The purpose of this checklist is to inform you of the required elements for doing a native Microsoft Azure deployment using the Horizon Control Plane.
Note: A Horizon Cloud on Microsoft Azure deployment refers to a native Microsoft Azure infrastructure.
Checklist Audience
This checklist is for Horizon Cloud customer accounts that have never had a Horizon Cloud on Microsoft Azure deployment in their tenant environment. Such tenants might be referred to as clean-slate environments or greenfield environments.
You must perform some items that follow before you deploy Horizon Cloud. You can defer some items until after the deployment is finished and running.
Microsoft Azure Subscription Requirements
For configuration limits, see Sizing Your Horizon Cloud Deployment, which includes information about using the Configuration Maximums tool. Starting on the Configuration Maximums page, select View Limits, Horizon Cloud, the most recent version, and the categories you want to view.
| ☐ | Valid Microsoft Azure subscriptions in a supported Microsoft Azure environment. If you want to deploy Horizon Edge appliances, which includes Horizon Edge Gateway and Unified Access Gateway instances, in their own dedicated provider (Microsoft Azure subscription), obtain another valid Microsoft Azure subscription to deploy pools.
Note: Horizon Cloud supports most Microsoft Azure regions. |
| ☐ | Valid Microsoft Azure administrative privileges in each Microsoft Azure subscription, for you to use the Microsoft Azure portal and perform the Horizon Cloud deployment preparation steps. |
| ☐ | Ensure that no Azure policy or resource locks are in place that would prevent Edge deployment resources from being created. For example, private endpoint creation which is blocked by a policy or resource lock created if you select Azure Private Link connectivity. |
| ☐ | Create one or more service principals in each Microsoft Azure subscriptions, noting the Subscription ID, directory ID, and application ID, and assign the appropriate role to each service principal in your subscriptions.
When you create multiple service principals, they share the Subscription ID and directory ID, but each service principal has its own application ID. |
| ☐ | Determine the type Microsoft Azure Edge format you want to deploy. The following options are available.
|
| ☐ | To Deploy Edge Gateway (AKS), Create a Microsoft Azure User Managed Identity. Horizon Edge using an AKS cluster requires a user managed identity with the Network Contributor role at the management VNet’s resource group scope and the Managed Identity Operator role at the Microsoft Azure subscription scope. See Microsoft documentation about managing user-assigned managed identities. If your Management subnet has a route table and the resource group of that route table is different than the VNet’s resource group, then the Network Contributor role must also be assigned to the resource group of the route table. |
| ☐ | Register the required resource providers for your Microsoft Azure subscription. See Confirm Required Resource Providers Are Registered in Your Microsoft Azure Subscription. |
| ☐ | Create a custom role that provides READ permissions to the Azure Compute Galleries in your subscriptions and assign that custom role to all service principals configured for a given Horizon Edge. |
| ☐ | If your Azure subscription requires resource groups to have certain tags applied during deployment, have a list of those Azure resource tags available to be provided during deployment of your Microsoft Azure Edge. |
| ☐ | If you plan to use encryption for an Edge Gateway (AKS) deployment, enable encryption in your Microsoft Azure subscription. If you have EncryptionAtHostSupported features enabled at the subscription level, then disk encryption is honored. To enable this feature in your Azure subscription, perform the steps in the Prerequisites section of Use the Azure portal to enable end-to-end encryption using encryption at host. |
Microsoft Azure Capacity Requirements
Where the following table refers to Microsoft Azure capacity, no manual installation is necessary. As long as the stated capacities are available in the subscription, the deployer automatically instantiates the described VMs.
| ☐ | Microsoft Azure capacity for the core Horizon Edge resources to deploy into that subscription. Notice that the capacity requirements vary depending on the Microsoft Azure Edge format you deploy, either Edge Gateway (AKS) or Edge Gateway (VM).
|
Network Requirements
The following network requirements include the details necessary to successfully deploy and operate a Horizon Edge. The two tables that follow are similar, but different. Use the table that applies to the Microsoft Azure Edge format type you plan to deploy, Edge Gateway (VM) or Edge Gateway (AKS).
-
Edge Gateway (VM)
Use the following table for an Edge Gateway (VM) deployment.
Network Requirements for an Edge Gateway (VM)
| ☐ | Microsoft Azure Virtual Network (VNet) created in your target Microsoft Azure region with applicable address space to cover required subnets. See Configure Network Settings for Microsoft Azure Regions. |
| ☐ |
The following subnet requirements are minimum. For larger environments, larger subnets might be required.
