Add an Image with Microsoft Azure

There are three ways to add images to Microsoft Azure. Choose the best method for your needs and ensure all prerequisites are met before proceeding. Refer to Microsoft Azure Deployments and IMS for more informaion.

If you plan to use encryption for an Edge Gateway (AKS) deployment, enable encryption in your Microsoft Azure subscription. Having the EncryptionAtHostSupported feature enabled at the subscription level honors disk encryption. To enable this feature, follow the steps in the Prerequisites section of Use the Azure portal to enable end-to-end encryption using encryption at host.

Methods to Add Images

There are three ways you could use to add images to Microsoft Azure:

1. Add an Image from Microsoft Azure Marketplace: Use this option if you need an image based on the latest OS builds available in the Azure Marketplace.

2. Add an Image with Microsoft Custom VM: Use this option if you have a custom workflow in Azure that generates base VMs for preparing images. This method also supports adding an image on a custom VM hosted on a Microsoft Azure dedicated host.

3. Add an Image from Microsoft Azure Compute Gallery: Use this option if you have an existing image in your Microsoft Azure Compute Gallery.

Prerequisites

Before adding an image, ensure the following prerequisites are met:

• Plan Your VM Model: Decide on the VM model based on the requirements outlined in Image Management System Requirements.

• Gateway Status: Ensure the Unified Access Gateway and Horizon Edge Gateway are in a Ready state.

• Subscription Verification:

  • Verify that your subscription has adequate CPU cores quota for the selected VM model. Refer to Image Management System Requirements for supported model types.
  • Ensure your subscription has the Encryption At Host feature enabled if using a VM model that supports EncryptionAtHostSupported. Refer to the same document for details.

• Network and IP Address Verification:

  • Verify that tenant (desktop) subnets allow a sufficient number of IP addresses.
  • Ensure you have the required number of public IP addresses provisioned for Microsoft RDP access.

• URL Accessibility: Verify that softwareupdate.omnissa.com is accessible (resolvable and reachable) over the 443 port on TCP protocol. For more details, refer to Port and Protocol Requirements for Your Horizon Cloud Deployment in Microsoft Azure.

• Virtual Network Configuration: Ensure at least one virtual network and tenant (desktop) subnet is selected for the provider.

• Guest Operating System Support: Determine if the guest operating system of the image is supported. Refer to the Interoperability Matrix for compatibility information.

Add an Image from Microsoft Azure Marketplace

When adding an image with option, Azure deploys a new virtual machine with the selected operating system. After adding the image, customize it according to your needs. Lastly, you must publish the image to make it available for use in pool templates.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the approprate option.

3. In the General Information section, add a unique Image Name and click Next.

   The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, you can add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Marketplace and click Next.

7. In the Destination sub-section, select the Site, Horizon Edge, and Provider.

8. In the VM details sub-section, select the OS, Generation Type, VM Model Type, and VM Model.

9. Select Generation Type between V1 and V2.

10. OS supports only a specific Security type. A Security type option will be automatically selected and deactivated between Standard and Trusted launch.

    If you select V1, only Standard Security type is activated. Standard provides a basic level of security to virtual machines.

    If you select V2, Trusted launch for Security type is activated by default. Secure boot is enabled by default, which provides protection against boot kits, rootkits, and kernel-level malware. Virtual Trusted Platform Module (vTPM) is also enabled by default, which securely stores keys, secrets and validates VM boot integrity. Trusted launch provides enhanced security and prevents advanced attacks on Gen 2 virtual machines.

    You can also select Standard Security type for V2.

11. Select a VM Model Type between Without GPU and With GPU.

12. Select a supported VM Model from the available options.

    VM Model options are shown based on VM model type and generation type. If the selected VM model supports Encryption At Host, the toggle will be activated automatically. This feature encrypts temporary disks and ephemeral OS disks using platform-managed keys.

13. In the Network sub-section, you can enable the Public IP by sliding the toggle to access the image through a Remote Desktop Protocol connection, then Select Network.

    To customize and optimize images, you need a VM created from the image running on an appropriate network to log in. Therefore, you must provide appropriate VNet, Subnet, and public IP that have sufficient quota on resources.

14. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account to access the image's operating system, and to use during the image customization process.

15. Select the check box for Windows license with Software Assurance and click Add.

    Adding an image from Microsoft Azure Marketplace brings it to a state of unpublished and ready to be customized. The image can be used by pools only after publishing.

Add an Image with Microsoft Azure Custom VM

When you select this option, an existing Azure VM is registered with the Horizon Cloud IMS service as a Custom Image. The Custom VM is then managed by IMS and deleted after the image publish operation. After adding the image, you can perform additional customizations before publishing it for use in pool templates.

Important Considerations

• Ensure the Azure VM is healthy with the Azure agent in a "Ready" status.
• The VM and its associated resources (e.g., disks, NICs) must be in the same resource group.
• The OS of the Custom VM must match the OS selected in the UI.

Prerequisites for Custom VM

• VM Model Type: The Custom VM must be either generation 1 or generation 2.

• Role-Based Access Control (RBAC): Set up RBAC for the resource group containing the Custom VM.

