Set up Private Link with Azure Virtual Desktop

This article shows you how to set up Private Link with Azure Virtual Desktop to privately connect to your remote resources. For more information about using Private Link with Azure Virtual Desktop, including limitations, see Azure Private Link with Azure Virtual Desktop.

Prerequisites

In order to use Private Link with Azure Virtual Desktop, you need the following things:

• An existing host pool with session hosts, an application group, and workspace.

• An existing virtual network and subnet you want to use for private endpoints.

• The required Azure role-based access control permissions to create private endpoints.

• A supported app on a local device to access a remote session:

  • Remote Desktop app on any platform. If you're using the Remote Desktop client for Windows, you must use version 1.2.4066 or later to connect using a private endpoint.
  • Windows App on macOS or iOS/iPadOS.

• If you want to use Azure CLI or Azure PowerShell locally, see Use Azure CLI and Azure PowerShell with Azure Virtual Desktop to make sure you have the desktopvirtualization Azure CLI extension or the Az.DesktopVirtualization PowerShell module installed. Alternatively, use the Azure Cloud Shell.

• Azure PowerShell cmdlets for Azure Virtual Desktop that support Private Link are in preview. You'll need to download and install the preview version of the Az.DesktopVirtualization module to use these cmdlets, which have been added in version 5.0.0.

Enable Private Link with Azure Virtual Desktop on a subscription

To use Private Link with Azure Virtual Desktop, you need to re-register the Microsoft.DesktopVirtualization resource provider on each subscription you want to use Private Link with Azure Virtual Desktop.

Select the relevant tab for your scenario.

Azure

Re-register the Azure Virtual Desktop resource provider

Before you can use Private Link with Azure Virtual Desktop, you need to re-register the Microsoft.DesktopVirtualization resource provider. You need to do this for each subscription you want to use for Private Link with Azure Virtual Desktop:

1. Sign in to the Azure portal.

2. In the search bar, enter Subscriptions and select the matching service entry.

3. Select the name of your subscription, then in the section Settings, select Resource providers.

4. Search for and select Microsoft.DesktopVirtualization, then select Re-register.

5. Verify that the status of Microsoft.DesktopVirtualization is Registered.

Azure US Gov and 21Vianet

Register Private Link with Azure Virtual Desktop (Azure for US Government and Azure operated by 21Vianet only)

For Azure for US Government and Azure operated by 21Vianet, first you need to register your Azure subscription for Private Link with Azure Virtual Desktop:

1. Sign in to the Azure portal.

2. In the search bar, enter Subscriptions and select the matching service entry.

3. Select the name of your subscription, then in the Settings section, select Preview features.

4. Select the drop-down list for the filter Type and set it to Microsoft.DesktopVirtualization.

5. Select Azure Virtual Desktop Private Link, then select Register.

Re-register the Azure Virtual Desktop resource provider

Once you've registered your subscription, you need to re-register the Microsoft.DesktopVirtualization resource provider. You need to do this for each subscription you want to use for Private Link with Azure Virtual Desktop:

1. Sign in to the Azure portal.

2. In the search bar, enter Subscriptions and select the matching service entry.

3. Select the name of your subscription, then in the section Settings, select Resource providers.

4. Search for and select Microsoft.DesktopVirtualization, then select Re-register.

5. Verify that the status of Microsoft.DesktopVirtualization is Registered.

Create private endpoints

During the setup process, you need to create private endpoints to the following resources, depending on your scenario.

1. All parts of the connection - initial feed discovery, feed download, and remote session connections for clients and session hosts - use private routes. You need the following private endpoints:

   Purpose	Resource type	Target sub-resource	Endpoint quantity
   Connections to host pools	Microsoft.DesktopVirtualization/hostpools	connection	One per host pool
   Feed download	Microsoft.DesktopVirtualization/workspaces	feed	One per workspace
   Initial feed discovery	Microsoft.DesktopVirtualization/workspaces	global	Only one for all your Azure Virtual Desktop deployments

2. Feed download and remote session connections for clients and session hosts use private routes, but initial feed discovery uses public routes. You need the following private endpoints. The endpoint for initial feed discovery isn't required.

   Purpose	Resource type	Target sub-resource	Endpoint quantity
   Connections to host pools	Microsoft.DesktopVirtualization/hostpools	connection	One per host pool
   Feed download	Microsoft.DesktopVirtualization/workspaces	feed	One per workspace

3. Only remote session connections for clients and session hosts use private routes, but initial feed discovery and feed download use public routes. You need the following private endpoint(s). Endpoints to workspaces aren't required.

