Note: Before you can use Private Link with Azure Virtual Desktop, you should re-register the Microsoft.DesktopVirtualization resource provider.

1. If needed, from your local computer, start a web browser, navigate to the Azure portal and sign in with your Odl_user credentials.
2. From the Azure portal, search for and select Subscriptions, select the Azure subscription you are using in this lab, and in the vertical navigation menu, in the Settings section, select Resource providers.
3. On the Resource providers tab, in the search text box, enter Microsoft.DesktopVirtualization, in the list of results, select the small circle to the left of the Microsoft.DesktopVirtualization entry, and then select Re-register.
4. Wait for the re-registration process to complete. This typically takes less than 1 minute.

Note: You could use an existing subnet of an Azure virtual network to implement private endpoints in the lab scenario, but it is a common practice to use a dedicated subnet for this purpose.

1. From the Azure portal, search for and select Virtual networks and select cpoF67-vnet11e.
2. On the cpoF67-vnet11e page, in the Settings section of the vertical navigation menu, select Subnets.
3. On the cpoF67-vnet11e | Subnets page, select + Subnet. In the Add a subnet pane, specify the following settings and select Add (leave other settings with their default values):

   Setting	Value
   Name	pe-Subnet
   Starting address	10.20.255.0
   Enable private subnet (no default outbound access)	Disabled

1. From the Azure portal, search for and select Azure Virtual Desktop, in the Manage section select Host pools and, select <sName>-cpoF67-hp1.
2. On the <sName>-cpoF67-hp1 page, in the Settings section, select Networking.
3. Select the Private endpoint connections tab and then, select + New private endpoint.
4. On the Basics tab of the Create a private endpoint page, specify the following settings and select Next : Resource >:

   Setting	Value
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG
   Name	<sName>-cpoF67-pehp1
   Network Interface Name	<sName>-cpoF67-pehp1-nic
   Region	your Azure Virtual Desktop deployment region

5. On the Resource tab, specify Target sub-resource = connection, then select Next : Virtual network >.
6. On the Virtual network tab, specify the following settings and select Next : DNS > (leave other settings with their default values):

   Setting	Value
   Virtual network	cpoF67-vnet11e (<sName>-cpoF67-11e-RG)
   Subnet	pe-Subnet
   Network policy for private endpoints	Disabled
   Private IP configuration	Dynamically allocate IP address

7. On the DNS tab, specify the following settings and select Next : Tags >:

   Setting	Value
   Integrate with private DNS zone	Yes
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG

   Note: This step will result in creation of a private DNS zone named privatelink.wvd.microsoft.com.

8. On the Tags tab, select Next : Review + create, then on the Review + create tab select Create.
9. Wait for the deployment to complete. The deployment might take about 3 minutes. Screenshot must show your Odl_user account, the deployed <sName>-cpoF67-pehp1 private endpoint for the connection sub-resource with the <sName>-cpoF67-hp1 host pool and its Approved connection status

1. From the Azure portal, search for and select Azure Virtual Desktop and select Workspaces. On the Workspaces page, select <sName>-cpoF67-21-ws1.
2. On the <sName>-cpoF67-21-ws1 page, in the Settings section, select Networking.
3. On the Networking page, select the Private endpoint connections tab and then, select + New private endpoint.
4. On the Basics tab of the Create a private endpoint page, specify the following settings and select Next : Resource >:

   Setting	Value
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG
   Name	<sName>-pefeeddwnld
   Network Interface Name	<sName>-pefeeddwnld-nic
   Region	your Azure Virtual Desktop deployment region

5. On the Resource tab, specify Target sub-resource = feed, then select Next : Virtual network >.
6. On the Virtual network tab, specify the following settings and select Next : DNS > (leave other settings with their default values):

   Setting	Value
   Virtual network	cpoF67-vnet11e (<sName>-cpoF67-11e-RG)
   Subnet	pe-Subnet
   Network policy for private endpoints	Disabled
   Private IP configuration	Dynamically allocate IP address

7. On the DNS tab, specify the following settings and select Next : Tags >:

   Setting	Value
   Integrate with private DNS zone	Yes
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG

   Note: This step will leverage the private DNS zone named privatelink.wvd.microsoft.com you created in the previous task.

