for each resource type. For more information, see Built-in Azure RBAC roles for Azure Virtual Desktop.
Assign the Azure Virtual Desktop service principal the Desktop Virtualization Virtual Machine Contributor role-based access control (RBAC) role on the resource group or subscription with the host pools and session hosts you want to use with session host update. For more information, see Assign Azure RBAC roles or Microsoft Entra roles to the Azure Virtual Desktop service principals.
A key vault containing the secrets you want to use for your virtual machine local administrator account credentials and, if you're joining session hosts to an Active Directory domain, your domain join account credentials. You need one secret for each username and password. The virtual machine local administrator password must meet the password requirements when creating a VM.
- You need to provide the Azure Virtual Desktop service principal the ability to read the secrets. Your key vault can be configured to use either:
  - The Azure RBAC permission model with the custom role you created assigned to the Azure Virtual Desktop service principal.
  - An access policy with the Get secret permission assigned to the Azure Virtual Desktop service principal.
- The key vault must allow Azure Resource Manager for template deployment.
Don't disable Windows Remote Management (WinRM) when creating session hosts using the Azure portal, as PowerShell DSC requires it.
If you want to use Azure PowerShell locally, see Use Azure CLI and Azure PowerShell with Azure Virtual Desktop to make sure you have the Az.DesktopVirtualization PowerShell module installed. Alternatively, use the Azure Cloud Shell.
Azure PowerShell cmdlets for Azure Virtual Desktop that support host pools with a session host configuration are in preview. You need to download and install the preview version of the Az.DesktopVirtualization module to use these cmdlets, which are added in version 5.3.0.

Note

You can't use PowerShell to add session hosts to a host pool with a session host configuration. You need to use the Azure portal to specify the number of session hosts you want to add, then Azure Virtual Desktop automatically creates them based on the session host configuration.

The Azure account that you use must have the following built-in RBAC roles or equivalent as a minimum on a resource group or subscription to create the following resource types. If you want to assign the roles to a resource group, you need to create the resource group first.

Resource type	RBAC role
Host pool, workspace, and application group	Desktop Virtualization Contributor
Session hosts (Azure and Azure Extended Zones)	Virtual Machine Contributor
Session hosts (Azure Stack HCI)	Azure Stack HCI VM Contributor

For ongoing management of host pools, workspaces, and application groups, you can use more granular roles for each resource type. For more information, see Built-in Azure RBAC roles for Azure Virtual Desktop.

To assign users to the application group, you also need Microsoft.Authorization/roleAssignments/write permissions on the application group. Built-in RBAC roles that include this permission are User Access Administrator and Owner.
Don't disable Windows Remote Management when you're creating session hosts by using the Azure portal, because PowerShell DSC requires it.
To add session hosts on Azure Stack HCI, you also need:
- An Azure Stack HCI cluster registered with Azure. Your Azure Stack HCI clusters need to be running a minimum of version 23H2. For more information, see Azure Stack HCI, version 23H2 deployment overview. Azure Arc VM management is installed automatically.
- A stable connection to Azure from your on-premises network.
- At least one Windows OS image available on the cluster. For more information, see how to create VM images by using Azure Marketplace images, use images in an Azure Storage account, and use images in a local share.
- A logical network that you created on your Azure Stack HCI cluster. DHCP logical networks or static logical networks with automatic IP allocation are supported. For more information, see Create logical networks for Azure Stack HCI.
To deploy session hosts to Azure Extended Zones, you also need:
- Your Azure subscription registered with the respective Azure Extended Zone. For more information, see Request access to an Azure Extended Zone.
- An existing Azure load balancer on the virtual network where you're deploying the session hosts.

The Azure account that you use must have the following built-in RBAC roles or equivalent as a minimum on a resource group or subscription to create the following resource types. If you want to assign the roles to a resource group, you need to create the resource group first.

Resource type RBAC role

Host pool, workspace, and application group Desktop Virtualization Contributor

Session hosts Virtual Machine Contributor

For ongoing management of host pools, workspaces, and application groups, you can use more granular roles for each resource type. For more information, see Built-in Azure RBAC roles for Azure Virtual Desktop.
If you want to use Azure PowerShell locally, see Use the Azure CLI and Azure PowerShell with Azure Virtual Desktop to make sure you have the Az.DesktopVirtualization Azure PowerShell module installed. Alternatively, use Azure Cloud Shell.

Important

If you want to create Microsoft Entra joined session hosts, we only support this using the AADLoginForWindows VM extension, which is added and configured automatically when using the Azure portal or ARM template with the Azure Virtual Desktop service.

The Azure account that you use must have the following built-in RBAC roles or equivalent as a minimum on a resource group or subscription to create the following resource types. If you want to assign the roles to a resource group, you need to create the resource group first.

Resource type RBAC role

Host pool, workspace, and application group Desktop Virtualization Contributor

Session hosts Virtual Machine Contributor

For ongoing management of host pools, workspaces, and application groups, you can use more granular roles for each resource type. For more information, see Built-in Azure RBAC roles for Azure Virtual Desktop.
If you want to use the Azure CLI locally, see Use the Azure CLI and Azure PowerShell with Azure Virtual Desktop to make sure you have the desktopvirtualization Azure CLI extension installed. Alternatively, use Azure Cloud Shell.

Important

Create a host pool with a session host configuration

To create a host pool with a session host configuration, select the relevant tab for your scenario and follow the steps.

Azure portal
Azure PowerShell

Here's how to create a host pool with a session host configuration using the Azure portal, which also creates a default session host management policy and default session host configuration. You can change the default session host management policy and session host configuration after deployment.

Make sure you've registered for the limited preview using the link at the beginning of this article, then sign in to the Azure portal using the specific link provided to you after registration.
In the search bar, enter Azure Virtual Desktop and select the matching service entry.
Select Host pools, then select Create.