   Purpose	Resource type	Target sub-resource	Endpoint quantity
   Connections to host pools	Microsoft.DesktopVirtualization/hostpools	connection	One per host pool

4. Both clients and session host VMs use public routes. Private Link isn't used in this scenario.

Important

• If you create a private endpoint for initial feed discovery, the workspace used for the global sub-resource governs the shared Fully Qualified Domain Name (FQDN), facilitating the initial discovery of feeds across all workspaces. You should create a separate workspace that is only used for this purpose and doesn't have any application groups registered to it. Deleting this workspace will cause all feed discovery processes to stop working.

• You can't control access to the workspace used for the initial feed discovery (global sub-resource). If you configure this workspace to only allow private access, the setting is ignored. This workspace is always accessible from public routes.

• IP address allocations are subject to change as the demand for IP addresses increases. During capacity expansions, additional addresses are needed for private endpoints. It's important you consider potential address space exhaustion and ensure sufficient headroom for growth. For more information on determining the appropriate network configuration for private endpoints in either a hub or a spoke topology, see Decision tree for Private Link deployment.

Connections to host pools

To create a private endpoint for the connection sub-resource for connections to a host pool, select the relevant tab for your scenario and follow the steps.

Portal

Here's how to create a private endpoint for the connection sub-resource for connections to a host pool using the Azure portal.

1. Sign in to the Azure portal.

2. In the search bar, type Azure Virtual Desktop and select the matching service entry to go to the Azure Virtual Desktop overview.

3. Select Host pools, then select the name of the host pool for which you want to create a connection sub-resource.

4. From the host pool overview, select Networking, then Private endpoint connections, and finally New private endpoint.

5. On the Basics tab, complete the following information:

   Parameter	Value/Description
   Subscription	Select the subscription you want to create the private endpoint in from the drop-down list.
   Resource group	This automatically defaults to the same resource group as your workspace for the private endpoint, but you can also select an alternative existing one from the drop-down list, or create a new one.
   Name	Enter a name for the new private endpoint.
   Network interface name	The network interface name fills in automatically based on the name you gave the private endpoint, but you can also specify a different name.
   Region	This automatically defaults to the same Azure region as the workspace and is where the private endpoint is deployed. This must be the same region as your virtual network and session hosts.

   Once you've completed this tab, select Next: Resource.

6. On the Resource tab, validate the values for Subscription, Resource type, and Resource, then for Target sub-resource, select connection. Once you've completed this tab, select Next: Virtual Network.

7. On the Virtual Network tab, complete the following information:

   Parameter	Value/Description
   Virtual network	Select the virtual network you want to create the private endpoint in from the drop-down list.
   Subnet	Select the subnet of the virtual network you want to create the private endpoint in from the drop-down list.
   Network policy for private endpoints	Select edit if you want to choose a subnet network policy. For more information, see Manage network policies for private endpoints.
   Private IP configuration	Select Dynamically allocate IP address or Statically allocate IP address. The address space is from the subnet you selected. If you choose to statically allocate IP addresses, you need to fill in the Name and Private IP for each listed member.
   Application security group	Optional: select an existing application security group for the private endpoint from the drop-down list, or create a new one. You can also add one later.

   Once you've completed this tab, select Next: DNS.

8. On the DNS tab, choose whether you want to use Azure Private DNS Zone by selecting Yes or No for Integrate with private DNS zone. If you select Yes, select the subscription and resource group in which to create the private DNS zone privatelink.wvd.microsoft.com. For more information, see Azure Private Endpoint DNS configuration.

   Once you've completed this tab, select Next: Tags.

9. Optional: On the Tags tab, you can enter any name/value pairs you need, then select Next: Review + create.

10. On the Review + create tab, ensure validation passes and review the information that is used during deployment.

11. Select Create to create the private endpoint for the connection sub-resource.

Azure PowerShell

Here's how to create a private endpoint for the connection sub-resource used for connections to a host pool using the Az.Network and Az.DesktopVirtualization PowerShell modules. Be sure to change the <placeholder> values for your own.

1. Open Azure Cloud Shell in the Azure portal with the PowerShell terminal type, or run PowerShell on your local device.

   • If you're using Cloud Shell, make sure your Azure context is set to the subscription that you want to use.

   • If you're using PowerShell locally, first sign in with Azure PowerShell, and then make sure your Azure context is set to the subscription that you want to use.