8. On the Tags tab, select Next : Review + create, then on the Review + create tab select Create. Do not wait for the deployment to complete but instead proceed to the next task (about 1 minute). Screenshot must show your Odl_user account, the <sName>-pefeeddwnld private endpoint for the feed sub-resource of the <sName>-cpoF67-21-ws1 workspace

1. From the Azure portal, search for and select Azure Virtual Desktop and then select Workspaces. On the Workspaces page, select <sName>-cpoF67-21-ws1.
2. On the <sName>-cpoF67-21-ws1 page, in the Settings section, select Networking.
3. On the Networking page, select the Private endpoint connections tab and then, select + New private endpoint.
4. On the Basics tab of the Create a private endpoint page, specify the following settings and select Next : Resource >:

   Setting	Value
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG
   Name	<sName>-pefeeddisc
   Network Interface Name	<sName>-pefeeddisc-nic
   Region	your Azure Virtual Desktop deployment region

5. On the Resource tab, specify Target sub-resource = global, then select Next : Virtual network >.
6. On the Virtual network tab, specify the following settings and select Next : DNS > (leave other settings with their default values):

   Setting	Value
   Virtual network	cpoF67-vnet11e (<sName>-cpoF67-11e-RG)
   Subnet	pe-Subnet
   Network policy for private endpoints	Disabled
   Private IP configuration	Dynamically allocate IP address

7. On the DNS tab, specify the following settings and select Next : Tags >:

   Setting	Value
   Integrate with private DNS zone	Yes
   Subscription	your lab subscription
   Resource group	<sName>-cpoF67-11e-RG

   Note: This step will result in creation of a private DNS zone named privatelink-global.wvd.microsoft.com.

8. On the Tags tab, select Next : Review + create, then on the Review + create tab select Create. Do not wait for the deployment to complete but instead proceed to the next task (about 1 minute). Screenshot must show your Odl_user account, the <sName>-pefeeddisc private endpoint for the global sub-resource of the <sName>-cpoF67-21-ws1 workspace
9. Note: For the network changes to take effect, you need to restart the session hosts in the target host pool. From the Azure portal, navigate to the Azure Virtual Desktop page, in the Manage section select Host pools and select <sName>-cpoF67-hp1.
10. On the <sName>-cpoF67-hp1 page, in the Manage section select Session hosts. In the list of session hosts, select all checkboxes to the left of each session host and then select Restart in the toolbar.
11. Wait until all session hosts are in the Running state.

Note: By default, connectivity to Azure Virtual Desktop workspaces and host pools is allowed from public networks. You will start by changing the default settings and enforcing private access.

1. From the Azure portal, search for and select Azure Virtual Desktop and then select Workspaces. On the Workspaces page, select <sName>-cpoF67-21-ws1.
2. On the <sName>-cpoF67-21-ws1 page, in the Settings section, select Networking. On the Networking page, on the Public access tab, select the option Disable public access and use private access, and then select Save.
3. From the Azure portal, select Azure Virtual Desktop, select Host pools and then, select <sName>-cpoF67-hp1.
4. On the <sName>-cpoF67-hp1 page, in the vertical navigation menu, in the Settings section, select Networking. On the Networking page, on the Public access tab, select Disable public access and use private access, and then select Save.
5. Note: To validate the private endpoint functionality, an RDP client needs to be connected to a network that has private connectivity to the Azure virtual network containing the subnet hosting the private endpoints you created earlier. From the Azure portal, search for and select Virtual networks and select cpoF67-vnet11e. On the cpoF67-vnet11e page, in the Settings section, select Subnets.
6. On the cpoF67-vnet11e | Subnets page, select + Subnet. In the Add a subnet pane, specify the following settings and select Add (leave other settings with their default values):

   Setting	Value
   Name	client-Subnet
   Starting address	10.20.2.0
   Enable private subnet (no default outbound access)	Disabled

7. From the Azure portal, search for and select Virtual machines, on the Virtual machines page, select + Create and, in the drop-down list, select Azure virtual machine.
8. On the Basics tab of the Create a virtual machine page, specify the following settings (leave other settings with their default values) and select Next : Disks >:

   Setting	Value
   Subscription	your lab subscription
   Resource group	new resource group cp0F67-111e-RG
   Virtual machine name	<sName>-client-vm0
   Region	your Azure Virtual Desktop deployment region
   Availability options	No infrastructure redundancy required
   Security type	Standard
   Image	Windows 11 Pro, version 24H2 - x64 Gen2
   Size	Standard D2s_v3
   Username	Adminuser
   Password	any valid password of your choice
   Public inbound ports	None
   Licensing	Enable the checkbox

9. On the Disks tab of the Create a virtual machine page, set the OS disk type to Standard HDD (locally-redundant storage) and select Next : Networking >.
10. On the Networking tab of the Create a virtual machine page, specify the following settings (leave other settings with their default values):

    Setting	Value
    Virtual network	cpoF67-vnet11e
    Subnet	client-Subnet
    Public IP	(new) <sName>-client-vm0-ip
    NIC network security group	Advanced

11. On the Networking tab, next to the Configure network security group drop-down list, select Create new. On the Create network security group page, delete the pre-created inbound rule 1000: default-allow-rdp and then select + Add an inbound rule. In the Add inbound security rule pane, in the Source drop-down list, select My IP address to identify the public IP address representing your connection to the internet.
12. In the Add inbound security rule pane, specify the following settings (leave other settings with their default values), and then select Add:

    Setting	Value
    Source	IP Addresses
    Source IP addresses/CIDR ranges	leave unchanged (this should still contain your public IP address)
    Source port ranges	*
    Destination	Any
    Service	RDP
    Action	Allow
    Priority	300
    Name	AllowCidrBlockRDPInbound

13. Back on the Create network security group page, select OK. Back on the Networking tab of the Create a virtual machine page, select Next : Management >.
14. On the Management tab, specify the following settings (leave other settings with their default values), and then select Next : Monitoring >:

    Setting	Value
    Patch orchestration options	Manual updates

15. On the Monitoring tab, specify the following settings (leave other settings with their default values), and then select Review + create:

    Setting	Value
    Boot diagnostics	Disable

16. On the Review + create tab, select Create. Wait for the deployment to complete. The deployment might take about 5 minutes.
17. From the Azure portal, search for and select Virtual machines, on the Virtual machines page, select <sName>-client-vm0 and connect to it using the RDP file.
18. When prompted, enter the user name and password you specified when deploying the Azure VM.
19. Within the Remote Desktop session start Microsoft Edge, navigate to the Connect to Azure Virtual Desktop with the Remote Desktop client for Windows page, scroll down to the section Download and install the Remote Desktop client (MSI), and select the Windows 64-bit link.
20. Open File Explorer, navigate to the Downloads folder, and launch the installation of the newly downloaded MSI file.
21. When prompted, accept the terms of the licensing agreement and choose the option to Install for all users of this machine. If prompted, accept the User Account Control prompt to proceed with the installation.
22. Once the installation completes, ensure that the Launch Remote Desktop when setup exits checkbox is selected and select Finish to start the Microsoft Remote Desktop client.
23. Within the Remote Desktop session to <sName>-client-vm0, in the Remote Desktop client window, select Subscribe and, when prompted, sign in with the credentials of the cpoF67-User2 Entra ID user account.
24. Ensure that the Remote Desktop page displays four icons, including Command Prompt, Microsoft Word, Microsoft Excel, Microsoft PowerPoint.
25. Double-click the Command Prompt icon.
26. When prompted to sign in, in the Windows Security dialog box, enter the password of the same Microsoft Entra user account you used to connect to the target Azure Virtual Desktop environment.
27. Verify that a Command Prompt window appears shortly afterwards.
28. Type Whoami /upn and press the Enter key.
29. Type Ipconfig /all and press the Enter key. Screenshot must show your Odl_user account, the Command Prompt Remote App session with the whoami /upn and ipconfig /all output displaying the cpoF67-User2 identity and the private IP configuration
30. At the Command Prompt, type logoff and press the Enter key to log off from the current Remote App session.
31. From your local computer, open a new incognito tab or use a different browser, type https://client.wvd.microsoft.com/arm/webclient/index.html and log in with cpoF67-User2 credentials.
32. A message validates that the connection failed. Don't close this tab — you will refresh it after Task 7. Screenshot must show your Odl_user account, the web client error message showing that the connection failed while public access was disabled

1. From your local computer, in the Azure portal, search for and select Azure Virtual Desktop and select Workspaces. On the Workspaces page, select <sName>-cpoF67-21-ws1. In the Settings section, select Networking. On the Networking page, on the Public access tab, select the option Enable public access from all networks, and then select Save.
2. From the Azure Virtual Desktop page, select Host pools and then select <sName>-cpoF67-hp1. On the <sName>-cpoF67-hp1 page, in the vertical navigation menu, in the Settings section, select Networking. On the <sName>-cpoF67-hp1 | Networking page, on the Public access tab, select the option Enable public access from all networks, and then select Save.
3. Refresh, or redo, Task 6, step 39. You should see the remote apps icons. Screenshot must show your Odl_user account, the web client displaying the remote application icons (Command Prompt, Microsoft Word, Microsoft Excel, Microsoft PowerPoint) after public access was re-enabled

Minimum 2-3 sentences each — original thinking, your own words!

1. Task 1: Why must the Microsoft.DesktopVirtualization resource provider be re-registered before using Azure Private Link with AVD?
2. Task 2: Why use a dedicated subnet for private endpoints instead of an existing one?
3. Tasks 3–5: What is the purpose of each Private Link workflow (feed discovery, feed download, host pool connections), and which private endpoint sub-resource implements each?
4. Task 6: Why did the connection in step 40 fail?
5. Task 7 & Lab Reflection: Why re-enable public network access after validation? What challenges did you face, and what did you learn about private connectivity? (Use your own experience.)

Screenshots you attach above and your Task 8 answers appear here. This is exactly what prints/exports as your PDF.

1. All attached screenshots must be high quality, with your Odl_user account clearly visible.
2. A brief explanation added for each screenshot.
3. Export with Print / Save as PDF and upload it to the Blackboard lab submission page.