Skip to content

Commit 743984c

Browse files
Merge pull request #112855 from Heidilohr/work-medium-large
Updated medium and large files
2 parents 50c58e3 + ca9a808 commit 743984c

File tree

4 files changed

+243
-277
lines changed

4 files changed

+243
-277
lines changed

articles/virtual-desktop/delegated-access-virtual-desktop.md

Lines changed: 17 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: Heidilohr
66

77
ms.service: virtual-desktop
88
ms.topic: conceptual
9-
ms.date: 03/21/2019
9+
ms.date: 04/30/2020
1010
ms.author: helohr
1111
manager: lizross
1212
---
@@ -24,48 +24,38 @@ Windows Virtual Desktop delegated access supports the following values for each
2424

2525
* Security principal
2626
* Users
27+
* User groups
2728
* Service principals
2829
* Role definition
2930
* Built-in roles
31+
* Custom roles
3032
* Scope
31-
* Tenant groups
32-
* Tenants
3333
* Host pools
3434
* App groups
35-
36-
## Built-in roles
37-
38-
Delegated access in Windows Virtual Desktop has several built-in role definitions you can assign to users and service principals.
39-
40-
* An RDS Owner can manage everything, including access to resources.
41-
* An RDS Contributor can manage everything, but can't access to resources.
42-
* An RDS Reader can view everything, but can't make any changes.
43-
* An RDS Operator can view diagnostic activities.
35+
* Workspaces
4436

4537
## PowerShell cmdlets for role assignments
4638

47-
You can run the following cmdlets to create, view, and remove role assignments:
39+
Before you start, make sure to follow the instructions in [Set up the PowerShell module](powershell-module.md) to set up the Windows Virtual Desktop PowerShell module if you haven't already.
4840

49-
* **Get-RdsRoleAssignment** displays a list of role assignments.
50-
* **New-RdsRoleAssignment** creates a new role assignment.
51-
* **Remove-RdsRoleAssignment** deletes role assignments.
41+
Windows Virtual Desktop uses Azure role-based access control (RBAC) while publishing app groups to users or user groups. The Desktop Virtualization User role is assigned to the user or user group and the scope is the app group. This role gives the user special data access on the app group.
5242

53-
### Accepted parameters
43+
Run the following cmdlet to add Azure Active Directory users to an app group:
5444

55-
You can modify the basic three cmdlets with the following parameters:
45+
```powershell
46+
New-AzRoleAssignment -SignInName <userupn> -RoleDefinitionName "Desktop Virtualization User" -ResourceName <hostpoolname> -ResourceGroupName <resourcegroupname> -ResourceType 'Microsoft.DesktopVirtualization/applicationGroups'
47+
```
5648

57-
* **AadTenantId**: specifies the Azure Active Directory tenant ID from which the service principal is a member.
58-
* **AppGroupName**: name of the Remote Desktop app group.
59-
* **Diagnostics**: indicates the diagnostics scope. (Must be paired with either the **Infrastructure** or **Tenant** parameters.)
60-
* **HostPoolName**: name of the Remote Desktop host pool.
61-
* **Infrastructure**: indicates the infrastructure scope.
62-
* **RoleDefinitionName**: name of the Remote Desktop Services role-based access control role assigned to the user, group, or app. (For example, Remote Desktop Services Owner, Remote Desktop Services Reader, and so on.)
63-
* **ServerPrincipleName**: name of the Azure Active Directory application.
64-
* **SignInName**: the user's email address or user principal name.
65-
* **TenantName**: name of the Remote Desktop tenant.
49+
Run the following cmdlet to add Azure Active Directory user group to an app group:
50+
51+
```powershell
52+
New-AzRoleAssignment -ObjectId <usergroupobjectid> -RoleDefinitionName "Desktop Virtualization User" -ResourceName <hostpoolname> -ResourceGroupName <resourcegroupname> -ResourceType 'Microsoft.DesktopVirtualization/applicationGroups'
53+
```
6654

6755
## Next steps
6856

6957
For a more complete list of PowerShell cmdlets each role can use, see the [PowerShell reference](/powershell/windows-virtual-desktop/overview).
7058

59+
For a complete list of roles supported in Azure RBAC, see [Azure built-in roles](../role-based-access-control/built-in-roles.md).
60+
7161
For guidelines for how to set up a Windows Virtual Desktop environment, see [Windows Virtual Desktop environment](environment-setup.md).