2. Get the details of the virtual network and subnet you want to use for the private endpoint and store them in a variable by running the following commands:

   # Get the subnet details for the virtual network
   $subnet = (Get-AzVirtualNetwork -Name <VNetName> -ResourceGroupName <ResourceGroupName>).Subnets | ? Name -eq <SubnetName>
   

3. Create a Private Link service connection for a host pool with the connection sub-resource by running the following commands.

   # Get the resource ID of the host pool
   $hostPoolId = (Get-AzWvdHostPool -Name <HostPoolName> -ResourceGroupName <ResourceGroupName>).Id
   
   # Create the service connection
   $parameters = @{
       Name = '<ServiceConnectionName>'
       PrivateLinkServiceId = $hostPoolId
       GroupId = 'connection'
   }
   
   $serviceConnection = New-AzPrivateLinkServiceConnection @parameters
   

4. Finally, create the private endpoint by running the commands in one of the following examples.

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network and session hosts.
      $location = '<Location>'
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
      }
      
      New-AzPrivateEndpoint @parameters
      

   2. To create a private endpoint with statically allocated IP addresses:

      # Specify the Azure region. This must be the same region as your virtual network and session hosts.
      $location = '<Location>'
      
      # Create a hash table for each private endpoint IP configuration
      $ip1 = @{
          Name = 'ipconfig1'
          GroupId = 'connection'
          MemberName = 'broker'
          PrivateIPAddress = '<IPAddress>'
      }
      
      $ip2 = @{
          Name = 'ipconfig2'
          GroupId = 'connection'
          MemberName = 'diagnostics'
          PrivateIPAddress = '<IPAddress>'
      }
      
      $ip3 = @{
          Name = 'ipconfig3'
          GroupId = 'connection'
          MemberName = 'gateway-ring-map'
          PrivateIPAddress = '<IPAddress>'
      }
      
      $ip4 = @{
          Name = 'ipconfig4'
          GroupId = 'connection'
          MemberName = 'web'
          PrivateIPAddress = '<IPAddress>'
      }
      
      # Create the private endpoint IP configurations
      $ipConfig1 = New-AzPrivateEndpointIpConfiguration @ip1
      $ipConfig2 = New-AzPrivateEndpointIpConfiguration @ip2
      $ipConfig3 = New-AzPrivateEndpointIpConfiguration @ip3
      $ipConfig4 = New-AzPrivateEndpointIpConfiguration @ip4
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
          IpConfiguration = $ipConfig1, $ipConfig2, $ipConfig3, $ipConfig4
      }
      
      New-AzPrivateEndpoint @parameters
      

   Your output should be similar to the following output. Check that the value for ProvisioningState is Succeeded.

   ResourceGroupName Name            Location ProvisioningState Subnet
   ----------------- ----            -------- ----------------- ------
   privatelink       endpoint-hp01   uksouth  Succeeded
   

5. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure PowerShell, see Configure the private DNS zone.

Azure CLI

Here's how to create a private endpoint for the connection sub-resource used for connections to a host pool using the network and desktopvirtualization extensions for Azure CLI.

Important

In the following examples, you'll need to change the <placeholder> values for your own.

1. Open Azure Cloud Shell in the Azure portal with the Bash terminal type, or run the Azure CLI on your local device.

   • If you're using Cloud Shell, make sure your Azure context is set to the subscription that you want to use.

   • If you're using the Azure CLI locally, first sign in with the Azure CLI, and then make sure your Azure context is set to the subscription that you want to use.

2. Create a Private Link service connection and the private endpoint for a host pool with the connection sub-resource by running the commands in one of the following examples.

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network and session hosts.
      location=<Location>
      
      # Get the resource ID of the host pool
      hostPoolId=$(az desktopvirtualization hostpool show \
          --name <HostPoolName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $hostPoolId \
          --group-id connection \
          --output table
      

   2. To create a private endpoint with statically allocated IP addresses:

      # Specify the Azure region. This must be the same region as your virtual network and session hosts.
      location=<Location>
      
      # Get the resource ID of the host pool
      hostPoolId=$(az desktopvirtualization hostpool show \
          --name <HostPoolName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Store each private endpoint IP configuration in a variable
      ip1={name:ipconfig1,group-id:connection,member-name:broker,private-ip-address:<IPAddress>}
      ip2={name:ipconfig2,group-id:connection,member-name:diagnostics,private-ip-address:<IPAddress>}
      ip3={name:ipconfig3,group-id:connection,member-name:gateway-ring-map,private-ip-address:<IPAddress>}
      ip4={name:ipconfig4,group-id:connection,member-name:web,private-ip-address:<IPAddress>}
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $hostPoolId \
          --group-id connection \
          --ip-configs [$ip1,$ip2,$ip3,$ip4] \
          --output table
      

   Your output should be similar to the following output. Check that the value for ProvisioningState is Succeeded.

