Azure Private Endpoint for an App Volumes Application Storage Account

The Azure private endpoint solution can be used to securely access storage accounts and file shares. Using the Horizon Universal Console, you can configure a private endpoint for a storage account either when deploying a new Horizon Edge or for an existing Horizon Edge.

When configuring a private endpoint and selecting a subnet (either Edge Gateway management subnet or custom subnet), ensure that the following prerequisites are set up in the Azure portal:

• Mandatory permissions configured at the subscription level:

  Note: When you create a service principal, the custom role must have the permissions listed here.

  
  "Microsoft.Resources/deployments/*",
  "Microsoft.Resources/subscriptions/resourceGroups/read",
  "Microsoft.Network/virtualNetworks/read",
  "Microsoft.Network/virtualNetworks/subnets/read",
  "Microsoft.Network/virtualNetworks/subnets/join/action",
  "Microsoft.Network/privateEndpoints/read",
  "Microsoft.Network/privateEndpoints/write",
  "Microsoft.Network/privateEndpoints/delete",
  "Microsoft.Network/locations/availablePrivateEndpointTypes/read"
  
  

  For more information about these permissions, see Microsoft documentation.

• Network peering between the following components:

  • Custom VNet where the private endpoint is configured and the VNet of the Edge Gateway Management.

  • Custom VNet where the private endpoint is configured and the VNet of each (existing or new) desktop pool. Network peering allows the Edge Gateway Management and the desktop pool to securely communicate with the storage account and file shares through the private endpoint.

  • Connectivity between networks in Microsoft Azure can be achieved by using the Hub-Spoke network model, in which case VNet peering is not required. You can leverage Hub-Spoke network topology for Desktop and Unified Access Gateway (UAG) subnets located in different VNets. This provides an alternative for environments where direct VNet peering is not preferred or required by organizational policy. For more information about Microsoft Azure hub and spoke architecture, see Hub-spoke network topology in Microsoft Azure product documentation.

Status of a Private Endpoint

The following are the different statuses of a private endpoint:

• Connected

  After a private endpoint is configured either for a new or existing Horizon Edge deployment, the status of the private endpoint is Connected.

• Not Configured

  When an existing storage account is not configured with a private endpoint or the configured private endpoint gets deleted, then the status of the private endpoint is Not Configured.

  For such a storage account, a private endpoint can be configured using the Configure Private Endpoint option. This option is available for each Horizon Edge in the Azure Storage Accounts table present in the App Volumes Application Storage section.

To configure a private endpoint when deploying a new Horizon Edge, see Deploying a Microsoft Azure Edge. To configure a private endpoint for an existing Horizon Edge, see Horizon Edge Details.