articles/virtual-desktop/diagnostics-log-analytics.md

Lines changed: 189 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: Heidilohr
66

77
ms.service: virtual-desktop
88
ms.topic: conceptual
9-
ms.date: 12/18/2019
9+
ms.date: 04/30/2020
1010
ms.author: helohr
1111
manager: lizross
1212
---
@@ -18,119 +18,255 @@ manager: lizross
1818
> The Windows Virtual Desktop Spring 2020 update is currently in public preview. This preview version is provided without a service level agreement, and we don't recommend using it for production workloads. Certain features might not be supported or might have constrained capabilities.
1919
> For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).
2020
21-
Windows Virtual Desktop offers a diagnostics feature that allows the administrator to identify issues through a single interface. This feature logs diagnostics information whenever someone assigned Windows Virtual Desktop role uses the service. Each log contains information about which Windows Virtual Desktop role was involved in the activity, any error messages that appear during the session, tenant information, and user information. The diagnostics feature creates activity logs for both user and administrative actions. Each activity log falls under three main categories:
21+
Windows Virtual Desktop uses [Azure Monitor](../azure-monitor/overview.md) for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories:
2222

23-
- Feed subscription activities: when a user tries to connect to their feed through Microsoft Remote Desktop applications.
24-
- Connection activities: when a user tries to connect to a desktop or RemoteApp through Microsoft Remote Desktop applications.
25-
- Management activities: when an administrator performs management operations on the system, such as creating host pools, assigning users to app groups, and creating role assignments.
23+
- Management Activities:
24+
25+
- Track whether attempts to change Windows Virtual Desktop objects using APIs or PowerShell are successful. For example, can someone successfully create a host pool using PowerShell?
26+
27+
- Feed:
28+
29+
- Can users successfully subscribe to workspaces?
30+
31+
- Do users see all resources published in the Remote Desktop client?
32+
33+
- Connections:
34+
35+
- When users initiate and complete connections to the service.
36+
37+
- Host registration:
38+
39+
- Was the session host successfully registered with the service upon connecting?
40+
41+
- Errors:
42+
43+
- Are users encountering any issues with specific activities? This feature can generate a table that tracks activity data for you as long as the information is joined with the activities.
44+
45+
- Checkpoints:
46+
47+
- Specific steps in the lifetime of an activity that were reached. For example, during a session, a user was load balanced to a particular host, then the user was signed on during a connection, and so on.
2648

2749
Connections that don't reach Windows Virtual Desktop won't show up in diagnostics results because the diagnostics role service itself is part of Windows Virtual Desktop. Windows Virtual Desktop connection issues can happen when the user is experiencing network connectivity issues.
2850

29-
## Why you should use Log Analytics
51+
Azure Monitor lets you analyze Windows Virtual Desktop data and review virtual machine (VM) performance counters, all within the same tool. This article will tell you more about how to enable diagnostics for your Windows Virtual Desktop environment.
3052

31-
We recommend you use Log Analytics to analyze diagnostics data in the Azure client that goes beyond single-user troubleshooting. As you can pull in VM performance counters into Log Analytics you have one tool to gather information for your deployment.
53+
>[!NOTE]
54+
>To learn how to monitor your VMs in Azure, see [Monitoring Azure virtual machines with Azure Monitor](../azure-monitor/insights/monitor-vm-azure.md). Also, make sure to [review the performance counter thresholds](../virtual-desktop/virtual-desktop-fall-2019/deploy-diagnostics.md#windows-performance-counter-thresholds) for a better understanding of your user experience on the session host.
3255
3356
## Before you get started
3457

35-
Before you can use Log Analytics with the diagnostics feature, you'll need to [create a workspace](../azure-monitor/learn/quick-collect-windows-computer.md#create-a-workspace).
58+
Before you can use Log Analytics, you'll need to create a workspace. To do that, follow the instructions in one of the following two articles:
59+
60+
- If you prefer using Azure portal, see [Create a Log Analytics workspace in Azure portal](../azure-monitor/learn/quick-create-workspace.md).
61+
- If you prefer PowerShell, see [Create a Log Analytics workspace with PowerShell](../azure-monitor/learn/quick-create-workspace-posh.md).
3662