   CustomNetworkInterfaceName    Location    Name                  ProvisioningState    ResourceGroup
   ----------------------------  ----------  --------------------  -------------------  ---------------
                                 uksouth     endpoint-hp01         Succeeded            privatelink
   

3. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure CLI, see Configure the private DNS zone.

Important

You need to create a private endpoint for the connection sub-resource for each host pool you want to use with Private Link.

---

Feed download

To create a private endpoint for the feed sub-resource for a workspace, select the relevant tab for your scenario and follow the steps.

Portal

1. From the Azure Virtual Desktop overview, select Workspaces, then select the name of the workspace for which you want to create a feed sub-resource.

2. From the workspace overview, select Networking, then Private endpoint connections, and finally New private endpoint.

3. On the Basics tab, complete the following information:

   Parameter	Value/Description
   Subscription	Select the subscription you want to create the private endpoint in from the drop-down list.
   Resource group	This automatically defaults to the same resource group as your workspace for the private endpoint, but you can also select an alternative existing one from the drop-down list, or create a new one.
   Name	Enter a name for the new private endpoint.
   Network interface name	The network interface name fills in automatically based on the name you gave the private endpoint, but you can also specify a different name.
   Region	This automatically defaults to the same Azure region as the workspace and is where the private endpoint is deployed. This must be the same region as your virtual network.

   Once you've completed this tab, select Next: Resource.

4. On the Resource tab, validate the values for Subscription, Resource type, and Resource, then for Target sub-resource, select feed. Once you've completed this tab, select Next: Virtual Network.

5. On the Virtual Network tab, complete the following information:

   Parameter	Value/Description
   Virtual network	Select the virtual network you want to create the private endpoint in from the drop-down list.
   Subnet	Select the subnet of the virtual network you want to create the private endpoint in from the drop-down list.
   Network policy for private endpoints	Select edit if you want to choose a subnet network policy. For more information, see Manage network policies for private endpoints.
   Private IP configuration	Select Dynamically allocate IP address or Statically allocate IP address. The address space is from the subnet you selected. If you choose to statically allocate IP addresses, you need to fill in the Name and Private IP for each listed member.
   Application security group	Optional: select an existing application security group for the private endpoint from the drop-down list, or create a new one. You can also add one later.

   Once you've completed this tab, select Next: DNS.

6. On the DNS tab, choose whether you want to use Azure Private DNS Zone by selecting Yes or No for Integrate with private DNS zone. If you select Yes, select the subscription and resource group in which to create the private DNS zone privatelink.wvd.microsoft.com. For more information, see Azure Private Endpoint DNS configuration.

   Once you've completed this tab, select Next: Tags.

7. Optional: On the Tags tab, you can enter any name/value pairs you need, then select Next: Review + create.

8. On the Review + create tab, ensure validation passes and review the information that is used during deployment.

9. Select Create to create the private endpoint for the feed sub-resource.

Azure PowerShell

1. In the same PowerShell session, create a Private Link service connection for a workspace with the feed sub-resource by running the following commands. In these examples, the same virtual network and subnet are used.

   # Get the resource ID of the workspace
   $workspaceId = (Get-AzWvdWorkspace -Name <WorkspaceName> -ResourceGroupName <ResourceGroupName>).Id
   
   # Create the service connection
   $parameters = @{
       Name = '<ServiceConnectionName>'
       PrivateLinkServiceId = $workspaceId
       GroupId = 'feed'
   }
   
   $serviceConnection = New-AzPrivateLinkServiceConnection @parameters
   

2. Finally, create the private endpoint by running the commands in one of the following examples.

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      $location = '<Location>'
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
      }
      
      New-AzPrivateEndpoint @parameters
      

   2. To create a private endpoint with a statically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      $location = '<Location>'
      
      # Create a hash table for each private endpoint IP configuration
      $ip1 = @{
          Name = 'ipconfig1'
          GroupId = 'feed'
          MemberName = 'web-r1'
          PrivateIPAddress = '<IPAddress>'
      }
      
      $ip2 = @{
          Name = 'ipconfig2'
          GroupId = 'feed'
          MemberName = 'web-r0'
          PrivateIPAddress = '<IPAddress>'
      }
      
      # Create the private endpoint IP configurations
      $ipConfig1 = New-AzPrivateEndpointIpConfiguration @ip1
      $ipConfig2 = New-AzPrivateEndpointIpConfiguration @ip2
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
          IpConfiguration = $ipConfig1, $ipConfig2
      }
      
      New-AzPrivateEndpoint @parameters
      

   Your output should be similar to the following. Check that the value for ProvisioningState is Succeeded.

