Modern EUC by Wayne Bellows

Tag: security

  • AVD Full Cloud-Native Setup With Nerdio- FSLogix with Entra-only Azure Files (No Domain Controllers)

    AVD Full Cloud-Native Setup With Nerdio- FSLogix with Entra-only Azure Files (No Domain Controllers)

    If you’ve been waiting to run Azure Virtual Desktop (AVD) + FSLogix without Windows AD domain controllers or Microsoft Entra Domain Services, Microsoft has now introduced a public preview capability that makes it possible: Microsoft Entra Kerberos authentication for Azure Files SMB with cloud-only identities.

    This unlocks a true cloud-native pattern where:

    • Users are sourced from Microsoft Entra ID (cloud-only)
    • Session hosts are Entra-joined
    • FSLogix profile containers are stored on Azure Files
    • No DCs / no AAD DS required

    Microsoft announced this preview in late 2025 as part of the broader “cloud-native identity” push for Azure Files.

    https://techcommunity.microsoft.com/blog/azurestorageblog/cloud-native-identity-with-azure-files-entra-only-secure-access-for-the-modern-e/4469778

    Important Preview Notice

    This feature is an early public preview, so expect:

    • Documentation changes
    • Portal UI differences (including preview portal links)
    • Updated prerequisites/limitations as it approaches GA

    Treat this as lab first → pilot → production.

    High-Level Steps

    1. Create a storage account and enable Microsoft Entra Kerberos authentication with default share-level permissions (current preview limitation)
    2. Grant admin consent to the Storage Account service principal
    3. Update tags in the App Registration manifest
    4. Disable / exclude MFA for the storage account (Conditional Access)
    5. Configure FSLogix Profile and Session Hosts to Retrieve Kerberos Tickets (registry)
    6. Configure Directory and File-Level Permissions for FSLogix (Critical)
    7. Test end-to-end using an Entra-joined session host + cloud user

    Prerequisites (Read This First)

    OS requirements

    Entra Kerberos for cloud-only identities requires:

    • Windows 11 Enterprise/Pro (single or multi-session), or
    • Windows Server 2025, with the latest updates applied.

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable?tabs=azure-portal%2Cintune

    Identity-source limitation

    A Storage Account cannot authenticate to multiple directory sources simultaneously (you must pick one method per account).

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

    Share-permissions limitation (preview)

    For cloud-only identities in this preview, default share-level permissions are the supported approach (applies to all authenticated users accessing shares in the account).

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-assign-share-level-permissions

    Cloud availability

    This capability is currently scoped to the Azure public cloud, with limitations outlined in Microsoft documentation.

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

    Recommended test design

    • AVD host pool with Entra ID-joined session hosts
    • Azure Files Premium
    • Two Entra groups: Storage Admin / Cloud Users

    Step 1 — Create Storage Account and Enable Microsoft Entra Kerberos Authentication on Storage Account with Default Share-Level Permissions

    1. In Nerdio Manager, navigate to Storage → Azure Files
    2. Select New Azure Files
    3. Enter the storage account name, location, performance, replication, file share name, and capacity
    4. Enable Share-level permission, select SMB Share Contributor, and add the user(s)/group(s) into Permissions (SMB share contributors)
    5. Enable Join AD or Entra ID and select Entra ID
    6. For NTFS file-level permissions, select None
    7. Ok
    Create Azure Files Share in NME
    Create Azure Files Share

    This links Azure Files SMB identity-based access to Entra Kerberos.

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

    Step 2 — Grant Admin Consent to the Storage Account Service Principal

    You must grant admin consent once per storage account used with Entra Kerberos.

    1. Go to Microsoft Entra ID
    2. Navigate to App registrations → All applications
    3. Find the Storage Account app registration (it typically appears with a bracket prefix, [Storage Account xxx.file.core.windows.net])
    4. Open it → Manage → API permissions
    5. Click Grant admin consent for your tenant
    6. Yes

    This enables the storage account’s app registration to operate correctly for the Entra Kerberos flow.

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

    Step 3 — Update Tags in the Application Manifest File

    This is one of the “preview sharp edges.”

    1. In the same App Registration, go to Manifest
    2. Locate the tags attribute
    3. Add “kdc_enable_cloud_group_sids”
    4. Save
    Tags in the application manifest
    Tags in the application manifest

    In GA, this may become automated, but for now it’s part of the manual setup path.

    https://learn.microsoft.com/en-us/entra/identity/authentication/kerberos

    Step 4 — Disable MFA for Storage Account Access (Conditional Access Exclusion)

    Entra Kerberos does not support MFA for Azure Files SMB access. If MFA is enforced, you may see errors such as System error 1327 / sign-in restrictions.

