Adding an Image with Microsoft Azure

There are three ways to add images to Microsoft Azure. Choose the best method for your needs and ensure all prerequisites are met before proceeding. Refer to Managing Images for Microsoft Azure Provider Deployments for more information.

If you plan to use encryption for an Edge Gateway (AKS) deployment, enable encryption in your Microsoft Azure subscription. Having the EncryptionAtHostSupported feature enabled at the subscription level honors disk encryption. To enable this feature, follow the steps in the Prerequisites section of Use the Azure portal to enable end-to-end encryption using encryption at host.

Methods to Add Images

There are three ways you could use to add images to Microsoft Azure:

1. Add an Image from Microsoft Azure Marketplace: Use this option if you need an image based on the latest OS builds available in the Azure Marketplace.

2. Add an Image with Microsoft Custom VM: Use this option if you have a custom workflow in Azure that generates base VMs for preparing images. This method also supports adding an image on a custom VM hosted on a Microsoft Azure dedicated host, including VMs that are managed using UEM. Refer to Requirements Checklist for Deploying a Microsoft Azure Edge.

3. Add an Image from Microsoft Azure Compute Gallery: Use this option if you have an existing image in your Microsoft Azure Compute Gallery.

Prerequisites

Before adding an image, ensure the following prerequisites are met:

• Plan Your VM Model: Decide on the VM model based on the requirements outlined in Requirements Checklist for Deploying a Microsoft Azure Edge.

• Gateway Status: Ensure the Unified Access Gateway and Horizon Edge Gateway are in a Ready state.

• Subscription Verification:

  • Verify that your subscription has adequate CPU cores quota for the selected VM model. Refer to Requirements Checklist for Deploying a Microsoft Azure Edge for supported model types.

  • Ensure your subscription has the Encryption At Host feature enabled if using a VM model that supports EncryptionAtHostSupported. Refer to the same document above for details. Note: Encryption At Host is only supported for Linux Image VMs and not for Pool VMs.

• Network and IP Address Verification:

  • Verify that tenant (desktop) subnets allow a sufficient number of IP addresses.

  • Ensure you have the required number of public IP addresses provisioned for Microsoft RDP access.

• URL Accessibility: Verify that softwareupdate.omnissa.com is accessible (resolvable and reachable) over the 443 port on TCP protocol. For more details, refer to Port and Protocol Requirements for Your Horizon Cloud Deployment in Microsoft Azure.

• Virtual Network Configuration: Ensure at least one virtual network and tenant (desktop) subnet is selected for the provider.

• Guest Operating System Support: Determine if the guest operating system of the image is supported. Refer to the Interoperability Matrix for compatibility information.

• Red Hat Enterprise Linux (RHEL) - Bring Your Own Subscription (BYOS): Using the Bring Your own subscription (BYOS) option for Red Hat Enterprise Linux images requires Red Hat products for Cloud Access on Azure to be enabled for the Azure subscription.

  Red Hat Cloud Access must be configured in Red Hat Subscription Management by:

  • Enabling Red Hat products for Cloud Access on Azure.

  • Adding the Microsoft Azure Subscription IDs to Cloud Access.

  If Red Hat Cloud Access is not enabled, the image import operation cannot be completed. For step-by-step instructions, refer to Red Hat Cloud Access.

• UEM Onboarding Workflow: Create an onboarding workflow in UEM with the Org ID (see Perform Actions using Workflows). Also, create a UEM OAuth client for the required settings configuration.

UEM Management Prerequisites

Your org should be running UEM 2602 version and above.

• The enrolment OG setting should be configured for Intelligent Hub Managed Mode.

• Create a UEM OAuth client and add it in the UEM integration section of IMS so that IMS can integrate with UEM.

• In the same section add the enrolment parameters for devices to enroll into UEM.

• In UEM the Workflow Step Status Reporting Interval should be set to 5 minutes.

• In UEM create an onboarding workflow to run as soon as the device enrolls. Include all applications, profiles, scripts etc that are required in the golden image (see Perform Actions using Workflows).