When you choose to use a dedicated provider to deploy Horizon Gateway appliances (Horizon Edge Gateway and Unified Access Gateway) you must create backend subnets in the provider from which desktops will be deployed. |
| ☐ | Confirm that your internal networks do not overlap the following values used by Kubernetes, which run inside the Edge Gateway (VM) deployment type.
|
| ☐ | Configure the VNet (Virtual Network) DNS server, pointing to a valid DNS server that can resolve both internal machine names and external names. See Configure Required DNS Records After Deploying Horizon Edge Gateway and Unified Access Gateway. For internal endpoints, AD server is an example. For external endpoints, outbound Internet access on the VNets you are using for the gateway deployment must resolve and reach specific DNS names using specific ports and protocols. This is required for deployment and ongoing operations. |
| ☐ | Outbound Internet access on the VNets you are using for the Horizon Edge deployment must resolve and reach specific DNS names using specific ports and protocols. This is required for deployment and ongoing operations. For the list of DNS names and ports, see Make Appropriate Destination URLs Reachable to Deploy a Horizon Edge Gateway in a Microsoft Azure Environment. |
| ☐ | Optional. Proxy server information if required for outbound internet access on the VNet that is used during deployment and ongoing operations of the Horizon Cloud environment. |
| ☐ | Optional. Microsoft Azure VPN/Express Route configured, when you want networking between the VNet and your on-premises corporate network. |
-
Edge Gateway (AKS)
Use the following table for an Edge Gateway (AKS) deployment. These requirements include support for the configuration of Horizon Edge Gateway using an AKS cluster. Configuring Horizon Edge Gateway using an AKS cluster provides you with a more easily scalable solution.
Network Requirements for an Edge Gateway (AKS)
| ☐ | Microsoft Azure Virtual Network (VNet) created in your target Microsoft Azure region with applicable address space to cover required subnets. See Configure Network Settings for Microsoft Azure Regions. |
| ☐ |
The following subnet requirements are minimum. For larger environments, larger subnets might be required.
When you choose to use a dedicated provider to deploy Horizon Gateway appliances (Horizon Edge Gateway and Unified Access Gateway) you must create backend subnets in the provider from which desktops will be deployed. |
| ☐ | If deploying an Edge Gateway (AKS) and you select the cluster outbound type value as NAT gateway at the time of Edge creation, configure a NAT gateway on the Management subnet to enable outbound connectivity for the Horizon Edge Gateway. If you select the cluster outbound type value as User defined routes at the time of Edge creation, configure a route table on the management subnet having the default route 0.0.0.0/0 pointing to a next hop of type VirtualAppliance or VirtualNetworkGateway. |
| ☐ | Gather the following CIDR IP address ranges, which you need to configure the Horizon Edge Gateway during deployment.
Note: Ensure that these ranges do not conflict with other ranges in use in your environment.
|
| ☐ | Configure the VNet (Virtual Network) DNS server, pointing to a valid DNS server that can resolve both internal machine names and external names. See Configure Required DNS Records After Deploying Horizon Edge Gateway and Unified Access Gateway. For internal endpoints, AD server is an example. For external endpoints, outbound Internet access on the VNets you are using for the gateway deployment must resolve and reach specific DNS names using specific ports and protocols. This is required for deployment and ongoing operations. |
| ☐ | Outbound Internet access on the VNets you are using for the Horizon Edge deployment must resolve and reach specific DNS names using specific ports and protocols. This is required for deployment and ongoing operations. For the list of DNS names and ports, see Make Appropriate Destination URLs Reachable to Deploy a Horizon Edge Gateway in a Microsoft Azure Environment. |
| ☐ | Optional. Proxy server information if required for outbound internet access on the VNet that is used during deployment and ongoing operations of the Horizon Cloud environment. |
| ☐ | Optional. Microsoft Azure VPN/Express Route configured, when you want networking between the VNet and your on-premises corporate network. |
| ☐ | If deploying an Edge Gateway (AKS), regarding a Horizon Edge using an AKS cluster, if the VNet you are using for the Horizon Edge deployment has a custom DNS server, you must add the Microsoft Azure DNS IP address 168.63.129.16 as a DNS forwarder for external-name resolution. |
Ports and Protocols Requirements
| ☐ | Specific ports and protocols are required for deployment and ongoing operations of your Horizon Cloud environment. See Port and Protocol Requirements for Your Horizon Cloud Deployment in Microsoft Azure. |
Unified Access Gateway Requirements
A cluster of Unified Access Gateway VMs is associated to a pool, which enables clients to have trusted Horizon Web Client connections to the VMs in that pool.
