Skip to content

Commit aaacdc5

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #213796 from Heidilohr/work-privatelink-preview
Public preview for Private Link for Azure Virtual Desktop
2 parents 680c230 + e1b7c41 commit aaacdc5

File tree

4 files changed

+237
-0
lines changed

4 files changed

+237
-0
lines changed

‎articles/virtual-desktop/TOC.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@
8383
href: proxy-server-support.md
8484
- name: Determine user connection quality
8585
href: connection-latency.md
86+
- name: Azure Private Link
87+
href: private-link-overview.md
8688
- name: Virtual machine sizing guidance
8789
href: /windows-server/remote/remote-desktop-services/virtual-machine-recs?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json
8890
- name: Identity and access management
@@ -347,6 +349,8 @@
347349
href: configure-rdp-shortpath.md
348350
- name: Limit RDP Shortpath port range
349351
href: configure-rdp-shortpath-limit-ports-public-networks.md
352+
- name: Set up Azure Private Link
353+
href: private-link-setup.md
350354
- name: Use Azure Firewall to protect Azure Virtual Desktop
351355
href: ../firewall/protect-azure-virtual-desktop.md?context=%2fazure%2fvirtual-desktop%2fcontext%2fcontext
352356
- name: Azure Virtual Desktop for Azure Stack HCI

‎articles/virtual-desktop/media/private-link-diagram.png

334 KB
Loading

‎articles/virtual-desktop/private-link-overview.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: Use Azure Private Link with Azure Virtual Desktop preview - Azure
3+
description: Learn how Azure Private Link (preview) can help you keep network traffic private.
4+
author: Heidilohr
5+
ms.topic: conceptual
6+
ms.date: 11/04/2022
7+
ms.author: helohr
8+
manager: femila
9+
---
10+
11+
# Use Azure Private Link with Azure Virtual Desktop (preview)
12+
13+
> [!IMPORTANT]
14+
> Private Link for Azure Virtual Desktop is currently in PREVIEW.
15+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
17+
You can use a [private endpoint](../private-link/private-endpoint-overview.md) from Azure Private Link with Azure Virtual Desktop to privately connect to your remote resources. With Private Link, traffic between your virtual network and the service travels the Microsoft "backbone" network, which means you'll no longer need to expose your service to the public internet. Keeping traffic within this "backbone" network improves security and keeps your data safe. This article describes how Private Link can help you secure your Azure Virtual Desktop environment.
18+
19+
## How does Private Link work with Azure Virtual Desktop?
20+
21+
Azure Virtual Desktop has three workflows with three corresponding resource types of private endpoints:
22+
23+
- The first workflow, initial feed discovery, lets the client discover all workspaces assigned to a user. To enable this process, you must create a single private endpoint to the global sub-resource of any workspace. However, you can only create one private endpoint in your entire Azure Virtual Desktop deployment. This endpoint creates Domain Name System (DNS) entries and private IP routes for the global fully-qualified domain name (FQDN) needed for initial feed discovery. This connection becomes a single, shared route for all clients to use.
24+
25+
- The next workflow is feed download, which is when the client downloads all connection details for a specific user for the workspaces that host their application groups. To enable this feed download, you must create a private endpoint for each workspace you want to enable. This endpoint will be to the workspace sub-resource of the specific workspace you want to allow.
26+
27+