On the Basics tab, complete the following information:

Parameter	Value/Description
Subscription	Select the subscription you want to create the host pool in from the drop-down list.
Resource group	Select an existing resource group or select Create new and enter a name.
Host pool name	Enter a name for the host pool, for example hp01, up to 64 characters in length.
Location	Select the Azure region where you want to create your host pool.
Validation environment	Select Yes to create a host pool that is used as a validation environment. A validation environment is required during the preview.
Preferred app group type	Select the preferred application group type for this host pool from Desktop or RemoteApp. A Desktop application group is created automatically when using the Azure portal, with whichever application group type you set as the preferred.
Host pool type
Host pool type	Pooled is automatically selected and is the only host pool type supported with a session host configuration.
Use a session host configuration	Select Yes.

Once you complete this tab, select Next: Session hosts.

On the Session hosts tab, complete the following information, which is captured in a session host configuration and used to create session hosts.

Parameter	Value/Description
Number of session hosts	Enter the number of session hosts you want to create when creating the host pool. You can enter 0 to not create any session hosts at this point, but a session host configuration is still created with the values you specify for when you do create session hosts. You can deploy up to 500 session host VMs at this point if you wish (depending on your subscription quota), or you can add more later. For more information, see Azure Virtual Desktop service limits and Virtual Machines limits.
Session host configuration
Resource group	Automatically defaults to the resource group you chose your host pool to be in on the Basics tab, but you can also select an alternative from the drop-down list.
Name prefix	Enter a name for your session hosts, for example hp01-sh. This value is used as the prefix for your session host VMs. Each session host has a suffix of a hyphen and then a sequential number added to the end, for example hp01-sh-0. It can be a maximum of 10 characters and is used in the computer name in the operating system. The prefix and the suffix combined can be a maximum of 15 characters. Session host names must be unique.
Virtual machine location	Select the Azure region where to deploy your session host VMs. This region must be the same as your virtual network is in.
Availability zones	Select one or more availability zones in which to deploy your virtual machines.
Security type	Select from Standard, Trusted launch virtual machines, or Confidential virtual machines. - If you select Trusted launch virtual machines, options for secure boot and vTPM are automatically selected. - If you select Confidential virtual machines, options for secure boot, vTPM, and integrity monitoring are automatically selected. You can't opt out of vTPM when using a confidential VM. Trusted launch virtual machines is the default.
Image	Select the OS image you want to use from the list, or select See all images to see more, including any custom images you create and store as an Azure Compute Gallery shared image or a managed image.
Virtual machine size	Select a SKU. If you want to use different SKU, select Change size, then select from the list.
OS disk type	Select the disk type to use for your session hosts. We recommend Premium SSD for production workloads.
OS disk size	Select a size for the OS disk. If you enable hibernate, ensure the OS disk is large enough to store the contents of the memory in addition to the OS and other applications.
Boot Diagnostics	Select whether you want to enable boot diagnostics.
Network and security
Virtual network	Select your virtual network. An option to select a subnet appears.
Subnet	Select a subnet from your virtual network.
Network security group type	Select whether you want to use a network security group (NSG). - Basic creates a new NSG and you can specify public inbound ports. - Advanced enables you to select an existing NSG. You don't need to open inbound ports to connect to Azure Virtual Desktop. Learn more at Understanding Azure Virtual Desktop network connectivity.
Domain to join
Select which directory you would like to join	Select Active Directory, then select the key vault that contains the secrets for the username and password for the domain join account. You can optionally specify a domain name and organizational unit path.
Virtual Machine Administrator account	Select the key vault and secret for the username and password for the local administrator account of the new session host VMs. The username and password must meet the requirements for Windows VMs in Azure.
Custom configuration
Custom configuration script URL	If you want to run a PowerShell script during deployment you can enter the URL here.

Tip

Once you complete this tab, you can continue to optionally register the default desktop application group with a new or pre-existing workspace from this host pool, and enable diagnostics settings by selecting Next: Workspace. Alternatively, if you want to create and configure these separately, select Next: Review + create and go to step 9.

Optional: On the Workspace tab, if you want to create a workspace and register the default desktop application group from this host pool, complete the following information:

Parameter	Value/Description
Register desktop app group	Select Yes. This registers the default desktop application group to the selected workspace.
To this workspace	Select an existing workspace from the list, or select Create new and enter a name, for example ws01.

Once you complete this tab, select Next: Advanced.

Optional: On the Advanced tab, if you want to enable diagnostics settings, complete the following information:

Parameter	Value/Description
Enable diagnostics settings	Check the box.
Choosing destination details to send logs to	Select one of the following destinations: - Send to Log Analytics workspace - Archive to storage account - Stream to an event hub

Once you complete this tab, select Next: Tags.

Optional: On the Tags tab, you can enter any name/value pairs you need, then select Next: Review + create.
On the Review + create tab, ensure validation passes and review the information that is during deployment.
Select Create to create the host pool.
Once the host pool is created, select Go to resource to go to the overview of your new host pool, then select Properties to view its properties.

Post deployment

If you also added session hosts to your host pool, there's some extra configuration you might need to do, which is covered in the following sections.

Licensing

To ensure that your session hosts have licenses applied correctly, you need to do the following tasks:

If you have the correct licenses to run Azure Virtual Desktop workloads, you can apply a Windows or Windows Server license to your session hosts as part of Azure Virtual Desktop and run them without paying for a separate license. This license is automatically applied when you create session hosts by using the Azure Virtual Desktop service, but you might have to apply the license separately if you create session hosts outside Azure Virtual Desktop. For more information, see Apply a Windows license to session host virtual machines.
If your session hosts are running a Windows Server OS, you also need to issue them a Remote Desktop Services (RDS) client access license (CAL) from an RDS license server. For more information, see License your RDS deployment with client access licenses.
For session hosts on Azure Stack HCI, you must license and activate the virtual machines before you use them with Azure Virtual Desktop. For activating VMs that use Windows 10 Enterprise multi-session, Windows 11 Enterprise multi-session, and Windows Server 2022 Datacenter: Azure Edition, use Azure verification for VMs. For all other OS images (such as Windows 10 Enterprise, Windows 11 Enterprise, and other editions of Windows Server), you should continue to use existing activation methods. For more information, see Activate Windows Server VMs on Azure Stack HCI.

