Azure WVD Prerequistes & Dependencies C

Item
Azure Subscription

Windows 10 Enterprise Licensing for WVD

Azure Active Directory (AAD) Tenant

& Active Directory
Azure Region
On Premises connectity

WVD Implementation Team ID creation & group

Permissions on Azure subscription

Remote Access to Infrastructure
Network

AD OU Creation

AD Delegated Access

Internet Access

Azure Governance doument

Service Account Creation

# Sensitivity: Internal Restricted

Test user accounts creation

New vnet addition to AD Sites & Subnets

VDI /Server OS/RDS Licensing

Antivirus Agents

User Profile Solution

User profile storage & user data drive

Storage Accounts

Permissions on Azure storage

NetApp File Storage requirment

Image Management
Monitoring Tools

Backup

Security

Network

Windows Virtual Desktop Client

(End points)

# Sensitivity: Internal Restricted

Windows Virtual Desktop Client
(End points)

Users Information

Line of Business(LOB) applications list

# Sensitivity: Internal Restricted

 Azure WVD Prerequistes & Dependencies Checklist
Description Prerequistes/Dependencies Status
An Azure subscription (needed to host resources) Prerequiste
To avail WVD Service,, customer should have Win 10 Enterprise
license - Refer License sheet for more details Prerequiste

An Active Directory to which you can join your VMs

A Windows Server Active Directory in sync with Azure Active
Directory. Prerequiste
Auzre region information to deploy WVD Session hosts Information
Azure Express Route or VPN Information

User ID and group creation for WVD Implementation team Prerequiste

Owner - Prefered access

or
Builtin Contributor access , User Access Admin role to assign
users in WVD and assign permissions for Azure Files (Storage
File Data SMB Share Contributor) Prerequiste
Jump Server or Bastion Service to access Azure VM's Prerequiste
Vnets and Subnets to use for WVD Prerequiste

Need dedicated OU structure -Wipro provides structure

Test OU - With block inheritance - This is temporary till project
completion

To create,Modify& Delete OU's, Computer Accounts,

DomainJoin
Permissions to create/Modify Group Policy Objects on VDI OU's
Delegated permission on implementation team user id's or
Delegate above permissions to service account Prerequisite
Internet access at WVD subnet level to create Host pool
creation. (recommended option)
or allow safe URL list as per MS
Prerequisite

Governance doument required to follow policies, naming and

compliance standards to deploy azure resources Prerequisite

Service Account creation for all WVD build activities

( Ex: Virtuadesk monitor schedule tasks, admin schedule tasks
& Domain Join)
Note: MFA should not enable for Admin /Service accounts Dependency

# Sensitivity: Internal Restricted

Need minimum of 2 user accounts for end to end VDI testing Dependency
It is required to add new WVD Vnet's to AD Sites & Subnets for
authentication Dependency

Windows VDI OS
Windows Server OS - As applicable
RDS License - As applicable
Refer License sheet for more details Dependency

Information on AV agents(Symantec/Mac Afee/Trend

Micro/Sentinel/Crowd strike/MS Defender) to deploy on
images Dependency
AD Native Roaming or RES or App Sense or Fslogix etc.. Information

User profile storage (Azure Files or Netapp Files)

Data drive -One Drive or same as profile storage or home
drives Information
Azure Storage
Azure Monitro Diagnostics Information

Storage File Data SMB Share Elevated Contributor to Admin

Group & Storage File Data SMB Share Contributor to all user
Group
All Groups should synch to Azure AD
Dedicated subnet
Includes Patches & applications
Deployment method to use: SCCM or Azure Gallery Information
Azure Monitor/SCOM or any other 3rd party tools Information
Backup tool (Azure Backup or any other 3rd party) to take
backup for Profile/Persistent & Golden Images Information
Windows OS hardening Dependency
Multi Factor Authentication details (Azure MFA/OKTAor any
other) Information
Azure Security Center Information
Network Security Groups(NSG's) to restrict traffic Information

Azure Firewall for internet access or to use onprem proxy Information

Any customer specific security Agents like DLP or any other
tools Information
Public IP's ( if applicable)
JumpServer or Bastion uses public ip Dependency

Communication with all enterprise services as applicable Dependency

Install the Windows Virtual Desktop Client on client devices Dependency

# Sensitivity: Internal Restricted

Allow MS safe list of URL's to access wvd Dependency
Pilot Users Dependency
Migration phase list (as applicable) Dependency
Production Users Dependency
Web application list with URL details Dependency
Applications(thick) Exe's to install on Golden Image Dependency
Communication from WVD to application servers Dependency
Point of contact for application installation Dependency

# Sensitivity: Internal Restricted

Remarks

https://docs.microsoft.com/en-
us/azure/virtual-desktop/faq

DSC ext:
https://docs.microsoft.com/en-
us/azure/virtual-
machines/extensions/dsc-windows
Safe URL:
https://docs.microsoft.com/en-
us/azure/virtual-desktop/safe-url-list

https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging

https://docs.microsoft.com/en-us/azure/virtual-desktop/expand-existing-host-pool

# Sensitivity: Internal Restricted

https://docs.microsoft.com/en-
us/azure/virtual-
machines/windows/hybrid-use-
benefit-licensing?WT.mc_id=Portal-
Microsoft_Azure_Compute

# Sensitivity: Internal Restricted

https://docs.microsoft.com/en-us/azure/virtual-desktop/safe-url-list

# Sensitivity: Internal Restricted

Server OS

VDI OS

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted
You are eligible to access Windows 10 multi-session, Windows 10, or Windows 7 with Windows Virtual
Desktop if you have one of the following per user licenses
Microsoft 365 F1, E3, E5, A3, A5, Business
Windows 10 Enterprise E3, E5
Windows 10 Education A3, A5
Windows 10 VDA per user

