--- version: "Hydra 2.8.0" language: "en" --- # Hydra These docs are your go-to resources for setting up and managing Hydra. Discover reference architecture, installation guides, and troubleshooting tips to make the most of Hydra in your AVD environment. --- version: "Hydra 2.8.0" language: "en" --- # Adding a Tenant ## Overview Hydra can be configured to host more than one tenant by utilizing a Service Principal. Note that a Service Principal is also required in a single tenant scenario when the environment is larger than 2000 users or 100 hosts. You can optionally use the Managed Service Identity (MSI) that comes with Hydra, if smaller than that within a single tenant. ## Creating the Service Principal in the Target Tenant 1. Within **Azure** , go to **Entra ID**. 2. Navigate to **Manage** \>**App registrations**. 3. Click **New Registration**. 4. Give the app registration a name, such as svc-hydra or sp-hydra, and click **Register**. 5. In the **Overview** pane, take note of the Application (client) ID and the Directory (tenant) ID. These will be needed later. 6. Go to **Manage** \>**Certificates \& secrets** on the left. 7. Go to **Client secrets** \>**New client secret**. 8. Give it a description and make a note of the expiration. When it expires, Hydra will lose access to the AVD resources. Record the secret value -- once you navigate away from this page, it is unable to be retrieved again. 9. The Hydra Service Principal or Identity must be granted the **User.Read.All** and **Group.Read.All** application permissions in Graph. Otherwise, existing assignments and searches will appear blank. These permissions must be consented from an Entra administrator. Do this in the App Registration underneath the **API Permissions**page. ![Frame 1659.png](https://docs.loginvsi.com/__attachments/a_3fe0413c78508d08d80fa6a1f6af17944293742a4b21276b145ea130852b8f66/Frame%201659.png?cb=1198841b7f5259ef0f740d8707b432a8) 10. Next, go to the subscription or resource group where the AVD resources reside. Under **Access Control (IAM)**, give the newly-created Service Principal Contributor access to the resources. If the Virtual Networks don't reside in the resource group, ensure you give them proper access there as well. You can use two least-privileged custom roles below versus giving Contributor or Owner Access. 11. It is recommended to utilize a custom role template by using [this link](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FMarcelMeurer%2FWVD-Hydra%2Frefs%2Fheads%2Fmain%2FHydra-CustomRoles.json) to deploy the custom roles below to your environment automatically. ## Custom Roles * **Hydra - Resource Access Role** A fine-tuned role to allow the SP or managed identity of Hydra to operate the resources of Azure Virtual Desktop. More restrictive than the default *Contributor* role that is typically utilized. * **Hydra - Change Permissions Role** This role is used by Hydra starting in 1.2.0 to change the permissions on Azure Resources, such as adding/removing access to application groups, to assign users to virtual machines, or to allow Power-on-Connect. We recommend assigning this role as restrictively as possible, such as to the Resource Group only containing AVD resources, as this role is highly privileged and can be used to grant identities access to Azure resources. If you have multiple subscriptions, modify both custom roles and add other subscriptions in **Assignable scopes**: ![Frame 2350.png](https://docs.loginvsi.com/__attachments/a_e80209bb59c978956de8f9255b5e7ff9e6e90e1ee918daf4694c53515ea7bb73/Frame%202350.png?cb=fd311be2043ef26771e73263d1505792) ## Allowing Hydra to Manage User Assignments Hydra can manage user assignments to resources after creating them by using the **Hydra - Change Permissions Role**, noted above. To allow this, add a role assignment for the Hydra Identity or Service Principal with the role "Hydra - Change Permissions Role" to all resource groups containing your Azure Virtual Desktop resources. The role is a **Privileged administrator** role: ![Frame 2351.png](https://docs.loginvsi.com/__attachments/a_45329cd3fc3a2a1776d7cf6211b663ff3dbfee8113167dd2fe6833f7aea9e175/Frame%202351.png?cb=2bf247ce1e218f515374d89fd529ee90) 1. Under **Members** , select the **Hydra Service Principal** or**Identity**. ![Frame 2352.png](https://docs.loginvsi.com/__attachments/a_d9f51671f6ba81c5e55463b08d89c1b62a5c004c0c1e41a0beee6831e2f8cc80/Frame%202352.png?cb=ac1bfce08434aecd577c0b17c5a48882) 2. Under **Conditions** , select **Allow users to only assign selected roles to selected principals (fewer privileges)**. 3. Click **+ Select roles and principals**. ![Frame 2353.png](https://docs.loginvsi.com/__attachments/a_628bb7c3deee435a0a12e1b72bf97f220fb2affca8ecf18f530df13b8b7a5424/Frame%202353.png?cb=440dada8981e4ee5acc6f8649e29f658) 4. Under **Constrain Roles** , select **Configure** and add the following roles: 1. Desktop Virtualization User 2. Virtual Machine User Login 3. Virtual Machine Administrator Login 4. Desktop Virtualization Power On Off Contributor This configuration limits the Hydra Identity's ability to assign these roles to other identities. ![Frame 2354.png](https://docs.loginvsi.com/__attachments/a_9625ede93b146f375a151b3750054eabded845cceb851948e226559fcc4dc333/Frame%202354.png?cb=d6cd10b6a2a81ff9f039784a77b67d36) 5. Select **Review + assign** twice to finish the role assignment wizard. ![Frame 1658.png](https://docs.loginvsi.com/__attachments/a_7e4a88396310e197974688cf05705171d2b9e3af70164e3f43c34bef0f88926b/Frame%201658.png?cb=5b7ddf02f1ccaef28d207181a2e30e91) ## Adding the Service Principal to Hydra 1. In the **Hydra portal** , head to **Tenants** and add a new tenant. Fill in the **Display Name** you wish to align with the tenant, **Tenant (Directory) ID** , **Application ID** , and **Secret**. ![Frame 1325.png](https://docs.loginvsi.com/__attachments/a_4aa86114a281a6fedff817cc96bfced878fbdabcac8678aa1ee788aa2205b6b3/Frame%201325.png?cb=eed3e787086ea99edc36e778906ae4f3) 2. Click **Test Primary** prior to saving to ensure that the values are correct. If the test is successful, click **Save**. ![Frame 1326.png](https://docs.loginvsi.com/__attachments/a_2d31f56a755c370269f5c11b8730d880fb25605e0652c2257bbf656a5bc798a6/Frame%201326.png?cb=b8df6af6da97b1442c7193715986dda7) 3. If the Host Pools do not appear in the Dashboard after several minutes, click **Restart Engine** at the top right. Wait several minutes and then try reloading the Hydra portal again. The Host Pools should now be visible. ## Updating the Tenant Service Principal To update an expiring Service Principal Secret, simply follow steps 6-8 in **Creating the Service Principal in the Target Tenant** above and then update the secret in the **Tenants** section. The Service Principal can operate off of multiple active secrets, so you can create a new one and update Hydra with zero downtime. --- version: "Hydra 2.8.0" language: "en" --- # All Cloud PCs ## Overview The All Cloud PCs page enables administrators to: 1. Monitor Cloud PC status across tenants at a glance via the dashboard indicators. 