    Everyone’s Conditional Access policies will be different; you’ll need to ensure any policies enforcing MFA for all resources and applied to AVD users have an exclusion for the storage account.

    What to do:

    1. Go to Conditional Access
    2. Identify policies that target all resources
    3. Add an exclusion for the Storage Account “app” (search it by name [Storage Account xxx.file.core.windows.net])
    4. Save

    This is a common “why can’t I map the drive” failure mode during testing.

    Step 5 — Configure FSLogix Profile and Session Hosts to Retrieve Kerberos Tickets

    If you skip this, you may get:

    • Credential prompts when mapping the share
    • System error 86

    You must add a registry key to each Entra-joined session host that will access the share. Nerdio can configure this registry value and the FSLogix settings as part of the FSLogix Profiles Storage Configuration.

    • Nerdio Manager → Profiles Management → New profile → FSLogix
    • Enter the profile name
    • Select Configure session hosts registry for Entra ID joined storage
    • Enter the FSLogix Profiles path (VHDLocation), the UNC path of your storage account, share, and directory (\\<storageaccount>.file.core.net\<share>\<directory>]
    • Configure your remaining FSLogix profile settings
    • Ok
    NME FSLogix Profiles Storage Configuration
    FSLogix Profiles Storage Configuration

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

    Important caveat: This setting can prevent on-premises AD-joined clients from accessing storage accounts via the legacy flow; if you need both Entra and Windows AD access patterns, realm mapping may be required (scenario-specific).

    Step 6 — Configure Directory and File-Level Permissions for FSLogix (Critical)

    Even if FSLogix “works” without this, you risk a serious security issue:

    • Users may be able to access other users’ profile containers

    6A) Validate you can mount the share (from an Entra-joined session host)

    Log on to a session host as a member of your “Storage Admin” Entra group, then run from Command Prompt:

    • net use X: \\<storageaccount>.file.core.windows.net\<share>

    If it fails:

    • Verify Step 5 registry key is present
    • Reboot the session host (often required during early preview workflows)

    6B) Set ACLs using Azure Portal “Manage access” (not File Explorer / icacls)

    In cloud-only identity mode, Microsoft provides an Azure Portal ACL experience for Windows-style permissions on Azure Files SMB.

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-configure-file-level-permissions

    Preview portal link:

    (If “Manage access” is not visible in the standard portal UI, use that preview link.)

    • In the Azure portal, navigate to your storage account
    • Data storage → Files shares → select share → Browse → three dots → Manage access
    • Delete everything except the CREATOR OWNER
    • Add your storage admin group with Full control
    • Add your user group and change it to Applies to this folder with Modify access
    Azure Files Share Manage Access
    Manage access

    https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions

    Why this works:

    • Users can create their own profile folder
    • Creator Owner grants them rights within the folder they created
    • They cannot access other users’ folders
    • Storage admins can troubleshoot, recover, and clean up profiles

    Once configured, save and re-check permissions in the portal or via folder security view (Windows UI may show Entra objects as SIDs in some builds).

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-configure-file-level-permissions

    Step 7 — Test End-to-End (Moment of Truth)

    1. Log in to AVD as a user in your AVD Users Entra group
    2. Confirm the session signs in successfully (good indicator)
    3. On a session host logged in as a Storage Admin, open the share
    4. Confirm a new user folder is created
    5. Confirm folder/file ACLs show

    You can validate per-folder permissions either:

    • In the Azure portal → Browse → drill into the user profile folder → Manage access
    • Or via Windows folder properties/security view (bearing in mind Entra objects may show as SIDs).

    https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-configure-file-level-permissions

    Operational Notes for Production

    Conditional Access design

    You will likely need a targeted strategy such as:

    • Exclude the storage account app from MFA requirements
    • Keep MFA for interactive user sign-in, but avoid breaking SMB access. This is a common real-world friction point.

    Keep tracking preview updates

    Microsoft is positioning this as a foundational capability for modern workloads, including AVD/FSLogix.

    https://techcommunity.microsoft.com/blog/azurestorageblog/cloud-native-identity-with-azure-files-entra-only-secure-access-for-the-modern-e/4469778

    References (Microsoft)

    References (Nerdio)

  • Choosing the Right Nerdio Manager Installation Method: A Practical Guide for AVD Environments

    Choosing the Right Nerdio Manager Installation Method: A Practical Guide for AVD Environments

    If you’ve ever planned a Nerdio Manager for Enterprise (NME) deployment, you may be aware that there isn’t just one way to install it. Depending on how your Azure environment is structured — identities, tenants, permissions, governance, and AVD architecture — the installation path can look very different.

