How does NMM support AAD join in existing accounts? – Nerdio Help Center

Applies to: Nerdio Manager for MSP (NMM) v2.3+

Overview

Your accounts created in NMM must have an AD to join the session host. NMM allows you to configure directory profiles (Azure AD or Active directory or Azure AD DS) for each of your host pools. Before we proceed further, let us briefly understand each directory profile type. Traditionally, AVD requires both Active Directory (AD) as well as Active Directory Domain Services (AD DS). AD DS is available in two formats:

Traditional AD DS from Windows server: The AD DS domain controllers can either be located on-prem and accessed over a site-to-site VPN or ExpressRoute. Or they can be VMs located within Azure itself or both. All AVD needs is a network line of sight to a domain controller, to facilitate the VM domain join at deployment time and to perform user authentication.
Azure Active Directory Domain Services (AAD DS), which is a Microsoft-managed PaaS service to provide AD DS inside of Azure. Customers do not manage the virtual machines for this service and were originally designed for just cloud-only organizations but have had recent updates to support trust relationships to existing on-prem AD DS.

Azure AD-joined VMs remove the need to have line-of-sight from the VM to an on-premises or virtualized Active Directory Domain Controller (DC) or to deploy Azure AD Domain services (Azure AD DS). In some cases, it can remove the need for a DC entirely, simplifying the deployment and management of the environment. This reduces your costs and complexity significantly. Azure AD-joined VMs can also be automatically enrolled in Intune for ease of management.

In this article, we will learn about:

How to configure various directory profiles for your account

How the directory profile type impacts host pool creation

How to configure various directory profiles for your account

From the main menu on your account's page, select "Settings->Integrations" tab as shown below:

On the "Directory" tile, click "Add" link to add another AD profile:

Provide the following details and click "OK" button:

DIRECTORY: Select directory type (Active Directory, Azure AD DS, Azure Active Directory) from the drop-down
AD DOMAIN: Specify the active directory domain (in FQDN format) for session host VMs to join
AD username: Specify AD username in FQDN format
AD password: Specify admin user's password
Organization unit: Specify OU in distinguished name (DN) format. If left blank, all computer objects will be placed in Computer's AD container

For example, you can add an "Azure AD DS" directory profile as shown below:

You can also add "Azure Active directory" as shown below:

Note: In this case, there is no option to specify a particular AAD. This is because the VMs will be automatically joined to the same AAD that the Azure subscription is connected to.

Once you configure the directory profile, the Settings > Integrations page will look like this:

Click "remove" link in case you want to delete any existing directory profile. On the pop-up, click "Confirm" button as shown below:

How the directory profile type impacts host pool creation

Directory profile information is used while creating or re-imaging sessions hosts. Let us look at how the directory profile type impacts host pool creation. From the account's main menu, navigate to AVD > Host Pools as shown below:

Scroll down and click "Add host pool" button:

When you create a host pool, you will be prompted to select AD profile as shown below:

If you select Directory type= "Active Directory" (say nmm-qa-man-ac1.nerdio.net which is also the default directory in our case) and provide other details like name, description, prefix, desktop images, etc, you will be able to create a host pool:

If you select Directory type= "Azure AD DS" (say nerdiofoxtrot.onmicrosoft.com) and provide other details like name, description, prefix, desktop images, etc, you will be able to create a host pool:

If you select Directory type= "Azure Active Directory", you will see a warning message

"There are several limitations, including lack of support for FSLogix. Enabling this feature will set the Validation flag on this host pool, and disable FSLogix.":

Note: You will still be able to create a host pool, despite the warning message. However, there are few limitations of AADJ while it's in preview:

FSLogix profiles are not supported, as a result all host pool desktops support local profiles only.
A new RDP custom property needs to be added. This is done for you by Nerdio Manager behind-the-scenes.
MFA is not supported for AAD joined session hosts.

It is possible to have session hosts with different directories under the same host pool, hence we display the directory type at the host level instead of pools level. To view the "Directory" type for each session host under the host pool, go to Host Pools > Session hosts as shown in the screenshot below. You will be able to view the directory info in the session host's name. If the host is not Azure AD joined, then its name is displayed in <VM name>.<domain name> format. Otherwise, you will be able to see a label "(AADJ)" next to the host name.

Overview

How to configure various directory profiles for your account

How the directory profile type impacts host pool creation

Comments