Microsoft Entra joined session hosts

For session hosts on Azure that are joined to Microsoft Entra ID, you also need to enable single sign-on or earlier authentication protocols, assign an RBAC role to users, and review your multifactor authentication policies so that users can sign in to the VMs. For more information, see Microsoft Entra joined session hosts.

Note

If you created a host pool, workspace, and registered the default desktop application group from this host pool in the same process, go to the section Assign users to an application group and complete the rest of the article. A Desktop application group is created automatically when using the Azure portal, whichever application group type you set as the preferred.
If you created a host pool and workspace in the same process, but didn't register the default desktop application group from this host pool, go to the section Create an application group and complete the rest of the article.
If you didn't create a workspace, continue to the next section and complete the rest of the article.

Here's how to create a host pool with a session host configuration, and a session host management policy using Azure PowerShell. You can change the session host configuration and session host management policy after deployment. Be sure to change the <placeholder> values for your own.

Important

In the following examples, the property ManagementType = 'Automated' is specified. This property is currently required to use a session host configuration and can't be changed after the host pool is created. This property is planned to be deprecated during the preview, allowing any host pool to manage using a session host configuration. Host pools created with the property ManagementType = 'Automated will continue to work after this property is deprecated.

Open Azure Cloud Shell in the Azure portal with the PowerShell terminal type, or run PowerShell on your local device.
- If you're using Cloud Shell, make sure your Azure context is set to the subscription that you want to use.
- If you're using PowerShell locally, first sign in with Azure PowerShell, and then make sure your Azure context is set to the subscription that you want to use.

Make sure you've registered for the limited preview using the link at the beginning of this article. Use the New-AzWvdHostPool cmdlet with the following example to create a host pool with a session host configuration using the breadth-first load-balancing algorithm and Desktop as the preferred application group type. More parameters are available; for more information, see the New-AzWvdHostPool PowerShell reference.
```
$parameters = @{
    Name = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
    ManagementType = 'Automated'
    HostPoolType = 'Pooled'
    PreferredAppGroupType = 'Desktop'
    LoadBalancerType = 'BreadthFirst'
    MaxSessionLimit = '<value>'
    Location = '<AzureRegion>'
}

New-AzWvdHostPool @parameters
```
You can view the properties of your new host pool by running the following command:
```
Get-AzWvdHostPool -Name <Name> -ResourceGroupName <ResourceGroupName> | FL *
```

Next you need to create a session host configuration using the New-AzWvdSessionHostConfiguration cmdlet. Here are some examples:

To create a session host configuration using the Windows 11 Enterprise multi-session, version 22H2 marketplace image, join Microsoft Entra ID, and Premium SSD for the OS disk type, run the following command. For information about how to find the values for the Marketplace image, see Find and use Azure Marketplace VM images with Azure PowerShell.

$parameters = @{
    FriendlyName = '<FriendlyName>'
    HostPoolName = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
    VMNamePrefix = '<Prefix>'
    VMLocation = '<AzureRegion>'
    ImageInfoType = 'Marketplace'
    MarketplaceInfoPublisher = 'MicrosoftWindowsDesktop'
    MarketplaceInfoOffer = 'Windows-11'
    MarketplaceInfoSku = 'win11-22h2-avd'
    MarketplaceInfoExactVersion = '<VersionNumber>'
    VMSizeId = 'Standard_D8s_v5'
    DiskInfoType = 'Premium_LRS'
    NetworkInfoSubnetId = '/subscriptions/<SubscriptionID>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Network/virtualNetworks/<VNetName>/subnets/<SubnetName>'
    DomainInfoJoinType = 'AzureActiveDirectory'
    VMAdminCredentialsUsernameKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
    VMAdminCredentialsPasswordKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
}

New-AzWvdSessionHostConfiguration @parameters

To create a session host configuration using a custom image, join an Active Directory domain, and Premium SSD for the OS disk type, run the following command:

$parameters = @{
    FriendlyName = '<FriendlyName>'
    HostPoolName = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
    VMNamePrefix = '<Prefix>'
    VMLocation = '<AzureRegion>'
    ImageInfoType = 'Custom'
    CustomInfoResourceID  = '/subscriptions/<SubscriptionID>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Compute/galleries/<GalleryName>/images/<ImageName>/versions/<ImageVersion>'
    VMSizeId = 'Standard_D8s_v5'
    DiskInfoType = 'Premium_LRS'
    NetworkInfoSubnetId = '/subscriptions/<SubscriptionID>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Network/virtualNetworks/<VNetName>/subnets/<SubnetName>'
    DomainInfoJoinType = 'ActiveDirectory'
    ActiveDirectoryInfoDomainName = '<DomainName>'
    DomainCredentialsUsernameKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
    DomainCredentialsPasswordKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
    VMAdminCredentialsUsernameKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
    VMAdminCredentialsPasswordKeyVaultSecretUri = 'https://<VaultName>.vault.azure.net/secrets/<SecretName>/<Version>'
}

New-AzWvdSessionHostConfiguration @parameters

You can view the configuration of your session host configuration by running the following command:

$parameters = @{
    HostPoolName = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
}

Get-AzWvdSessionHostConfiguration @parameters | FL *

Finally, create a session host management policy using the New-AzWvdSessionHostManagement cmdlet by running the following command. For valid time zone values, see Get-TimeZone PowerShell reference and use the value from the StandardName property.

$parameters = @{
    HostPoolName = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
    ScheduledDateTimeZone = '<TimeZone>'
    UpdateLogOffDelayMinute = '<Number>'
    UpdateMaxVmsRemoved = '<Number>'
    UpdateDeleteOriginalVM = $False
    UpdateLogOffMessage = '<Message>'
}

New-AzWvdSessionHostManagement @parameters

Create a host pool with standard management

To create a host pool, select the relevant tab for your scenario and follow the steps.

Here's how to create a host pool by using the Azure portal:

Sign in to the Azure portal.
On the search bar, enter Azure Virtual Desktop and select the matching service entry.
Select Host pools, and then select Create.

