PoC Guide: Citrix DaaS with Azure Virtual Desktop Hybrid
Overview
Microsoft Azure Virtual Desktops allow enterprises to deliver virtual applications and desktops from Azure. This proof of concept (PoC) guide is designed to help you quickly configure Citrix DaaS with Azure Virtual Desktop for a trial evaluation only, in a hybrid environment. At the end of this PoC guide you will be able to bridge your on-premises Citrix DaaS deployment with a Microsoft Azure subscription using Citrix DaaS. You will be able to let your users launch a Azure Virtual Desktop virtual app or desktop utilizing the new Windows 11 Multi-Session experience, while also accessing on-premises resources.
Conceptual Architecture
Scope
In this PoC guide, you experience the role of a Citrix Cloud and Microsoft Azure administrator and create a hybrid environment that spans your organization’s on-premises deployment and Azure. You provide access to a virtualization environment consisting of the Windows 11 Multi-Session experience in Azure Virtual Desktop (AVD) and on-premises resources to an end user with Citrix DaaS.
This guide showcases how to perform the following actions:
- Create a new Azure subscription and an Azure Active Directory (AAD) Tenant (if you don’t have one)
- Connect your on-premises AD to your AAD using Azure AD Connect
- Create Master Image using Windows 11 Enterprise for Virtual Desktops
- Create a Citrix Cloud account (if you don’t have one)
- Request a Citrix DaaS trial
- Create a Citrix DaaS account (Citrix Cloud account) and add the Azure tenant as a Resource Location
- Create a Windows Server VM and install the Citrix Cloud Connector in your Azure resource location
- Prepare the Azure Virtual Desktop template for the session host virtual machines (VMs). Install the Citrix Virtual Delivery Agent on the AVD VM
- Utilize your Citrix Virtual Apps and Desktops service account (Citrix Cloud account) to connect to your Azure subscription using the Citrix Cloud Connector
- Use Citrix Machine Creation Services for deploying a catalog and then create a delivery group
- Create a Windows Server VM and install the Citrix Cloud Connector in on-premises Resource Location and add it as a resource location
- Utilize your Citrix DaaS account (Citrix Cloud account) to connect to your on-premises resources using the Citrix Cloud Connector
- Let your users connect to the AVD or on premises sessions via Citrix Workspace
There is a requirement from Microsoft that the AVD session hosts must be joined to a Windows Active Directory (AD) domain that has been synchronized with either Azure AD using Azure AD Connect or with Azure AD Domain Services. This would require you to connect your on-premises Active Directory to your organization’s Azure subscription. This is out-of-scope for this guide but if you are also a Citrix Networking or Citrix SD-WAN customer then you can useSite-to-Site VPNwithCitrix ADC(which requires a public IP) orCitrix SD-WAN. The two preceding options are creating IPsec tunnels between your on-premises environment and the AVD network in Azure.
If you are looking for a solution that does much more than just set-up a link between these two locations, then we suggest considering creating an end to end SDWAN solution. The main advantages this gives you are integrated security, orchestration, and policy based configuration. SDWAN has further benefits:
- Enables direct access to video-on-demand that is rendered from the customer data center
- Provides intelligent traffic steering from the VDA to other on-premises properties
- VoIP and real-time video traffic are navigated from the corporate data center
- Aggregate more than 1 link to give you resiliency and expanded bandwidth by combining the different links
To set up an end to end SDWAN solution you can follow these guides:
Configuring SDWAN to connect to Azure virtual network
Deploy SDWAN on Azure using SDWAN Center
Express routeorPoint-to-Site VPNwhich doesn’t require a public IP are other options to establish the connectivity.
This guide provides detailed instructions on how to deploy and configure your environment including VMs, connecting your AD to Azure AD. As a Citrix and Azure tenant administrator, you create the AVD environment to enable your users to test various scenarios that showcase Citrix DaaS and Azure Virtual Desktop integration.
Create an Azure Subscription and an Azure Active Directory Tenant
If you are an existing Microsoft O365 customer you should already have an Azure Active Directory (AAD) and so you can log in to Azure as the global administrator of the subscription and skip to the next section.
Go to the url:Sign into Azureandlogin to Azure
Enter you information, clickNext
Verify your identityand thenprovide your credit card detailsfor billing purposes. You may be asked to verify your card details by making a payment of ~ USD 1
Once you are done you should see this in Azure Portal. If that is the payment method you want to use clickNext. Else change it and then clickNext.
