Azure fileshare for WVD with Fslogix

Setting up an Azure Storage is not a complex task. But when we want to use it for Windows Virtual Desktop and we need to integrate it with a local active directory, it is quite complex. I had a workshop this week with a customer and I realized how hard it was to share knowledge and explain how it should be setup. So I felt that another guide was needed on the subject.

With fslogix you save user profiles as vhdx disk images on a fileshare. It can be almost any fileshare, but it needs to be able to manage the speed and be high available. And in a modern cloud computing you shouldn´t even consider using a fileserver. The Azure storage is the absolute best option.

Step 1 : Create a Storage account in Azure

Open up the Azure portal and create a new Azure Storage Account

Keep the Storage account name short if possible due to the netbios name limit (16char) in local active directory.
Place the storage in the same region as your WVD´s
Select Premium and Filestorage

A good way of limiting and securing the access to the storage is to select private endpoint or public endpoint (selected networks). Then the storage is only available from the private networks selected. The Private endpoint will add a small cost.

Finally, limit the public anonumous access of the storage

You can now go ahead and create your Azure storage

Step 2 : Create a File Share

Open your Azure storage and select file shares node.
Select to create a new File share
Name and select a size for your share. When using Premium file shares, you will be billed for the complete size. also note that the bigger the more IOPS.

Go ahead and create the fileshare. You can create multiple shares if you want to seperate profile and office containers. And also one for upcomming MSIX packages.

Step 3 : Enable Active Directory authentication on the Storage account

Then we have the tricky part, joining the storage account as a server object in our local active directory. This will enable kerberos access control towards the shares.

The simple way is to logon to a domain controller and run the powershell commands. Otherwise you will also need to install ADDS powershell in server components.

You must also download ane extract AzFilesHybrid PowerShell module from here

Start an elevated PowerShell prompt and change directory to the folder where you extracted the AzFilesHybrid and run the following commands:

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
install-module AZ
Import-Module -Name c:\temp\azfileshybrid\AzFilesHybrid.psd1
Connect-AzAccount

Login to Azure and verify that you are connected to correct subscription. If not change with:

Select-AzSubscription -SubscriptionName "<your subscription name>"

Then connect your Azure storage to local AD by this command:

join-AzStorageaccountForAuth -ResourceGroupName "<Resource Group Name>" -Name "<Storage Account Name>" -DomainAccountType "ComputerAccount" -OrganizationalUnitDistinguishedName "<OU Distinguished Name>"

In my case it looks like this:

join-AzStorageaccountForAuth -ResourceGroupName "Tbone-Storage" -Name "tbonewvdprofile" -DomainAccountType "ComputerAccount" -OrganizationalUnitDistinguishedName "OU=Servers,DC=Tbone,DC=se"

Make sure your storage computer object is created in the OU selected.
It can take some time before the storage account is updated with the connection to your on-prem AD.

Step 4 : Configure share folder permissions

On a normal fileserver, when sharing a folder you can set the shared folder permissions. In Azure you need to add these permissions on the fileshare with Storage account Access control (IAM)
Add a new role assignment on the file share

The shared folder admins will need Storage File Data SMB Elevated Contributor rights

But don´t forget, the end users will need Storage File SMB Share Contributor rights

Final task: Set the NTFS permissions

You can get the servername under properties for the storage account:

Logon to a workstation with credentials that has been granted the Storage File Data SMB Elevated Contributor role in previous step. The workstation must also have access to the selected network in step 1. (private or public endpoint selected networks)
Open the share in explorer \\tbonewvdprofile.file.core.windows.net\profiles

Rightclick and select Properties for the share.
Open the security tab and select Advanced
Set at least the minimum permissions for fslogix:

Users	This Folder Only	Modify
Creator / Owner	Subfolders and Files Only	Modify
Administrator (optional)	This Folder, Subfolders, and Files	Full Control

The share is now ready for profiles from fslogix!

About The Author