   ResourceGroupName Name            Location ProvisioningState Subnet
   ----------------- ----            -------- ----------------- ------
   privatelink       endpoint-ws01   uksouth  Succeeded
   

3. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure PowerShell, see Configure the private DNS zone.

Azure CLI

1. In the same CLI session, create a Private Link service connection and the private endpoint for a workspace with the feed sub-resource by running the following commands.

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      location=<Location>
      
      # Get the resource ID of the workspace
      workspaceId=$(az desktopvirtualization workspace show \
          --name <WorkspaceName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $workspaceId \
          --group-id feed \
          --output table
      

   2. To create a private endpoint with statically allocated IP addresses:

      # Specify the Azure region. This must be the same region as your virtual network.
      location=<Location>
      
      # Get the resource ID of the workspace
      workspaceId=$(az desktopvirtualization workspace show \
          --name <WorkspaceName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Store each private endpoint IP configuration in a variable
      ip1={name:ipconfig1,group-id:feed,member-name:web-r1,private-ip-address:<IPAddress>}
      ip2={name:ipconfig2,group-id:feed,member-name:web-r0,private-ip-address:<IPAddress>}
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $workspaceId \
          --group-id feed \
          --ip-configs [$ip1,$ip2] \
          --output table
      

   Your output should be similar to the following. Check that the value for ProvisioningState is Succeeded.

   CustomNetworkInterfaceName    Location    Name                  ProvisioningState    ResourceGroup
   ----------------------------  ----------  --------------------  -------------------  ---------------
                                 uksouth     endpoint-ws01         Succeeded            privatelink
   

2. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure CLI, see Configure the private DNS zone.

Important

You need to a create private endpoint for the feed sub-resource for each workspace you want to use with Private Link.

Initial feed discovery

To create a private endpoint for the global sub-resource used for the initial feed discovery, select the relevant tab for your scenario and follow the steps.

Important

• Only create one private endpoint for the global sub-resource for all your Azure Virtual Desktop deployments.

• A private endpoint to the global sub-resource of any workspace controls the shared fully qualified domain name (FQDN) for initial feed discovery. This in turn enables feed discovery for all workspaces. Because the workspace connected to the private endpoint is so important, deleting it will cause all feed discovery processes to stop working. We recommend you create an unused placeholder workspace for the global sub-resource.

Portal

1. From the Azure Virtual Desktop overview, select Workspaces, then select the name of a workspace you want to use for the global sub-resource.

   1. Optional: Instead, create a placeholder workspace to terminate the global endpoint by following the instructions to Create a workspace.

2. From the workspace overview, select Networking, then Private endpoint connections, and finally New private endpoint.

3. On the Basics tab, complete the following information:

   Parameter	Value/Description
   Subscription	Select the subscription you want to create the private endpoint in from the drop-down list.
   Resource group	This automatically defaults to the same resource group as your workspace for the private endpoint, but you can also select an alternative existing one from the drop-down list, or create a new one.
   Name	Enter a name for the new private endpoint.
   Network interface name	The network interface name fills in automatically based on the name you gave the private endpoint, but you can also specify a different name.
   Region	This automatically defaults to the same Azure region as the workspace and is where the private endpoint will be deployed. This must be the same region as your virtual network.

   Once you've completed this tab, select Next: Resource.

4. On the Resource tab, validate the values for Subscription, Resource type, and Resource, then for Target sub-resource, select global. Once you've completed this tab, select Next: Virtual Network.

5. On the Virtual Network tab, complete the following information:

   Parameter	Value/Description
   Virtual network	Select the virtual network you want to create the private endpoint in from the drop-down list.
   Subnet	Select the subnet of the virtual network you want to create the private endpoint in from the drop-down list.
   Network policy for private endpoints	Select edit if you want to choose a subnet network policy. For more information, see Manage network policies for private endpoints.
   Private IP configuration	Select Dynamically allocate IP address or Statically allocate IP address. The address space is from the subnet you selected. If you choose to statically allocate IP addresses, you need to fill in the Name and Private IP for each listed member.
   Application security group	Optional: select an existing application security group for the private endpoint from the drop-down list, or create a new one. You can also add one later.