    This is one of the questions I’m asked most often by customers:

    “Which installation method do I actually need to use?”

    To make this easier, I created a simple decision tree (I’ll include a diagram at the end) and broke down each installation type. Whether you’re deploying for a single small environment or a global multi-tenant estate, this guide should point you in the right direction.

    Why are there multiple installation methods?

    Nerdio Manager integrates deeply with:

    • Entra ID
    • Azure subscriptions
    • Azure Virtual Networking
    • AVD / Windows 365 resources
    • App registrations
    • Service principals
    • Resource providers

    Because every customer structures their identity and resource topology differently, NME provides installation paths for a range of real-world scenarios — including restricted RBAC environments and split-tenant setups.

    Summary of All Installation Types

    Here is a high-level overview of all six installation methods available in Nerdio Manager.

    1️⃣ Standard Install (Azure Marketplace)

    The most common and simplest deployment method.

    Use this when:

    • Your user identities and AVD resources live in the same Entra ID tenant.
    • You have the required permissions to deploy and initialise NME.
    • You don’t need to customise the Entra ID application name.

    Typical customers: Most AVD/W365 deployments, POCs, and standard single-tenant setups.

    📄 Guide: https://nmehelp.getnerdio.com/hc/en-us/articles/26124313550477-Nerdio-Manager-Installation-Guide

    2️⃣ Custom Entra ID Application Name

    Some customers need to customise the app registration name (e.g., naming conventions or multiple NME instances in the same tenant).

    Use this when:

    • You do have app creation permissions.
    • You need a non-default app name.
    • You want to avoid conflicts when deploying multiple Nerdio Manager instances.

    📄 Guide: https://nmehelp.getnerdio.com/hc/en-us/articles/26124326251405-Advanced-Installation-Methods

    3️⃣ Split Identity Deployment

    This is for customers whose user identities exist in one Entra ID tenant, while the AVD session hosts and Azure resources live in another.

    This is common with:

    • NHS Trusts
    • Shared services
    • Large groups that centralise identity
    • Multi-organisation structures

    Use this when:

    • You must separate identity governance from Azure resource management.

    📄 Guide: https://nmehelp.getnerdio.com/hc/en-us/articles/26124326194573-Advanced-Installation-Split-Identity

    4️⃣ Pre-Created Entra ID Application

    Some organisations do not allow deployment engineers to create app registrations — typically due to strict RBAC, identity governance, or Conditional Access rules.

    Use this when:

    • You don’t have permission to create an Entra ID app.
    • A separate team (Identity/Security) needs to pre-create the Nerdio app for you.
    • You’ll reference the existing App ID, Secret, and Object ID during initialization.

    📄 Guide: https://nmehelp.getnerdio.com/hc/en-us/articles/26124326326669-Advanced-installation-Create-Entra-ID-application

    5️⃣ External Identities (Guest Accounts)

    Some customers have user identities mastered in another tenant but synchronised into the AVD tenant as guest / external identities. This is not split identity — everything still runs in a single AVD tenant.

    Use this when:

    • Your users are guests from another tenant.
    • You want them to connect to AVD/Windows 365 using External Identities.
    • You want to avoid maintaining a full split-tenant architecture.

    This overlays onto Install Types 1, 2, or 4.

    📄 Microsoft announcement: https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-365-and-azure-virtual-desktop-support-external-identities-now-generally-/4468103

    6️⃣ Multi-Tenant Deployment

    Once NME is installed, you can manage AVD deployments across multiple Entra tenants from a single console.

    Use this when:

    • You’re an MSP, enterprise group, or global organisation.
    • You want one Nerdio Manager instance for multiple tenants.
    • You need unified monitoring, autoscale, images, apps, and governance across tenants.

    📄 Guide: https://nmehelp.getnerdio.com/hc/en-us/articles/26124299740685-Tenants-Overview

    Putting It All Together — The Installation Decision Tree

    I created a simple flowchart to help customers quickly identify the correct installation type. It includes:

    • Tenant topology
    • Permissions
    • Identity architecture
    • Guest user model
    • Multi-tenant requirements
    Nerdio Manager for Enterprise deployment decision tree
    NME deployment decision tree

    Final Thoughts

    Choosing the right installation method is crucial for:

    • Proper AVD lifecycle management
    • Compliance with your organisation’s identity model
    • Ensuring NME has the permissions it needs
    • Avoiding rework later
    • Supporting multi-tenant or cross-tenant architectures

    If you’re planning a new deployment or reviewing your existing setup, this guide (and the diagram) should help you pick the correct path with confidence.