Marcel
Marcel That's me: Marcel

Using WVDAdmin for Windows Virtual Desktop in 2-AAD-Environment (Microsoft Demo Case)

Using WVDAdmin for Windows Virtual Desktop in 2-AAD-Environment (Microsoft Demo Case)

Using Azure Starter for Windows Virtual Desktop in 2-AAD-Environment (Microsoft Demo Case)

Usually, the WVD tenant and the resources (sessions hosts) are in the same AAD tenant. If you have two Azure AD tenant, you can use WVDAdmin with a second service principal to access the session hosts.

Example:

  • Azure AD 1 - “my-msft.onMicrosoft.com
    • Your personal AAD where you have your users, an AD-Controller, AD-Connect (or AD domain services), and other resources. In this AAD you have deployed your WVD tenant.
  • Azure AD 2 - “microsoft.onMicrosoft.com
    • You have no high-level permission to the AAD because it’s own by your company and shared with many other users/professionals. In this AAD, you have a subscription (AIR) containing your session hosts.

Split-AAD-02.png

Create the first service principal in “my-msft.onMicrosoft.com”. Configure this service principal as described in the primary guide - except permitting to the resource group containing the session hosts and the vnet (these are in the other tenant). Use the data of this service principal in the welcom dialog of WVDAdmin.

Create the second service principal in “microsoft.onMicrosoft.com”. Give the service principal contributor permission to the resource group containing the session hosts and to the vnet for the session host. Open the registry and navigate to HKEY_CURRENT_USER\Software\ITProCloud\WVDAdmin. Add three string value to configure the service principal to access the resource groups

  • AzResAlternativeTenantId
  • AzResAlternativeAppId
  • AzResAlternativeAppSecret

Split-AAD-03.png

If you use another tenant group name as “Default Tenant Group” add another string “TenantGroupName” and set your tenant group name.

This solution is supported from the current version 1.3.3

Read more and download WVDAdmin on the main page