On the Basics tab, complete the following information:

Parameter	Value/Description
Subscription	In the dropdown list, select the subscription where you want to create the host pool.
Resource group	Select an existing resource group, or select Create new and enter a name.
Host pool name	Enter a name for the host pool, such as hp01.
Location	Select the Azure region where you want to create your host pool.
Validation environment	Select Yes to create a host pool that's used as a validation environment. Select No (default) to create a host pool that isn't used as a validation environment.
Preferred app group type	Select the preferred application group type for this host pool: Desktop or RemoteApp. A desktop application group is created automatically when you use the Azure portal.
Host pool type	Select whether you want your host pool to be Personal or Pooled. If you select Personal, a new option appears for Assignment type. Select either Automatic or Direct. If you select Pooled, two new options appear for Load balancing algorithm and Max session limit. - For Load balancing algorithm, choose either breadth-first or depth-first, based on your usage pattern. - For Max session limit, enter the maximum number of users that you want load-balanced to a single session host. For more information, see Host pool load-balancing algorithms.

Tip

After you complete this tab, you can continue to optionally create session hosts, create a workspace, register the default desktop application group from this host pool, and enable diagnostic settings by selecting Next: Virtual Machines. Alternatively, if you want to create and configure these resources separately, select Next: Review + create and go to step 9.

Optional: On the Virtual machines tab, if you want to add session hosts, expand one of the following sections and complete the information, depending on whether you want to create session hosts on Azure or on Azure Stack HCI. For guidance on sizing session host virtual machines, see Session host virtual machine sizing guidelines.

To add session hosts on Azure, expand this section.

Parameter	Value/Description
Add virtual machines	Select Yes. This action shows several new options.
Resource group	This value defaults to the resource group that you chose to contain your host pool on the Basics tab, but you can select an alternative.
Name prefix	Enter a name prefix for your session hosts, such as hp01-sh. Each session host has a suffix of a hyphen and then a sequential number added to the end, such as hp01-sh-0. This name prefix can be a maximum of 11 characters and is used in the computer name in the operating system. The prefix and the suffix combined can be a maximum of 15 characters. Session host names must be unique.
Virtual machine type	Select Azure virtual machine.
Virtual machine location	Select the Azure region where you want to deploy your session hosts. This value must be the same region that contains your virtual network.
Availability options	Select from availability zones, availability set, or No infrastructure redundancy required. If you select availability zones or availability set, complete the extra parameters that appear.
Security type	Select from Standard, Trusted launch virtual machines, or Confidential virtual machines. - If you select Trusted launch virtual machines, options for secure boot and vTPM are automatically selected. - If you select Confidential virtual machines, options for secure boot, vTPM, and integrity monitoring are automatically selected. You can't opt out of vTPM when using a confidential VM.
Image	Select the OS image that you want to use from the list, or select See all images to see more. The full list includes any images that you created and stored as an Azure Compute Gallery shared image or a managed image.
Virtual machine size	Select a size. If you want to use a different size, select Change size, and then select from the list.
Hibernate	Select the box to enable hibernation. Hibernation is available only for personal host pools. For more information, see Hibernation in virtual machines. If you're using Microsoft Teams media optimizations, you should update the WebRTC redirector service to 1.45.2310.13001. FSLogix and app attach currently don't support hibernation. Don't enable hibernation if you're using FSLogix or app attach for your personal host pools.
Number of VMs	Enter the number of virtual machines that you want to deploy. You can deploy up to 400 session hosts at this point if you want (depending on your subscription quota), or you can add more later. For more information, see Azure Virtual Desktop service limits and Virtual Machines limits.
OS disk type	Select the disk type to use for your session hosts. We recommend that you use only Premium SSD for production workloads.
OS disk size	Select a size for the OS disk. If you enable hibernation, ensure that the OS disk is large enough to store the contents of the memory in addition to the OS and other applications.
Confidential computing encryption	If you're using a confidential VM, you must select the Confidential compute encryption checkbox to enable OS disk encryption. This checkbox appears only if you selected Confidential virtual machines as your security type.
Boot Diagnostics	Select whether you want to enable boot diagnostics.
Network and security
Virtual network	Select your virtual network. An option to select a subnet appears.
Subnet	Select a subnet from your virtual network.
Network security group	Select whether you want to use a network security group (NSG). - None doesn't create a new NSG. - Basic creates a new NSG for the VM network adapter. - Advanced enables you to select an existing NSG. We recommend that you don't create an NSG here, but create an NSG on the subnet instead.
Public inbound ports	You can select a port to allow from the list. Azure Virtual Desktop doesn't require public inbound ports, so we recommend that you select No.
Domain to join
Select which directory you would like to join	Select from Microsoft Entra ID or Active Directory, and complete the relevant parameters for the selected option.
Virtual Machine Administrator account
Username	Enter a name to use as the local administrator account for the new session hosts.
Password	Enter a password for the local administrator account.
Confirm password	Reenter the password.
Custom configuration
Custom configuration script URL	If you want to run a PowerShell script during deployment, you can enter the URL here.

To add session hosts on Azure Stack HCI, expand this section.

Parameter	Value/Description
Add virtual machines	Select Yes. This action shows several new options.
Resource group	This value defaults to the resource group that you chose to contain your host pool on the Basics tab, but you can select an alternative.
Name prefix	Enter a name prefix for your session hosts, such as hp01-sh. Each session host has a suffix of a hyphen and then a sequential number added to the end, such as hp01-sh-0. This name prefix can be a maximum of 11 characters and is used in the computer name in the operating system. The prefix and the suffix combined can be a maximum of 15 characters. Session host names must be unique.
Virtual machine type	Select Azure Stack HCI virtual machine.
Custom location	In the dropdown list, select the Azure Stack HCI cluster where you want to deploy your session hosts.
Images	Select the OS image that you want to use from the list, or select Manage VM images to manage the images available on the cluster that you selected.
Number of VMs	Enter the number of virtual machines that you want to deploy. You can add more later.
Virtual processor count	Enter the number of virtual processors that you want to assign to each session host. This value isn't validated against the resources available in the cluster.
Memory type	Select Static for a fixed memory allocation, or select Dynamic for a dynamic memory allocation.
Memory (GB)	Enter a number for the amount of memory, in gigabytes, that you want to assign to each session host. This value isn't validated against the resources available in the cluster.
Maximum memory	If you selected dynamic memory allocation, enter a number for the maximum amount of memory, in gigabytes, that you want your session host to be able to use.
Minimum memory	If you selected dynamic memory allocation, enter a number for the minimum amount of memory, in gigabytes, that you want your session host to be able to use.
Network and security
Network dropdown	Select an existing network to connect each session to.
Domain to join
Select which directory you would like to join	Active Directory is the only available option. This includes using Microsoft Entra hybrid join.
AD domain join UPN	Enter the user principal name (UPN) of an Active Directory user who has permission to join the session hosts to your domain.
Password	Enter the password for the Active Directory user.
Specify domain or unit	Select yes if you want to join session hosts to a specific domain or be placed in a specific organizational unit (OU). If you select no, the suffix of the UPN is used as the domain.
Virtual Machine Administrator account
Username	Enter a name to use as the local administrator account for the new session hosts.
Password	Enter a password for the local administrator account.
Confirm password	Reenter the password.