2. Search and filter Cloud PCs by key properties. 3. Take bulk actions on selected Cloud PCs: Sync, Restart, Reprovision, Create snapshot. 4. Review detailed information for each Cloud PC, including status, policy, utilization, and image. 5. Access row-level actions to restore a Cloud PC to a previous snapshot. ## Cloud PC Dashboard At the top of the page, a dashboard summarizes Cloud PC status across all tenants. Each indicator shows the number of Cloud PCs in a given state: | **Indicator** | **Description** | |------------------------------------|-------------------------------------------------------------------------| | Red (Failed) | Cloud PCs that have encountered errors during provisioning or operation | | Yellow (In grace period) | Cloud PCs are temporarily in a grace period, pending updates or actions | | Green (Provisioned) | Fully provisioned Cloud PCs ready for use | | Yellow (Provisioned with warnings) | Provisioned Cloud PCs with warnings that may require attention | | Blue (Provisioning) | Cloud PCs are currently being provisioned | | Blue (Not provisioned) | Cloud PCs not yet provisioned | ![Frame 1543.png](https://docs.loginvsi.com/__attachments/a_c26ac13d0afaa0e13fb4ef03900db17f9263eab56096386986d1ab6df72fc170/Frame%201543.png?cb=6c7065458a69d9b19187c4671763e944) ## Search and Toolbar Actions Above the Cloud PCs table: * **Search field:** Allows you to search for Cloud PCs by tenant, device name, user, provisioning policy, or other searchable properties. * **Toolbar icons:** Apply actions to selected Cloud PCs in the table. Hover over an icon for instructions: | **Icon** | **Action** | |-----------------|-----------------------------------| | Refresh | Sync selected Cloud PCs | | Restart | Restart selected Cloud PCs | | Camera | Create a snapshot / restore point | | Arrow down left | Reprovision selected Cloud PCs | | Burger icon | Download CSV export of the table | **Note**: Actions apply only to selected Cloud PCs in the table. If no item is selected, tooltips explain that a selection is required. ## Cloud PCs Table The table lists all Cloud PCs and their properties. Columns include: * **Tenant name** * **Status** * **Device name** * **User** * **Cloud PC size** * **Utilization** (hover shows CPU%, Memory Usage %, Processor Queue, Disk Queue) * To enable device utilization info, install the Hydra Agent on the Cloud PC. For details, see [Hydra Agent for Cloud PCs](https://docs.loginvsi.com/hydra/2.8.0/hydra-agent-for-cloud-pcs.md). * **Provisioning policy** * **Experience** * **Image** * **Date modified** * **Date provisioned** * **Actions** ### Column Filters and Sorting * All columns (except **Date modified** and **Actions**) have a Filter icon. * Filters allow you to search or select values relevant to that column. For example: * **Status:** Deprovisioning, In grace period, Not provisioned, Provisioned, Provisioning * **Image:** Windows 10Pro, Windows 11Pro * **Date provisioned** supports sorting ascending or descending. ### Actions Column * Each row has an **Actions menu** (burger icon). * Clicking the icon restores a Cloud PC to a previous snapshot if available. ![Frame 2191.png](https://docs.loginvsi.com/__attachments/a_dce27446ad5af75ee90f5050fcb0f3b6917ffcbc75c91c07a5a56245dc032812/Frame%202191.png?cb=c626cc1f48fe09de6248a1fde57bb419) ### Selection Controls * At the bottom of the table, you can select all Cloud PCs on the current page to perform bulk actions via the toolbar. --- version: "Hydra 2.8.0" language: "en" --- # Assigning Roles in Hydra ## Overview You can use role-based access control (RBAC) in Hydra to grant users the appropriate level of access. 1. In **Hydra** , navigate to **Role-Based Access**. ![Frame 2067.png](https://docs.loginvsi.com/__attachments/a_afe63dfa56d5658bc5a27a2c5fafb1cf8bb2ac6a2ee538f01ddeab0a1a6d568a/Frame%202067.png?cb=5ab56976afa0f304a71bb0c3b2326e1d) 2. Click **Add**, then specify: 1. The user or group (using UPN or object ID). 2. The scope (**All tenants**, a specific tenant, or a specific host pool). 3. The role you want to assign. 4. Add a note about the role (Optionally). 3. Click **Save**. ![Frame 2068.png](https://docs.loginvsi.com/__attachments/a_93db0cf7a830dda395ef572784890df08a2b934715e282c772f35001ad81cbeb/Frame%202068.png?cb=41a9c857b6406e4e82f8aa7650c84a25) ## Built-in Roles The following table describes the available roles in Hydra: | **Role** | **Description** | |---------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Full administrator | Can manage every aspect of the application. Only the full administrator can edit the role-based access settings, scripts/ script collections, and edit the global tenant configuration. This role only works for the **All tenants - All resources**scope. | | Host pool administrator | Can manage every aspect of a host pool or Windows 365 resource: e.g., change the configuration, delete/create session hosts, start/stop/restart session hosts, and handle user sessions. Additionally, the user can start scripts and script collections. Users with this role related to all resources can create and modify host pools, app groups, and workspaces. | | Host pool resource manager | Can delete/create session hosts, start/stop/restart session hosts, and handle user sessions. Additionally, the user can start scripts/ script collections