Azure Virtual Desktop with Liquidware Flexapp
Total Page:16
File Type:pdf, Size:1020Kb
Whitepaper - Azure Virtual Desktop With Liquidware FlexApp Introduction This Whitepaper has been authored by Marius Sandbu (https://msandbu.org) and is aimed at providing information and guidance regarding Azure Virtual Desktop in combination with Liquidware FlexApp. Azure Virtual Desktop is Microsoft’s new Cloud-based VDI solution delivered from Microsoft Azure, and with the ever-growing complexity of managing applications in a cloud-based environment, it is important to have proper tools in place to optimize application delivery. About the Author Marius Sandbu is a Guild Lead for Public Cloud working for TietoEVRY in Norway. Primary focusing on Cloud-based services, End-user Computing, and Security with more than 15 years of experience within IT. He has also extensive experience with end-user computing solutions such as VMware Horizon, Citrix Virtual Apps and Desktops, Microsoft RDS, and on Cloud platforms like Microsoft Azure, Google Cloud, Amazon Web Services, EUC Cloud solutions such as Citrix Cloud and Horizon Cloud, and other products such as Office 365 and Microsoft 365. Marius is a Microsoft Azure MVP and part of the VMware EUC Champions group. You can contact him with any questions or feedback regarding this whitepaper on his email address: [email protected] or social media such as Twitter https://twitter.com/msandbu Azure virtual desktop with Liquidware FlexApp - Page 1 Contents OVERVIEW OF AZURE VIRTUAL DESKTOP AND LIQUIDWARE FLEXAPP 3 AVD - Architecture and traffic flow 4 Cloud Economics and Microsoft Azure 6 Ecosystem of Azure virtual desktop 7 Image Provisioning 7 Automatic Scaling 7 GPU based workloads 8 Management of Infrastructure 8 Azure Bastion 8 Azure Update Management 9 Setting up Azure virtual desktop 9 Prerequisites 9 AVD Setup 9 Updating a AVD Host pool with a new application 13 Limitations with AVD 13 Application Scalability and Image Management using FlexApp 15 FlexApp Architecture 16 Creating a FlexApp Application Layer for AVD 18 Leveraging FlexApp with Azure Blob Storage 22 Summary and the future architecture of application delivery 23 Azure virtual desktop with Liquidware FlexApp - Page 2 Overview of Azure Virtual Desktop and Liquidware FlexApp Azure virtual desktop (AVD) is Microsoft’s Cloud-based VDI/RDSH delivery platform built with PaaS services on Microsoft Azure. AVD was released in 2019 and is the result of the evolution of RDS in combination with new delivery offerings based upon providing a multi-user Windows 10 experience. In addition to this Microsoft also acquired the company FSLogix which provides solutions aimed at ease of management of user-profiles in combination with Office 365 which is now a key part in Windows 10 as it is included by default when setting up multi-user desktops in Azure. AVD is a service that is made free to eligible customers when customers have one of the following licenses ● Microsoft 365 E3/E5 ● Microsoft 365 A3/A5 ● Microsoft 365 F1 ● Microsoft 365 Business ● Windows 10 Enterprise E3/E5 ● Windows 10 Education A3/A5 ● Windows 10 VDA per user As part of getting access to the service you also get access to Multi-user Windows 10, FSLogix, and also access to Windows 7 with extended support. Last year (2020) Microsoft also made numerous enhancements to the platform such as: ● AVD Optimized for Microsoft Teams with audio and video offloading ● RDP Shortpath providing better transport using UDP Protocol ● Monitoring capabilities using Azure Monitor ● Support for management tools such as Endpoint Manager and Defender ATP ● Screen Capture Protection features While AVD is an evolving service it is lacking some core capabilities to provide optimized image lifecycle management and application delivery. Using FlexApp from Liquidware we can streamline the application delivery process and make Azure virtual desktop more flexible and reduce the need for multiple golden images that need maintenance, which we will cover more in detail as part of this whitepaper. Azure virtual desktop with Liquidware FlexApp - Page 3 AVD - Architecture and traffic flow With AVD, Microsoft is responsible for the Management and Data plane in Microsoft Azure across different regions. As of now AVD consistent with the following components: ● Web Access (User-based access) ● Management Components ● Connection Broker ● Diagnostics Role (Used for Troubleshooting) ● Gateway (Handles user-session traffic) Azure Virtual Desktop Ecosystem The responsibility as a customer is managing the different VDI desktops which are grouped into one or more host pools and other Azure-based components that are used as part of the overall platform, such as VPN Gateway, Firewalls, or storage services. AVD is a service that is intended to be used in combination with Azure infrastructure, so to configure AVD, it requires that we have an Azure Subscription to get access and to provision VDI/RDSH hosts. Also, AVD