- The final workflow involves making connections to host pools. Every connection has two sides: clients and session host VMs. To enable connections, you need to create a private endpoint for the host pool sub-resource of any host pool you want to allow.
28+
29+
You can either share these private endpoints across your network topology or you can isolate your virtual networks (VNets) so that each has their own private endpoint to the host pool or workspace.
30+
31+
The following diagram shows how Private Link securely connects a local client to the Azure Virtual Desktop service:
32+
33+
:::image type="content" source="media/private-link-diagram.png" alt-text="A diagram that shows Private Link connecting a local client to the Azure Virtual Desktop service.":::
34+
35+
## Supported scenarios
36+
37+
When adding Private Link, you can connect to Azure Virtual Desktop in the following ways:
38+
39+
- Both the clients and the session host VMs use public routes, which don't require Private Link.
40+
- The clients use public routes while session host VMs use private routes.
41+
- Both clients and session host VMs use private routes.
42+
43+
## Public preview limitations
44+
45+
The public preview of using Private Link with Azure Virtual Desktop has the following limitations:
46+
47+
- All Azure Virtual Desktop clients are compatible with Private Link, but we currently only offer troubleshooting support for the web client version of Private Link.
48+
49+
- A private endpoint to the global sub-resource of any workspace controls the shared FQDN for initial feed discovery. This control enables feed discovery for all workspaces. Because the workspace connected to the private endpoint is so important, deleting it will cause all feed discovery processes to stop working. Instead of deleting the workspace, you should create an unused placeholder workspace to terminate the global endpoint.
50+
51+
- Validation for data path access checks, particularly those that prevent exfiltration, are still being validated. To help us with validation, the preview version of this feature will collect feedback from customers regarding their exfiltration requirements, particularly their preferences for how to audit and analyze findings. We don't recommend or support using the preview version of this feature for production data traffic.
52+
53+
- After you've changed a private endpoint to a host pool, you must restart the *Remote Desktop Agent Loader* (RDAgentBootLoader) service on the session host VM. You'll also need to restart this service whenever you change a host pool's network configuration. Instead of restarting the service, you can restart the session host.
54+
55+
- Service tags are used by the Azure Virtual Desktop service for agent monitoring traffic. The service automatically creates these tags.
56+
57+
- The public preview doesn't support using both Private Link and [RDP Shortpath](./shortpath.md) at the same time.
58+
59+
## Next steps
60+
61+
- Learn about how to set up Private Link with Azure Virtual Desktop at [Set up Private Link for Azure Virtual Desktop](private-link-setup.md).
62+
- Learn how to configure Azure Private Endpoint DNS at [Private Link DNS integration](../private-link/private-endpoint-dns.md#virtual-network-and-on-premises-workloads-using-a-dns-forwarder).
63+
- For general troubleshooting guides for Private Link, see [Troubleshoot Azure Private Endpoint connectivity problems](../private-link/troubleshoot-private-endpoint-connectivity.md).
64+
- Understand how connectivity for the Azure Virtual Desktop service works at[Azure Virtual Desktop network connectivity](network-connectivity.md).
65+
- See the [Required URL list](safe-url-list.md) for the list of URLs you'll need to unblock to ensure network access to the Azure Virtual Desktop service.

