In a previous post: Messing around with WVD, AADDS and FSLogix – Albandrod’s Memory (albandrodsmemory.com) I was talking about how AVD breaks some scenarios and how we could fix them.
In this ocassion I will talk about my experience working with the new version of AADJoin for AVD which is finally in public preview. So with this approach we can eliminate the need to have a domain controller or AADDS in place for your AVD deployment to work, but as you can imagine it has some drawbacks.
First important thing that you have to be aware of implementing this type of scenario is that when you’re adding the VMs to the HP, it is necessary to select the following option:
Also is important to check wether is we want to join the VMs to Intune or not, in my case I selected yes, and after a few moments of the VM creation, I was able to see it in the endpoint portal:
After you have created the HP, my recommendation would to configure it, you can use the following advanced RDP properties:
use multimon:i:0 which basically Determines whether the session should use true multiple monitor support when connecting to the remote computer
To access Azure AD-joined VMs using the web, Android, macOS, iOS, and Microsoft Store clients, you must add targetisaadjoined:i:1 to the HP. These connections are restricted to entering user name and password credentials when signing in to the session host.
But, what is more important for me, and it was driving me crazy at first, it was the authantication in AVD AADJoined:
The following configurations are currently supported with Azure AD-joined VMs:
- Personal desktops with local user profiles.
- Pooled desktops used as a jump box. In this configuration, users first access the Azure Virtual Desktop VM before connecting to a different PC on the network. Users should not save data on the VM.
- Pooled desktops or apps where users don’t need to save data on the VM. For example, for applications that save data online or connect to a remote database.
So, don’t break your head trying to authenticate with your current user as in WVD Joined Domain, you will need to use a Local profile for AzureAD Joined VMs, if not you will receive an error like the following which will drive you nuts:
But after using the local user in the VM you will be able to log in the VM.
Once you log in to the VM, you can check the dsregcmd to see the status:
And also how the machine is enrolled in Intune, you can check the information regarding the enterprise registration 🙂
For me AVD AADJoin, it is a pseudo Windows365 but with custom images and without paying the full license to access to the resource itself. The other things about AVD and AADJoin are pretty the same as Domain Joined, so have fun with them
Till next time!
Albandrod's Memory 