37-
After you've created your workspace, follow the instructions in [Connect Windows computers to Azure Monitor](../azure-monitor/platform/agent-windows.md#obtain-workspace-id-and-key) to get the following information:
63+
After you've created your workspace, follow the instructions in [Connect Windows computers to Azure Monitor](../azure-monitor/platform/agent-windows.md#obtain-workspace-id-and-key) to get the following information:
3864

3965
- The workspace ID
4066
- The primary key of your workspace
4167

4268
You'll need this information later in the setup process.
4369

44-
## Push diagnostics data to your workspace
70+
Make sure to review permission management for Azure Monitor to enable data access for those who monitor and maintain your Windows Virtual Desktop environment. For more information, see [Get started with roles, permissions, and security with Azure Monitor](../azure-monitor/platform/roles-permissions-security.md).
4571

46-
You can push diagnostics data from your Windows Virtual Desktop tenant into the Log Analytics for your workspace. You can set up this feature right away when you first create your tenant by linking your workspace to your tenant, or you can set it up later with an existing tenant.
72+
## Push diagnostics data to your workspace
4773

48-
To link your tenant to your Log Analytics workspace while you're setting up your new tenant, run the following cmdlet to sign in to Windows Virtual Desktop with your TenantCreator user account:
74+
You can push diagnostics data from your Windows Virtual Desktop objects into the Log Analytics for your workspace. You can set up this feature right away when you first create your objects.
4975

50-
```powershell
51-
Add-RdsAccount -DeploymentUrl https://rdbroker.wvd.microsoft.com
52-
```
76+
To set up Log Analytics for a new object:
5377

54-
If you're going to link an existing tenant instead of a new tenant, run this cmdlet instead:
78+
1. Sign in to the Azure portal and go to **Windows Virtual Desktop**.
5579

56-
```powershell
57-
Set-RdsTenant -Name <TenantName> -AzureSubscriptionId <SubscriptionID> -LogAnalyticsWorkspaceId <String> -LogAnalyticsPrimaryKey <String>
58-
```
80+
2. Navigate to the object (such as a host pool, app group, or workspace) that you want to capture logs and events for.
5981

60-
You'll need to run these cmdlets for every tenant you want to link to Log Analytics.
82+
3. Select **Diagnostic settings** in the menu on the left side of the screen.
83+
84+
4. Select **Add diagnostic setting** in the menu that appears on the right side of the screen.
85+
86+
The options shown in the Diagnostic Settings page will vary depending on what kind of object you're editing.
87+
88+
For example, when you're enabling diagnostics for an app group, you'll see options to configure checkpoints, errors, and management. For workspaces, these categories configure a feed to track when users subscribe to the list of apps. To learn more about diagnostic settings see [Create diagnostic setting to collect resource logs and metrics in Azure](../azure-monitor/platform/diagnostic-settings.md).
89+
90+
>[!IMPORTANT]
91+
>Remember to enable diagnostics for each Azure Resource Manager object that you want to monitor. Data will be available for activities after diagnostics has been enabled. It might take a few hours after first set-up.
92+
93+
5. Enter a name for your settings configuration, then select **Send to Log Analytics**. The name you use shouldn't have spaces and should conform to [Azure naming conventions](../azure-resource-manager/management/resource-name-rules.md). As part of the logs, you can select all the options that you want added to your Log Analytics, such as Checkpoint, Error, Management, and so on.
94+
95+
6. Select **Save**.
6196

6297
>[!NOTE]
63-
>If you don't want to link the Log Analytics workspace when you create a tenant, run the `New-RdsTenant` cmdlet instead.
98+
>Log Analytics gives you the option to stream data to [Event Hubs](../event-hubs/event-hubs-about.md) or archive it in a storage account. To learn more about this feature, see [Stream Azure monitoring data to an event hub](../azure-monitor/platform/stream-monitoring-data-event-hubs.md) and [Archive Azure resource logs to storage account](../azure-monitor/platform/resource-logs-collect-storage.md).
99+
100+
## How to access Log Analytics
101+
102+
You can access Log Analytics workspaces on the Azure portal or Azure Monitor.
103+
104+
### Access Log Analytics on a Log Analytics workspace
105+
106+
1. Sign in to the Azure portal.
107+
108+
2. Search for **Log Analytics workspace**.
109+
110+
3. Under Services, select **Log Analytics workspaces**.
111+
112+
4. From the list, select the workspace you configured for your Windows Virtual desktop object.
113+
114+
5. Once in your workspace, select **Logs**. You can filter out your menu list with the **Search** function.
115+
116+
### Access Log Analytics on Azure Monitor
117+
118+
1. Sign into the Azure portal
119+
120+
2. Search for and select **Monitor**.
121+
122+
3. Select **Logs**.
123+
124+
4. Follow the instructions in the logging page to set the scope of your query.
125+
126+
5. You are ready to query diagnostics. All diagnostics tables have a "WVD" prefix.
127+
128+
![]()
64129