To add session hosts on Azure Extended Zones, expand this section.

Parameter	Value/Description
Add virtual machines	Select Yes. This action shows several new options.
Resource group	This value defaults to the resource group that you chose to contain your host pool on the Basics tab, but you can select an alternative.
Name prefix	Enter a name prefix for your session hosts, such as hp01-sh. Each session host has a suffix of a hyphen and then a sequential number added to the end, such as hp01-sh-0. This name prefix can be a maximum of 11 characters and is used in the computer name in the operating system. The prefix and the suffix combined can be a maximum of 15 characters. Session host names must be unique.
Virtual machine type	Select Azure virtual machine.
Virtual machine location	Select the Azure region where you want to deploy your session hosts. This value must be the same region that contains your virtual network. Then select Deploy to an Azure Extended Zone.
Azure Extended Zones
Azure Extended Zone	Select Los Angeles.
Place the session host(s) behind an existing load balancing solution?	Select the box. This action shows options for selecting a load balancer and a back-end pool.
Select a load balancer	Select an existing load balancer on the virtual network where you're deploying the session hosts.
Select a backend pool	Select a back-end pool on the load balancer where you want to place the session hosts.
Availability options	Select from availability zones, availability set, or No infrastructure dependency required. If you select availability zones or availability set, complete the extra parameters that appear.
Security type	Select from Standard, Trusted launch virtual machines, or Confidential virtual machines. - If you select Trusted launch virtual machines, options for secure boot and vTPM are automatically selected. - If you select Confidential virtual machines, options for secure boot, vTPM, and integrity monitoring are automatically selected. You can't opt out of vTPM when using a confidential VM.

After you complete this tab, select Next: Workspace.

Optional: On the Workspace tab, if you want to create a workspace and register the default desktop application group from this host pool, complete the following information:

Parameter	Value/Description
Register desktop app group	Select Yes. This action registers the default desktop application group to the selected workspace.
To this workspace	Select an existing workspace from the list, or select Create new and enter a name, such as ws01.

After you complete this tab, select Next: Advanced.

Optional: On the Advanced tab, if you want to enable diagnostic settings, complete the following information:

Parameter	Value/Description
Enable diagnostics settings	Select the box.
Choosing destination details to send logs to	Select one of the following destinations: - Send to a Log Analytics workspace - Archive to a storage account - Stream to an event hub

After you complete this tab, select Next: Tags.

Optional: On the Tags tab, you can enter any name/value pairs that you need, and then select Next: Review + create.
On the Review + create tab, ensure that validation passes and review the information that will be used during deployment.
Select Create to create the host pool.
Select Go to resource to go to the overview of your new host pool, and then select Properties to view its properties.

Post-deployment tasks

If you also added session hosts to your host pool, you need to do some extra configuration, as described in the following sections.

Licensing

To ensure that your session hosts have licenses applied correctly, you need to do the following tasks:

If you have the correct licenses to run Azure Virtual Desktop workloads, you can apply a Windows or Windows Server license to your session hosts as part of Azure Virtual Desktop and run them without paying for a separate license. This license is automatically applied when you create session hosts by using the Azure Virtual Desktop service, but you might have to apply the license separately if you create session hosts outside Azure Virtual Desktop. For more information, see Apply a Windows license to session host virtual machines.
If your session hosts are running a Windows Server OS, you also need to issue them a Remote Desktop Services (RDS) client access license (CAL) from an RDS license server. For more information, see License your RDS deployment with client access licenses.
For session hosts on Azure Stack HCI, you must license and activate the virtual machines before you use them with Azure Virtual Desktop. For activating VMs that use Windows 10 Enterprise multi-session, Windows 11 Enterprise multi-session, and Windows Server 2022 Datacenter: Azure Edition, use Azure verification for VMs. For all other OS images (such as Windows 10 Enterprise, Windows 11 Enterprise, and other editions of Windows Server), you should continue to use existing activation methods. For more information, see Activate Windows Server VMs on Azure Stack HCI.

Microsoft Entra joined session hosts

Note

If you created a host pool and a workspace, and you registered the default desktop application group from this host pool in the same process, go to the section Assign users to an application group and complete the rest of the article. A desktop application group (whichever application group type you set as preferred) is created automatically when you use the Azure portal.
If you created a host pool and workspace in the same process, but you didn't register the default desktop application group from this host pool, go to the section Create an application group and complete the rest of the article.
If you didn't create a workspace, continue to the next section and complete the rest of the article.

Here's how to create a host pool by using the Az.DesktopVirtualization Azure PowerShell module. The following examples show you how to create a pooled host pool and a personal host pool. Be sure to change the <placeholder> values for your own.

Open Azure Cloud Shell in the Azure portal with the PowerShell terminal type, or run PowerShell on your local device.
- If you're using Cloud Shell, make sure your Azure context is set to the subscription that you want to use.
- If you're using PowerShell locally, first sign in with Azure PowerShell, and then make sure your Azure context is set to the subscription that you want to use.

Use the New-AzWvdHostPool cmdlet with the following examples to create a host pool. More parameters are available. For more information, see the New-AzWvdHostPool Azure PowerShell reference.