If you agree, checkI agreecheck box for subscription agreement, offer details and privacy statement. ClickSign Up.
Alternately you can enroll in an O365 Enterprise E3 trial by going to thislinkand providing your details
Click+ Create a Resourceand search forAzure Active Directoryand select it
ClickCreate
Provide theOrganization nameandInitial domain nameof the AD that you want to create. Select theCountry or Regionand then clickCreate
Wait for the Azure AD to be created
Connect the on premises AD to Azure AD using Azure AD Connect
Launch an RDP session to the AD.
Open a browser and login to Azure as the global administrator of the subscription and Azure AD. ClickAzure Active Directoryand thenAzure AD Connect. ClickDownload Azure AD Connect
In the browser window that opens clickDownload
ClickRun
In the Azure AD connect dialog, clickContinue
ClickUse Express Settings
Provide the Azure Active Directory global administratorUsername and Password. ClickNextandlogin againif requested
Provide the Active Directory enterprise administratorUsername and Password. ClickNext.
Check theContinue without matching all UPN suffixes to verified domains, clickNext
ClickInstall
Once the config is complete, clickExit
Go back to the Azure Active Directory page in the Azure portal and clickUsers. Validate that the user(s) you created are visible in the list.
Create a master image using Windows 11 Enterprise Multi-session
Select+or+ Create a resource. Search forMicrosoft Windows 11and select the Microsoft Windows 11 option that shows Windows 11 Enterprise multi-session in the drop-down list.
Select theWindows 11 Enterprise multi-sessionoption from the drop-down list and then clickCreate
Select the appropriateSubscriptionand theResource groupcreated for AVD to deploy the machine in. Provide anamefor theMaster Image VM. Choose the sameregion as the AD VM. Enter thecredentials for the administrator account. ClickNext: Disks
Select theappropriate OS disk typeand加密类型for your deployment. ClickNext: Networking
Select thevirtual networkthat your other VMs are on and ensure that aPublic IPis being created for the Master Image. Click回顾+创建
Ensure that theValidation Passedmessage appears andcheck the machine settings. ClickCreateto begin the Master Image VM creation
Once the VM creation completes, clickGo to resource.
The VM must have a networking rule to allow incoming RDP traffic on it Public IP. ClickNetworking在e Favorites column. ClickAdd inbound port rule
Your public IP can be obtained by running a google search for
whatsmyip
address to make RDP connections to the AD VM. SelectIP Addressas Source, enter thePublic IP Address of the machineyou want to connect from in the Source IP field, set Destination Port ranges to3389, andProtocoltoTCP. Set an appropriatePriority valueand provide aname to the rule.* ClickAdd*: Leaving port 3389 open remotely long-term can pose a security risk.
RDP in to the machine with the admin credentialsyou provided when creating the VM andjoin the VM to the domainandrebootthe machine.
Create a Cloud Connector in your Azure subscription
Select+or+ Create a resourcein Azure. SelectWindows Server 2019 Datacenterunder Get Started to create a new Windows Server 2016 machine.
Select the appropriateSubscriptionand theResource groupcreated for AVD to deploy the machine in. Provide aname for the Cloud connector VM. Choose thesame region as the ADVM. Enter thecredentials for the administrator account. ClickNext: Disks
Select theappropriate OS disk typeandEncryption Typefor your deployment. ClickNext: Networking
Select thevirtual networkthat your other VMs are on and ensure that aPublic IPis being created for the Cloud Connector VM. Click回顾+创建
Ensure that theValidation Passedmessage appears andcheck the machine settings. ClickCreateto begin the Cloud connector VM creation
Once the VM creation completes, clickGo to Resource
The VM must have a networking rule to allow incoming RDP traffic on it Public IP. ClickNetworking在e favorites column and then click thename of the network interface
ClickNetwork Security Groupand then select theNetwork Security Groupof yoyur AVD VM as it already has the port rules to allow access to your machine. ClickSave
*: Leaving port 3389 open remotely long-term can pose a security risk.
RDP in to the machine with the admin credentials you provided when creating the VM and join the Cloud Connector VM to the domain and reboot the machine.
Create a Citrix Cloud account
If you are new to Citrix Cloud, please follow the instructions on theCitrix Cloud Sign Uppage.
If you are an existing Citrix Cloud customer continue onto the next section. Ensure that you have an active Citrix Cloud account. If your account has expired you need to contact sales to enable it.
Create a new Resource Location
RDP to the Cloud Connector VM and login as the AD admin. Goto the URL:Citrix Cloud.
