Azure Virtual Desktop – Terraform – Create a Host Group, Desktop Application Group and Workspace for Clustered Remote Application aka Published Applications (Part 3) (2023)

In the previous blog post we look at creating Personal Desktop (1x1 mapping) and Shared Desktop (1 x Many) using TerraformAzure Virtual Desktop – Terraform – Create a Host Pool, Desktop Application Pool and Workspace for Personal Desktop (Part 1) | AskAreshandAzure Virtual Desktop – Terraform – Create a Host Pool, Desktop Application Pool and Workspace for Team Desktop (Part 2). In this series of blog posts I will show how to create AVD Host Pool, Application Pool and Workspace using Terraform for Pooled Remote App aka Published Applications (1xMany)

We will create the following three types of configurations using Terraform:

  • Azure Virtual Desktop – Personal Desktop (1×1) – Part 1
  • Azure Virtual Desktop – Pooled Desktop (Multi-Session Full Desktop Experience) – Part 2
  • Azure Virtual Desktop – Remote Application (Multi-session Application, also known as Published Apps) – Part 3

Note– We build Pooled RemoteApp in this post and next post were the other guys. In this post In this post I will not show the case of creating a service principal and secret, please refer to Part 1 for this activity.


Here are the prerequisites before you start

(Video) Develop and Deploy applications on Kubernetes

  • An Azure subscription
  • The Terraform CLI
  • The Azure CLI
  • Emptywithin your Azure subscription to use Terraform

Terraform – Authentication via Service Manager & Secret client

Before we run any Terraform code the following powershell (Make sure it's running as an administrator) will run and save the credentials as environment variables. If we do this via the environment variable, we don't need to store the following information in the file. In a future blog post there are better ways to store the following details and I hope to introduce them:

# PowerShell $ env: arm_client_id = "9E453B62-0000-0000-0000-00000006E1AC" $ env: arm_client_secret = "z318q ~ 000000000000000000000000000000 _" $ env: arm_tenant_id = "a02e602c-0000-00-00-0 Arm_subscription_id = " 7b051460-00000-00000-00000-000000ecb1"
  • Azure Subscription ID – Azure Portal Subscription copy ID
  • Customer ID – From the above step you will have the details
  • Client Secret – From the above step you will have the details
  • Tenant ID – While creating the Enterprise Apps in ADD, you will have the details

Terraform Folder Structure

Here is the folder structure for the terraform code:

Azure Virtual Desktop Pooled RemoteApp– Create a directory to publish the following Terraform code (,, and

+---Config-AVD-Pooled-RemoteApp| || || || |

AVD Configuration – Pooled RemoteApp –

Create a file named and enter the following code:

(Video) Windows Virtual Desktop │ Expert Talk │Skill Me UP Academy

terraform { require_providers { azurerm = { source = "hashicorp/azurerm" version = "3.49.0" } azuread = { source = "hashicorp/azuread" } }}provider "azurerm" { attributes {}}

AVD Configuration – Pooled RemoteApp –

Create a file named and insert the following code. Let me explain what we are trying to achieve here:

  • Create a resource group
  • Create a workspace
  • Create a Host Pool
  • Create a Remote Application Group (RAG)
  • Partner workplace and RAG
  • Map the Azure AD group to the Desktop Application Group (RAG)
  • Map the Azure AD Group to the Resource Group for RBAC for the Session Host (Virtual Machine User Login)
# The resource group name is extracted when the execution plan is applied.resource "azurerm_resource_group" "rg" { name = var.rg_name location = var.resource_group_location tags = var.tags}# Create AVD workspaceresource "azurerm_virtual_desktop_workspace" "varspace" { name .workspace resource_group_name = location = azurerm_resource_group.rg.location friendly_name = "${var.prefix} Workspace" description = "${var.prefix} Workspace" tags = var.tags}# Create host pool resource AVD " azurerm_virtual_desktop_host_pool" "hostpool" { resource_group_name = location = azurerm_resource_group.rg.location name = var.hostpool friendly_name = var.hostpool validate_environment = false . getisaadjoined:i:1; drivestoredirect:s:*;audiomode:i:0;videoplaybackmode:i:1;redirectclipboard:i:1;redirectprinters:i:1;devicestoredirect:s:*;redirectcomports:i:1;redirectsmartcards:i:1;usbdevicestoredirect: s:*;enablecredsspsupport:i:1;redirectwebauthn:i:1;use multimon:i:1;enablerdsaadauth:i:1;" description = "${var.prefix} HostPool" type = "Pooled" #[Pooled or Personal] preferred_app_group_type = "RailApplications" #[Desktop or RailApplications] maximum_sessions_allowed = 5 #[Tweak based on your vm tshirt size] load_balancer "Dtype_th " #[BreadthFirst or DepthFirst] tags = var.tagsscheduled_agent_updates { enabled = true timezone = "AUS Eastern Standard Time" # Update this value with the desired time zone schedule { day_of_week = "Saturday" hour_of_day = 1 #[1 here means 1:0 AM] }}} resource "azurerm_virtual_desktop_host_pool_registration_info" "registrationinfo" { hostpool_id = azurerm_virtual_desktop_host_pool expiration_date = var.rfc3339}# Create "AVDgroup" resource_group_name = host_pool_id = azurerm_virtual_desktop_host_pool.hostpool. id location = azurerm_resource_group.rg.location type = "RemoteApp" name = var.app_group_name friendly_name = "RemoteApp AppGroup" description = "${var.prefix} AVD RemoteApp application group" varet_on = [azurerm_virtual_desktop.desktophostartpool_space] tags = var. tags}# Associate Workspace and DAResource "azurerm_virtual_desktop_workspace_application_group_association" "ws-dag" { application_group_id = workspace_id = azurermworksktopign_virtual_id. the Application Group (RAG) resource "azurerm_role_assignment" "AVDGroupRemoteAppAssignment" { scope = role_definition_name = "Desktop Virtualization User" principal_id = data.azuread_group.AVDGroup.object_id }# Assignment for the AAD Group for the resource group ment" "RBACAsignment" { scope = role_definition_name = "Virtual Machine User Login" principal_id = data.azuread_group.AVDGroup.object_id}