To create a pooled host pool by using the breadth-first load-balancing algorithm and desktop as the preferred app group type, run the following command:

$parameters = @{
     Name = '<HostPoolName>'
     ResourceGroupName = '<ResourceGroupName>'
     HostPoolType = 'Pooled'
     LoadBalancerType = 'BreadthFirst'
     PreferredAppGroupType = 'Desktop'
     MaxSessionLimit = '<value>'
     Location = '<AzureRegion>'
}

New-AzWvdHostPool @parameters

To create a personal host pool by using the automatic assignment type and desktop as the preferred app group type, run the following command:

$parameters = @{
     Name = '<HostPoolName>'
     ResourceGroupName = '<ResourceGroupName>'
     HostPoolType = 'Personal'
     LoadBalancerType = 'Persistent'
     PreferredAppGroupType = 'Desktop'
     PersonalDesktopAssignmentType = 'Automatic'
     Location = '<AzureRegion>'
}

New-AzWvdHostPool @parameters

You can view the properties of your new host pool by running the following command:

$parameters = @{
    HostPoolName = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
}

Get-AzWvdHostPool @parameters | FL *

Here's how to create a host pool by using the desktopvirtualization extension for the Azure CLI. The following examples show you how to create a pooled host pool and a personal host pool. Be sure to change the <placeholder> values for your own.

Open Azure Cloud Shell in the Azure portal with the Bash terminal type, or run the Azure CLI on your local device.
- If you're using Cloud Shell, make sure your Azure context is set to the subscription that you want to use.
- If you're using the Azure CLI locally, first sign in with the Azure CLI, and then make sure your Azure context is set to the subscription that you want to use.

Use the az desktopvirtualization hostpool create command with the following examples to create a host pool. More parameters are available. For more information, see the az desktopvirtualization hostpool Azure CLI reference.

To create a pooled host pool by using the breadth-first load-balancing algorithm and desktop as the preferred app group type, run the following command:

az desktopvirtualization hostpool create \
     --name <Name> \
     --resource-group <ResourceGroupName> \
     --host-pool-type Pooled \
     --load-balancer-type BreadthFirst \
     --preferred-app-group-type Desktop \
     --max-session-limit <value> \
     --location <AzureRegion>

To create a personal host pool by using the automatic assignment type, run the following command:

az desktopvirtualization hostpool create \
     --name <Name> \
     --resource-group <ResourceGroupName> \
     --host-pool-type Personal \
     --load-balancer-type Persistent \
     --preferred-app-group-type Desktop \
     --personal-desktop-assignment-type Automatic \
     --location <AzureRegion>

You can view the properties of your new host pool by running the following command:

az desktopvirtualization hostpool show --name <Name> --resource-group <ResourceGroupName>

Create a workspace

Next, to create a workspace, select the relevant tab for your scenario and follow the steps.

Here's how to create a workspace by using the Azure portal:

On the Azure Virtual Desktop overview, select Workspaces, and then select Create.

On the Basics tab, complete the following information:

Parameter	Value/Description
Subscription	In the dropdown list, select the subscription where you want to create the workspace.
Resource group	Select an existing resource group, or select Create new and enter a name.
Workspace name	Enter a name for the workspace, such as workspace01.
Friendly name	Optional: Enter a display name for the workspace.
Description	Optional: Enter a description for the workspace.
Location	Select the Azure region where you want to deploy your workspace.

Tip

After you complete this tab, you can continue to optionally register an existing application group to this workspace, if you have one, and enable diagnostic settings by selecting Next: Application groups. Alternatively, if you want to create and configure these resources separately, select Review + create and go to step 9.

Optional: On the Application groups tab, if you want to register an existing application group to this workspace, complete the following information:

Parameter	Value/Description
Register application groups	Select Yes, and then select + Register application groups. On the new pane that opens, select the Add icon for the application groups that you want to add, and then choose Select.

After you complete this tab, select Next: Advanced.

Optional: On the Advanced tab, if you want to enable diagnostic settings, complete the following information:

Parameter	Value/Description
Enable diagnostics settings	Select the box.
Choosing destination details to send logs to	Select one of the following destinations: - Send to a Log Analytics workspace - Archive to a storage account - Stream to an event hub

After you complete this tab, select Next: Tags.

Optional: On the Tags tab, you can enter any name/value pairs that you need, and then select Next: Review + create.
On the Review + create tab, ensure that validation passes and review the information that will be used during deployment.
Select Create to create the workspace.
Select Go to resource to go to the overview of your new workspace, and then select Properties to view its properties.

Note

If you added an application group to this workspace, go to the section Assign users to an application group and complete the rest of the article.
If you didn't add an application group to this workspace, continue to the next section and complete the rest of the article.

Here's how to create a workspace by using the Az.DesktopVirtualization Azure PowerShell module:

In the same PowerShell session, use the New-AzWvdWorkspace cmdlet with the following example to create a workspace. More parameters are available, such as parameters to register existing application groups. For more information, see the New-AzWvdWorkspace Azure PowerShell reference.
```
$parameters = @{
   Name = '<WorkspaceName>'
   ResourceGroupName = '<ResourceGroupName>'
   Location = '<AzureRegion>'
}

New-AzWvdWorkspace @parameters
```

You can view the properties of your new workspace by running the following command:

$parameters = @{
   Name = '<WorkspaceName>'
   ResourceGroupName = '<ResourceGroupName>'
}

Get-AzWvdWorkspace @parameters | FL *

Here's how to create a workspace by using the desktopvirtualization extension for the Azure CLI:

In the same CLI session, use the az desktopvirtualization workspace create command with the following example to create a workspace. More parameters are available, such as parameters to register existing application groups. For more information, see the az desktopvirtualization workspace Azure CLI reference.
```
az desktopvirtualization workspace create \
    --name <Name> \
    --resource-group <ResourceGroupName>
```

You can view the properties of your new workspace by running the following command:

az desktopvirtualization workspace show \
    --name <Name> \
    --resource-group <ResourceGroupName>

Create an application group

To create an application group, select the relevant tab for your scenario and follow the steps.

Here's how to create an application group by using the Azure portal:

On the Azure Virtual Desktop overview, select Application groups, and then select Create.