You use the Horizon Universal Console to configure Horizon Cloud with the Unified Access Gateway. The items below are required for that type of configuration.
| ☐ |
For all configuration types, outbound Internet access to the following endpoint name is required: *.horizon.omnissa.com When Allow Internal Access Over a Corporate Network is the Unified Access Gateway Access Type, either user defined routing or NAT Gateway can be applied to the Management subnet to allow outbound traffic. When the Unified Access Gateway Access Type is configured externally with a DMZ network, external access to the following endpoint name must be configured on the DMZ network: *.horizon.omnissa.com |
| ☐ | An internal FQDN, external FQDN, or both are required depending on the access type you select during the Unified Access Gateway configuration.
|
| ☐ | Certificate or certificates for the Unified Access Gateway in PEM or PFX format matching the FQDN. Note: If the certificate or certificates that you supply for this purpose use CRLs (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol) settings that refer to specific DNS names, then you must ensure outbound Internet access on the VNet to those DNS names is resolvable and reachable. During configuration of your supplied certificate in the Unified Access Gateway configuration, the Unified Access Gateway software reaches out to those DNS names to check the certificate's revocation status. If those DNS names are not reachable, deployment fails. These names are highly dependent on the CA that you used to obtain the certificates. |
| ☐ | Follow the appropriate subnet guidelines depending on your Unified Access deployment mode: Basic Mode:
Advanced Mode:
|
Understanding User Identity and Machine Identity
Horizon Cloud differs from other environments in how it handles identity. In Horizon Cloud, the service makes a distinction between user identity and machine identity, and it relies on both types of identity when establishing a secure connection between a client and a remote desktop or application.
Note: You might be new to this distinction between user identity and machine identity if you are more familiar with environments that use a single identity provider to authenticate both user and machine identity, such as the first-generation Horizon Cloud environment or a Horizon 8 on-premises environment.
In Horizon Cloud, you must set up an identity configuration consisting of an identity provider to authenticate the user identity and an identity provider to authenticate the machine identity.
-
User identity
Horizon Cloud requires you to register a user identity provider. The service uses this identity provider to authenticate client users attempting to access remote desktops and applications.
-
Machine identity
Horizon Cloud also requires you to register a machine identity provider. The service uses this identity provider to establish the machine identity of virtual machines that provide remote desktops and applications.
Through the machine identity provider, the service joins remote desktops and the virtual machine sources for remote applications to the trusted network domain that client users are entitled to access.
Supported Identity Configurations
Horizon Cloud requires you to register an identity configuration that consists of a user identity provider and a machine identity provider. Feature capabilities might vary depending on the particular identity providers included in the configuration.
Horizon Cloud supports the following identity configurations.
Supported Identity Configurations for Horizon Cloud
| Identity Configuration | User Identity Provider | Machine Identity Provider | Feature Considerations |
|---|---|---|---|
| A | Microsoft Entra ID Commercial or Microsoft Entra ID Government | Active Directory |
|
| B | Microsoft Entra ID Commercial or Microsoft Entra ID Government | Microsoft Entra ID |
|
| C | Workspace ONE Access Cloud or Workspace ONE Access On Premises | Active Directory |
|
| D | Omnissa Identity Service | Active Directory |
|
The following sections describe requirements for each supported user identity provider and machine identity provider.
User Identity Requirements
This section describes the requirements for the user identity provider that you choose to use in your identity configuration. Horizon Cloud supports Microsoft Entra ID and Workspace ONE Access as providers of user identity.
In addition to the requirements described in this section, see the Supported Identity Configurations section for information about feature considerations and the machine identity providers that you can use with each user identity provider. For an overview of how Horizon Cloud manages identity, see the Understanding User Identity and Machine Identity section.
-
Microsoft Entra ID
☐ When Microsoft Entra ID Commercial or Microsoft Entra ID Government is your user identity provider, a user with Microsoft Entra ID Global Administrator privileges must do the following. - Approve the requested permissions.
- Provide consent for the entire organization.
-
Workspace ONE Access
☐ When Workspace ONE Access Access Cloud or Workspace ONE Access On Premises is your user identity provider, a user with Administrator privileges must do the following. - Integrate the identity provider.
- Configure required pre-requisites for Horizon Cloud integration.
-
Omnissa Identity Service
☐ When Omnissa Identity Service is your user identity provider, a user with Administrator privileges must do the following. - Integrate the identity provider.