and can create images. | | Host pool VM, user manager and remove hosts | Can handle user sessions, start/stop/restart/delete session hosts, and change the drain mode. | | Host pool VM and user manager | Can handle user sessions, start/stop/restart session hosts, and change the drain mode. | | User and profile manager | Can manage user sessions, processes, and delete FSLogix profiles, but cannot work with the session hosts. | | User manager plus | Can manage user sessions, but cannot work with the session hosts. Additionally, the role can terminate user processes. For CloudPCs, the user must have this role assigned to all resources of a Tenant. | | User manager | Can manage user sessions, but cannot work with the session hosts. | | Reader | Can view most data in Hydra. | | User | Can only see, start, stop, and restart their assigned session hosts and can disconnect and log off their sessions. | --- version: "Hydra 2.8.0" language: "en" --- # Autoscaling ## Why Autoscaling is Important In Azure Virtual Desktop, virtual machines incur usage costs even when there are no connected desktop sessions. Autoscaling can be essential to ensure unused machines do not increase costs. That said, even when machines are powered off ("deallocated") through autoscaling, storage costs persist. Hydra has solutions for both of these scenarios. ## Permanent vs Temporary Hosts It is helpful to understand that there are two types of hosts that Hydra recognizes: permanent and temporary. Permanent hosts are hosts that have either been created manually using the **Add new session host(s)** button, or they have been created outside of Hydra, such as the Azure Portal. These hosts will experience **power operations** through Hydra's autoscaling, such as starting or deallocating. These hosts can also take advantage of automatic disk swapping to HDD to help reduce storage costs when deallocated. Temporary hosts, on the other hand, are hosts that have been created only through Hydra's autoscaling. When Hydra needs to meet additional autoscaling demands and does not have enough permanent hosts to power on, it will automatically create temporary hosts to meet the demand. Hydra uses the information in the **New Session Host Rollout** tab to create temporary hosts, so this information is required if temporary hosts wish to be utilized. These hosts will experience **creations and deletions** instead of power operations like permanent hosts. When it is time to scale down, Hydra will completely delete the hosts, saving on both compute **and** storage. Temporary hosts can be identified by the **double arrow** icon in the Details page: ![image-20260210-225956.png](https://docs.loginvsi.com/__attachments/a_50c2404a9c7be1410e8dbc414f5c28a37796456810b6b3c311821ba2fb7e56cd/image-20260210-225956.png?cb=b0f99b9b4373b6af443d32fcbf8939df) It is worth noting that while temporary hosts save on both compute and storage when deleted, they take much longer to create compared to simply powering on and off permanent hosts. ## Configuring Auto-Scale: Pooled Host Pools From the main **Dashboard**: 1. Find the host pool where auto-scaling should be configured, and open its **Configuration**. ![Frame 1431.png](https://docs.loginvsi.com/__attachments/a_07e89ef3fd09b0617df01e98067d9e79abc7948241c8a089cd8cec5a31c4db1e/Frame%201431.png?cb=38e2a208936d8ff306f8500f37f0dac0) 2. Open the **Autoscale \& Autoshutdown** pane of the Host Pool configuration. 3. In the **Autoscale configuration** section, fill in the following details: * **Enabled**: Determines whether to apply the configured Autoscale \& Autoshutdown settings. * **Use Power-On-Connect**: Dictates whether Microsoft Power-On-Connect is enabled for the host pool; host pools will have zero session hosts until the first user connection, at which point the Session Host will dynamically be deployed, as opposed to static Schedules. * **Session hosts running 24/7**: Determines the number of session hosts running 24/7; at least one session host is required to allow user logins (unless using Power-On-Connect). * **Default LoadBalancer Type**: Dictates the load-balancer type for the host pool---either Depth-first (user sessions will be brokered until a Max Session Limit is met) or Breadth-first (user sessions will be brokered across all available Session Hosts). * **Depth-first is recommended** * **Min. number of available sessions**: Determines the capacity for new sessions; e.g., a Min. number of available sessions value of 5 means there will always be enough session hosts to support 5 sessions; a value of 0 means there are no session hosts. * **Min. number of hosts without sessions**: Determines how many session hosts should be available without any user sessions; e.g., a Min. number of hosts without sessions value of 0 means there are no session hosts. * **Dynamically rollout new session**: Hosts up to a max number of hosts in the pool determines the maximum number of allowed session hosts in the host pool, when the New Session Host Rollout configuration is set. * **Note: Power-On-Connect cannot trigger the creation of new session hosts** * **Concurrent starts/rollouts of session**: Hosts at the same time limit the number of parallel starts (creation) of session hosts. The Concurrent starts/rollouts of session hosts at the same time value should be higher in larger environments for quicker rollouts. ![Frame 1432.png](https://docs.loginvsi.com/__attachments/a_ffe35fdd1aeeb5bfab5dc7c3f2f42cebc48f60415b425a01c3d011edc594912b/Frame%201432.png?cb=9b01752c48230ec1c5b931df04ab4777) ## Scheduling Capacity Schedules can be used to define a minimum number of session hosts for a specific time range to handle login storms. For example, a default of five sessions hosts between 6:00 am and 8:00 am on weekdays. 