AVD Cloud-Native: Autenticação do FSLogix Sem Depender de AD Tradicional

Aprenda a configurar os perfis do FSLogix no Azure Virtual Desktop eliminando totalmente a dependência de Domain Controllers e do Active Directory tradicional na sua infraestrutura.

RDP:

targetisaadjoined:i:1;drivestoredirect:s:;usbdevicestoredirect:s:;redirectclipboard:i:1;redirectprinters:i:0;audiomode:i:0;videoplaybackmode:i:1;devicestoredirect:s:*;redirectcomports:i:1;redirectsmartcards:i:1;enablecredsspsupport:i:0;redirectwebauthn:i:1;use multimon:i:1;enablerdsaadauth:i:1

Comandos:

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1

$profilePath = "\\nome.file.core.windows.net\fslogixgaijin\profiles" # Replace with your Azure File Share path

Set-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "VHDLocations" -Value $profilePath

Set-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "Enabled" -Value 1 -Type DWord

Set-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "DeleteLocalProfileWhenVHDShouldApply" -Value 1 -Type DWord

Set-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "SizeInMBs" -Value 30000 -Type DWord

Set-ItemProperty -Path "HKLM:\SOFTWARE\FSLogix\Profiles" -Name "FlipFlopProfileDirectoryName" -Value 1 -Type DWord

Learn:

Store FSLogix profile containers on Azure Files using Microsoft Entra ID: https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid?wt.mc_id=MVP_446145&pivots=hybrid-identities?wt.mc_id=studentamb_360184

Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable?tabs=azure-portal%2Cintune&wt.mc_id=MVP_446145#prerequisites?wt.mc_id=studentamb_360184

Cloud Native Identity with Azure Files: Entra-only Secure Access for the Modern Enterprise: https://techcommunity.microsoft.com/blog/azurestorageblog/cloud-native-identity-with-azure-files-entra-only-secure-access-for-the-modern-e/4469778?wt.mc_id=MVP_446145?wt.mc_id=studentamb_360184

Configure the clients to retrieve Kerberos tickets: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable?tabs=azure-portal%2Cregkey&wt.mc_id=MVP_446145#configure-the-clients-to-retrieve-kerberos-tickets?wt.mc_id=studentamb_360184

How to update Tags attribute in application manifest file: https://learn.microsoft.com/en-us/entra/identity/authentication/kerberos?wt.mc_id=MVP_446145#how-to-update-tags-attribute-in-application-manifest-file?wt.mc_id=studentamb_360184

Configure directory-level and file-level permissions for Azure file shares: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-configure-file-level-permissions?wt.mc_id=MVP_446145#configure-windows-acls-using-the-azure-portal?wt.mc_id=studentamb_360184