You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-desktop/delegated-access-virtual-desktop.md
+17-27Lines changed: 17 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: Heidilohr
6
6
7
7
ms.service: virtual-desktop
8
8
ms.topic: conceptual
9
-
ms.date: 03/21/2019
9
+
ms.date: 04/30/2020
10
10
ms.author: helohr
11
11
manager: lizross
12
12
---
@@ -24,48 +24,38 @@ Windows Virtual Desktop delegated access supports the following values for each
24
24
25
25
* Security principal
26
26
* Users
27
+
* User groups
27
28
* Service principals
28
29
* Role definition
29
30
* Built-in roles
31
+
* Custom roles
30
32
* Scope
31
-
* Tenant groups
32
-
* Tenants
33
33
* Host pools
34
34
* App groups
35
-
36
-
## Built-in roles
37
-
38
-
Delegated access in Windows Virtual Desktop has several built-in role definitions you can assign to users and service principals.
39
-
40
-
* An RDS Owner can manage everything, including access to resources.
41
-
* An RDS Contributor can manage everything, but can't access to resources.
42
-
* An RDS Reader can view everything, but can't make any changes.
43
-
* An RDS Operator can view diagnostic activities.
35
+
* Workspaces
44
36
45
37
## PowerShell cmdlets for role assignments
46
38
47
-
You can run the following cmdlets to create, view, and remove role assignments:
39
+
Before you start, make sure to follow the instructions in [Set up the PowerShell module](powershell-module.md)to set up the Windows Virtual Desktop PowerShell module if you haven't already.
48
40
49
-
***Get-RdsRoleAssignment** displays a list of role assignments.
50
-
***New-RdsRoleAssignment** creates a new role assignment.
51
-
***Remove-RdsRoleAssignment** deletes role assignments.
41
+
Windows Virtual Desktop uses Azure role-based access control (RBAC) while publishing app groups to users or user groups. The Desktop Virtualization User role is assigned to the user or user group and the scope is the app group. This role gives the user special data access on the app group.
52
42
53
-
### Accepted parameters
43
+
Run the following cmdlet to add Azure Active Directory users to an app group:
54
44
55
-
You can modify the basic three cmdlets with the following parameters:
***AadTenantId**: specifies the Azure Active Directory tenant ID from which the service principal is a member.
58
-
***AppGroupName**: name of the Remote Desktop app group.
59
-
***Diagnostics**: indicates the diagnostics scope. (Must be paired with either the **Infrastructure** or **Tenant** parameters.)
60
-
***HostPoolName**: name of the Remote Desktop host pool.
61
-
***Infrastructure**: indicates the infrastructure scope.
62
-
***RoleDefinitionName**: name of the Remote Desktop Services role-based access control role assigned to the user, group, or app. (For example, Remote Desktop Services Owner, Remote Desktop Services Reader, and so on.)
63
-
***ServerPrincipleName**: name of the Azure Active Directory application.
64
-
***SignInName**: the user's email address or user principal name.
65
-
***TenantName**: name of the Remote Desktop tenant.
49
+
Run the following cmdlet to add Azure Active Directory user group to an app group:
> The Windows Virtual Desktop Spring 2020 update is currently in public preview. This preview version is provided without a service level agreement, and we don't recommend using it for production workloads. Certain features might not be supported or might have constrained capabilities.
19
19
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
20
20
21
-
Windows Virtual Desktop offers a diagnostics feature that allows the administrator to identify issues through a single interface. This feature logs diagnostics information whenever someone assigned Windows Virtual Desktop role uses the service. Each log contains information about which Windows Virtual Desktop role was involved in the activity, any error messages that appear during the session, tenant information, and user information. The diagnostics feature creates activity logs for both user and administrative actions. Each activity log falls under three main categories:
21
+
Windows Virtual Desktop uses [Azure Monitor](../azure-monitor/overview.md) for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories:
22
22
23
-
- Feed subscription activities: when a user tries to connect to their feed through Microsoft Remote Desktop applications.
24
-
- Connection activities: when a user tries to connect to a desktop or RemoteApp through Microsoft Remote Desktop applications.
25
-
- Management activities: when an administrator performs management operations on the system, such as creating host pools, assigning users to app groups, and creating role assignments.
23
+
- Management Activities:
24
+
25
+
- Track whether attempts to change Windows Virtual Desktop objects using APIs or PowerShell are successful. For example, can someone successfully create a host pool using PowerShell?