1. From the **Autoscale \& Autoshutdown** page of the host pool where **Schedules** are desired: 2. Find the **Schedules** table, and click **Add** to create a new Schedule ![Frame 1433.png](https://docs.loginvsi.com/__attachments/a_b9166c284368945e6a54455d1164b8ee4d9086b5a52d62f40d0166cdf2ed73d1/Frame%201433.png?cb=792a7e1081a370c36e459c94df20aa18) A new Schedule item will appear in the **Schedules** table with default settings configured: ![Frame 1434.png](https://docs.loginvsi.com/__attachments/a_88f33f65f467fe6a2d5fecde82d40bd55d88f1bf7e470bee6e0825a4859ad0a6/Frame%201434.png?cb=58fcd082dbf567767da8256e8925d622) Now that the Schedule item is created, configure the following settings: * **Min. Hosts**: Determines the minimum number of session hosts running in the scheduled timeframe; Hydra will start and/or create additional hosts as needed. * **Min. Free Sessions (optionally)**: Determines the minimum number of available sessions during the scheduled timeframe. * **Weekdays selected**: Activates the Schedule. * **From (local time)**: Determines the starting time on selected Weekdays when the Schedule is active. * **Note: Configure the Host Pool Time-Zone on the Base tab**. * **To (local time**): Determines the ending time on selected Weekdays when the Schedule will be deactivated. * **Note: Configure the Host Pool Time-Zone on the Base tab**. * **Load-Balancer**: Configures the load-balancing behavior of the host pool; this can be different than the default Load-Balancer Type configured in the Configure Auto-scaling section above. For example, a schedule might use Breadth-first and Min. Hosts settings to spread logons across hosts, dramatically improving logon times during logon storms. * **Build-First**: Determines whether to temporarily deploy a new session host to reach the minimum level of hosts for this time frame, as opposed to starting existing ones. When no longer needed, they are deleted as opposed to deallocated, saving costs for compute and storage. ## Scheduling Capacity: Best Practices Based on experience and testing, there are best practices for leveraging schedules: * Create a New Session Host Rollout configuration and test it. * Enable Use Power-On-Connect and bring down the Session Hosts Running 24/7 value to 0. * Create permanent session hosts that are available and will be started during user connections; starting session hosts is faster than creating them. * Use a schedule to provide temporarily created Session Hosts during the busiest timeframes; temporary hosts will be deleted if no longer needed (as opposed to only deallocating them, which saves additional costs on disks). * Configure Session Timeouts to log off disconnected sessions, allowing for further automatic deallocation (or deletion of temporary hosts) of deployed session hosts * Session host pool schedules can now be reordered using drag and drop. This is useful when multiple schedules exist and need to be arranged in a clear, logical order. * The system allows schedules to overlap. Overlapping schedules are considered a bad practice and are not recommended. When schedules overlap, the schedule higher in the list runs first. Below, an example configuration is shown to achieve best practices: ![Frame 1576.png](https://docs.loginvsi.com/__attachments/a_a6b90983c958791e3d1b15fa705113b0acc5df1bb2eef93418aa7c1514a06b8f/Frame%201576.png?cb=0cb3c082865b49ff89f99de2d1edf3f5) ## Advanced Settings ### Reserving a Number of Existing Hosts In addition to the default usage of the Build-First setting, one of the Advanced Settings worth mentioning here is the ability to reserve existing hosts as part of your Autoscaling logic. By default, Hydra will attempt to provision additional Session Hosts to handle increased user demand. However, tasks such as domain joins or application installs may delay the process, resulting in end-users who have to wait for their session host to deploy. Instead of an error message indicating there are no available session hosts, the user gets notified that a session host is being powered on for them. **Note**: Automatic Disk-Swap will not function in this scenario. In the backend, the user is actually sending the power-on command to the session host. Hydra is not involved in this operation; thus, it cannot perform the disk swap. Power-on-Connect must be used in these scenarios. 1. From your**Host Pool configuration** page, open the **Advanced Settings** , and then open the **Details** drop-down. ![Frame 1436.png](https://docs.loginvsi.com/__attachments/a_4017313f18b75a5a75c041866af4c634736e11cda3914f8ce1a9ad099bd961e6/Frame%201436.png?cb=d007252deb616d40e6f26328796b9bd8) 2. Find the **Reserve a number of existing hosts** field and input the desired value. ![Frame 1437.png](https://docs.loginvsi.com/__attachments/a_e33034e813895eef169a42ea2c9c4ae378efe8097b6cdb9b823935c8dd1321df/Frame%201437.png?cb=2381f0107eb3d2ebb47b881c1d3e1431) ## Session Consolidation The Session Consolidation section provides a way to minimize the number of hosts off-hours to support your users. A few items to note about Session Consolidation: * Session Consolidation temporarily sets the Load Balancer to Depth First. This ensures that new sessions don't get brokered to hosts that Hydra is trying to consolidate. * Session Consolidation can perform one of the following Consolidation Actions: * Notify users to log off, but do not force users to log off - it only messages them. * Force users to log off immediately. * Notify users to log off, then force them to log off after the reminder timer expires. * Session Consolidation triggers whenever the Autoscaling Base Configuration is in use. That is, whenever a defined autoscaling schedule is not active. The following options are available: ![Frame 1552.png](https://docs.loginvsi.com/__attachments/a_5677e11106b8f222abf4070b31059f1131814cebe18ea370d9125ee0fa0d792f/Frame%201552.png?cb=5cef395e9e5ec18d4ba68ace53f1d579) * **Stay in the consolidation mode for at least (minutes)**: Defines the amount of time the pool should remain in Depth First and continue messaging users * **Snooze between two consolidation processes for at least (minutes)**: Defines the amount of time to wait until the next consolidation kicks off after the time above has ended. * **Start consolidation if no schedule active and load less than n-%** : Defines the pool's load percentage based on the host capacity configuration to determine if Session Consolidation is necessary and should proceed. Once both the load is less than this percentage **and** an autoscaling schedule is not active. * **Remind users to log-off each (minutes)**: Defines how