EnterUsername and Password. ClickSign In. (If your account manages more than one customer select the appropriate one)
Under Resource Locations ClickEdit or Add New
Click+ Resource Locationand entername of the New Resource Location. ClickSave
Under the newly created resource location click+ Cloud Connectors
ClickDownload. ClickRunwhen the download begins
Citrix Cloud connectivity test successful message should be displayed. ClickSign in and Installto continue. If the test fails, check the following link to resolve the issue -CTX224133
From the drop-down lists select the appropriateCustomer and Resource Location. ClickInstall
Once the installation completes, a service connectivity test runs. Let it complete and you should again see a successful result. ClickClose
Refresh the Resource Location page in Citrix Cloud. Click on云连接ors
The newly added Cloud Connector is listed. In production environments, ensure to have 2 Cloud Connectors per resource location
Request a Citrix DaaS trial
Sign in to yourCitrix Cloudaccount
From the management console, selectRequest Trialfor the Citrix DaaS Service
Note:
For some services you must reqwuest a demo from a Citrix sales representative before you can try out the service. Requesting a demo allows you to discuss your organization’s cloud service needs with a Citrix sales representative. Also, the sales representative ensures you have all the information needed to use the service successfully. When your trial is approved and ready to use, Citrix will send you an email notification.
Install Virtual Delivery Agent on the AVD host VM
While we wait, we can install the Citrix Virtual Apps and Desktops, Virtual Delivery Agent on the Windows 11 Multiuser VM that we created.
Connect to theAVD VM via RDP as the domain admin
OpenCitrix.comin your browser. Hover overSign inand clickMy Account
Sign in with yourUsername and Password.
ClickDownloads.
From theSelect a Productdrop-down list, selectCitrix Virtual Apps and Desktops
In the page that opens, select thelatest version of Citrix Virtual Apps and Desktops 7(除非t the .x at the end)
Scroll down toComponents that are on the product ISO but also packaged separately. Click thechevronto expand the section. ClickDownload Fileunder Server OS Virtual Delivery Agent
Check“I have read and certify that I comply with the above Export Control Laws” check box, if you agree. ClickAccept. The download should begin.
Savethe file andRunit when the download completes
ClickNext在e Environment section to create a master MCS image.
在核心组件部分,检查Citrix Workspace app check box if your users would use the session to launch sessions from within it. ClickNext
In the Additional section choose the components you need and clickNext
NOTE:To see logon information in Citrix Director, select also Citrix User Profile Manager
Enter theUPN for the Cloud ConnectorVM and clickTest Connection. Ensure that the test is successful a green tick appears next to the entered UPN. ClickAddand clickNext
ClickNext在e Feature section andNextagain in the Firewall section.
ClickInstall在e Summary section
Once the installation completes, in the Diagnostics section clickConnect. Enter yourCitrix Cloud credentials, clickOK. Once the credentials are validated, clickNext
ClickFinishand let the VMreboot.
Create a hosting connection between Citrix DaaS and Azure
Configure Citrix DaaS to connect to the Azure Subscription that hosts the Azure Virtual Desktop VMs.
Once the trial is approved,Log in to Citrix Cloudfrom your local machine. Scroll toMy Services, and locateDaaSservice tile, clickManage
theFull Configurationpage is displayed
在e left navigation menu, clickZonesand verify that theResource Locationand云连接oryou have setup are visible.
In the left menu under Configuration. ClickHostingand then clickAdd Connection and Resourcesthat host the machines.
From the drop downs selectCreate New Connection,Microsoft© AzureTMas Connection Type,Azure Globalfor Azure environment and an the Azure zone location setup as a Resources Location. SelectCitrix provisioning tools (Machine Creation Servicesselected. ClickNext
Paste your Azure Subscription ID在e Subscription ID text box and enter aConnection Name. ClickCreate Newto create a new service principal. Alternately you can manually grant Citrix Cloud Access to the Azure subscription (with more restrictive roles than the default contributor)CTX224110
Sign into your Azure account when prompted.Ensure that the user is an owner and not an external user在e subscription
Check theConsent on behalf of your organizationcheck box and clickAcceptif you agree. Once the validation completes Connected is displayed. ClickNext
Select theappropriate Regionand clickNext
Enter aName for these resourcesand select the appropriateVirtual networkandSubnetwhere the VMs are to be created. ClickNext. Review the Summary and clickFinish
You are returned to the Hosting page. Once you are done clickMachine Catalogsto start creating your catalog.
