Skip to content

Commit

Permalink
Replaced Azure AD with Microsoft Entra ID
Browse files Browse the repository at this point in the history
  • Loading branch information
@igorpag
igorpag committed Jul 13, 2023
1 parent d63bd51 commit 7a44417
Showing 1 changed file with 17 additions and 17 deletions.
34 changes: 17 additions & 17 deletions checklists/avd_checklist.en.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,8 @@
{
"category": "Foundation",
"subcategory": "Capacity Planning",
"text": "Estimate the number of Application Groups required across all Host Pools in the Azure AD tenant",
"description": "There is a limit of 500 Application Groups that can be created in AVD for each Azure Active Directory tenant. The limit can be increased (see the companion link for details) but it is not recommended.",
"text": "Estimate the number of Application Groups required across all Host Pools in the Microsoft Entra ID tenant",
"description": "There is a limit of 500 Application Groups that can be created in AVD for each Microsoft Entra ID (former Azure AD) tenant. The limit can be increased (see the companion link for details) but it is not recommended.",
"guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c",
"severity": "Medium",
"link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits"
Expand Down Expand Up @@ -193,8 +193,8 @@
{
"category": "Identity",
"subcategory": "Requirements",
"text": "An Azure Active Directory tenant must be available with at least one subscription linked",
"description": "An Azure subscription must be parented to the same Azure AD tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Azure AD Domain Services instance.",
"text": "A Microsoft Entra ID tenant must be available with at least one subscription linked",
"description": "An Azure subscription must be parented to the same Microsoft Entra ID (former Azure AD) tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Microsoft Entra ID Domain Services instance.",
"guid": "6ceb5443-5125-4922-9442-93bb628537a5",
"severity": "High",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity"
Expand All @@ -212,7 +212,7 @@
"category": "Identity",
"subcategory": "Requirements",
"text": "Assess User Account types and requirements",
"description": "Users need accounts that are in Azure AD. If you're also using AD DS or Azure AD DS in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Azure AD with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Azure AD. If you're using Azure AD with Azure AD DS, user accounts are synchronized one way from Azure AD to Azure AD DS. This synchronization process is automatic. AVD also supports Azure AD native accounts with some restrictions. External identities (B2B or B2C) are not supported.",
"description": "Users need accounts that are in Microsoft Entra ID (former Azure AD). If you're also using AD DS or Azure AD Domain Services in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Microsoft Entra ID with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Microsoft Entra ID. If you're using Microsoft Entra ID with Azure AD Domain Services, user accounts are synchronized one way from Microsoft Entra ID to Azure AD Domain Services. This synchronization process is automatic. AVD also supports Microsoft Entra ID native accounts with some restrictions. External identities (B2B or B2C) are not supported.",
"guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b",
"severity": "Medium",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios"
Expand All @@ -221,7 +221,7 @@
"category": "Identity",
"subcategory": "Requirements",
"text": "If Single-Sign On (SSO) is a requirement, review the supported scenarios and prerequisites",
"description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Azure AD authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using ADFS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.",
"description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Microsoft Entra ID (former Azure AD) authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using AD FS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.",
"guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4",
"severity": "Medium",
"link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso"
Expand All @@ -230,16 +230,16 @@
"category": "Identity",
"subcategory": "Requirements",
"text": "Select the proper AVD Session Host domain join type",
"description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Azure AD Joined or Azure AD DS joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.",
"description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Microsoft Entra ID (former Azure AD) Joined or Azure AD Domain Services joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.",
"guid": "ea962a15-9394-46da-a7cc-3923266b2258",
"severity": "High",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios"
},
{
"category": "Identity",
"subcategory": "Requirements",
"text": "Before using Azure Active Directory Domain Services (AAD-DS) for AVD, be sure to review the limitations.",
"description": "Compare self-managed Windows Active Directory Domain Services, Azure Active Directory, and managed Azure Active Directory Domain Services",
"text": "Before using Azure AD Domain Services (AAD-DS) for AVD, be sure to review the limitations.",
"description": "Compare self-managed Windows Active Directory Domain Services, Microsoft Entra ID (former Azure AD), and managed Azure AD Domain Services (AAD-DS)",
"guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b",
"severity": "Low",
"link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions"
Expand Down Expand Up @@ -293,7 +293,7 @@
"category": "Identity",
"subcategory": "Active Directory",
"text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)",
"description": "Avoid granting access per user, instead use AD groups and replicate them using ADC in Azure AD. ",
"description": "Avoid granting access per user, instead use AD groups and replicate them using Active Directory Connector (ADC) in Microsoft Entra ID (former Azure AD). ",
"guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c",
"severity": "Medium",
"link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups"
Expand All @@ -310,17 +310,17 @@
{
"category": "Identity",
"subcategory": "Active Directory",
"text": "A Windows Server Active Directory forest/domain must be in sync with Azure Active Directory",
"description": "You can configure this using Azure AD Connect (for hybrid organizations) or Azure AD Domain Services (for hybrid or cloud organizations).",
"text": "A Windows Server Active Directory forest/domain must be in sync with Microsoft Entra ID",
"description": "You can configure this using Active Directory Connect (ADC) or Azure AD Domain Services (for hybrid or cloud organizations). Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
"guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a",
"severity": "High",
"link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity"
},
{
"category": "Identity",
"subcategory": "Azure AD",
"text": "Configure Azure Files share for Azure Active Directory (Azure AD) Kerberos authentication on Azure AD Joined scenario",
"description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Azure AD) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.",
"subcategory": "Microsoft Entra ID",
"text": "Configure Azure Files share for Microsoft Entra ID (former Azure AD) Kerberos authentication on Microsoft Entra ID Joined scenario",
"description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Microsoft Entra ID) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.",
"guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338",
"severity": "Medium",
"link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable"
Expand Down Expand Up @@ -1029,9 +1029,9 @@
},
{
"category": "Security",
"subcategory": "Azure Active Directory",
"subcategory": "Microsoft Entra ID",
"text": "Evaluate the usage of Multi-Factor Authentication (MFA) and Conditional Access (CA) for AVD users",
"description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article.",
"description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article. Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).",
"guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9",
"severity": "Medium",
"link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa"
Expand Down

0 comments on commit 7a44417

Please sign in to comment.