Configuring Hydra to Support AVD Hybrid Environments

Installing the Hydra Preview Version 

Hydra version 2.5.1 is the preview version of Hydra supporting Microsoft’s Public Preview of AVD Hybrid on Hyper-V nodes and clusters. If we have received your Azure Tenant ID and Hydra Instance name, you should see the Preview version available for installation in the Hydra Update Center. For this, click on the avatar icon in the top left of the Hydra UI and select Update Center.

Using the Hydra Proxy 

We are using our Hydra Proxy feature to perform operations on-premises on behalf of the Hydra instance running in Azure. For more information on Hydra Proxy, see Installing and Using the Hydra Proxy (Preview).

When using AVD Hybrid, the Hydra Proxy is responsible for: 

• Starting VMs 

• Stopping VMs 

• Restarting VMs 

• Deleting VMs and their disks 

• Creating new VMs / session hosts, including  

  • Azure Connected Machine Agent (ARC) Installation 

  • Azure Virtual Desktop (AVD) Agent 

  • Domain join (AD and Entra) 

  • Azure Monitoring Agent (if selected) 

• Imaging of existing Golden Master VMs (note: a Golden Master VM must have the ARC agent installed) 

• Etc. 

Grouping Hybrid Locations in Hydra Proxy Configuration File 

The Hydra Proxy can handle multiple groups of Hyper-V nodes (servers) as a “Hybrid Location”. All nodes in a group are represented by their Location ID. That is similar to custom locations as it relates to Azure Local. The group of nodes can also be part of a failover cluster.  

Preparing Hyper-V Nodes 

All Cluster Nodes and stand-alone Hyper-V servers must be configured similarly: 

• At least one Network Switch with the same name across all nodes 

• One or more local folders to store the virtual machines. (Note: SYSTEM, SERVICE, and Administrators should have FULL CONTROL access to those folders): 

• C:\LocalStorage (for nodes without cluster shares) 

• C:\ClusterStorage\UserStorage_1 (for nodes with cluster shares) 

Preparing an Image Gallery 

Hyper-V Virtual Machine images are sysprep’d VHDX files. Hydra needs a shared resource to store those files. For a stand-alone Hyper-V server Hybrid Location, a local folder would work. For clusters with multiple nodes, use a cluster share, or a share on a file server. (Note: SYSTEM, SERVICE, and Administrators should have FULL CONTROL access to those folders). If a network share is used, add the Everyone full permission (to let the NTFS permission apply). To access the network share, each node needs permission to this share in the right context. 

Examples: 

• C:\LocalStorage\Images 

• C:\ClusterStorage\UserStorage_1\Images 

• \\Server\Images 

Installing the Hydra Proxy 

1. To start, enable and install the Hydra Proxy (always use the newest version for this preview). For steps, see Installing and Using the Hydra Proxy (Preview).

2. For AVD Hybrid, add a new custom location.  

Here is an example: 

{ 
   "CustomLocations":[ 
      { 
         "LocationType":"HyperV", 
         "LocationId":"almere-datacenter", 
         "LocationName":"Almere", 
         "ClusterName":"HYPERV-ALMERE.almere.nl", 
         "ClusterNodes":[ 
            "HYPERV-ALMERE-0.almere.nl", 
            "HYPERV-ALMERE-1.almere.nl", 
            "HYPERV-ALMERE-2.almere.nl" 
         ], 
         "ClusterShares":[ 
            "C:\\LocalStorage", 
            "D:\\ClusterStorage\\UserStorage_2" 
         ], 
         "Networks":[ 
            { 
               "Name":"External-vSwitch" 
            }, 
            { 
               "Name":"Internal High Security" 
            } 
         ], 
         "ImageGalleries":[ 
            { 
               "Name":"Default", 
               "GalleryLibraryPath":"C:\\LocalStorage\\Images\\Repository.json" 
            }, 
            { 
               "Name":"AdvancedRemote", 
               "GalleryLibraryPath":"C:\\LocalStorage\\Images\\Repository-Secure.json" 
            }, 
            { 
               "Name":"On-Share", 
               "GalleryLibraryPath":"\\\\HYPERV-ALMERE-0\\Images-FileShare\\Repository-Share.json" 
            } 
         ] 
      } 
   ] 
} 

Custom location properties:

3. Continue with Installing and Using the Hydra Proxy (Preview) and skip the test of creating a local image on Azure Local. 