often we should message users while the consolidation process is active. * **User message header** and **user message body**: Defines the messaging parameters sent to the user. For example, the default messaging will look as follows: ![Frame 1553.png](https://docs.loginvsi.com/__attachments/a_7372db699ec64f584f6e73f68a2de711376683ec79e2df6745e71f3f469282f4/Frame%201553.png?cb=6ac2c1df9209ecdabf668b2bcce3ba13) ## Configuring Auto-Scale: Personal Host Pools Personal, or persistent host pools contain assigned session hosts for named users. Because of the inherent differences between Personal and Pooled host pools, the auto-scaling configuration is different. It is recommended to use **Power-On-Connect** for **Personal Pools**, such that users can start their sessions as needed, and let autoscaling schedules handle power management. From the main **Dashboard**: 1. Find the host pool where auto-scaling should be configured, and open its **Configuration**. ![Frame 1440.png](https://docs.loginvsi.com/__attachments/a_f39d78bab8ed7f4f422d62ef1e89b2320ed0b68d27cc3f49c463794f847fec11/Frame%201440.png?cb=2815f7a5f00007693112299852ef0498) 2. From the **Host Pool configuration** page, open the **Autoscale \& Auto shutdown** setting: ![Frame 1441.png](https://docs.loginvsi.com/__attachments/a_f3785333585fe3bf854a58903e4f118a80f0342e43d52fe2661620c17fe67d5d/Frame%201441.png?cb=c58ae85a7cc20dabd433e11e2cd699c3) 3. Click **Add** to create a new Autoscale configuration. Now that the Schedule item is created, configure the following settings: * **Timeout in minutes**: Determines how long to wait before deallocating an unused session host; i.e., after the user logs off * **Weekdays selected**: Activates the Schedule. * **From (local time)**: Determines the starting time on selected Weekdays when the Schedule is active. * **Note: Configure the Host Pool Time-Zone on the Base tab.** * **To (local time)**: Determines the ending time on selected Weekdays when the Schedule will be deactivated. * **Note: Configure the Host Pool Time-Zone on the Base tab.** Below is an example host pool that is configured to shut down unused session hosts after 20 minutes, which is active every hour, of every day of the week. ![Frame 1442.png](https://docs.loginvsi.com/__attachments/a_d47ec55d064f6b4dcf3fb37741fd6b9f9530aded5acc796b5591603288948857/Frame%201442.png?cb=350a0eb1d36818c4966b1da039214def) **Note** : The **Timeout in minutes** setting will deallocate unused session hosts, where unused refers to a session host with no sessions. Disconnected sessions, while inactive, do not meet this criterion. Use the **Session Timeouts** setting at the Host Pool level to automatically logoff disconnected users after a certain threshold, at which point the **Timeout in minutes** setting can deallocate them. ## Automatically Delete Unused Personal Hosts Hydra can automatically delete personal hosts that have not been used for a certain number of days. To do this, expand the Advanced settings drop-down in the **Autoscale \& Auto Shutdown** page. Select the checkbox for **I know what I'm doing** to allow access to check **Automatically delete hosts**. Set the desired number of days that the host is unutilized before Hydra automatically deletes it. --- version: "Hydra 2.8.0" language: "en" --- # AVD Admin Dashboard ## Overview The Admin Dashboard provides an overview of Azure Virtual Desktop (AVD) host pools across all tenants where AVD management is enabled. The dashboard displays all configured host pools and provides key information for each pool in individual tiles. ## Search by Pool Name or **Tenant** Use the search field at the top to search for a host pool name or tenant name within the currently filtered list of host pools. ![Frame 1574.png](https://docs.loginvsi.com/__attachments/a_7aae491fb79d2078e6866e5fd072b8d75e018dd1ea04c3d8c1357937cafd1fc3/Frame%201574.png?cb=f5d9572dafd9d431ff4ccec045e95665) ## Filter by Tenant Use a filter to help narrow down the list of host pools by tenant. This filter allows you to focus on host pools associated with specific tenants. You can use this filter to: * Select **one host pool** * Select **multiple host pools** * Select **all host pools** * Select **no host pools** Selecting all host pools or none produces the same result: host pools from all tenants are displayed. ![Frame 1575.png](https://docs.loginvsi.com/__attachments/a_1e357ed039c4d43ee66fd34602f06d6d3e21a0515d44cba5866486822910813a/Frame%201575.png?cb=39a922ffb4f995a4182245b85e1e99dd) ## **Host Pool Tile Details** | **Icon / Field** | **Description** | |-------------------------------|----------------------------------------------------------------------------------------------------------------------------| | People icon | Multi-session host pool | | Two-way arrow (up/down) | Load balancer mode. e.g, Depth first | | Circular percentage icon | % load of the session host based on the number of sessions and session capacity | | Sessions | Number of connected and disconnected sessions | | Capacity now | Current session capacity of the host pool | | Capacity soon | Upcoming session capacity of the host pool, including free capacity from hosts currently starting or in the roll-out phase | | Play icon/button | Number of available session hosts, including temporary hosts created during scale-out | | Right arrow icon | Number of starting session hosts | | Stop/pause icon/button | Number of deallocating session hosts | | Angled arrow top-right | Number of session hosts currently in the roll-out phase | | Trash icon | Number of session hosts deleting | | Left-right arrow icon | Number of session hosts temporarily scaled out (included in the available hosts number) | | Green play arrow with 0 s/min | Login rate in new sessions per minute | | Wavy icon | Expand **Details** for the host pool | | Burger icon | Configure host pool settings | ### Email Subscription An email subscription prompt is available to keep administrators informed of new releases, features, and other important information via the Hydra Dispatch newsletter. When a **Full Admin** user logs in for the first time, a pop-up prompt is displayed inviting the user to subscribe to the newsletter. ![Frame 