- Select Horizon Cloud to be used with Omnissa Identity Service.
Machine Identity Requirements
This section describes the requirements for the machine identity provider that you choose to use in your identity configuration. Horizon Cloud supports Microsoft Entra ID and Active Directory as providers of machine identity.
In addition to the requirements described in this section, see the Supported Identity Configurations section for information about feature considerations and the user identity providers that you can use with each machine identity provider. For an overview of how Horizon Cloud manages identity, see see the Understanding User Identity and Machine Identity section.
-
Microsoft Entra ID
☐ To enable the deletion of a pool or VM, ensure that the service principal has permissions to delete the device entry from Microsoft Entra ID. The permissions are as follows: - Scope: https://graph.microsoft.com
- Permission: Device.ReadWrite.All
- Read and write devices
- Admin Consent: Yes
☐ To allow the configuration of administrative units for a Microsoft Entra ID-joined pool, ensure that the service principal has the following permissions: - Scope: https://graph.microsoft.com
- Permission: AdministrativeUnit.ReadWrite.All
- Read and write administrative units.
- Admin Consent: Yes
- Scope: https://graph.microsoft.com
- Permission: RoleManagement.Read.Directory
- Read all directory RBAC settings. This permission is required to validate service principal role assignments.
- Admin Consent: Yes
- Scope: https://graph.microsoft.com
- Permission: Device.Read.All
- Read all devices in the directory. This permission is required to read the Entra ID joined pool VM device information and to add that device to the pool administrative unit.
- Admin Consent: Yes
When planning to use administrative units, if you do not wish to provide the Device.ReadWrite.All permission, you can apply the following permission with the appropriate scope either at the directory level or the administrative unit level:- Scope: Entire directory or specific administrative units
- Permission: microsoft.directory/devices/delete
- Delete devices from Microsoft Entra ID.
- Admin Consent: Yes
☐ Configure Role-based Access Control (RBAC) in Microsoft Entra ID. This configuration ensures that only the users or user groups that have Virtual Machine Administrator Login or Virtual Machine User Login role can log into their entitlements.
-
Active Directory
☐ Active Directory server with line-of-sight to the Horizon Edge Gateway instances and desktop subnets. For example: - An on-premises Active Directory server connected via VPN/Express Route
- An Active Directory server located in Microsoft Azure
☐ If you plan to connect your Active Directory using LDAPS, gather PEM-encoded root and intermediate CA certificates for your Active Directory domain. When you use the Horizon Universal Console to set up your Active Directory Domain, you are prompted at that time to upload the PEM-encoded root and intermediate CA certificates. ☐ Supported Microsoft Windows Active Directory Domain Services (AD DS) domain functional levels. - Windows Server 2016
- Windows Server 2012 R2
- Windows Server 2012
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
- Windows Server 2012 R
☐ - Domain Bind Account
Active Directory domain bind account (a standard user with read access) that has the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >.
The account must have the following permissions:
- List Contents
- Read All Properties
- Read Permissions
- Read tokenGroupsGlobalAndUniversal (implied by Read All Properties)
Set the account password to Never Expire to ensure continued access to log in to your Horizon Cloud environment.
- If you are familiar with the Horizon on-premises offering, the above permissions are the same set that are required for the Horizon on-premises offering's secondary credential accounts.
- Domain bind accounts are granted the default out-of-the-box read-access-related permissions typically granted to authenticated users in a Microsoft Active Directory deployment. However, if your organization's AD administrators have chosen to lock down read-access-related permissions for regular users, you must request those AD administrators preserve the authenticated users standard defaults for the domain bind accounts you will use for Horizon Cloud.
☐ - Auxiliary Domain Bind Account
Must be separate from the main domain bind account. The UI will prevent re-using the same account in both fields. Active Directory domain bind account (a standard user with read access) that has the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The account must have the following permissions:- List Contents
- Read All Properties
- Read Permissions
- Read tokenGroupsGlobalAndUniversal (implied by Read All Properties)
- If you are familiar with the Horizon on-premises offering, the above permissions are the same set that are required for the Horizon on-premises offering's secondary credential accounts.
- Domain bind accounts are granted the default out-of-the-box read-access-related permissions typically granted to authenticated users in a Microsoft Active Directory deployment. However, if your organization's AD administrators have chosen to lock down read-access-related permissions for regular users, you must request those AD administrators preserve the authenticated users standard defaults for the domain bind accounts you will use for Horizon Cloud.