26
+
27
+
- Feed:
28
+
29
+
- Can users successfully subscribe to workspaces?
30
+
31
+
- Do users see all resources published in the Remote Desktop client?
32
+
33
+
- Connections:
34
+
35
+
- When users initiate and complete connections to the service.
36
+
37
+
- Host registration:
38
+
39
+
- Was the session host successfully registered with the service upon connecting?
40
+
41
+
- Errors:
42
+
43
+
- Are users encountering any issues with specific activities? This feature can generate a table that tracks activity data for you as long as the information is joined with the activities.
44
+
45
+
- Checkpoints:
46
+
47
+
- Specific steps in the lifetime of an activity that were reached. For example, during a session, a user was load balanced to a particular host, then the user was signed on during a connection, and so on.
26
48
27
49
Connections that don't reach Windows Virtual Desktop won't show up in diagnostics results because the diagnostics role service itself is part of Windows Virtual Desktop. Windows Virtual Desktop connection issues can happen when the user is experiencing network connectivity issues.
28
50
29
-
## Why you should use Log Analytics
51
+
Azure Monitor lets you analyze Windows Virtual Desktop data and review virtual machine (VM) performance counters, all within the same tool. This article will tell you more about how to enable diagnostics for your Windows Virtual Desktop environment.
30
52
31
-
We recommend you use Log Analytics to analyze diagnostics data in the Azure client that goes beyond single-user troubleshooting. As you can pull in VM performance counters into Log Analytics you have one tool to gather information for your deployment.
53
+
>[!NOTE]
54
+
>To learn how to monitor your VMs in Azure, see [Monitoring Azure virtual machines with Azure Monitor](../azure-monitor/insights/monitor-vm-azure.md). Also, make sure to [review the performance counter thresholds](../virtual-desktop/virtual-desktop-fall-2019/deploy-diagnostics.md#windows-performance-counter-thresholds) for a better understanding of your user experience on the session host.
32
55
33
56
## Before you get started
34
57
35
-
Before you can use Log Analytics with the diagnostics feature, you'll need to [create a workspace](../azure-monitor/learn/quick-collect-windows-computer.md#create-a-workspace).
58
+
Before you can use Log Analytics, you'll need to create a workspace. To do that, follow the instructions in one of the following two articles:
59
+
60
+
- If you prefer using Azure portal, see [Create a Log Analytics workspace in Azure portal](../azure-monitor/learn/quick-create-workspace.md).
61
+
- If you prefer PowerShell, see [Create a Log Analytics workspace with PowerShell](../azure-monitor/learn/quick-create-workspace-posh.md).
36
62
37
-
After you've created your workspace, follow the instructions in [Connect Windows computers to Azure Monitor](../azure-monitor/platform/agent-windows.md#obtain-workspace-id-and-key) to get the following information:
63
+
After you've created your workspace, follow the instructions in [Connect Windows computers to Azure Monitor](../azure-monitor/platform/agent-windows.md#obtain-workspace-id-and-key) to get the following information:
38
64
39
65
- The workspace ID
40
66
- The primary key of your workspace
41
67
42
68
You'll need this information later in the setup process.
43
69
44
-
## Push diagnostics data to your workspace
70
+
Make sure to review permission management for Azure Monitor to enable data access for those who monitor and maintain your Windows Virtual Desktop environment. For more information, see [Get started with roles, permissions, and security with Azure Monitor](../azure-monitor/platform/roles-permissions-security.md).
45
71
46
-
You can push diagnostics data from your Windows Virtual Desktop tenant into the Log Analytics for your workspace. You can set up this feature right away when you first create your tenant by linking your workspace to your tenant, or you can set it up later with an existing tenant.
72
+
## Push diagnostics data to your workspace
47
73
48
-
To link your tenant to your Log Analytics workspace while you're setting up your new tenant, run the following cmdlet to sign in to Windows Virtual Desktop with your TenantCreator user account:
74
+
You can push diagnostics data from your Windows Virtual Desktop objects into the Log Analytics for your workspace. You can set up this feature right away when you first create your objects.
2. Navigate to the object (such as a host pool, app group, or workspace) that you want to capture logs and events for.
59
81
60
-
You'll need to run these cmdlets for every tenant you want to link to Log Analytics.