Note– The individual applications have not yet been published. They can be published once you create the session host. After that, using Terraform, individual apps can be published as well. The applications exe path must be mapped to the operating system. I plan to create a separate blog post on creating session host via Terraform.

AVD Configuration – Pooled RemoteApp –

Create a file named and enter the following code:

variable "resource_group_location" { default = "australiaeast" description = "Resource Group Location - Australia East" } variable "rg_name" { type = string default = "AE-DEV-AVD-01-PO-A-RG" description = " Name of the resource pool in which service objects will be deployed"}variable "workspace" { type = string description = "Name of the Azure Virtual Desktop Workspace" default = "AE-DEV-AVD-01-WS"}variable "hostpool" " { type = string description = "Name of the Azure Virtual Desktop Pool host" default = "AE-DEV-AVD-01-PO-A-HP"}variable "app_group_name" { description = "Name of the Azure Virtual Desktop application group " type = string default = "AE-DEV-AVD-01-RAG"}variable "rfc3339" { type = string default = "2023-05-20T12:43:13Z" #Update this value with a future date description = " Registration token expiration"}variable "prefix" { type = string default = "AE-DEV-AVD-01-HP-" description = "Prefix of the name of the AVD HostPools"}variable "tags" { type = map( string ) default = { Environment = "Dev" Department = "IT" Location = "AustraliaEast" ServiceClass = "DEV" Workload = "Host Pool 01" }}data "azuread_client_config" "AzureAD" {}data "azuread_group" "AVDGroup" { display_name = "Win365-Users" }

AVD Configuration – Pooled RemoteApp –

Create a file named and insert the following code. This will show the console what is being developed in the form of output.

(Video) Deploy Windows Virtual Desktop (WVD) Session Hosts with Azure DevOps

output "azure_virtual_desktop_compute_resource_group" { description = "Name of the resource group where the session host will be deployed" value =} output "azure_virtual_desktop_host_pool" { description = "Name of the Azure hosttophost_pool" ol.hostpool .name}output " azurerm_virtual_desktop_application_group" { description = "Name of the Azure Virtual Desktop DAG" value = } output "azurerm_virtual_desktop_workspace" { description = "Desktopzureme }output "location" { description = "The Azure area" value = azurerm_resource_group.rg.location}data "azuread_group" "aad_group" { display_name = "Win365-Users"}output "AVD_user_groupname" { description = "Azure Active Directory Group for AVD users" value = data.azuread_group.aad_group.display_name}

Start Terraform – AVD – Pooled RemoteApp

Run terraform init to initialize Terraform deployment. This command downloads the Azure provider required to manage your Azure resources. (Pulls AzureRM and AzureAD)

Terraform init -upgrade

Create Terraform Execution Plan – AVD – Pooled RemoteApp

Run terraform plan to create an execution plan.

terraform plan -out mainavdremoteapp.tfplan

Implement Terraform Execution Plan – AVD – Pooled RemoteApp

Run the terraform application to apply the execution plan to your cloud infrastructure.

terraform apply mainavdremoteapp.tfplan

Validate the output in the Azure Portal

Go to Azure portal, select Azure Virtual Desktop and Select Host pools, Application Group and Workspace created using Terraform.