requires that you have an Active Directory to which the AVD sessions hosts are joined to or Azure Active Directory Domain Services which is a PaaS service offering of Active Directory in Azure. Azure virtual desktop with Liquidware FlexApp - Page 4 All AVD services are multi-tenant and are running as PaaS services and are Microsoft’s responsibility. The core services are handling all brokering, traffic flow, and such to the session hosts on the backend. NOTE: It should be noted that AVD does not support Azure AD joined devices on the infrastructure components, meaning that you cannot connect to a multi-user Windows 10 machine which is Azure AD Joined. This has however been announced and will be launched In preview soon → Azure Virtual Desktop: The flexible cloud VDI platform for the hybrid workplace | Azure blog and updates | Microsoft Azure As part of AVD, you can also run Windows Server RDSH as part of Azure virtual desktop, where you are using a multi-user Windows Server, it should be noted that this requires that we have RDS CAL licenses also. The services can also be used in combination with other services in Azure, which means that we can provision AVD VDI/RDSH hosts which have dedicated GPU capacity, RDMA based networking, high-end SSD performance or integrate with other PaaS services in Azure. On each of the session hosts, we would need to install an agent (Azure virtual desktop agent) which will authenticate to the AVD service using an access token that is unique for each tenant. This will register the VDI/RDSH host to the AVD tenant and allow for incoming connections from the gateway. NOTE: The Azure virtual desktop services are not available in all Azure regions, but are slowly rolling out to more and more regions. As part of the initial assessment, it is recommended that you use this site as a way to measure the latency to your closest region https://azure.microsoft.com/en-us/services/virtual-desktop/assessment/ and that your infrastructure should be as close as possible to the AVD components to provide an optimal user experience. If your VDI/RDSH servers are placed in another Azure region they will still communicate with the closest possible region where AVD is available. Since all agents are communicating using a reverse TCP connection, it does not require any public-facing VDI/RDSH servers. The communication and authentication flow is as follows: Azure virtual desktop with Liquidware FlexApp - Page 5 1. A user launches AVD client which authenticates to the Azure AD tenant. All Conditional Access Policies are evaluated against the user if any, the user signs in, and Azure AD returns a token to the user session. 2. The AVD client presents a token to the Web Access component, Broker queries the Azure SQL DB to determine resources authorized for the user. 3. The Gateway will through the AVD Agent communicate to the Active Directory Domain to which the VM’s are joined, to validate the user and get a Kerberos ticket. 4. User selects a resource, the AVD Client connects to Gateway which then initiates a session to the backend server using the reverse TCP connection. NOTE: You can use the tool RDAnalyzer to detect the statistics and performance of your AVD Session, more information here → https://rdanalyzer.com/ NOTE: Since AVD is using reverse TCP session to the endpoint it will add some latency overhead to the connection compared to a Microsoft RDS/Citrix HDX/ VMware Blast session. Cloud Economics and Microsoft Azure When setting up virtual infrastructure in Azure you need to understand the financial aspects of the different services that you are consuming. Virtual Infrastructure in Azure is billed per second for the allocated hardware for any VM (CPU, Memory, and licenses). In addition, you also have other variable costs such as storage (disk usage and throughput) and network egress traffic from Microsoft’s data centers. You can use the Azure Cost calculator to create estimates for any given service in Azure→ Pricing Calculator | Microsoft Azure Within Azure, you also have the option to reserve infrastructure capacity for either 1 or 3 years. Using reserved capacity you can reduce the cost of the overall virtual infrastructure by up to between 30 - 60%. Having a more flexible way of providing applications to any VDI or RDS session hosts in Azure can also reduce the number of virtual machines needed to provide applications to your users and also reduce the overall cost of your Azure environment. Azure virtual desktop with Liquidware FlexApp - Page 6 Ecosystem of Azure virtual desktop Azure virtual desktop is constantly being enhanced by Microsoft with new functionality but is still lacking some core management capabilities such as image provisioning options and how to do management of the session hosts. Therefore, this section is used to describe some of the options available to us, to mitigate those limitations, but also to describe some of the possibilities within Microsoft Azure.