On the Basics tab, complete the following information:

Parameter	Value/Description
Subscription	In the dropdown list, select the subscription where you want to create the application group.
Resource group	Select an existing resource group, or select Create new and enter a name.
Host pool	Select the host pool for the application group.
Location	Metadata is stored in the same location as the host pool.
Application group type	Select the application group type for the host pool: Desktop or RemoteApp.
Application group name	Enter a name for the application group, such as Session Desktop.

Tip

After you complete this tab, select Next: Review + create. You don't need to complete the other tabs to create an application group, but you need to create a workspace, add an application group to a workspace, and assign users to the application group before users can access the resources.

If you created an application group for RemoteApp, you also need to add applications to it. For more information, see Publish applications.

Optional: If you chose to create a RemoteApp application group, you can add applications to this group. On the Application groups tab, select + Add applications, and then select an application. For more information on the application parameters, see Publish applications with RemoteApp. At least one session host in the host pool must be turned on and available in Azure Virtual Desktop.

After you complete this tab, or if you're creating a desktop application group, select Next: Assignments.
Optional: On the Assignments tab, if you want to assign users or groups to this application group, select + Add Microsoft Entra users or user groups. On the new pane that opens, select the box next to the users or groups that you want to add, and then choose Select.

After you complete this tab, select Next: Workspace.

Optional: On the Workspace tab, if you're creating a desktop application group, you can register the default desktop application group from the host pool that you selected by completing the following information:

Parameter	Value/Description
Register application group	Select Yes. This action registers the default desktop application group to the selected workspace.
Register application group	Select an existing workspace from the list.

After you complete this tab, select Next: Advanced.

Optional: If you want to enable diagnostic settings, on the Advanced tab, complete the following information:

Parameter	Value/Description
Enable diagnostics settings	Select the box.
Choosing destination details to send logs to	Select one of the following destinations: - Send to a Log Analytics workspace - Archive to a storage account - Stream to an event hub

After you complete this tab, select Next: Tags.

Optional: On the Tags tab, you can enter any name/value pairs that you need, and then select Next: Review + create.
On the Review + create tab, ensure that validation passes and review the information that will be used during deployment.
Select Create to create the application group.
Select Go to resource to go to the overview of your new application group, and then select Properties to view its properties.

Note

If you created a desktop application group, assigned users or groups, and registered the default desktop application group to a workspace, your assigned users can connect to the desktop and you don't need to complete the rest of the article.
If you created a RemoteApp application group, added applications, and assigned users or groups, go to the section Add an application group to a workspace and complete the rest of the article.
If you didn't add applications, assign users or groups, or register the application group to a workspace, continue to the next section and complete the rest of the article.

Here's how to create an application group by using the Az.DesktopVirtualization Azure PowerShell module:

In the same PowerShell session, get the resource ID of the host pool for which you want to create an application group and store it in a variable by running the following command:
```
$parameters = @{
    Name = '<HostPoolName>'
    ResourceGroupName = '<ResourceGroupName>'
}

$hostPoolArmPath = (Get-AzWvdHostPool @parameters).Id
```

Use the New-AzWvdApplicationGroup cmdlet with the following examples to create an application group. For more information, see the New-AzWvdApplicationGroup Azure PowerShell reference.

To create a desktop application group, run the following command:

$parameters = @{
     Name = '<ApplicationGroupName>'
     ResourceGroupName = '<ResourceGroupName>'
     ApplicationGroupType = 'Desktop'
     HostPoolArmPath = $hostPoolArmPath
     Location = '<AzureRegion>'
}

New-AzWvdApplicationGroup @parameters

To create a RemoteApp application group, run the following command. You can only create a RemoteApp application group with a pooled host pool.

$parameters = @{
     Name = '<Name>'
     ResourceGroupName = '<ResourceGroupName>'
     ApplicationGroupType = 'RemoteApp'
     HostPoolArmPath = $hostPoolArmPath
     Location = '<AzureRegion>'
}

New-AzWvdApplicationGroup @parameters

You can view the properties of your new application group by running the following command:

$parameters = @{
   Name = '<ApplicationGroupName>'
   ResourceGroupName = '<ResourceGroupName>'
}

Get-AzWvdApplicationGroup @parameters | FL *

Here's how to create an application group by using the desktopvirtualization extension for the Azure CLI:

In the same CLI session, get the resource ID of the host pool for which you want to create an application group and store it in a variable by running the following command:
```
hostPoolArmPath=$(az desktopvirtualization hostpool show \
    --name <Name> \
    --resource-group <ResourceGroupName> \
    --query [id] \
    --output tsv)
```

Use the az desktopvirtualization applicationgroup create command with the following examples to create an application group. For more information, see the az desktopvirtualization applicationgroup Azure CLI reference.

To create a Desktop application group, run the following command:

az desktopvirtualization applicationgroup create \
     --name <Name> \
     --resource-group <ResourceGroupName> \
     --application-group-type Desktop \
     --host-pool-arm-path $hostPoolArmPath \
     --location <AzureRegion>

To create a RemoteApp application group, run the following command. You can only create a RemoteApp application group with a pooled host pool.

az desktopvirtualization applicationgroup create \
     --name <Name> \
     --resource-group <ResourceGroupName> \
     --application-group-type RemoteApp \
     --host-pool-arm-path $hostPoolArmPath \
     --location <AzureRegion>

You can view the properties of your new application group by running the following command:

az desktopvirtualization applicationgroup show \
    --name <Name> \
    --resource-group <ResourceGroupName>

Add an application group to a workspace

Next, to add an application group to a workspace, select the relevant tab for your scenario and follow the steps.

Here's how to add an application group to a workspace by using the Azure portal:

On the Azure Virtual Desktop overview, select Workspaces, and then select the name of the workspace to which you want to assign an application group.
On the workspace overview, select Application groups, and then select + Add.
In the list, select the plus icon (+) next to an application group. Only application groups that aren't already assigned to a workspace are listed.
Choose Select. The application group is added to the workspace.

