Securing Your Azure Virtual Desktop with Private Link: A Three-Tiered Approach
Azure Virtual Desktop (AVD) offers enhanced security by integrating with Azure Private Link. This allows you to keep your AVD traffic within your private network, shielding it from the public internet. Private Link for AVD operates across three distinct workflows, each requiring specific private endpoint configurations:
Initial Feed Discovery (Global): This is like finding the AVD directory. It lets users see all the workspaces assigned to them. For this, you need one private endpoint connected to the global sub-resource. Think of it as a single, central access point. Crucially, you only need one of these per AVD deployment, regardless of how many workspaces you have.
Feed Download (Per Workspace): Once users know their workspaces, they need the connection details. This is the feed download. Here, you'll need a separate private endpoint for the feed sub-resource in each workspace you want accessible via Private Link. Each workspace gets its own private "download station."
Connections to Host Pools (Per Host Pool): Finally, the actual connection to the virtual desktops themselves. This involves the host pools. Similar to feed download, you need a separate private endpoint for the connection sub-resource in each host pool you want to secure with Private Link. Each host pool gets its own private "connection tunnel."
Flexible Implementation Options:
You have flexibility in how you use these private endpoints:
Fully Private: All three workflows (feed discovery, feed download, and connections) use Private Link. Maximum security.
Hybrid Approach 1: Feed download and connections are private, but initial feed discovery uses public routes. A balance of security and convenience.
Hybrid Approach 2: Only connections are private. Feed discovery and download use public routes. Focuses security on the actual desktop sessions.
Public Only: No Private Link used. All traffic goes over the public internet. Least secure, but simplest to set up.
By understanding these three workflows and the different implementation options, you can tailor your Private Link strategy to meet your specific security and accessibility needs for Azure Virtual Desktop. What specific scenario are you considering? Perhaps securing access for remote workers, or connecting your on-premises environment? Let's explore how Private Link fits into your plans!
Tasks
1. Re-register the Azure Virtual Desktop Resource Provider
Sign in to the Azure portal.
Navigate to Subscriptions > select your subscription > Resource providers.
Search for Microsoft.DesktopVirtualization and click Re-register.
2. Create an Azure Virtual Network Subnet
Go to Virtual networks > select your vnet (e.g. az140-vnet11e).
Under Settings, select Subnets > + Subnet.
Configure:
Click Add.
3. Implement Private Endpoints
For Host Pool Connections:
Go to Azure Virtual Desktop > Host pools > select your host pool (e.g.az140-21-hp1).
Under Networking, select Private endpoint connections > + New private endpoint.
Configure:
Resource Group: az140-11e-RG
Name: az140-11-pehp1
Region: East US
Target sub-resource: connection
Virtual Network: az140-vnet11e, Subnet: pe-Subnet
Enable Private DNS integration
Click Create.
For Feed Download:
Go to Azure Virtual Desktop > Workspaces > select az140-21-ws1.
Under Networking, select Private endpoint connections > + New private endpoint.
Configure:
Name: az140-11-pefeeddwnld
Target sub-resource: feed
Use the same network settings as above.
For Initial Feed Discovery:
Repeat the steps above with:
4. Validate Private Endpoint Functionality
Disable public access:
Restart session hosts:
Validate by connecting an RDP client with private network access.
Key Takeaways
✔️ Azure Private Link secures AVD connections.
✔️ Private endpoints are needed for feed discovery, feed download, and host pool connections.
✔️ Private DNS integration ensures proper name resolution.
✔️ Public access should be disabled for full security.