• Include in this workflow a managed resources profile to keep apps, baselines and profiles and unenrollment. If the image will not be enrolled into UEM in the pools then the keep hub setting can be left as default.

• The VM image must be provisioned with the Intelligent HUB in provisioning mode. Use the following command when installing the Hub: Msiexec -- PROVISIONHUB=Y

• 1. If the image will be used in the pools then include a script in the Workflow to set the Deferred Enrolment Feature Flag registry setting to True:

  HKEY_LOCAL_MACHINE\SOFTWARE\AIRWATCH\Feature\DeferEnrollmentFeatureFlag - True
  

Adding an Image from Microsoft Azure Marketplace

When adding an image using this option, Azure deploys a new virtual machine with the selected operating system. After adding the image, customize it according to your needs. Lastly, you must publish the image to make it available for use in pool templates.

Note:

• During the image publish process, the Horizon Agent installation only supports Windows images.

• For Linux images, Horizon Agent installation must be performed manually.

  Before publishing a Linux image, install a supported Horizon Agent for Linux on the Linux virtual machine.

  For installation instructions, see:

  • Install Horizon Agent on a Linux Virtual Machine
  • Install Linux Dependency Packages for Horizon Agent

  If you are updating an existing Linux image, see:

  • Upgrade Horizon Agent on a Linux Virtual Machine

  For supported Linux distributions, Horizon Agent versions, and interoperability information, see the Interoperability Matrix.

• Supported Linux OS images include Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Red Hat Enterprise Linux (RHEL) 8.6, 9.6 (single-session only).

• The Manage with UEM option is supported only for Windows images.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the appropriate option.

3. In the General Information section, add a unique Image Name and click Next.

   The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Marketplace and click Next.

7. In the Destination sub-section, select the Site, Horizon Edge, and Provider.

8. In the VM details sub-section, select the OS, Generation Type, VM Model Type, and VM Model.

   When a Linux operating system is selected, select the appropriate license type based on the OS distribution:

   • Red Hat Enterprise Linux: Choose either Pay as you go (PAYG) or Bring your own subscription (BYOS).

     The BYOS option requires Red Hat products for Cloud Access on Azure to be enabled for the subscription.

   • Ubuntu: Only Pay as you go (PAYG) is available.

9. Select Generation Type between V1 and V2.

10. For Windows images, the OS supports only a specific Security type. A Security type option will be automatically selected and deactivated between Standard and Trusted launch.

    If you select V1, only Standard Security type is activated. Standard provides a basic level of security to virtual machines.

    If you select V2, Trusted launch for Security type is activated by default. Secure boot is enabled by default, which provides protection against boot kits, rootkits, and kernel-level malware. Virtual Trusted Platform Module (vTPM) is also enabled by default, which securely stores keys, secrets and validates VM boot integrity. Trusted launch provides enhanced security and prevents advanced attacks on Gen 2 virtual machines.

    You can also select Standard Security type for V2.

11. Select a VM Model Type (With GPU / Without GPU).

12. Select a supported VM Model from the available options.

    VM Model options are shown based on VM model type and Generation Type selections. If the selected VM model supports Encryption At Host, the toggle will be activated automatically. This feature encrypts temporary disks and ephemeral OS disks using platform-managed keys.

13. In the Network sub-section, enable Public IP by sliding the toggle to access the image through a Remote Desktop Protocol (RDP) connection, then Select Network.

    To customize and optimize images, you need a VM created from the image running on an appropriate network to log in. Therefore, you must provide appropriate VNet, subnet, and public IP that have sufficient quota on resources.

14. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account to access the image's operating system, and to use during the image customization process.

    Note: These credentials are used to remotely access the VM during image customization (RDP for Windows images, SSH for Linux images).

15. Select Windows license with Software Assurance (required only for Windows-based images) and click Next. Adding an image from Microsoft Azure Marketplace brings it to an Unpublished state. After customization, publish the image before it can be used in pool templates.

16. Select Manage with UEM by enabling the toggle if the customer is using UEM; otherwise, click Add.

    When you add an image from Microsoft Azure Marketplace, it is created in an unpublished state. If Manage with UEM is enabled, the image is customized by UEM before it is ready to be published. You must publish the image before it can be used in pool templates.