65130
## Cadence for sending diagnostic events
66131

67-
Diagnostic events are sent to Log Analytics when completed.
132+
Diagnostic events are sent to Log Analytics when completed.
133+
134+
Log Analytics only reports in these intermediate states for connection activities:
135+
136+
- Started
137+
- Connected
138+
- Completed
68139

69140
## Example queries
70141

71-
The following example queries show how the diagnostics feature generates a report for the most frequent activities in your system:
142+
The following example queries show how the diagnostics feature generates a report for the most frequent activities in your system.
72143

73-
This first example shows connection activities initiated by users with supported remote desktop clients:
144+
To get a list of connections made by your users, run this cmdlet:
74145

75146
```powershell
76-
WVDActivityV1_CL
147+
WVDConnections
148+
| project-away TenantId,SourceSystem
149+
| summarize arg_max(TimeGenerated, *), StartTime = min(iff(State== 'Started', TimeGenerated , datetime(null) )), ConnectTime = min(iff(State== 'Connected', TimeGenerated , datetime(null) )) by CorrelationId
150+
| join kind=leftouter (
151+
WVDErrors
152+
|summarize Errors=makelist(pack('Code', Code, 'CodeSymbolic', CodeSymbolic, 'Time', TimeGenerated, 'Message', Message ,'ServiceError', ServiceError, 'Source', Source)) by CorrelationId
153+
) on CorrelationId
154+
| join kind=leftouter (
155+
WVDCheckpoints
156+
| summarize Checkpoints=makelist(pack('Time', TimeGenerated, 'Name', Name, 'Parameters', Parameters, 'Source', Source)) by CorrelationId
157+
| mv-apply Checkpoints on
158+
(
159+
order by todatetime(Checkpoints['Time']) asc
160+
| summarize Checkpoints=makelist(Checkpoints)
161+
)
162+
) on CorrelationId
163+
| project-away CorrelationId1, CorrelationId2
164+
| order by TimeGenerated desc
165+
```
77166

78-
| where Type_s == "Connection"
167+
To view feed activity of your users:
79168

80-
| join kind=leftouter (
169+
```powershell
170+
WVDFeeds
81171
82-
    WVDErrorV1_CL
172+
| project-away TenantId,SourceSystem
83173
84-
    | summarize Errors = makelist(pack('Time', Time_t, 'Code', ErrorCode_s , 'CodeSymbolic', ErrorCodeSymbolic_s, 'Message', ErrorMessage_s, 'ReportedBy', ReportedBy_s , 'Internal', ErrorInternal_s )) by ActivityId_g
174+
| join kind=leftouter (
85175
86-
    ) on $left.Id_g  == $right.ActivityId_g 
176+
WVDErrors
87177
88-
| join  kind=leftouter (
178+
|summarize Errors=makelist(pack('Code', Code, 'CodeSymbolic', CodeSymbolic, 'Time', TimeGenerated, 'Message', Message ,'ServiceError', ServiceError, 'Source', Source)) by CorrelationId
89179
90-
    WVDCheckpointV1_CL
180+
) on CorrelationId
91181
92-
    | summarize Checkpoints = makelist(pack('Time', Time_t, 'ReportedBy', ReportedBy_s, 'Name', Name_s, 'Parameters', Parameters_s) ) by ActivityId_g
182+
| join kind=leftouter (
93183
94-
    ) on $left.Id_g  == $right.ActivityId_g
184+
WVDCheckpoints
95185
96-
|project-away ActivityId_g, ActivityId_g1
97-
```
186+
| summarize Checkpoints=makelist(pack('Time', TimeGenerated, 'Name', Name, 'Parameters', Parameters, 'Source', Source)) by CorrelationId
98187
99-
This next example query shows management activities by admins on tenants:
188+
| mv-apply Checkpoints on
100189
101-
```powershell
102-
WVDActivityV1_CL
190+
(
103191
104-
| where Type_s == "Management"
192+
order by todatetime(Checkpoints['Time']) asc
105193
106-
| join kind=leftouter (
194+
| summarize Checkpoints=makelist(Checkpoints)
107195
108-
    WVDErrorV1_CL
196+
)
109197
110-
    | summarize Errors = makelist(pack('Time', Time_t, 'Code', ErrorCode_s , 'CodeSymbolic', ErrorCodeSymbolic_s, 'Message', ErrorMessage_s, 'ReportedBy', ReportedBy_s , 'Internal', ErrorInternal_s )) by ActivityId_g
198+
) on CorrelationId
111199
112-
    ) on $left.Id_g  == $right.ActivityId_g 
200+
| project-away CorrelationId1, CorrelationId2
113201
114-
| join  kind=leftouter (
202+
| order by TimeGenerated desc
203+
```
115204

