Publishing an Image with Microsoft Azure

After you add an image and verify its details, you can publish the image from Horizon Cloud. Before performing any of the following steps, review the information at Microsoft Azure Deployments and IMS.

Prerequisites

Confirm that the following tasks have been completed:

• Domain registration

• The Microsoft Entra ID is connected to Cloud Services

• The site was created successfully

• The Unified Access Gateway (UAG) and Edge gateway are connected and ready

• The image has been verified and is unpublished

• The softwareupdate.omnissa.com URL is resolvable and reachable from the management and tenant (desktop) subnets using the 443 port over TCP protocol for downloading agent-related software used in the system image creation operations. For more information, refer to: Port and Protocol Requirements for Your Horizon Cloud Deployment in Microsoft Azure

  • Ensure that Microsoft Azure security policies related to CSE allow the installation and execution of CSE on the image VM. If you set up a proxy in the image VM, the softwareupdate.omnissa.com URL must be allowlisted so that the URLs are bypassed by the proxy. Note: When you assign a policy, you can select exclusions, which are resources to exclude from the policy assignment. If you use this method, select image-related resources to exclude from the policy

• For GPU VM Models, make sure that NVIDIA GPU drivers are installed on the VM. For more information, refer to: Install NVIDIA GPU drivers on N-series VMs running Windows

• At least one virtual network and tenant (desktop) subnet is selected for the provider

• Horizon Cloud automatically installs the Horizon Agent (HAI) during the publishing workflow. However, if installing the agent before the publishing workflow is necessary for your specific use case, refer to KB 91998. If you do manually install the Horizon Agent, deselect the Install Horizon Agent toggle when you peform the publishing workflow

• Horizon Cloud requires CSE to install the Horizon Agent. Therefore, if you use Azure Policy to restrict the installation of extensions on an image VM, which is a VM used for image preparation, do one of the following during the assign-policy phase of the configuration to prevent the publishing process from failing

  • Ensure that Microsoft Azure Custom Script Extensions (CSE), and that the Azure RunCommand and Sysprep are not blocked or interrupted by policies, firewalls, or external solutions on the image VM in Microsoft Azure. During the image publish process for Azure images, Azure Custom Script Extension and Azure RunCommand are used and the image is generalized using Sysprep before capturing in Azure Compute Gallery
  • Allow a CSE whose name contains hcs-image-CustomScriptExtension to execute. During the publishing process, Horizon Cloud uses this for the CSE attached to the image VM

• All Windows updates are completed with no pending reboots

• For 24H2 and above, make sure to login with the admin credentials that were provided when the image was added

Procedure

1. On the Horizon Universal Console Home page, click the Images tile to navigate to the Images page. Click an image that is Ready to Publish.

2. On the Image Details page, select the image Version, and click the drop-down Unpublished > Publish.

3. Under the Destination section, the image version you selected above will be imported to the Source Horizon Edge. This option is pre-selected and cannot be changed. To publish the Image to more Horizon Edges, select the appropriate checkboxes in the table. Then click Next.

4. Under Properties > VM details, there are five different toggle options for you to set. Click Next after all of the following toggles are set.

• Enable remote desktop access for all users: Toggle this ON to enable remote access for all users. Toggle this OFF to restrict user access to remote desktop. Then ensure that only intended users are entitled to remote desktop access via restricted groups policy in Microsoft Active Directory. For more information, see Configuring the Restricted Groups Policy. This option is only applicable to Windows multi-session images.

• Turn Off Automatic Windows Update: Toggle this ON to deactivate physical desktop features for more efficient VM performance, capacity utilization, and helps to avoid any Microsoft Windows Sysprep issues.

• Remove Windows Store apps: Toggle this ON to remove AppX packages, and deactivate automatic app and Windows Store updates and downloads. With this toggle on, it will improve performance and helps avoid Microsoft Windows Sysprep issues.