1567.png](https://docs.loginvsi.com/__attachments/a_37efa3b3f3518cb95b1c7e8da5d9aceed4448fe85d753ca05163c59986e17b12/Frame%201567.png?cb=aa166b2782bcfd289b9e6da82fd4988e) | **Action** | **Description** | |-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Learn more | Opens the Login VSI website, where you can subscribe to the newsletter. This does **not** subscribe the user directly from Hydra. | | Cancel | Dismisses the prompt. If you click "Cancel" without clicking "Learn more" or "Don't show this again", the prompt will appear again on the next visit. The same behavior applies to the banner: dismissing it will cause it to appear again unless you click "Learn more" or "Don't show this again." | | Don't show this again | Prevents the prompt from being shown again. | If you dismiss the prompt, a **Subscribe** button remains available in the Hydra header, allowing you to subscribe to the product updates whenever convenient. ![Frame 1563.png](https://docs.loginvsi.com/__attachments/a_ff92de6f5eb9e82970839e318778bc674c01e497620e2a066bf6ce0f94b20dce/Frame%201563.png?cb=543bdbcd4882f7bbe426d008f2eddd5f) **Note**: * The newsletter is currently the primary way to receive product updates (for example, new versions or announcements). * In-product notifications for such updates are not currently available. ## Display the Host Pools Dashboard as a Table You can configure the Host Pools dashboard to display information in a table format. To switch to the table view: 1. In the upper-right corner of the Hydra UI, select your avatar. 2. Select **Global Settings**. 3. Scroll to the **Others** section. 4. Select the checkbox next to **Show Dashboard as table**. ![Frame 2313.png](https://docs.loginvsi.com/__attachments/a_c514b6bb5d42e6b9b1aee9f20ecdc8601d8f2766dd8de6040b95cc3d5f563346/Frame%202313.png?cb=8645fc0373e00a51c725bcca26b9f01d) After you enable this setting, the Host Pools dashboard is displayed in a table format. The table view also allows you to customize the information displayed by showing or hiding individual columns: ![Frame 2312.png](https://docs.loginvsi.com/__attachments/a_6ce13a3b9a1f74a84256e653ff122efcf478efefbf0e8077888567e1980aff08/Frame%202312.png?cb=b541bf5528f00e261272309e1df74398) --- version: "Hydra 2.8.0" language: "en" --- # Azure Virtual Desktop ## Overview The Azure Virtual Desktop section in Hydra Lens provides information about connections and errors for selected AVD host pools. Here, you can: 1. Apply filters to select a tenant, host pools, and a time period. 2. Monitor the KPIs for the selected AVD environment. 3. Use two tabs with more details: 1. [Connections](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Connections): View session activity and connections by location and user. 2. [Errors](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Errors): View unhealthy session hosts and connection errors by client and IP segment. To access the section, navigate to**Hydra Lens** \> **Azure Virtual Desktop** in the **Hydra left-hand menu**: ![Frame 2451.png](https://docs.loginvsi.com/__attachments/a_ee355515051df735150a8edd806b5de1706a1a85e634bcd583cb012432b91afc/Frame%202451.png?cb=138f02cc77c4df4ecdd65c06ac23717e) ## Prerequisites For data to populate in this page, your Host Pools must have **Diagnostic Logging** enabled. Diagnostic Logging requires a Log Analytics Workspace to be set up in the same tenant as the Host Pools. For single-tenant scenarios, you can utilize the Log Analytics Workspace that comes with Hydra. For multi-tenant scenarios, you will need a [Log Analytics Workspace setup](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal) in each customer tenant. In either case, the tenant's Service Principal must have the ability to read from the Log Analytics Workspace. This can be accomplished by assigning our custom **Hydra - Resource Access Role** or Azure's built-in **Log Analytics Reader** role. To enable Diagnostic Logging: 1. Navigate to the Host Pool object in Hydra via **Azure Resources** \> **Virtual Desktop**. 2. Target the specific Host Pool and select **Properties**. 3. In the initial **Configuration** tab for the Host Pool, find the **Enable diagnostic logging** setting and select a **Log Analytics Workspace**. If none are available, ensure the tenant's Service Principal has proper access as noted above. ![Frame 2478.png](https://docs.loginvsi.com/__attachments/a_4451c705c7e02ae16a8b1a6da89bce419c547a48d1a0d29c647074294cb1aa7f/Frame%202478.png?cb=3693af7619a4422d9a8dee0da3a09aff) **Tip** : This can also be accomplished via the [Azure Portal](https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics). ## Filtering AVD Data Use the filters at the top of the page to specify the AVD data to include in the report. You can filter by: | **Filter** | **Description** | |-------------|----------------------------------------------------| | Tenant | Select one tenant. | | Host Pools | Select one or more host pools within the tenant. | | Time Period | Select the period for which you want to view data. | A tenant can contain multiple host pools with session hosts. Only host pools that have diagnostic logging enabled can provide data for the report. The host pool filter indicates how many host pools have diagnostic logging enabled. Host pools without diagnostic logging can also appear in the list, but you can't include their data in the report. **Note**: If you select a host pool that doesn't have diagnostic logging enabled, a tooltip message prompts you to enable diagnostic logging for that host pool before you can view its data. See an example below: ![Frame 2479.png](https://docs.loginvsi.com/__attachments/a_4d58b87731fe0d724bf0028acea5c7c810db74bbc7fe655c43feba316488286e/Frame%202479.png?cb=706804b9da0606ebd3f86f0eee6a9fd8) To update the report: 1. Select a tenant. 2. Select the host pools to include. 3. Select a time period. 