Here's how to add an application group to a workspace by using the Az.DesktopVirtualization Azure PowerShell module:

In the same PowerShell session, use the Update-AzWvdWorkspace cmdlet with the following example to add an application group to a workspace:

# Get the resource ID of the application group that you want to add to the workspace

$parameters = @{
    Name = '<ApplicationGroupName>'
    ResourceGroupName = '<ResourceGroupName>'
}

$appGroupPath = (Get-AzWvdApplicationGroup @parameters).Id

# Add the application group to the workspace
$parameters = @{
    Name = '<WorkspaceName>'
    ResourceGroupName = '<ResourceGroupName>'
    ApplicationGroupReference = $appGroupPath
}

Update-AzWvdWorkspace @parameters

You can view the properties of your workspace by running the following command. The key ApplicationGroupReference contains an array of the application groups added to the workspace.
```
$parameters = @{
    Name = '<WorkspaceName>'
    ResourceGroupName = '<ResourceGroupName>'
}

Get-AzWvdWorkspace @parameters | FL *
```

Here's how to add an application group to a workspace by using the desktopvirtualization extension for the Azure CLI:

In the same CLI session, use the az desktopvirtualization workspace update command with the following example to add an application group to a workspace:

# Get the resource ID of the application group that you want to add to the workspace
appGroupPath=$(az desktopvirtualization applicationgroup show \
    --name <Name> \
    --resource-group <ResourceGroupName> \
    --query [id] \
    --output tsv)

# Add the application group to the workspace
az desktopvirtualization workspace update \
    --name <Name> \
    --resource-group <ResourceGroupName> \
    --application-group-references $appGroupPath

You can view the properties of your workspace by running the following command. The key applicationGroupReferences contains an array of the application groups added to the workspace.
```
az desktopvirtualization applicationgroup show \
    --name <Name> \
    --resource-group <ResourceGroupName>
```

Assign users to an application group

Finally, to assign users or user groups to an application group, select the relevant tab for your scenario and follow the steps. We recommend that you assign user groups to application groups to make ongoing management simpler.

The account you use needs permission to assign roles in Azure RBAC on the application group after it's created. The permission is Microsoft.Authorization/roleAssignments/write, which is included in some built-in roles, such as User Access Administrator and Owner.

Here's how to assign users or user groups to an application group by using the Azure portal:

On the Azure Virtual Desktop overview, select Application groups.
Select the application group from the list.
On the application group overview, select Assignments.
Select + Add, and then search for and select the user account or user group that you want to assign to this application group.
Finish by choosing Select.

Here's how to assign users or user groups to an application group by using the Az.Resources Azure PowerShell module.

In the same PowerShell session, use the New-AzRoleAssignment cmdlet with the following examples to assign users or user groups to an application group:

To assign users to the application group, run the following commands:

$parameters = @{
    SignInName = '<UserPrincipalName>'
    ResourceName = '<ApplicationGroupName>'
    ResourceGroupName = '<ResourceGroupName>'
    RoleDefinitionName = 'Desktop Virtualization User'
    ResourceType = 'Microsoft.DesktopVirtualization/applicationGroups'
}

New-AzRoleAssignment @parameters

To assign user groups to the application group, run the following commands:

# Get the object ID of the user group that you want to assign to the application group
$userGroupId = (Get-AzADGroup -DisplayName "<UserGroupName>").Id

# Assign users to the application group
$parameters = @{
    ObjectId = $userGroupId
    ResourceName = '<ApplicationGroupName>'
    ResourceGroupName = '<ResourceGroupName>'
    RoleDefinitionName = 'Desktop Virtualization User'
    ResourceType = 'Microsoft.DesktopVirtualization/applicationGroups'
}

New-AzRoleAssignment @parameters

Here's how to assign users or user groups to an application group by using the role extension for the Azure CLI.

In the same CLI session, use the az role assignment create command with the following examples to assign users or user groups to an application group:

To assign users to the application group, run the following commands:

# Get the resource ID of the application group that you want to add to the workspace
appGroupPath=$(az desktopvirtualization applicationgroup show \
    --name <Name> \
    --resource-group <ResourceGroupName> \
    --query [id] \
    --output tsv)

# Assign users to the application group
az role assignment create \
    --assignee '<UserPrincipalName>' \
    --role 'Desktop Virtualization User' \
    --scope $appGroupPath

To assign user groups to the application group, run the following commands:

# Get the resource ID of the application group that you want to add to the workspace
appGroupPath=$(az desktopvirtualization applicationgroup show \
    --name <Name> \
    --resource-group <ResourceGroupName> \
    --query [id] \
    --output tsv)

# Get the object ID of the user group that you want to assign to the application group
userGroupId=$(az ad group show \
    --group <UserGroupName> \
    --query [id] \
    --output tsv)

# Assign users to the application group
az role assignment create \
    --assignee $userGroupId \
    --role 'Desktop Virtualization User' \
    --scope $appGroupPath

After you deploy Azure Virtual Desktop, your users can connect from several platforms, including a web browser. For more information, see Remote Desktop clients for Azure Virtual Desktop and Connect to Azure Virtual Desktop with the Remote Desktop Web client.

Here are some extra tasks that you might want to do:

Jagamisviis:

Deploy Azure Virtual Desktop

Prerequisites

Create a host pool with a session host configuration

Post deployment

Licensing

Microsoft Entra joined session hosts

Create a host pool with standard management

Post-deployment tasks

Licensing

Microsoft Entra joined session hosts

Create a workspace

Create an application group

Add an application group to a workspace

Assign users to an application group

Tagasiside

Lisaressursid

Resource type	RBAC role
Host pool, workspace, and application group	Desktop Virtualization Contributor
Session hosts (Azure)	Virtual Machine Contributor

Resource type	RBAC role
Host pool, workspace, and application group	Desktop Virtualization Contributor
Session hosts	Virtual Machine Contributor

Jagamisviis:

Deploy Azure Virtual Desktop

Prerequisites

Create a host pool with a session host configuration

Post deployment

Licensing

Microsoft Entra joined session hosts

Create a host pool with standard management

Post-deployment tasks

Licensing

Microsoft Entra joined session hosts

Create a workspace

Create an application group

Add an application group to a workspace

Assign users to an application group

Related content

Tagasiside

Lisaressursid