You are eligible to access Windows Server 2012 R2/2016/2019 and newer desktops and apps if you have a
per-user or per-device RDS CAL license with active Software Assurance (SA).
Remote Desktop Services (RDS) Client Access License (CAL) with active Software Assurance (SA)

FSLogix
Microsoft 365 F1, E3, E5, A3, A5, Business
Windows 10 Enterprise E3, E5
Windows 10 Education A3, A5
Windows 10 VDA per user
Remote Desktop Services (RDS) Client Access License (CAL) with active Software Assurance (SA)

For customers with Software Assurance, Azure Hybrid Benefit for Windows Server allows you to use your
on-premises Windows Server licenses and run Windows virtual machines on Azure at a reduced cost. You
can use Azure Hybrid Benefit for Windows Server to deploy new virtual machines with Windows OS

For customers with Windows 10 Enterprise E3/E5 per user or Windows Virtual Desktop Access per user
(User Subscription Licenses or Add-on User Subscription Licenses), Multitenant Hosting Rights for Windows
10 allows you to bring your Windows 10 Licenses to the cloud and run Windows 10 Virtual Machines on
Azure without paying for another license

Windows 10 Sinle -Custom Image

# Sensitivity: Internal Restricted

Windows 10 Multi Session

Windows Server

# Sensitivity: Internal Restricted

https://azure.microsoft.com/en-us/pricing/details/virtual-desktop/

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/hybrid-
use-benefit-licensing
https://azure.microsoft.com/en-us/pricing/hybrid-benefit/

https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted
1. Resource Group - Contributor role at Resource Group Level
2. Virtual networks - Contributor role at Virtual Network Level
3. Virtual Machines/Images/AV Set - Contributor role at Virtual Machine Level
4. Storage Accounts - Contributor role at Storage accounts Level
5. Azure Monitor- Monitoring contributor role at Subscription level.
6. Azure Advisor - Contributor role at resource group level.
8. Security Center - "Contributor / Security Admin" role at Subscription Level
9. Key Vault - "Contributor" Role at Resource Group Level.
10. Network Security Group - "Contributor" role at Resource Group Level.
14.Log Analytics workspace require Contributor Role at subscription Level
Contributor rights to register Resource Providers
Azure Image Builder/Azure Shared Image Gallery- Contributor Access
IAM Roles required :
Storage File Data SMB Share Contributor
Storage File Data SMB Share Elevated Contributor (NTFS configurations)

# Sensitivity: Internal Restricted

 Virtual machines
The virtual machines you create for Windows Virtual Desktop must have access to

Address Outbound TCP port

*.wvd.microsoft.com 443

gcs.prod.monitoring.core.windows.net 443

production.diagnostics.monitoring.core.wi 443
ndows.net
*xt.blob.core.windows.net 443
*eh.servicebus.windows.net 443
*xt.table.core.windows.net 443
catalogartifact.azureedge.net 443
kms.core.windows.net 1688
mrsglobalsteus2prod.blob.core.windows.n 443
et
wvdportalstorageblob.blob.core.windows. 443
net
169.254.169.254 80

168.63.129.16 80
*.microsoftonline.com 443

*.events.data.microsoft.com 443
www.msftconnecttest.com 443

*.prod.do.dsp.mp.microsoft.com 443
login.windows.net 443

*.sfx.ms 443

*.digicert.com 443

Remote Desktop clients

Any Remote Desktop clients you use must have access to the follow

Address Outbound TCP port

*.wvd.microsoft.com 443

*.servicebus.windows.net 443

go.microsoft.com 443
aka.ms 443
docs.microsoft.com 443
privacy.microsoft.com 443
query.prod.cms.rt.microsoft.com 443

# Sensitivity: Internal Restricted

 Virtual machines
indows Virtual Desktop must have access to the following URLs in Azure

Purpose Service Tag Remarks

Service traffic WindowsVirtualDesktop Mandatory

Agent traffic AzureCloud Mandatory

Agent traffic AzureCloud Mandatory

Agent traffic AzureCloud Mandatory

Agent traffic AzureCloud Mandatory
Agent traffic AzureCloud Mandatory
Azure Marketplace AzureCloud Mandatory
Windows activation Internet Mandatory
Agent and SXS stack updates AzureCloud Mandatory

Azure portal support AzureCloud Mandatory

Azure Instance Metadata service endpoint

N/A Mandatory

Session host health monitoring N/A Mandatory

Authentication to Microsoft Online login.microsoftonline.us Optional
Services
Telemetry Service None Optional
Detects if the OS is connected to None Optional
the internet
Windows Update None Optional
Sign in to Microsoft Online Services, login.microsoftonline.us Optional
Microsoft 365
Updates for OneDrive client oneclient.sfx.ms Optional
software
Certificate revocation check None Optional

Remote Desktop clients

op clients you use must have access to the following URLs:

Purpose Clients Azuregov

Service traffic All *.wvd.micros
oft.us
Troubleshooting data All *.servicebus.
usgovcloudap
i.net
Microsoft FWLinks All None
Microsoft URL shortener All None
Documentation All None
Privacy statement All None
Client updates All None

# Sensitivity: Internal Restricted

 WVD Safe URL List

Office 365 URLs and IP address ranges

# Sensitivity: Internal Restricted

https://docs.microsoft.com/en-us/azure/virtual-desktop/safe-url-list

https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

# Sensitivity: Internal Restricted