   Once you've completed this tab, select Next: DNS.

6. On the DNS tab, choose whether you want to use Azure Private DNS Zone by selecting Yes or No for Integrate with private DNS zone. If you select Yes, select the subscription and resource group in which to create the private DNS zone privatelink-global.wvd.microsoft.com. For more information, see Azure Private Endpoint DNS configuration.

   Once you've completed this tab, select Next: Tags.

7. Optional: On the Tags tab, you can enter any name/value pairs you need, then select Next: Review + create.

8. On the Review + create tab, ensure validation passes and review the information that is used during deployment.

9. Select Create to create the private endpoint for the global sub-resource.

Azure PowerShell

1. Optional: Create a placeholder workspace to terminate the global endpoint by following the instructions to Create a workspace.

2. In the same PowerShell session, create a Private Link service connection for the workspace with the global sub-resource by running the following commands. In these examples, the same virtual network and subnet are used.

   # Get the resource ID of the workspace
   $workspaceId = (Get-AzWvdWorkspace -Name <WorkspaceName> -ResourceGroupName <ResourceGroupName>).Id
   
   # Create the service connection
   $parameters = @{
       Name = '<ServiceConnectionName>'
       PrivateLinkServiceId = $workspaceId
       GroupId = 'global'
   }
   
   $serviceConnection = New-AzPrivateLinkServiceConnection @parameters
   

3. Finally, create the private endpoint by running the commands in one of the following examples.

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      $location = '<Location>'
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
      }
      
      New-AzPrivateEndpoint @parameters
      

   2. To create a private endpoint with a statically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      $location = '<Location>'
      
      $ip = @{
          Name = '<IPConfigName>'
          GroupId = 'global'
          MemberName = 'web'
          PrivateIPAddress = '<IPAddress>'
      }
      
      $ipConfig = New-AzPrivateEndpointIpConfiguration @ip
      
      # Create the private endpoint
      $parameters = @{
          Name = '<PrivateEndpointName>'
          ResourceGroupName = '<ResourceGroupName>'
          Location = $location
          Subnet = $subnet
          PrivateLinkServiceConnection = $serviceConnection
          IpConfiguration = $ipconfig
      }
      
      New-AzPrivateEndpoint @parameters
      

   Your output should be similar to the following. Check that the value for ProvisioningState is Succeeded.

   ResourceGroupName Name            Location ProvisioningState Subnet
   ----------------- ----            -------- ----------------- ------
   privatelink       endpoint-global uksouth  Succeeded
   

4. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink-global.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure PowerShell, see Configure the private DNS zone.

Azure CLI

1. Optional: Create a placeholder workspace to terminate the global endpoint by following the instructions to Create a workspace.

2. In the same CLI session, create a Private Link service connection and the private endpoint for the workspace with the global sub-resource by running the following commands:

   1. To create a private endpoint with a dynamically allocated IP address:

      # Specify the Azure region. This must be the same region as your virtual network.
      location=<Location>
      
      # Get the resource ID of the workspace
      workspaceId=$(az desktopvirtualization workspace show \
          --name <WorkspaceName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $workspaceId \
          --group-id global \
          --output table
      

   2. To create a private endpoint with statically allocated IP addresses:

      # Specify the Azure region. This must be the same region as your virtual network.
      location=<Location>
      
      # Get the resource ID of the workspace
      workspaceId=$(az desktopvirtualization workspace show \
          --name <WorkspaceName> \
          --resource-group <ResourceGroupName> \
          --query [id] \
          --output tsv)
      
      # Store each private endpoint IP configuration in a variable
      ip={name:ipconfig,group-id:global,member-name:web,private-ip-address:<IPAddress>}
      
      # Create a service connection and the private endpoint
      az network private-endpoint create \
          --name <PrivateEndpointName> \
          --resource-group <ResourceGroupName> \
          --location $location \
          --vnet-name <VNetName> \
          --subnet <SubnetName> \
          --connection-name <ConnectionName> \
          --private-connection-resource-id $workspaceId \
          --group-id global \
          --ip-config $ip \
          --output table
      

   Your output should be similar to the following. Check that the value for ProvisioningState is Succeeded.