• The following Windows Store apps are retained and will not be removed during publishing process: Microsoft.DesktopAppInstaller
  Microsoft.Messaging
  Microsoft.MSPaint
  Microsoft.Windows.Photos
  Microsoft.MicrosoftStickyNotes
  Microsoft.WindowsCalculator
  Microsoft.WindowsCommunicationsApps
  Microsoft.WindowsSoundRecorder
  Microsoft.WindowsStore
  Microsoft.WindowsNotepad
  Microsoft.ScreenSketch
  Microsoft.Xbox.TCUI
  Microsoft.XboxApp
  Microsoft.XboxGameCallableUI
  Microsoft.XboxGameOverlay
  Microsoft.XboxGamingOverlay
  Microsoft.XboxIdentityProvider
  Microsoft.XboxSpeechToTextOverlay
  MSTeams
  Windows.CBSPreview
  windows.immersivecontrolpanel
  Windows.PrintDialog
  Microsoft.Paint
  Microsoft.ZuneMusic
  

• Remove custom script extensions: This toggle is ON by default to remove the custom script extensions attached to the VM. It cannot be turned off to ensures that the publishing process does not fail due to existing custom script extensions attached to the VM.

5. Enable Publish Error Recovery: Toggle this ON to create a backup VM for image recovery if an unrecoverable error occurs during the publishing process. Click Next.

6. Install Horizon Agent: Toggle this OFF if the image already has your preferred agents installed in it.

   Note: The Install Horizon Agent toggle is ON by default because typically an image will not already have agents installed on it and you will have the publishing operation install the agents. When this toggle is ON and you click Publish, the system will run the agent installation process on the image as part of publishing the image. However, if the image already has your preferred agents installed, ensure that you toggle this OFF to avoid operation conflicts that could occur if the toggle is on because the system will again run the agent installation process on an image in which the agents are already installed.

   Note: When you select the Install Horizon Agent toggle of ON, the published image version loses the agent features metadata. If you want to use this image version for App Volumes Application packaging, you must input the App Volumes agent feature AvAgentInstall manually by using the Image Management Services API. Note that for other resource type use cases such as Pools, there is no such requirement. A sample API snippet is shown below:

        curl -X 'PATCH' \
        'https://cloud-sg.horizon.omnissa.com/imagemgmt/v1/images/Image_ID/versions/Version_ID?org_id=Org_ID' \
        -H 'accept: application/json' \
        -H 'Authorization: Bearer TOKEN' \
        -H 'Content-Type: application/json' \
        -d '{
        "horizonAgentMetaData": {
        "features": [
        "AvAgentInstall",
        ]
        }
        }'

7. Horizon Agent Features: Toggle on or off as your company needs and then click Next. Note: Features that are toggled off will be removed if previously installed.

8. In the Published Image Operations section, toggle ON the Validate published image to validate that errors do not occur when the published image is used to provision the pools, specifically where a system-generated pool is used to validate the image.

   When you toggle ON the Validate published image, the duration of the publishing process might increase. Note: If an imported VM was deployed on an Azure Dedicated Host, image validation will be supported. However, if the Azure Dedicated Host Group does not have Automatic Placement, image validation is not supported.

9. With Validate published image enabled (toggled on), select a destination Virtual Network.

   This network will be attached to the system-generated pool created from the image. Select the same tenant virtual network that you plan to use for creating pools in future.

   For any un-authenticated outbound proxy for any pool VMs to communicate, Toggle ON and provide the values for the proxy host and proxy port. This outbound proxy configuration is used to validate the Image Publish process by creating and cleaning-up a System Pool.

   If you have already configured outbound proxy settings (proxy host and proxy port) for the Horizon Edge selected in this workflow, then Toggle ON the Copy Horizon Edge proxy toggle to use the same configuration here. As a result, Horizon Edge proxy settings are automatically carried over to both the Proxy host and Proxy port fields.

10. Select a network from the Select Network list for the published image operations.

11. (Optional): You can manage Azure resource tags as needed.

    See Using Azure Resource Tags for the background information on this feature.

    1. Expand the Advanced node.
    • If inherited tags exist, those tags are listed for your reference.
    • If no inherited tags exist, a link is provided that you can use to inherit tags from the provider.

    2. Click Add.

    3. Manage resource tags as needed.

       You can add tags to be applied to the Azure Compute Gallery’s version specific to this image version.

    4. Click Done.

12. Click Publish.