# Azure Private Link for Azure Virtual Desktop

**Securing Your Azure Virtual Desktop with Private Link: A Three-Tiered Approach**

Azure Virtual Desktop (AVD) offers enhanced security by integrating with Azure Private Link. This allows you to keep your AVD traffic within your private network, shielding it from the public internet. Private Link for AVD operates across three distinct workflows, each requiring specific private endpoint configurations:

1. **Initial Feed Discovery (Global):** This is like finding the AVD directory. It lets users see all the workspaces assigned to them. For this, you need *one* private endpoint connected to the *global* sub-resource. Think of it as a single, central access point. Crucially, you only need *one* of these per AVD deployment, regardless of how many workspaces you have.
    
2. **Feed Download (Per Workspace):** Once users know their workspaces, they need the connection details. This is the feed download. Here, you'll need a *separate* private endpoint for the *feed* sub-resource in *each* workspace you want accessible via Private Link. Each workspace gets its own private "download station."
    
3. **Connections to Host Pools (Per Host Pool):** Finally, the actual connection to the virtual desktops themselves. This involves the host pools. Similar to feed download, you need a *separate* private endpoint for the *connection* sub-resource in *each* host pool you want to secure with Private Link. Each host pool gets its own private "connection tunnel."
    

**Flexible Implementation Options:**

You have flexibility in how you use these private endpoints:

* **Fully Private:** All three workflows (feed discovery, feed download, and connections) use Private Link. Maximum security.
    
* **Hybrid Approach 1:** Feed download and connections are private, but initial feed discovery uses public routes. A balance of security and convenience.
    
* **Hybrid Approach 2:** Only connections are private. Feed discovery and download use public routes. Focuses security on the actual desktop sessions.
    
* **Public Only:** No Private Link used. All traffic goes over the public internet. Least secure, but simplest to set up.
    

By understanding these three workflows and the different implementation options, you can tailor your Private Link strategy to meet your specific security and accessibility needs for Azure Virtual Desktop. What specific scenario are you considering? Perhaps securing access for remote workers, or connecting your on-premises environment? Let's explore how Private Link fits into your plans!

## **Tasks**

### **1\. Re-register the Azure Virtual Desktop Resource Provider**

1. Sign in to the **Azure portal**.
    
2. Navigate to **Subscriptions** > select your subscription > **Resource providers**.
    
3. Search for `Microsoft.DesktopVirtualization` and click **Re-register**.
    

### **2\. Create an Azure Virtual Network Subnet**

1. Go to **Virtual networks** > select your vnet (e.g. `az140-vnet11e`).
    
2. Under **Settings**, select **Subnets** > **\+ Subnet**.
    
3. Configure:
    
    * **Name:** `pe-Subnet`
        
    * **Starting address:** `10.20.255.0`
        
4. Click **Add**.
    

### **3\. Implement Private Endpoints**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740072758225/38e15bc1-176e-4c81-a88f-befbb5a1af7c.png align="center")

#### **For Host Pool Connections:**

1. Go to **Azure Virtual Desktop** > **Host pools** > select your host pool (e.g.`az140-21-hp1`).
    
2. Under **Networking**, select **Private endpoint connections** > **\+ New private endpoint**.
    
3. Configure:
    
    * **Resource Group:** `az140-11e-RG`
        
    * **Name:** `az140-11-pehp1`
        
    * **Region:** East US
        
    * **<mark>Target sub-resource:</mark>** `connection`
        
    * **Virtual Network:** `az140-vnet11e`, **Subnet:** `pe-Subnet`
        
    * Enable **Private DNS integration**
        
4. Click **Create**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740073018603/2306d160-c6bf-4799-a933-78855b6118d8.png align="center")

#### **For Feed Download:**

1. Go to **Azure Virtual Desktop** &gt; **Workspaces** &gt; select `az140-21-ws1`.
    
2. Under **Networking**, select **Private endpoint connections** &gt; **\+ New private endpoint**.
    
3. Configure:
    
    * **Name:** `az140-11-pefeeddwnld`
        
    * **Target sub-resource:** `feed`
        
    * Use the same network settings as above.
        

#### **For Initial Feed Discovery:**

1. Repeat the steps above with:
    
    * **Name:** `az140-11-pefeeddisc`
        
    * **Target sub-resource:** `global`
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740011680687/c15fd9a3-749c-4010-a0f6-220b95eeb273.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740011712590/28902854-84ff-4717-9987-6b948d75e603.png align="center")

### **4\. Validate Private Endpoint Functionality**

1. **Disable public access:**
    
    * **Azure Virtual Desktop** &gt; **Workspaces** &gt; `az140-21-ws1` &gt; **Networking** &gt; **Disable public access**.
        
    * **Azure Virtual Desktop** &gt; **Host pools** &gt; `az140-21-hp1` &gt; **Networking** &gt; **Disable public access**.
        
2. **Restart session hosts:**
    
    * Navigate to **Host pools** &gt; **Session hosts**.
        
    * Select all hosts &gt; Click **Restart**.
        
3. **Validate by connecting an RDP client** with private network access.
    

---

## **Key Takeaways**

✔️ **Azure Private Link** secures AVD connections.

✔️ **Private endpoints** are needed for feed discovery, feed download, and host pool connections.

✔️ **Private DNS integration** ensures proper name resolution.

✔️ **Public access should be disabled** for full security.