• Region Consistency: The Target Provider region and the Custom VM's region must be the same.

  Note: The selected Custom VM is converted to a generalized image and cannot be reused as a VM during the image publish workflow. It is recommended to keep a backup of the VM.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the approprate option.

3. In the General Information section, add a unique Image Name and click Next. The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, you can add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Custom VM and click Next.

7. In the Destination sub-section, select the Site, Horizon Edge, and Provider.

8. In the VM details sub-select a VM.

   For this VM selection, the Azure resource group must be selected beforehand from the drop-down list. While both resource groups contain the name pattern hcs-<ProviderInstance_Id>-base-vms, select the appropriate resource group that is applicable to your existing Microsoft Azure Edge. All custom VMs must be part of the selected resource group. Also, note that the image and any other related resources will be in the same resource group. You can obtain the resource group name in the Microsoft Azure portal, on the VM details page.

   Note: Pools can only be provisioned with the generation type of the selected VM.

9. Select the OS type of this Custom VM. Be sure to accurately select the OS type of the Custom VM as it cannot be verified after selecting.

10. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account to access the image's operating system, and to use during the image customization process.

    The username cannot exceed 19 characters and cannot end in a period(.). Usernames prohibited by Microsoft Azure, such as guest or administrator cannot be used.

    Passwords must be 12 to 123 characters and meet 3 of the following requirements: lowercase letter [a-z], uppercase letter [A-Z], number, special character (!@#$%/^&*). Some passwords prohibited by Microsoft Azure, such as Password1.

11. Select the check box for Windows license with Software Assurance and click Add.

Add an Image from Microsoft Azure Compute Gallery

This option is typically used by Managed Service Providers (MSPs) who publish images into their own organization using the Horizon Cloud image management system first and then copy these images to customer organizations. The source image in the Microsoft Azure Compute Gallery should have the appropriate Horizon Agent (compatible with Horizon Cloud) and should be generalized (with Microsoft Sysprep) after all customizations are performed. These images are copied directly to the target provider's Azure Compute Gallery and used as-is for pool creation without needing to be published.

Important Considerations:

• When using this option, choose Copy from source image under image attributes and provide the Organization ID where the source image was published. This ensures that required attributes like Horizon Agent version and image metadata are copied from the source image.
• If you choose Override and don't provide the Organization ID, the IMS services won't have information about image attributes like Horizon Agent version and features.

Prerequisites for Custom VM

• Image Compatibility: Refer to the Interoperability Matrix to ensure the image is supported.

• Image Definition: Verify that the Offer and SKU values for the Microsoft Windows operating system are correctly set in your Microsoft Azure Compute Gallery image definition. For example, for Microsoft Windows Server 2022, ensure the Offer value is windowsserver and the SKU value is 2022-datacenter.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the approprate option.

3. In the General Information section, add a unique Image Name and click Next.

   The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, you can add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Compute Gallery and click Next.

7. In the Destination sub-section, select the Site and Horizon Edge.

8. In the Source image version details sub-section, add the Microsoft Entra ID Tenant ID from the Microsoft Azure portal. Add the Resource ID obtained from the Microsoft Azure portal by clicking on the JSON View link located on image version of the image definition. If image was published using Horizon Universal Console, this ID can be obtained in console from Location Path column of Image Copies grid on image version details page.

   Ensure that the provider of selected destination Horizon Edge has Microsoft Azure RBAC read access to the source image or resource group containing the image. Also, ensure that the source image is already published with the Horizon agent.

9. Select Copy from source for image for Image Attributes to use the attributes from the source image version.

   If you are supported by a Managed Services Provider (MSP, then you can copy the image from the MSP Organization’s provider to your provider. This process leverages a published source image in the Horizon catalog corresponding to an external organization (MSP) other than your own organization. The MSP provides a complete image including the details of the application residing in the server or multi-session image.

   When you select Copy from source for image, specify the Organization ID that shared or published the image originally.

   Override allows you to configure the attributes. Override option is applicable when you want to copy a source image that is not in your Horizon catalog. For example, an image from an external subscription that is readable by the Horizon provider’s subscription.

   When you import an external image, make sure that the source image has the latest Horizon agent installed, or else the VMs that are created as part of desktop/server pools on this image might encounter an error.

   Source image is an already published image that is generalized with the necessary agent and software. Thus, a copy of the same image into customer organization can be directly used by pools. It could also be re-published to other subscriptions or regions. Your provider must have appropriate RBAC access to the source image.

   When you select Override, specify the OS of the source image. If the OS does not support a specific generation type, a supported generation type is selected by default.

10. If selectable, select a Generation Type option.

    Note: Microsoft Azure generation 1 and 2 VMs are supported. If you select V1, pools can be provisioned only with V1 generation models.

11. In the VM details sub-section select VM Model Type and VM Model.

    Note: Your selections for the Generation Type and the VM Model Type act as a filter and determine which VM models are available in the VM Model drop-down menu.

12. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account to access the image's operating system, and to use during the image conversion process.

13. Select the check box for Windows license with Software Assurance and click Add.