   CustomNetworkInterfaceName    Location    Name                  ProvisioningState    ResourceGroup
   ----------------------------  ----------  --------------------  -------------------  ---------------
                                 uksouth     endpoint-global       Succeeded            privatelink
   

3. You need to configure DNS for your private endpoint to resolve the DNS name of the private endpoint in the virtual network. The private DNS zone name is privatelink-global.wvd.microsoft.com. For the steps to create and configure the private DNS zone with Azure CLI, see Configure the private DNS zone.

Closing public routes

Once you've created private endpoints, you can also control if traffic is allowed to come from public routes. You can control this at a granular level using Azure Virtual Desktop, or more broadly using a network security group (NSG) or Azure Firewall.

Control routes with Azure Virtual Desktop

With Azure Virtual Desktop, you can independently control public traffic for workspaces and host pools. Select the relevant tab for your scenario and follow the steps. You can't configure this in Azure CLI. You need to repeat these steps for each workspace and host pool you use with Private Link.

Portal

Workspaces

1. From the Azure Virtual Desktop overview, select Workspaces, then select the name of the workspace to control public traffic.

2. From the host pool overview, select Networking, then select the Public access tab.

3. Select one of the following options:

   Setting	Description
   Enable public access from all networks	End users can access the feed over the public internet or the private endpoints.
   Disable public access and use private access	End users can only access the feed over the private endpoints.

4. Select Save.

Host pools

1. From the Azure Virtual Desktop overview, select Host pools, then select the name of the host pool to control public traffic.

2. From the host pool overview, select Networking, then select the Public access tab.

3. Select one of the following options:

   Setting	Description
   Enable public access from all networks	End users can access the feed and session hosts securely over the public internet or the private endpoints.
   Enable public access for end users, use private access for session hosts	End users can access the feed securely over the public internet but must use private endpoints to access session hosts.
   Disable public access and use private access	End users can only access the feed and session hosts over the private endpoints.

4. Select Save.

Azure PowerShell

Important

Azure PowerShell cmdlets for Azure Virtual Desktop that support Private Link are in preview. You'll need to download and install the preview version of the Az.DesktopVirtualization module to use these cmdlets, which have been added in version 5.0.0.

Workspaces

1. In the same PowerShell session, you can disable public access and use private access by running the following command:

   $parameters = @{
       Name = '<WorkspaceName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'Disabled'
   }
   
   Update-AzWvdWorkspace @parameters
   

2. To enable public access from all networks, run the following command:

   $parameters = @{
       Name = '<WorkspaceName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'Enabled'
   }
   
   Update-AzWvdWorkspace @parameters
   

Host pools

1. In the same PowerShell session, you can disable public access and use private access by running the following command:

   $parameters = @{
       Name = '<HostPoolName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'Disabled'
   }
   
   Update-AzWvdHostPool @parameters 
   

2. To enable public access from all networks, run the following command:

   $parameters = @{
       Name = '<HostPoolName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'Enabled'
   }
   
   Update-AzWvdHostPool @parameters
   

3. To use public access for end users, but use private access for session hosts, run the following command:

   $parameters = @{
       Name = '<HostPoolName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'EnabledForSessionHostsOnly'
   }
   
   Update-AzWvdHostPool @parameters
   

4. To use private access for end users, but use public access for session hosts, run the following command:

   $parameters = @{
       Name = '<HostPoolName>'
       ResourceGroupName = '<ResourceGroupName>'
       PublicNetworkAccess = 'EnabledForClientsOnly'
   }
   
   Update-AzWvdHostPool @parameters
   

Important

Changing access for session hosts won't affect existing sessions. After you've changed a private endpoint to a host pool, you must restart the Remote Desktop Agent Loader (RDAgentBootLoader) service on each session host in the host pool. You also need to restart this service whenever you change a host pool's network configuration. Instead of restarting the service, you can restart each session host.

Block public routes with network security groups or Azure Firewall

If you're using network security groups or Azure Firewall to control connections from user client devices or your session hosts to the private endpoints, you can use the WindowsVirtualDesktop service tag to block traffic from the public internet. If you block public internet traffic using this service tag, all service traffic uses private routes only.

Caution

• Make sure you don't block traffic between your private endpoints and the addresses in the required URL list.

• Don't block certain ports from either the user client devices or your session hosts to the private endpoint for a host pool resource using the connection sub-resource. The entire TCP dynamic port range of 1 - 65535 to the private endpoint is needed because port mapping is used to all global gateways through the single private endpoint IP address corresponding to the connection sub-resource. If you restrict ports to the private endpoint, your users may not be able to connect successfully to Azure Virtual Desktop.