‎articles/virtual-desktop/private-link-setup.md

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
---
2+
title: Set up Private Link for Azure Virtual Desktop preview - Azure
3+
description: How to set up Private Link for Azure Virtual Desktop (preview).
4+
author: Heidilohr
5+
ms.topic: how-to
6+
ms.date: 11/04/2022
7+
ms.author: helohr
8+
manager: femila
9+
---
10+
11+
# Set up Private Link for Azure Virtual Desktop (preview)
12+
13+
> [!IMPORTANT]
14+
> Private Link for Azure Virtual Desktop is currently in PREVIEW.
15+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
16+
17+
This article will show you how to set up Private Link for Azure Virtual Desktop (preview) in your Azure Virtual Desktop deployment. For more information about what Private Link can do for your deployment and the limitations of the public preview version, see [Private Link for Azure Virtual Desktop (preview)](private-link-overview.md).
18+
19+
## Prerequisites
20+
21+
In order to use Private Link in your Azure Virtual Desktop deployment, you'll need the following things:
22+
23+
- An Azure account with an active subscription.
24+
- An Azure Virtual Desktop deployment with service objects, such as host pools, app groups, and [workspaces](environment-setup.md#workspaces).
25+
- The [required permissions to use Private Link](../private-link/rbac-permissions.md).
26+
27+
## Enable preview content on your Azure subscription
28+
29+
In order to use Private Link, you'll need to enable preview features on your Azure subscription first. To enable preview features:
30+
31+
1. Go to [Preview features - Microsoft Azure](https://portal.azure.com/#view/Microsoft_Azure_Resources/PreviewFeaturesBlade).
32+
33+
1. In the search box under **Preview features**, search for **Private**.
34+
35+
2. Select the **Azure Virtual Desktop Private Link Public Preview** check box.
36+
37+
3. In the bottom-right corner of the screen, select **Register**.
38+
39+
Once you select **Register**, you'll be able to use Private Link.
40+
41+
## Create a placeholder workspace
42+
43+
A private endpoint to the global sub-resource of any workspace controls the shared fully qualified domain name (FQDN) for initial feed discovery. This control enables feed discovery for all workspaces. Because the workspace connected to the private endpoint is so important, deleting it will cause all feed discovery processes to stop working. Instead of deleting the workspace, you should create an unused placeholder workspace to terminate the global endpoint before you start using Private Link. To create a workspace, follow the instructions in [Workspace information](create-host-pools-azure-marketplace.md#workspace-information).
44+
45+
## Set up Private Link in the Azure portal
46+
47+
Now, let's set up Private Link for your host pool. During the setup process, you'll create private endpoints to the following resources:
48+
49+
| Resource type | Target sub-resource | Quantity |
50+
|--|--|
51+
| Microsoft.DesktopVirtualization/workspaces | global | One for all Azure Virtual Desktop deployments |
52+
| Microsoft.DesktopVirtualization/workspaces | feed | One per workspace |
53+
| Microsoft.DesktopVirtualization/hostpools | connection | One per host pool |
54+
55+
To configure Private Link in the Azure portal:
56+
57+
1. Open the Azure portal and sign in.
58+
59+
1. Search for and select **Azure Virtual Desktop**.
60+
61+
1. Go to **Host pools**, then select the name of the host pool you want to use.
62+
63+
>[!TIP]
64+
>You can also start setting up by going to **Private Link Center** > **Private Endpoints** > **Add a private endpoint**.
65+
66+
1. After you've opened the host pool, go to **Networking** > **Private Endpoint connections**.
67+
68+
1. Select **Add a private endpoint**.
69+
70+
1. In the **Basics** tab, either use the drop-down menus to select the **Subscription** and **Resource group** you want to use or create a new resource group.
71+
72+
1. Next, enter a name for your new private endpoint. The network interface name will fill automatically.
73+
74+
1. Select the **region** your private endpoint will be located in. You must choose the same location as your session host and the virtual network (VNet) you plan to use.
75+
76+
1. When you're done, select **Next: Resource >**.
77+
78+
1. In the **Resource** tab, use the following resource:
79+
80+
- Resource type: **Microsoft.DesktopVirtualization/hostpools**
81+
- Resource: *your host pool*
82+
- Target sub-resource: connection
83+
84+
1. Select **Next: Virtual Network >**.
85+
86+
1. In the **Virtual Network** tab, make sure the values in the **Virtual Network** and **subnet** fields are correct.
87+
88+
1. In the **Private IP configuration** field, choose whether you want to dynamically or statically allocate IP addresses from the subnet you selected in the previous step. <!--What's the difference between these two and why should I choose each?-->
89+
90+
- If you choose to statically allocate IP addresses, you'll need to fill in the **Name** and **Private IP** for each listed member.
91+
92+
1. Next, select an existing application security group or create a new one.
93+
94+
- If you're creating a new application security group, select **Create new**, then enter a name for the new security group.
95+
96+
1. When you're finished, select **Next: DNS >**.
97+
98+
1. In the **DNS** tab, in the **Integrate with private DNS zone** field, select **Yes** if you want to integrate with an Azure private DNS zone. Learn more about integration at [Azure Private endpoint DNS configuration](../private-link/private-endpoint-dns.md).
99+
100+
1. When you're done, select **Next: Tags >**.
101+
102+
1. In the **Tags** tab, you can optionally add tags to help the Azure service categorize your resources. If you don't want to add tags, select **Next: Review + create**.
103+
104+
1. Review the details of your private endpoint. If everything looks good, select **Create** and wait for the deployment to finish.
105+
106+
1. Now, repeat the process to create private endpoints for your resources. Return to step 3, but select **Workspaces** instead of host pools and use the following resources, then follow the rest of the steps until the end.
107+
108+
- Resource type: **Microsoft.DesktopVirtualization/workspaces**
109+
- Resource: *your placeholder workspace*
110+
- Target sub-resource: global
111+
112+
- Resource type: **Microsoft.DesktopVirtualization/workspaces**
113+
- Resource: *your workspace*
114+
- Target sub-resource: feed
115+
116+
>[!NOTE]
117+
>You'll need to repeat this process to create a private endpoint for every resource you want to put into Private Link.
118+
119+
## Closing public routes
120+
121+
In addition to creating private routes, you can also control if the Azure Virtual Desktop resource allows traffic to come from public routes.
122+
123+
To control public traffic:
124+
125+
1. Open the Azure portal and sign in.
126+
127+
1. Search for and select **Azure Virtual Desktop**.
128+
129+
1. Go to **Host pools** > **Networking** > **Firewall and virtual networks**.
130+
131+
1. First, configure the **Allow end users access from public network** setting.
132+
133+
- If you select the check box, users can connect to the host pool using public internet or private endpoints.
134+
135+
- If you don't select the check box, users can only connect to host pool using private endpoints.
136+
137+
1. Next, configure the **Allow session hosts access from public network** setting.
138+
139+
- If you select the check box, Azure Virtual Desktop session hosts will talk to the Azure Virtual Desktop service over public internet or private endpoints.
140+
141+
- If you don't select the check box, Azure Virtual Desktop session hosts can only talk to the Azure Virtual Desktop service over private endpoint connections.
142+
143+
## Network security groups
144+
145+
Follow the directions in [Tutorial: Filter network traffic with a network security group using the Azure portal](../virtual-network/tutorial-filter-network-traffic.md) to set up a network security group (NSG). You can use this NSG to block the **WindowsVirtualDesktop** service tag. If you block this service tag, all service traffic will use private routes only.
146+
147+
When you set up your NSG, you must configure it to allow both the URLs in the [required URL list](safe-url-list.md) and your private endpoints. Make sure to include the URLs for Azure Monitor.
148+
149+
## Validate your Private Link deployment
150+
151+
To validate your Private Link for Azure Virtual Desktop and make sure it's working:
152+
153+
1. Check to see if your session hosts are registered and functional on the VNet. You can check their health status with [Azure Monitor](azure-monitor.md).
154+
155+
1. Next, test your feed connections to make sure they perform as expected. Use the client and make sure you can add and refresh workspaces.
156+
157+
1. Finally, run the following end-to-end tests:
158+
159+
- Make sure your clients can't connect to Azure Virtual Desktop and your session hosts from public routes.
160+
- Make sure the session hosts can't connect to Azure Virtual Desktop from public routes.
161+
162+
## Next steps
163+
164+
- Learn more about how Private Link for Azure Virtual Desktop at [Use Private Link with Azure Virtual Desktop](private-link-overview.md).
165+
- Learn how to configure Azure Private Endpoint DNS at [Private Link DNS integration](../private-link/private-endpoint-dns.md#virtual-network-and-on-premises-workloads-using-a-dns-forwarder).
166+
- For general troubleshooting guides for Private Link, see [Troubleshoot Azure Private Endpoint connectivity problems](../private-link/troubleshoot-private-endpoint-connectivity.md)
167+
- Understand how connectivity for the Azure Virtual Desktop service works at[Azure Virtual Desktop network connectivity](network-connectivity.md)
168+
- See the [Required URL list](safe-url-list.md) for the list of URLs you'll need to unblock to ensure network access to the Azure Virtual Desktop service.

0 commit comments

Comments
 (0)