Restrict access to users on Host Pools in Azure

Question

I need to create a single hostpool which houses about 10 VMs. I need to allow certain groups of people specific access to a certain number and deny them access to others. for example;

VM1, VM2 and VM3 got to Intune group 1, with no access to other VMs 4 through to 7.

When I have tried adding permissions to the groups via VM IAMs, they still try to connect to the VMs they shouldn't have access to and present the error "The sign in method is not allowed" and then present that user as a -1 on the user sessions.

I hope that is clear and any help would be appreciated.

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

You'll need to use a combination of Azure RBAC and AVD application group assignments.

• Create separate application groups for each set of VMs you want to restrict access to
• Assign the appropriate users or groups to each application group. This will determine who can access which VMs
• For each VM, assign the "Virtual Machine User Login" role to the appropriate group
• Ensure that the users are also assigned the Desktop Virtualization User role for the host pool

If you continue to see the The sign in method is not allowed error, verify that:

• The VMs are properly joined to the domain
• The users have the correct licenses assigned
• The network security groupallows RDP traffic from the Azure Virtual Desktop service

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful