1. Open the Azure portal and sign in with your Odl_user credentials.
2. Start a PowerShell session in the Azure Cloud Shell. If prompted, in Getting started, select your lab subscription and Apply.
3. Run this command to register the Microsoft.DesktopVirtualization resource provider:
   Register-AzResourceProvider -ProviderNamespace Microsoft.DesktopVirtualization

   Note: Do not wait for the registration to complete — it might take a couple of minutes.

4. Close the Cloud Shell pane.
5. Search for and select Virtual networks, then + Create.
6. On the Basics tab, specify these settings, then Next (replace <sName> with your name):

   Setting	Value
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG
   Virtual network name	cpoF67-vnet11e
   Region	your Azure Virtual Desktop deployment region

7. On the Security tab, accept the defaults, then Next.
8. On the IP addresses tab, apply these settings (modify the default if needed):

   Setting	Value
   IP address space	10.20.0.0/16

   Edit the default subnet entry:

   Setting	Value
   Name	hp1-Subnet
   Starting address	10.20.1.0
   Enable private subnet	Disabled

9. Back on the IP addresses tab, select Review + create, then Create.
10. Search for and select Microsoft Entra ID, then in Manage, select Users.
11. Create a new user. For User principal name and Display name type cpoF67-User1-<sName>.
12. Create another user. For User principal name and Display name type cpoF67-User2-<sName>.
13. Create two groups. Name them AVD-DAG-<sName> and AVD-RemoteApp-<sName>.
14. Make cpoF67-User1-<sName> a member of AVD-DAG-<sName>.
15. Make cpoF67-User2-<sName> a member of AVD-RemoteApp-<sName>. Screenshot must show your Odl_user account, the cpoF67-User1-<sName> and cpoF67-User2-<sName> users and the AVD-DAG-<sName> and AVD-RemoteApp-<sName> groups with their members

1. Search for and select Azure Virtual Desktop, then in Manage, select Host pools, then + Create.
2. On the Basics tab, specify these settings, then Next : Session hosts >:

   Setting	Value
   Resource group	<sName>-cpoF67-21e-RG
   Host pool name	<sName>-cpoF67-hp1
   Location	your AVD deployment region
   Validation environment	No
   Preferred app group type	Desktop
   Host pool type	Pooled
   Create Session Host Configuration	No
   Load balancing algorithm	Breadth-first

   Note: with Breadth-first, the max session limit parameter is optional.

3. On the Session hosts tab, specify these settings, then Next : Workspace >:

   Setting	Value
   Add virtual machines	Yes
   Name prefix	<sName>-sh
   Virtual machine type	Azure virtual machine
   Availability options	No infrastructure redundancy required
   Security type	Trusted launch virtual machines
   Image	Windows 11 Enterprise multi-session, Version 23H2 + Microsoft 365 Apps
   Virtual machine size	Standard D2s_v3
   Number of VMs	2
   OS disk type	Standard HDD
   OS disk size	Default size (128GiB)
   Boot Diagnostics	Enable with managed storage account (recommended)
   Virtual network	cpoF67-vnet11e
   Subnet	hp1-Subnet
   Network security group	Basic
   Public inbound ports	No
   Directory to join	Microsoft Entra ID
   Enroll VM with Intune	No
   User name	Student
   Password / Confirm	a sufficiently complex string (see note)

   Note: the password should be at least 12 characters with lower-case, upper-case, digits, and special characters.

4. On the Workspace tab, confirm Register desktop app group is No, then Review + create and Create.
5. Wait for the deployment to complete (about 20 minutes). Screenshot must show your Odl_user account, the deployed <sName>-cpoF67-hp1 host pool with its two session hosts <sName>-sh

1. In Azure Virtual Desktop, select Application groups and note the auto-generated <sName>-cpoF67-hp1-DAG desktop application group, then select it.
2. On the DAG page, in Manage, select Assignments, then + Add.
3. Checkmark AVD-DAG-<sName> and click Select.
4. Back on the Application groups page, select + Create.
5. On the Basics tab, specify these settings, then Next : Applications >:

   Setting	Value
   Resource group	<sName>-cpoF67-21e-RG
   Host pool	<sName>-cpoF67-hp1
   Application group type	Remote App
   Application group name	<sName>-cpoF67-hp1-Office365-RAG