82
+
3. Select **Diagnostic settings** in the menu on the left side of the screen.
83
+
84
+
4. Select **Add diagnostic setting** in the menu that appears on the right side of the screen.
85
+
86
+
The options shown in the Diagnostic Settings page will vary depending on what kind of object you're editing.
87
+
88
+
For example, when you're enabling diagnostics for an app group, you'll see options to configure checkpoints, errors, and management. For workspaces, these categories configure a feed to track when users subscribe to the list of apps. To learn more about diagnostic settings see [Create diagnostic setting to collect resource logs and metrics in Azure](../azure-monitor/platform/diagnostic-settings.md).
89
+
90
+
>[!IMPORTANT]
91
+
>Remember to enable diagnostics for each Azure Resource Manager object that you want to monitor. Data will be available for activities after diagnostics has been enabled. It might take a few hours after first set-up.
92
+
93
+
5. Enter a name for your settings configuration, then select **Send to Log Analytics**. The name you use shouldn't have spaces and should conform to [Azure naming conventions](../azure-resource-manager/management/resource-name-rules.md). As part of the logs, you can select all the options that you want added to your Log Analytics, such as Checkpoint, Error, Management, and so on.
94
+
95
+
6. Select **Save**.
61
96
62
97
>[!NOTE]
63
-
>If you don't want to link the Log Analytics workspace when you create a tenant, run the `New-RdsTenant` cmdlet instead.
98
+
>Log Analytics gives you the option to stream data to [Event Hubs](../event-hubs/event-hubs-about.md) or archive it in a storage account. To learn more about this feature, see [Stream Azure monitoring data to an event hub](../azure-monitor/platform/stream-monitoring-data-event-hubs.md) and [Archive Azure resource logs to storage account](../azure-monitor/platform/resource-logs-collect-storage.md).
99
+
100
+
## How to access Log Analytics
101
+
102
+
You can access Log Analytics workspaces on the Azure portal or Azure Monitor.
103
+
104
+
### Access Log Analytics on a Log Analytics workspace
105
+
106
+
1. Sign in to the Azure portal.
107
+
108
+
2. Search for **Log Analytics workspace**.
109
+
110
+
3. Under Services, select **Log Analytics workspaces**.
111
+
112
+
4. From the list, select the workspace you configured for your Windows Virtual desktop object.
113
+
114
+
5. Once in your workspace, select **Logs**. You can filter out your menu list with the **Search** function.
115
+
116
+
### Access Log Analytics on Azure Monitor
117
+
118
+
1. Sign into the Azure portal
119
+
120
+
2. Search for and select **Monitor**.
121
+
122
+
3. Select **Logs**.
123
+
124
+
4. Follow the instructions in the logging page to set the scope of your query.
125
+
126
+
5. You are ready to query diagnostics. All diagnostics tables have a "WVD" prefix.
127
+
128
+
![]()
64
129
65
130
## Cadence for sending diagnostic events
66
131
67
-
Diagnostic events are sent to Log Analytics when completed.
132
+
Diagnostic events are sent to Log Analytics when completed.
133
+
134
+
Log Analytics only reports in these intermediate states for connection activities:
135
+
136
+
- Started
137
+
- Connected
138
+
- Completed
68
139
69
140
## Example queries
70
141
71
-
The following example queries show how the diagnostics feature generates a report for the most frequent activities in your system:
142
+
The following example queries show how the diagnostics feature generates a report for the most frequent activities in your system.
72
143
73
-
This first example shows connection activities initiated by users with supported remote desktop clients:
144
+
To get a list of connections made by your users, run this cmdlet:
| summarize usercount = count(UserName) by CodeSymbolic
262
+
| sort by usercount desc
263
+
| render barchart
131
264
```
132
265
133
-
You'll need to run this cmdlet for every tenant you want to stop sending data from.
266
+
>[!NOTE]
267
+
>The most important table for troubleshooting is WVDErrors. Use this query to understand which issues occur for user activities like connections or feeds when a user subscribes to the list of apps or desktops. The table will show you management errors as well as host registration issues.
268
+
>
269
+
>During public preview, if you need help with resolving an issue, make sure you give the CorrelationID for the error in your help request. Also, make sure your Service Error value always says ServiceError = “false”. A "false" value means the issue can be resolved by an admin task on your end. If ServiceError = “true”, you'll need to escalate the issue to Microsoft.
0 commit comments