Validate Private Link with Azure Virtual Desktop

Once you've closed public routes, you should validate that Private Link with Azure Virtual Desktop is working. You can do this by checking the connection state of each private endpoint, the status of your session hosts, and testing your users can refresh and connect to their remote resources.

Check the connection state of each private endpoint

To check the connection state of each private endpoint, select the relevant tab for your scenario and follow the steps. You should repeat these steps for each workspace and host pool you use with Private Link.

Portal

Workspaces

1. From the Azure Virtual Desktop overview, select Workspaces, then select the name of the workspace for which you want to check the connection state.

2. From the workspace overview, select Networking, then Private endpoint connections.

3. For the private endpoint listed, check the Connection state is Approved.

Host pools

1. From the Azure Virtual Desktop overview, select Host pools, then select the name of the host pool for which you want to check the connection state.

2. From the host pool overview, select Networking, then Private endpoint connections.

3. For the private endpoint listed, check the Connection state is Approved.

Azure PowerShell

Important

You need to use the preview version of the Az.DesktopVirtualization module to run the following commands. For more information and to download and install the preview module, see PowerShell Gallery.

Workspaces

1. In the same PowerShell session, run the following commands to check the connection state of a workspace:

   (Get-AzWvdWorkspace -Name <WorkspaceName> -ResourceGroupName <ResourceGroupName).PrivateEndpointConnection | FL Name, PrivateLinkServiceConnectionStateStatus, PrivateLinkServiceConnectionStateDescription, PrivateLinkServiceConnectionStateActionsRequired
   

   Your output should be similar to the following. Check that the value for PrivateLinkServiceConnectionStateStatus is Approved.

   Name                                             : endpoint-ws01
   PrivateLinkServiceConnectionStateStatus          : Approved
   PrivateLinkServiceConnectionStateDescription     : Auto-approved
   PrivateLinkServiceConnectionStateActionsRequired : None
   

Host pools

1. In the same PowerShell session, run the following commands to check the connection state of a host pool:

   (Get-AzWvdHostPool -Name <HostPoolName> -ResourceGroupName <ResourceGroupName).PrivateEndpointConnection | FL Name, PrivateLinkServiceConnectionStateStatus, PrivateLinkServiceConnectionStateDescription, PrivateLinkServiceConnectionStateActionsRequired
   

   Your output should be similar to the following. Check that the value for PrivateLinkServiceConnectionStateStatus is Approved.

   Name                                             : endpoint-hp01
   PrivateLinkServiceConnectionStateStatus          : Approved
   PrivateLinkServiceConnectionStateDescription     : Auto-approved
   PrivateLinkServiceConnectionStateActionsRequired : None
   
   

Azure CLI

1. In the same CLI session, run the following commands to check the connection state of a workspace or a host pool:

   az network private-endpoint show \
       --name <PrivateEndpointName> \
       --resource-group <ResourceGroupName> \
       --query "{name:name, privateLinkServiceConnectionStates:privateLinkServiceConnections[].privateLinkServiceConnectionState}"
   

   Your output should be similar to the following. Check that the value for status is Approved.

   {
     "name": "endpoint-ws01",
     "privateLinkServiceConnectionStates": [
       {
         "actionsRequired": "None",
         "description": "Auto-approved",
         "status": "Approved"
       }
     ]
   }
   

Check the status of your session hosts

1. Check the status of your session hosts in Azure Virtual Desktop.

   1. From the Azure Virtual Desktop overview, select Host pools, then select the name of the host pool.

   2. In the Manage section, select Session hosts.

   3. Review the list of session hosts and check their status is Available.

Check your users can connect

To test that your users can connect to their remote resources:

1. Use the Remote Desktop client and make sure you can subscribe to and refresh workspaces.

2. Finally, make sure your users can connect to a remote session.

Next steps

• Learn more about how Private Link for Azure Virtual Desktop at Use Private Link with Azure Virtual Desktop.

• Learn how to configure Azure Private Endpoint DNS at Private Link DNS integration.

• For general troubleshooting guides for Private Link, see Troubleshoot Azure Private Endpoint connectivity problems.

• Understand how connectivity for the Azure Virtual Desktop service works at Azure Virtual Desktop network connectivity.

• See the Required URL list for the list of URLs you need to unblock to ensure network access to the Azure Virtual Desktop service.