Create a Machine Catalog and a Delivery Group
ClickCreate Machine Catalog.
In theMachiune Catalog Setupdialog, clickNext
EnsureMulti-Session OSis selected. ClickNext
EnsureMachines that are power managedandCitrix机创建服务are selected and the correct Azure network is shown in the Resources. ClickNext
Choose the correctdisk that is associated with the AVD VM. From the minimum functional level drop-downselect 1811 (or newer). ClickNext. A pop-up appears to ask for the VM attached to the VHD to be stopped.
Log in to the Azure portaland UnderVirtual Machines, go to theAVD VMand Click theStopbutton. Ignore the warning about losing the Public IP. Wait forstatus to show Stopped (deallocated). Return to theCitrix Cloud taband clickClose
LeaveDefaultsand clickNext
修改虚拟机的数量if you want and select themachine sizeyou want for your VMs. ClickNext
ClickNext
Set thewrite back cache sizeif you want it. ClickNext
ClickNextand clickClose
Select theOUin which the VMs should be placed. Enter the computerAccount naming scheme. Ensure the name is fewer than 15 chars long and ends with a #. ClickNext
ClickEnter Credentials. In the dialog that opens enterusername and passwordof the AD admin. ClickDone. ClickNext
ClickNext
ClickNext
Enter anamefor the machine catalog. ClickFinish
Wait for the catalog to be created.
When Machine Catalog creation is finished, from the left side menu clickDelivery GroupsthenCreate Delivery Group.
Select theWindows 11 Multisession Catalog.Increment the number of machinesto the number of VMS you want to add to the delivery group. ClickNext
For our example we will select theAllow any authenticated users to use this Delivery Grouporadio button. ClickNext
If you want to also make apps available from this delivery group click theAdddrop-down list and chooseFrom Start Menu
From the Add Applications from Start Menu Dialogcheck the boxes next to the appsyou want to make available. Then clickOK
ClickNext
In the Desktops section clickAdd. EnterDisplay Namefor the delivery group. EnsureEnable desktopis checked. ClickOK
ClickNext
ClickNext
Select the appropriate许可类型and ClickNext
Enter aDelivery Group name. ClickFinish
Once the delivery group is created, your Delivery Group overivew should look like this.
If you want to add your on-premises resources to the Workspace follow the below steps.
Create a Cloud Connector in your on-premises data center
- Add a cloud connector in your on-premises data center. Create a Windows server 2012 R2 or 2016 VM in your on-premises. Repeat the steps in the “Create a new Resource Location” section.
Add on-premises site to the Workspace
- Follow the steps in theguideto add the on-premises site to Citrix DaaS. Complete till the end of Task 3: Configure connectivity and confirm settings in this page.
Launch the session from Citrix Workspace
Open the Workspace URLyou had saved earlier (from Citrix Cloud) to the Citrix Workspace.Log in as one of the domain usersthat you had added to the Delivery Group.
ClickView all Desktops
Click on theWindows 11 Multi-session DGdesktop that you created in Azure.
The session should launch giving you access to the Azure Virtual Desktop
Summary
The guide walked you through bringing your Azure hosted Azure Virtual Desktop and on premises resources (using Workspace Configuration) together, so users access them in one place. You learned how to create a hybrid setup to manage both Azure Virtual Desktops based VMs and on premises based resources using Citrix VIrtual Apps and Desktops. The process included creating a network conneciton between the Azure virtual network and your on premises data center. Also you learned how to synchronize your on premises Active Directory with Azure Active Directory with Azure AD connect. We even looked at how to create a Citrix Cloud account, if you didn’t have one and get access to Citrix Virtual Apps and Desktops service, which makes all this work.
To learn more about migrating your on premises Citrix Virtual Apps and Desktops setup to the cloud, read thedeployment guide
In this article
- Overview
- Conceptual Architecture
- Scope
- Create an Azure Subscription and an Azure Active Directory Tenant
- Connect the on premises AD to Azure AD using Azure AD Connect
- Create a master image using Windows 11 Enterprise Multi-session
- Create a Cloud Connector in your Azure subscription
- Create a Citrix Cloud account
- Create a new Resource Location
- Request a Citrix DaaS trial
- Install Virtual Delivery Agent on the AVD host VM
- Create a hosting connection between Citrix DaaS and Azure
- Create a Machine Catalog and a Delivery Group
- Create a Cloud Connector in your on-premises data center
- Add on-premises site to the Workspace
- Launch the session from Citrix Workspace
- Summary