Azure Virtual Desktop for Non-Networkers
Identity and Licensing
Identity and Licensing
Before you can deploy any virtual desktops, you need to set up the identity layer. For Azure Virtual Desktop (AVD), this layer is handled by , which manages user accounts and controls access to resources. Our focus is on a cloud-only setup, which simplifies things considerably. We won't be dealing with traditional on-premises domain controllers or synchronization tools. Everything happens directly in Azure.
Microsoft Entra ID (Azure AD) is a cloud-based identity and access management (IAM) service.
License and Role Check
First, ensure your account has the correct licenses. AVD requires specific Microsoft 365 or Windows licenses to cover the operating system usage rights for your users.
Eligible licenses include Microsoft 365 E3/E5, A3/A5, F3, Business Premium, or Windows E3/E5/A3/A5.
Next, verify your permissions within the Azure subscription. To assign users to AVD resources, you need a role that allows you to manage access. The simplest way to ensure this is by having the Owner role on the subscription. If you don't have that, the User Access Administrator role is also sufficient. These roles are part of Azure's (RBAC) system, which governs what actions users can perform on which resources.
Create a User Group
It's a best practice to manage access using groups rather than assigning permissions to individual users. This makes administration much easier. We'll create a dedicated security group in Microsoft Entra ID for our AVD users. Later, we will grant this entire group access to the virtual desktop application group.
You can create this group through the Azure portal, or by using the Azure CLI with a command like this:
# Replace 'AVD-Users' with your desired group name
az ad group create --display-name "AVD-Users" --mail-nickname "avdusers"
Once the group is created, you can add the user accounts that will need access to the virtual desktops.
Register the Resource Provider
Finally, every Azure service has a resource provider that supplies the necessary components for that service. Before you can create AVD resources like host pools or application groups, you must register the Microsoft.DesktopVirtualization resource provider with your subscription. This is a one-time action per subscription.
Think of it as enabling the AVD feature set for your account. If you try to deploy resources without registering the provider first, the deployment will fail.
# This command registers the AVD provider
az provider register --namespace Microsoft.DesktopVirtualization
# You can check the registration status with this command
az provider show --namespace Microsoft.DesktopVirtualization --query "registrationState"
With our identity foundation, user group, and resource provider ready, we're prepared to start building the AVD environment.
What is the core identity provider for a cloud-only Azure Virtual Desktop (AVD) deployment?
An administrator is unable to assign users to an AVD application group. Which Azure RBAC role would grant the necessary permissions without giving full control over the entire subscription?