4. Select **Refresh**. ![Frame 2464.png](https://docs.loginvsi.com/__attachments/a_ee955782fa90abcb8274c7adabe12a63f14457621905fa39cb8da783de294318/Frame%202464.png?cb=5998abb614c4e7e013848f3cd1715380) The updated page shows data for the selected tenant, host pools, and time period. ## KPI Cards The KPI cards provide a summary of the selected AVD environment. **Note**: The KPI cards show the current state of the environment rather than values aggregated over the selected time period. The following KPI cards are available: | **KPI** | **Description** | |------------------------------------|-------------------------------------------------------------------------| | Host Pools | The number of host pools | | Session Hosts | The total number of session hosts. | | Unhealthy Session Hosts | The number of session hosts that are currently unhealthy. | | Orphaned Session Hosts | The number of orphaned session hosts. | | Average Logon Timing | The average logon time for the selected data and time period. | | Host Pools with Diagnostic Logging | The number of selected host pools that have diagnostic logging enabled. | ![Frame 2465.png](https://docs.loginvsi.com/__attachments/a_4ceec2e630de1ee9a76cca4f1385a562c391860c8246f89f33284fa9bc9e8eb2/Frame%202465.png?cb=aceb5eff7a985a9051e4367875711a0e) ## Connections Use this tab to review session activity and user connections. The tab contains the following sections: * [Number of Sessions (Active \& Inactive)](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Number-of-Sessions-(Active-&-Inactive)) * [Sessions by Location and User](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Sessions-by-Location-and-User) ### Number of Sessions (Active \& Inactive) The chart shows the number of active and inactive sessions over the selected time period. Hover over the chart to view the number of active and inactive sessions at a specific timestamp. The chart also shows the maximum number of active sessions and the maximum number of inactive sessions for the selected time period. ![Frame 2466.png](https://docs.loginvsi.com/__attachments/a_04da96fa51027d3705042e68782de3714532a6d0719a3271a04143c6caa8ed75/Frame%202466.png?cb=b053de306c24a2013a739d3131bce97c) ### Sessions by Location and User The table shows where users connected from and how many connections they made during the selected time period. The table includes the following columns: |-------------|-------------------------------------------------------------------------| | **Column** | **Description** | | Tenant | The tenant associated with the connection. | | User Name | The user associated with the connection. | | Country | The country associated with the connection. | | City | The city associated with the connection. | | Connections | The number of connections for the user during the selected time period. | ![Frame 2467.png](https://docs.loginvsi.com/__attachments/a_6a63a26f31ea51173b79a5f5cf4ee7d47250d7924ade3712cf04d6fa0d41fb60/Frame%202467.png?cb=624a0dbe7f2a3e360076fe03d3b9d808) You can: * Sort the table by any column. * Filter the table by column values. * Search the table. For example, you can filter the table to view users from a particular city, filter for a specific user, or review how many times a user connected during the selected time period. ## Errors Use this tab to review unhealthy session hosts and connection errors. The tab contains the following sections: * [Unhealthy Session Hosts](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Unhealthy-Session-Hosts) * [Errors by Client](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Errors-by-Client) * [Errors by IP Segment (Class C)](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md#Errors-by-IP-Segment-(Class-C)) ### Unhealthy Session Hosts The table lists session hosts that have an error state. It includes the following columns: |--------------|-----------------------------------------------------| | **Column** | **Description** | | Tenant | The tenant associated with the session host. | | Host Pool | The host pool that contains the session host. | | Session Host | The session host with the error state. | | Date/Time | The date and time associated with the error. | | Message | The error message associated with the session host. | ![Frame 2468.png](https://docs.loginvsi.com/__attachments/a_2670325a144b7f99e7c489735eec616ef5c4f65bb249bb1166730ab86ce91817/Frame%202468.png?cb=e83e86eda455aab8a4a1970f1addcb12) You can filter the table by tenant, host pool, session host, or message. You can also sort the entries by time. Use the pagination controls to move through additional results. ### Errors by Client The table shows connection success and error information for the clients used to connect to session hosts. Clients can include Remote Desktop Connection, the Windows 365 connector, or a web connector. The following columns are available: |---------------|---------------------------------------------------------| | **Column** | **Description** | | ClientType | The type of client used to connect to the session host. | | ClientVersion | The version of the client. | | Success | The number of successful connections. | | Errors | The number of connection errors. | | Error Rate | The error rate for the client type. | ![Frame 2469.png](https://docs.loginvsi.com/__attachments/a_23c0da9bc68fdc4a91c7268416c536573f546e51664006cbbffb5b8691fc9c83/Frame%202469.png?cb=d0e5f70673577994491b22c26038fcda) You can sort and filter the table to investigate connection errors for particular client types or versions. ### Errors by IP Segment (Class C) The table shows connection success and error information by Class C IP segment. Use this information to identify IP segments with higher error rates. The table includes the following columns: |----------------|---------------------------------------------------------| | **Column** | **Description** | | IP Segment (C) | The Class C IP segment associated with the connections. | | Success | The number of successful connections. | | Errors | The number of connection errors. | | Error Rate | The error rate for the IP segment. | ![Frame 2470.png](https://docs.loginvsi.com/__attachments/a_187ae222444b1075a1db3654ba1bd28acccf21bde8836cfdaf8aa047e968e144/Frame%202470.png?cb=b0b328ac8f5e67867f780737fee42efa) You can sort and filter the table to investigate errors for particular IP segments. ## Network Performance Use this tab to review network performance reports. The tab contains the following sections: ### Network Performance by User This table shows network latency