Log in to the Azure portal and select the correct directory and subscription where you want to create the AVD host pool and desktops. Make sure you have the correct permission (contributor or owner) to create the storage account. See Figure 5-1.

Search for storage account in the top search bar. See Figure 5-2.

Click the Create option to create a new storage account. See Figure 5-3.

Select the correct subscription and resource group names from the drop-down where you want to create the AVD desktops. If the resource group does not exist, then you can create a new resource group by clicking the Create new option. See Figure 5-4.

Scroll down and provide the storage account details such as the name, region, performance (SKU), account type, and redundancy. The following are the recommended values for each field:

Name: As per your organization’s standards, but Azure accepts only 24 lowercase characters and numbers.

Region: This is the same as the AVD host pool.

Performance (SKU): Premium (no GEO replication supported).

Premium account type: File share.

Redundancy: Zone redundant (ZRS).

Click the Next button once you have filled in all the details. See Figure 5-5.

You can verify the options available on the Advanced tab and make sure they align with your organization’s requirements. Click the Next button once you have filled in all the details. See Figure 5-6.

Select “Private endpoint” on the Networking tab and click the “Add private endpoint” option. See Figure 5-7.

Select the subscription, resource group, region, endpoint name, storage sub resource (must be a file), and VNet/subnet in the private endpoint pop-up.

Endpoint name: As per your organization’s naming standards.

Storage subresource: This must be a file.

VNet/subnet: This is the same VNet where you want to create a pooled host pool.

Click OK and the Next button once you have filled in all the details. See Figure 5-8.

Select “Enable soft delete for file shares” if you want to keep the deleted files for specific days. Click Next and add the tag details as per your organization’s standards. Click the “Review + create” button once you have entered all the required information. See Figure 5-9.

Click Create once the validation is completed. See Figure 5-10.

Click “Go to resource” to open the storage account’s Overview page. See Figure 5-11.

Verify all the information on the Overview page such as the name, storage account SKU, and region. See Figure 5-12.

Go to the storage account created in the earlier step and click “File share” in the left pane. Click “+ File share” to add an additional share. See Figure 5-13.

Enter the file share name and size, and click the Create button in the file share pop-up. See Figure 5-14.

Once the file share is ready, it will be visible under the “File share” option on the storage account. See Figure 5-15.

Click the file share name, and you will be able to see the permission error in Figure 5-16 as the file share is locked to AVD Azure VNet. Resources/VMs from that VNet instance can access only the file share. It is always recommended to enable the private endpoint for the storage account to the AVD VNet, so the file share will be accessible directly from AVD VM over a private endpoint, and the traffic will not go over the Internet.

Now you can go back to the “File share” option under the storage account to configure Active Directory for the file share. Click Active Directory on the right side, as shown in Figure 5-17.

Once you click Active Directory, it will give you two different Active Directory options, as shown in Figure 5-18.

Select the appropriate Active Directory that you are using and click the Setup button. If you are using Azure AD domain services, then it is easy to set up the Active Directory option for the storage account file share, as shown in Figure 5-19.

Once you enable Azure ADDS, then you will be able to see the screen in Figure 5-20. Note that you can use/configure only one AD (Azure ADDS or on-premises AD).

Additionally, if you have an Active Directory user and a computer console connected to your Azure AD domain, then you can check the Azure storage file share account/object under the AzureFilesConfig OU. See Figure 5-21.

If you are using an on-premises Active Directory Service (ADDS), then you need the AzFilesHybrid module (https://github.com/Ar-Sa/azure-files-samples/tree/master/AzFilesHybrid ) on the domain join so that you can run the Join-AzStorageAccountForAuth command to domain-join the file share. The following is the script you can run from any domain-joined VM (or download the PowerShell code from https://github.com/Ar-Sa/Arun/blob/master/Powershell/Azure%20storage%20account%20file%20share%20domain%20join/set-AzStorageDomainJoin.ps1):

The next step is to create the ADDS group for AVD users and assign permissions on the file share.

If you are using the Azure AD domain service, then you can create a security group in Azure AD itself, and it will sync with Azure ADDS. Go to Azure AD and click Groups. On the All Groups plane click “New group.” See Figure 5-22.

Enter the group name and select the correct members to whom you want to give access to the AVD desktop. See Figure 5-23.

The group will be also available in the Azure ADDS Active Directory User and Computer (ADUC) console. See Figure 5-24.

If you are using on-premises ADDS, then simply go to the ADDS ADUC console and create new group, and it will sync with Azure AD.

Go to the file share, select Access control (IAM), click Add, and select “Add role assignment.” See Figure 5-25.

Select the Storage File Data SMB Share Contributor role, and click Next. See Figure 5-26.

Select the AVD group we created in an earlier step, and click Select. See Figure 5-27.

Click “Review + assign.” See Figure 5-28 and Figure 5-29.