    Note: Hub Agent installation is not applicable in this workflow. Both Dedicated and Floating pools are supported.

Adding an Image with Microsoft Azure Custom VM

When you select this option, an existing Azure VM is registered with the Horizon Cloud IMS service as a Custom Image. The Custom VM is then managed by IMS and deleted after the image publish operation. After adding the image, you can perform additional customizations before publishing it for use in pool templates.

Important Considerations

• Ensure the Azure VM is healthy with the Azure agent in a "Ready" status.
• The VM and its associated resources (e.g., disks, NICs) must be in the same resource group.
• The OS of the Custom VM must match the OS selected in the UI.

Prerequisites for Microsoft Azure Custom VM

• VM Model Type: The Custom VM must be either generation 1 or generation 2.

• Role-Based Access Control (RBAC): Set up RBAC for the resource group containing the Custom VM.

• Region Consistency: The Target Provider region and the Custom VM's region must be the same.

  Note: The selected Custom VM is converted to a generalized image and cannot be reused as a VM during the image publish workflow. It is recommended to keep a backup of the VM.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the appropriate option.

3. In the General Information section, add a unique Image Name and click Next. The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Custom VM and click Next.

7. In the Destination sub-section, select the Site, Horizon Edge, and Provider.

8. In the VM details sub-select a VM.

   For this VM selection, the Azure resource group must be selected beforehand from the drop-down list. While both resource groups contain the name pattern hcs-<ProviderInstance_Id>-base-vms, select the appropriate resource group that is applicable to your existing Microsoft Azure Edge. All custom VMs must be part of the selected resource group. Also, note that the image and any other related resources will be in the same resource group. You can obtain the resource group name in the Microsoft Azure portal, on the VM details page.

   Note: Pools can only be provisioned with the generation type of the selected VM.

9. Select the OS type of this Custom VM. Be sure to accurately select the OS type of the Custom VM as it cannot be verified after selecting.

   When a Linux operating system is selected, select the appropriate license type based on the OS distribution:

   • Red Hat Enterprise Linux: Choose either Pay as you go (PAYG) or Bring your own subscription (BYOS).

     The BYOS option requires Red Hat products for Cloud Access on Azure to be enabled for the subscription.

   • Ubuntu: Only Pay as you go (PAYG) is available.

10. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account to access the image's operating system, and during the image customization process.

    • The username cannot exceed 19 characters and cannot end with a (.) period.

    • Usernames prohibited by Microsoft Azure, such as guest or administrator cannot be used.

    • Passwords must be 12 to 123 characters and meet 3 of the following requirements: lowercase letter [a-z], uppercase letter [A-Z], number, special character (!@#$%/^&*).

    • Some passwords prohibited by Microsoft Azure, such as Password1 cannot be used.

11. Select Windows license with Software Assurance when adding Windows-based images, and click Add.

    Note: This option applies only to Windows-based images. Linux images do not require Windows licensing and this checkbox should be left unchecked when adding Linux OS images.

Adding an Image from Microsoft Azure Compute Gallery

This option is typically used by Managed Service Providers (MSPs) who publish images into their own organization using the Horizon Cloud image management system and then copy these images to customer organizations. The source image in the Microsoft Azure Compute Gallery must contain the appropriate Horizon Agent (compatible with Horizon Cloud) and must be generalized after all customizations are performed. Windows images must be generalized using Microsoft Sysprep, while Linux images must be generalized using waagent -deprovision+user. These images are copied directly to the target provider's Azure Compute Gallery and used as-is for pool creation without needing to be published.

Important Considerations:

• When using this option, choose Copy from source image under image attributes and provide the Organization ID where the source image was published. This ensures that required attributes like Horizon Agent version and image metadata are copied from the source image.

• If you choose Override and do not provide the Organization ID, the IMS services will not have information about image attributes like Horizon Agent version and features.

Prerequisites for Microsoft Azure Compute Gallery

• Image Compatibility: Refer to the Interoperability Matrix to ensure the image is supported.