116-
    WVDCheckpointV1_CL
205+
To find all connections for a single user:
117206

118-
    | summarize Checkpoints = makelist(pack('Time', Time_t, 'ReportedBy', ReportedBy_s, 'Name', Name_s, 'Parameters', Parameters_s) ) by ActivityId_g
207+
```powershell
208+
|where UserName == "userupn"
209+
|take 100
210+
|sort by TimeGenerated asc, CorrelationId
211+
```
212+
119213

120-
    ) on $left.Id_g  == $right.ActivityId_g
214+
To find the number of times a user connected per day:
121215

122-
|project-away ActivityId_g, ActivityId_g1
216+
```powershell
217+
WVDConnections
218+
|where UserName == "userupn"
219+
|take 100
220+
|sort by TimeGenerated asc, CorrelationId
221+
|summarize dcount(CorrelationId) by bin(TimeGenerated, 1d)
123222
```
124223

125-
## Stop sending data to Log Analytics
126224

127-
To stop sending data from an existing tenant to Log Analytics, run the following cmdlet and set empty strings:
225+
To find session duration by user:
226+
227+
```powershell
228+
let Events = WVDConnections | where UserName == "userupn" ;
229+
Events
230+
| where State == "Connected"
231+
| project CorrelationId , UserName, ResourceAlias , StartTime=TimeGenerated
232+
| join (Events
233+
| where State == "Completed"
234+
| project EndTime=TimeGenerated, CorrelationId)
235+
on CorrelationId
236+
| project Duration = EndTime - StartTime, ResourceAlias
237+
| sort by Duration asc
238+
```
239+
240+
To find errors for a specific user:
241+
242+
```powershell
243+
WVDErrors
244+
| where UserName == "[email protected]"
245+
|take 100
246+
```
247+
248+
To find out whether a specific error occurred:
249+
250+
```powershell
251+
WVDErrors
252+
| where CodeSymbolic =="ErrorSymbolicCode"
253+
| summarize count(UserName) by CodeSymbolic
254+
```
255+
256+
To find the occurrence of an error across all users:
128257

129258
```powershell
130-
Set-RdsTenant -Name <TenantName> -AzureSubscriptionId <SubscriptionID> -LogAnalyticsWorkspaceId <String> -LogAnalyticsPrimaryKey <String>
259+
WVDErrors
260+
| where ServiceError =="false"
261+
| summarize usercount = count(UserName) by CodeSymbolic
262+
| sort by usercount desc
263+
| render barchart
131264
```
132265

133-
You'll need to run this cmdlet for every tenant you want to stop sending data from.
266+
>[!NOTE]
267+
>The most important table for troubleshooting is WVDErrors. Use this query to understand which issues occur for user activities like connections or feeds when a user subscribes to the list of apps or desktops. The table will show you management errors as well as host registration issues.
268+
>
269+
>During public preview, if you need help with resolving an issue, make sure you give the CorrelationID for the error in your help request. Also, make sure your Service Error value always says ServiceError = “false”. A "false" value means the issue can be resolved by an admin task on your end. If ServiceError = “true”, you'll need to escalate the issue to Microsoft.
134270
135271
## Next steps
136272

0 commit comments

Comments
 (0)