(Video) Tom Harvey - Infrastructure as Code with Terraform on Azure

Liquidate the above resources (Optional)

If you want to delete all above resources, you can use below commands to destroy. Execute the terraform plan and set the destruction flag.

terraform plan -destroy -out mainavdremoteapp.destroy.tfplan

Terraform execution application to implement the execution plan.

terraform app mainavdremoteapp.destroy.tfplan

Quick Start Links

The intent here is to get you up and running with Terraform on Azure Virtual Desktop Solution:

Setting up your computer to get started with Terrafor using PowershellInstall Terraform on Windows with Azure PowerShell
AVD Configure Azure Virtual Desktop
Terraform Learning

I hope you find this information helpful in getting started with Terraform to deploy Azure Virtual Desktop – Pooled Remote App. Let me know if I've missed any steps or details and I'll be happy to update the post.

(Video) How do I add a VM to my host pool Azure?

Ares Sarkari

Labels:AVD,Blue,Azure Virtual Desktop,HashiCorp,IaC,Microsoft,PowerShell,Terraform


How do I create an application group in Azure Virtual Desktop? ›

Sign in to the Azure portal. In the search bar, type Azure Virtual Desktop and select the matching service entry. Select Workspaces, then select the name of the workspace you want to assign an application group to. From the workspace overview, select Application groups, then select + Add.

How do I create an application group in Azure? ›

Select RemoteApp under Application group type, then enter a name for your RemoteApp. Select Next: Assignments > tab. To assign individual users or user groups to the application group, select +Add Azure AD users or user groups. Select the users you want to have access to the apps.

How do I create an Azure Virtual Desktop workspace? ›

Get started with Azure Virtual Desktop
  1. Create a host pool.
  2. Create an application group, a workspace, and assign users.
  3. Add session hosts to a host pool.
  4. Publish applications.

How do I host custom apps with Azure Virtual Desktop AVD? ›

Other options for Win32 applications
  1. Include the application manually on session hosts. Follow the instructions at Prepare and customize a master VHD image to include an app as part of the Windows image you use for your virtual machines. ...
  2. Use Microsoft Intune to deploy the application at scale. ...
  3. Manual installation.
Mar 2, 2023

What is Azure Virtual Desktop application Group? ›

Workspaces. A workspace is a logical grouping of application groups in Azure Virtual Desktop. Each Azure Virtual Desktop application group must be associated with a workspace for users to see the remote apps and desktops published to them.

How do I create an application group? ›

Expand Application Management and select the Application Group node. In the Create group in the ribbon, select Create Application Group. On the General Information page, specify information about the app group. On the Software Center page, include information that shows in Software Center.

What is the difference between Azure Virtual Desktop and Virtual Machine? ›

Purpose: Azure VMs provide infrastructure for hosting virtual machines, while Azure Virtual Desktop provides a virtual desktop experience for end users. Operating System: Azure VMs can run both Windows and Linux operating systems, while Azure Virtual Desktop provides a Windows 10 virtual desktop environment.

Does Azure Virtual Desktop support third party collaboration apps? ›

Azure Virtual Desktop is currently optimized for Teams. Microsoft currently doesn't support third-party collaboration apps like Zoom. Third-party organizations are responsible for giving compatibility guidelines to their customers.

How do I create multiple virtual machines in Azure? ›

2 answers
  1. Create up to 100 identical VMs using Azure DevTest Labs. ...
  2. Automatically create multiple VMs with the same base OS and configuration with Azure Virtual Machine Scale Sets. ...
  3. Rapidly create VMs using Azure CLI, PowerShell, ARM templates, and managed images.
Feb 7, 2022

How do I create a host group in Azure? ›

In this example, we'll create a host group using one availability zone and two fault domains.
  1. Open the Azure portal.
  2. Select Create a resource in the upper left corner.
  3. Search for Host group and then select Host Groups from the results.
  4. In the Host Groups page, select Create.
Mar 9, 2023

How do I create a bulk group in Azure? ›

In Azure AD, select Groups > All groups. Open the group to which you're adding members and then select Members. On the Members page, select bulk operations and then choose Import members. On the Bulk import group members page, select Download to get the CSV file template with required group member properties.

What is the difference between Windows Virtual Desktop and remote desktop? ›

Typically, windows virtual Desktop (WVD) differs from remote desktop services (RDS) since WVD focuses on providing a central location for users to access various applications hosted by a central server. At the same time, RDS offers a platform where users can access a networked computer from a remote location.

What is the difference between a virtual desktop pool and a personal virtual desktop? ›

Personal desktop—desktops are directly assigned to a single user. This is typically used when you need persistent desktops that users can customize. Pooled desktop— users are assigned desktops from an available pool of machines.

Can you use Azure Virtual Desktop for desktop virtualization? ›

With Azure Virtual Desktop, you can set up a scalable and flexible environment: Create a full desktop virtualization environment in your Azure subscription without running any gateway servers. Publish host pools as you need to accommodate your diverse workloads.