• Image Definition: Verify that the Offer and SKU values for the Microsoft Windows operating system are correctly set in your Microsoft Azure Compute Gallery image definition. For example, for Microsoft Windows Server 2022, ensure the Offer value is windowsserver and the SKU value is 2022-datacenter.

Procedure

1. From the Horizon Universal Console, select Images in the left menu.

2. On the Images page, click Add and select the appropriate option.

3. In the General Information section, add a unique Image Name and click Next. The image version is automatically appended to the name with dashes to create the image copy name (Image-1-0, Image-1-100).

4. You can add a Description of the image.

5. In the Markers field, you can add new markers. Give unique names to the markers. New markers are saved when the image is saved.

6. In the Image Source section, select Microsoft Azure Compute Gallery and click Next.

7. In the Destination sub-section, select the Site and Horizon Edge.

8. In the Source image version details sub-section, add the Microsoft Entra ID Tenant ID from the Microsoft Azure portal. Add the Resource ID obtained from the Microsoft Azure portal by clicking on the JSON View link located on the image version of the image definition. If the image was published using Horizon Universal Console, this ID can be obtained from the Location Path column of the Image Copies grid on the image version details page.

   Ensure that the provider of the selected destination Horizon Edge has Microsoft Azure RBAC read access to the source image or resource group containing the image. Ensure that the source image is already published with the Horizon agent.

   Note: When using an Omnissa managed app, the following additional configuration is required:

   • The Omnissa managed app at the top of the table must have at least Reader access to the Azure Compute Gallery or the resource group containing the image.

   • Source subscription: The subscription where the source Azure Compute Gallery image resides. This can be owned by a Microsoft partner or Managed Service Provider (MSP).

   • Target Subscription: The subscription used by the Horizon Cloud provider to create Azure resources (such as Horizon Edge, UAG, images, and pools).

   • The Omnissa managed app must have the required permissions as defined in the existing service principal requirements.

   • Ensure that appropriate Microsoft Azure RBAC permissions are assigned in both subscriptions.

9. Select Copy from source for image for Image Attributes to use the attributes from the source image version.

   • If you are supported by a Managed Services Provider (MSP), then you can copy the image from the MSP organization’s provider to your provider. This process leverages a published source image in the Horizon catalog corresponding to an external organization (MSP) other than your own organization. The MSP provides a complete image including the details of the application residing in the server or multi-session image.

   • When you select Copy from source for image, specify the Organization ID that shared or published the image originally.

   • Override allows you to configure the attributes. Override option is applicable when you want to copy a source image that is not in your Horizon catalog. For example, an image from an external subscription that is readable by the Horizon provider’s subscription.

   • When you import an external image, make sure that the source image has the latest Horizon agent installed, or else the VMs that are created as part of desktop/server pools on this image might encounter an error.

   • A source image is an already published image that is generalized with the necessary agent and software. Thus, a copy of the same image into a customer organization can be directly used by pools. It could also be re-published to other subscriptions or regions. Your provider must have appropriate RBAC access to the source image.

   • When you select Override, specify the OS of the source image. If the OS does not support a specific generation type, a supported generation type is selected by default.

   • When a Linux operating system is selected, select the appropriate license type based on the OS distribution:

     • Red Hat Enterprise Linux: Choose either Pay as you go (PAYG) or Bring your own subscription (BYOS).

       The BYOS option requires Red Hat products for Cloud Access on Azure to be enabled for the subscription.

     • Ubuntu: Only Pay as you go (PAYG) is available.

10. If selectable, select a Generation Type option. Note: Microsoft Azure generation 1 and 2 VMs are supported. If you select V1, pools can be provisioned only with V1 generation models.

11. In the VM details sub-section, select the VM Model Type and VM Model. Note: Your selections for the Generation Type and the VM Model Type act as a filter and determine which VM models are available in the VM Model drop-down menu.

12. In the Admin credentials for VM sub-section, add a Username and Password for the local admin account. This account is used to access the image's operating system, and during the image conversion process.

13. Select Windows license with Software Assurance when adding Windows-based images, and click Add.