4. Ensure that the Hydra Proxy is running. For testing purposes, we recommend running it as an administrator: 

Configuring a Host Pool for AVD Hybrid 

Create a new Host Pool for your AVD Hybrid deployment in Hydra (Azure Resource > Virtual Desktop) or in the Azure Portal. Please ensure the following configurations: 

1. Enable the validation environment option.

2. If not already done, grant the Hydra service principal the appropriate permissions (such as our custom role Hydra - Resource Access Role). For more information on roles, see Assigning Roles in Hydra.

3. In the Azure Portal, enable the Host Pool's System-assigned managed identity for later use. To learn more, see the Microsoft documentation.

4. If you haven’t already, create a service principal with a secret in https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApp. The new service principal is needed for the automated ARC deployment. 

   1. Add a name, like ARC.Onboarding.

   2. Generate a secret and store it for later use. 

   3. Store the application ID for later use. 

5. Create or use a resource group for our ARC objects and add the account ARC.Onboarding (from the previous step) to the resource group with the role “Azure Connected Machine Onboarding” (for a new resource group, also add the Hydra service principal).

6. Add the managed identity of the Host Pool as a “Reader” to the resource group for the ARC objects.

Example: Permissions on the resource group for the ARC objects: 

Preparing a Golden Master 

Before we can capture an image to roll out new session hosts, we need a new Golden Master VM on one of our nodes. If you want to use Entra ID-only joined hosts, we recommend Windows Server 2025. 

1. Create a new VM with your operating system on a Hyper-V node 

2. Rename the computer hostname to match the name of the VM in Hyper-V (!) 

3. Install necessary updates 

4. Install your applications 

5. Install the Azure Connected Machine Agent (ARC)

   1. Choose Onboard in the Azure Portal for more instructions: https://portal.azure.com/#servicemenu/Microsoft_Azure_ArcCenterUX/AzureArcCenterHub/servers

   2. If asked for a resource group to store the ARC object, select the same resource group referenced in “Configuring a Host Pool for AVD Hybrid.” 

The ARC object should be visible in Azure: 

Capturing an Image 

1. Go to Imaging in Hydra and select your tenant. If the Hydra Proxy is connected and configured successfully, you should be able to select your Hybrid Location in the drop-down list “Hybrid Location”. 

2. After that, select your Golden Master from the Virtual Machine list and your Target Image Gallery (that is the name from your HydraProxy.json configuration): 

3. Click Create Image to start the imaging process.

The image is stored in the folder and added as an entry to the JSON file. Example: 

Rolling Out a Host in a Pool 

1. To adjust the rollout configuration in Hydra, click on the menu icon in the Host Pool tile:

2. Selecting a network switch from Hyper-V is the trigger for Hydra to let you configure the settings related to AVD Hybrid. You can find the switches (similar to the name in the HydraProxy.json) at the bottom of the list: 

3. Fill out the missing parameters to describe how a session host should be built in this pool. There are some AVD Hybrid-specific settings in Host Pool Configuration > New Session Host Rollout: 

4. Click Save to apply the changes.

Rolling Out New Hosts: Starting, Stopping, Restarting 

Clicking on the Host Pool tile opens the session host list. There are several actions to start, stop, restart, or roll out a new host (similar to native Azure Virtual Machines): 

Known Limitations 

• Currently works only in Azure Global (not GOV-cloud tenants).

• The configured local admin username for a rollout is ignored. The name is the same as on the Golden Master (Administrator).

• All local administrator accounts of the Golden Master are reset to the configured local admin password.