☐ - Domain Join Account
Active Directory domain join account which can be used by the system to perform Sysprep operations and join the virtual computers to the domain. Typically a new account that you create for this express purpose. (A domain join user account) The account must have the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >. The use of white spaces in the account's user name is currently unsupported. Set the account password to Never Expire to ensure continued ability for Horizon Cloud to perform the Sysprep operations and join the virtual computers to the domain. This account requires the following Active Directory permissions, applied to the Computers OU, or to the OU that you will enter into the console's Domain Join UI.- Read All Properties - this object only
- Create Computer Objects - this object and all descendant objects
- Delete Computer Objects - this object and all descendant objects
- Write All Properties - Descendant Computer objects
- Reset Password - Descendant Computer objects
For more details on creating and reusing domain join accounts, see Creating Active Directory Domain Bind and Domain Join Accounts.
In Microsoft Active Directory, when you create a new OU, the system might automatically set thePrevent Accidental Deletionattribute which applies aDenyto the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear theDenythat Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear theDenypermission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.
☐ - Optional Auxiliary Domain Join Account
Active Directory domain join account which can be used by the system to perform Sysprep operations and join the virtual computers to the domain. Typically, a new account that you create for this express purpose (A domain join user account).
The account must have the sAMAccountName attribute. The sAMAccountName attribute must be 20 characters or less and cannot contain any of the following characters: "/ \ [ ] : ; | = , + * ? < >.
The use of white spaces in the account's user name is currently unsupported.
Set the account password to Never Expire to ensure continued ability for Horizon Cloud to perform the Sysprep operations and join the virtual computers to the domain.
This account requires the following Active Directory permissions, applied to the Computers OU, or to the OU that you will enter into the console's Domain Join UI.- Read All Properties - this object only
- Create Computer Objects - this object and all descendant objects
- Delete Computer Objects - this object and all descendant objects
- Write All Properties - Descendant Computer objects
- Reset Password - Descendant Computer objects
In Microsoft Active Directory, when you create a new OU, the system might automatically set thePrevent Accidental Deletionattribute which applies aDenyto the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear theDenythat Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear theDenypermission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.
☐ - Active Directory organizational unit (OU) or units (OUs) for virtual desktops and RDS session-based desktops or published applications or both.
In Microsoft Active Directory, when you create a new OU, the system might automatically set thePrevent Accidental Deletionattribute which applies aDenyto the Delete All Child Objects permission for the newly created OU and all descendant objects. As a result, if you explicitly assigned the Delete Computer Objects permission to the domain join account, in the case of a newly created OU, Active Directory might have applied an override to that explicitly assigned Delete Computer Objects permission. Because clearing the Prevent Accidental Deletion flag might not automatically clear theDenythat Active Directory applied to the Delete All Child Objects permission, in the case of a newly added OU, you might have to verify and manually clear theDenypermission set for Delete All Child Objects in the OU and all child OUs before using the domain join account in the Horizon Cloud console.
Image Management System Requirements
Your Microsoft Azure subscription must accommodate the following requirements depending on the types of images you want to provision from the deployed Horizon Edge.
☐ Base for the image. One or more of the supported Microsoft Azure VM configurations. - Microsoft Azure generation 1 and 2 VMs are supported.
Non-GPU:- Standard_DS2_v2
- Standard_NV12s_v3
Pool VM Requirements
Your Microsoft Azure subscription must accommodate the following requirements depending on the types of pool VMs you want to provision from the deployed Horizon Edge.
☐ Model selection for the VMs in pools — any of the Microsoft Azure VM configurations available in the Microsoft Azure region, except for those not compatible with Horizon Cloud desktop operations.
Consider the following details when selecting a VM model.- The decision to select between a GPU-enabled model type and Non-GPU model type depends on the VM selected during image creation.
- To create a multi-session pool, select an image created using a multi-session operating system.
- For production environments, scale testing recommends using models that have a minimum of 2 CPUs or larger.
- See Microsoft Azure VM Types and Sizes for Horizon Cloud (89090) to learn about the compatibility of different Microsoft Azure VM types and sizes with Horizon Cloud.
- Microsoft Azure generation 1 and 2 VMs are supported in pools.
Horizon Client and Horizon Web Client Requirements
☐ Ensure that your end users use a supported client to access their service-provided resources. See the list at Release Notes - Client Support section
Tip: When end users connect to Horizon Cloud using a browser, their connections automatically use the latest version of the Horizon Web Client.
Was this page helpful?