What is application grouping? ›

Application Grouping enables you to create form-based performance reports or extracts that relate data to logical business units or functions known as Applications. In this context, an Application is a name that you associate with a set of performance data field values.

How do you assign users and groups to app roles for your application? ›

Select the application in which you want to assign users or security group to roles. Under Manage, select Users and groups. Select Add user to open the Add Assignment pane. Select the Users and groups selector from the Add Assignment pane.

How do I put my apps in a group? ›

Organize on Home screens
  1. Touch and hold an app or shortcut.
  2. Drag that app or shortcut on top of another. Lift your finger. To add more, drag each one on top of the group. To name the group, tap the group. Then, tap the suggested folder name.

How do I assign an application security group to Azure VM? ›

Associate WEBVM1 with the Application Security Group
  1. Click on Virtual machines option.
  2. Select the provided virtual machine.
  3. Click on Networking.
  4. Choose the Application security groups.
  5. From the dropdown that appears, select the security group that we created. Then select Save.

How do I add a group to an app role in Azure? ›

Azure portal
  1. Sign in to the Azure portal or Microsoft Entra admin center.
  2. Select Azure Active Directory > Roles and administrators to see the list of all available roles.
  3. Select the role name to open the role. ...
  4. Select Add assignments. ...
  5. Select the group you want to assign to this role.
Apr 25, 2023

What is the difference between ASG and NSG in Azure? ›

ASGs introduce the ability to deploy multiple applications within the same subnet, and isolate traffic based on ASGs whereas NSGs can be used to filter network traffic to different Azure resources.

How do I add multiple users to a security group in Azure AD? ›

In Azure AD, select Groups > All groups. Open the group to which you're adding members and then select Members. On the Members page, select bulk operations and then choose Import members. On the Bulk import group members page, select Download to get the CSV file template with required group member properties.

How do I assign a device to a group in Azure? ›

Add users, groups, or devices to a single administrative unit
  1. Sign in to the Azure portal.
  2. Select Azure Active Directory.
  3. Select Administrative units and then select the administrative unit you want to add users, groups, or devices to.
  4. Select one of the following: ...
  5. Select Add member, Add, or Add device.
Mar 9, 2023

How do I Create a workspace group? ›

Create a group
  1. Sign in to Google Groups.
  2. At the top, click Create group.
  3. Enter information and choose settings for the group. Settings reference.
  4. Click Create group.
  5. Wait a few minutes for your new group to become active before sending a message to it. ...
  6. (Optional) Next steps: Choose advanced settings for your group.

What is VM host groups? ›

The use of VM/Host Groups will allow administrators to “pin” virtual machines to sites, preventing unnecessary vMotions/migrations. If virtual machines are allowed to move freely across sites, it may end up on the remote site.

Can virtual machine be in multiple resource groups? ›

A resource can only exist in a single Resource Group which means a single Virtual Network cannot be added to multiple Resource Groups but it does not need to be.

Which two group and membership types should you use for Azure AD role? ›

Only Global Administrators and Privileged Role Administrators can create a role-assignable group. The membership type for role-assignable groups must be Assigned and can't be an Azure AD dynamic group.

How do I create a group with all users in Azure? ›

Creating an "all users" dynamic group

Select Azure Active Directory. Under Manage, select Groups, and then select New group. On the New Group page, under Group type, select Security. Enter a Group name and Group description for the new group.


1. Host your web apps with Microsoft Azure App Service
(Microsoft DevRadio)
2. Deploy Azure AD Domain Service and Join a Server to the Domain
(Travis Roberts)
3. Workshop -Terraform with Azure - Zero to Hero | Ravikanth Chaganti | AzConfDev2020
(AzConf Dev)
4. Marius Sandbu - Learn how to migrate traditional workloads to Windows Virtual Desktop and beyond
(Christiaan Brinkhoff)
5. Azure Master Class v2 - Module 11 - IaC & DevOps
(John Savill's Technical Training)
6. Azure Master Class v2 - Module 3 - Governance
(John Savill's Technical Training)
Top Articles
Latest Posts
Article information

Author: Reed Wilderman

Last Updated: 05/21/2023

Views: 5733

Rating: 4.1 / 5 (52 voted)

Reviews: 91% of readers found this page helpful

Author information

Name: Reed Wilderman

Birthday: 1992-06-14

Address: 998 Estell Village, Lake Oscarberg, SD 48713-6877

Phone: +21813267449721

Job: Technology Engineer

Hobby: Swimming, Do it yourself, Beekeeping, Lapidary, Cosplaying, Hiking, Graffiti

Introduction: My name is Reed Wilderman, I am a faithful, bright, lucky, adventurous, lively, rich, vast person who loves writing and wants to share my knowledge and understanding with you.