6. On the Applications tab, + Add applications and add Word: Application source Start menu, Display name and Description Microsoft Word, Require command line No, then Review + add and Add.
7. Repeat and add Excel (Display name/Description: Microsoft Excel).
8. Repeat and add PowerPoint (Display name/Description: Microsoft PowerPoint).
9. Select Next : Assignments >, then + Add Microsoft Entra users or user groups, checkmark AVD-RemoteApp-<sName> and click Select.
10. Select Next : Workspace >, set Register application group to No, then Review + create and Create (less than 1 minute).
11. Back on the Application groups page, select + Create for a file-path based application group.
12. On the Basics tab, specify these settings, then Next : Applications >:

    Setting	Value
    Resource group	<sName>-cpoF67-21e-RG
    Host pool	<sName>-cpoF67-hp1
    Application group type	RemoteApp
    Application group name	<sName>-cpoF67-hp1-Utilities-RAG

13. On the Applications tab, + Add applications and configure:

    Setting	Value
    Application source	File path
    Application path	C:\Windows\system32\cmd.exe
    Application identifier	Command Prompt
    Display name	Command Prompt
    Description	Windows Command Prompt
    Require command line	No

14. On the Icon tab: Icon path C:\Windows\system32\cmd.exe, Icon index 0, then Review + add and Add.
15. Select Next : Assignments >, add AVD-RemoteApp-<sName>, then Next : Workspace >, set Register application group to No, then Review + create and Create. Screenshot must show your Odl_user account, the <sName>-cpoF67-hp1-DAG, -Office365-RAG and -Utilities-RAG application groups

1. In Azure Virtual Desktop, select Workspaces, then + Create.
2. On the Basics tab, specify these settings, then Next : Application groups >:

   Setting	Value
   Resource group	<sName>-cpoF67-21e-RG
   Workspace name	<sName>-cpoF67-21-ws1
   Friendly name	<sName>-cpoF67-21-ws1
   Location	your AVD deployment region

3. On the Application groups tab, set Register application groups to Yes, select + Register application groups, and add <sName>-cpoF67-hp1-DAG, -Office365-RAG, and -Utilities-RAG, then Select.
4. Select Review + create, then Create. Screenshot must show your Odl_user account, the <sName>-cpoF67-21-ws1 workspace with the three application groups registered

Note: with Microsoft Entra joined session hosts, you must assign RBAC roles. The Virtual Machine User Login role is required to sign in to session hosts, and Virtual Machine Administrator Login for local administrative privileges.

1. Search for and select Resource groups, then select <sName>-cpoF67-21e-RG.
2. In the vertical navigation menu, select Access control (IAM), then + Add > Add role assignment.
3. Search for and select Virtual Machine User Login, then Next.
4. On the Members tab, keep User, group, or service principal selected, click + Select members, locate AVD-RemoteApp-<sName> and click Select.
5. Select Next, then Review + assign.
6. Back on the IAM page, select + Add > Add role assignment again, search for and select Virtual Machine Administrator Login, then Next.
7. On the Members tab, click + Select members, locate and select AVD-DAG-<sName>, then Select.
8. Select Review + assign. Screenshot must show your Odl_user account, the Virtual Machine User Login and Virtual Machine Administrator Login role assignments on <sName>-cpoF67-21e-RG

Minimum 2-3 sentences each — original thinking, your own words!

1. The lab used Breadth-first load balancing for the pooled host pool — if user density increased significantly, explain a potential performance issue and recommend an alternative algorithm with justification.
2. Evaluate security implications of assigning Virtual Machine Administrator Login to AVD-DAG-<sName> at the resource group level — propose a least-privilege alternative and when it might still be necessary.
3. Suppose a new compliance requirement demands user data isolation — argue why switching from this pooled setup to a personal host pool would (or wouldn't) address it, including management trade-offs.
4. Reflect on your experience completing the Azure Virtual Desktop lab deploying Microsoft Entra joined session hosts. What key knowledge or skills did you gain about AVD architecture, Entra integration, or RBAC configurations, and what specific challenges did you encounter?

Screenshots you attach above and your Task 6 answers appear here. This is exactly what prints/exports as your PDF.

1. All attached screenshots must be high quality, with your Odl_user account clearly visible.
2. A brief explanation added for each screenshot.
3. Export with Print / Save as PDF and upload it to the Blackboard lab submission page.