Azure / avdaccelerator

AVD Accelerator deployment automation to simplify the setup of AVD (Azure Virtual Desktop) based on best practices
MIT License
305 stars 198 forks source link

AADDSscenario says Entra ID joined but joins domain controller #580

Closed mloskot closed 4 months ago

mloskot commented 5 months ago

Let us know the feedback or general question

The AADDSscenario/readme.md says:

This scenario deploys a new Azure Virtual Desktop workload with Microsoft Entra ID joined session host

while in the code it makes use of the JsonADDomainExtensions for a regular domain join:

https://github.com/Azure/avdaccelerator/blob/c6e13867711a44443256505d8dad50ca79a267ea/workload/terraform/greenfield/AADDSscenario/host.tf#L65-L82

If this scenario was creating Entra ID joined VM-s, should shouldn't it rather setup the VM extension AADLoginForWindows , as after https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows:

The AADLoginForWindows extension must be installed successfully for the VM to complete the Microsoft Entra join process.

and

After you enable this capability, your Windows VMs in Azure will be Microsoft Entra joined. You cannot join them to another domain, like on-premises Active Directory or Microsoft Entra Domain Services.

I believe there exists the confusion caused by describing "Entra ID join" while performing a domain join.

danycontre commented 4 months ago

@mloskot thanks for your feedback, readme was updated to reference Microsoft Entra Domain Services, the scenario is meant to join session host to Microsoft Entra Domain Services domain controllers not to Microsoft Entra ID.

mloskot commented 4 months ago

@danycontre I see. Thank you!