and estimated bandwidth per user session. Use this information to identify potential performance issues users may be experiencing. The table includes the following columns: |----------------|-------------------------------------------------------------------------| | **Column** | **Description** | | User Name | The user associated with the session | | Protocol | The network protocol established for this session | | Avg. RTT | The average Round Trip latency in milliseconds (ms) | | Max. RTT | The maximum Round Trip latency in milliseconds (ms) | | P90 RTT | The 90th percentile Round Trip latency in milliseconds (ms) | | Avg. Bandwidth | The average, estimated throughput in megabits per second (Mbps) | | Max. Bandwidth | The maximum, estimated throughput in megabits per second (Mbps) | | P90 Bandwidth | The 90th percentile, estimated throughput in megabits per second (Mbps) | ![NetworkPerformanceByUser.png](https://docs.loginvsi.com/__attachments/a_be75a79b38b0bc719ee303f7f79f21ebdda7178934ce60a01a06196579e3dea1/NetworkPerformanceByUser.png?cb=f24e7d44c764fe870013d82660cf17d4) You can sort and filter the table to investigate the performance for specific users. --- version: "Hydra 2.8.0" language: "en" --- # Capturing an Image ## Introduction Images can be created and stored in an Azure Compute Gallery, or optionally created directly within a Resource Group, if the source machine is not "Trusted Launch" enabled. ## Configuring Image Creation 1. From the left-side menu, click I**mage Builder** and then **Create an Image**. ![Frame 1345.png](https://docs.loginvsi.com/__attachments/a_074456caa1190114642ee62dcb86ffe4bd9833c3829ea4e15d7825564fd5c483/Frame%201345.png?cb=0fa03921a383976af883202ac80f9f20) 2. Select the **Tenant** where the Golden Master virtual machine exists. This will open additional configuration options. 3. In the **Virtual Machine** drop-down, select the **Golden Master** virtual machine. 4. Decide whether you want Hydra to apply Automatic Naming or whether a custom scheme is desired. * By default, Hydra will automatically name your image using the following format: \_\. For example, Windows11Gold_2025-07-01_12-00-00 * If a custom naming scheme is desired, enter it within the Image Name field 5. Optionally provide an **Image Description** of requirements or customizations. 6. Select the **Target Resource Group** where the image should be created. 7. Use the **Keep Older Versions** drop-down to select an appropriate number of backups to keep. For example, you can keep all image versions, just the latest one, or up to the last 20 versions. ![Frame 1346.png](https://docs.loginvsi.com/__attachments/a_2ce8d6d78fd31c179dea6cac0183702219389c800239efb75870d2b2c95b7da0/Frame%201346.png?cb=66b5dc062e3762858b079e399b8fd3d2) ![Frame 1347.png](https://docs.loginvsi.com/__attachments/a_0aa3cfaf00a0cac14b70f3fa6c14511a47d816b6f4781af90ec610ff2721cbfc/Frame%201347.png?cb=dd2f61cb92647be061316aaf9a1ea573) ## Configuring Azure Compute Gallery Image Storage Hydra does not create Azure Compute Gallery objects or VM Image Definitions. You must create these manually in the Azure Portal. For more information on creating an Azure Compute Gallery, image definitions, and image versions, see the [Microsoft Documentation](https://learn.microsoft.com/en-us/azure/virtual-machines/create-gallery?tabs=portal%2Cportaldirect%2Ccli2). ![Frame 2164.png](https://docs.loginvsi.com/__attachments/a_fe7379bbe23cdcf75cbed0bff87488ec3f6ee95714a6e67f7928e87abad26cf6/Frame%202164.png?cb=e83d3b584b4647540f74298e36742b40) 1. If an Azure Compute Gallery deployment is required, click the **Azure Compute Gallery** drop-down to display additional configuration menus. This will display all available VM Image Definitions in all available Azure Compute Galleries. 2. From the **Locations** drop-down, specify Azure regions where the Image should be available. 3. Use **Remove Native Image after Copying** to delete the native image after copying it to the gallery definition. 4. Use **Shallow Replication** for testing and development. This makes the image ready faster, but you can't deploy many hosts in parallel while the image is not copied, and the image is only available in the home region. 5. Use the **Keep Older Versions** drop-down to select an appropriate number of backups to keep. For example, you can keep all image versions, just the latest one, or up to the last 20 versions. Hydra will remove older versions to reduce costs. 6. If you select **Advanced options**, there are more options available: 1. **Date Naming**: Makes the version format year.month.day (UTC). This simplifies the image version view, but it removes an existing same-day version from the gallery definition, and existing hosts don't recognize it as a new image. (e.g., 2026.04.20). 2. **Version Name**: Gives the image you are creating a unique version number (e.g., 100.25.215). 3. **Replica Count**: Creates a specified number of image copies. 4. **Disk Type**: Specifies the Storage type of the image you are creating (e.g., Premium SSD). ## Building the Image 1. When finished with configuration, click **Create Image**to begin the process. Depending on the master image size, the number of installed applications, and the number of destination compute galleries, this can take from 6 to 45 minutes. ![Frame 1349.png](https://docs.loginvsi.com/__attachments/a_cd3d105f6fc8f9baece44df8e5034448a68ce7a91e305a5e9c13c5ca201b3c6c/Frame%201349.png?cb=fcf12142a0ffc80331a963c4c0263fee) 2. Use the **Imaging Log** table to track the progress of your images. The **Results** column displays each step of the process for straightforward tracking, including the image name. ![Frame 2486.png](https://docs.loginvsi.com/__attachments/a_0046c2b1c9223738c9acd251721d9a36f13a978d1bb9c66fa5482810f7f229cc/Frame%202486.png?cb=6b92b86b2e9e4714f731cb1dbcdaafef) 3. If for any reason you wish to cancel an imaging job in process, click on the "running" icon in the **State**column and confirm you want to cancel the job. ![Frame 2485.png](https://docs.loginvsi.com/__attachments/a_1721c9a87f10c11588714e8244cca33a5675144bc7d0d944c41f9f1c61d2b814/Frame%202485.png?cb=f81cf443708645c1bc8b8f97133c38fa) --- version: "Hydra 2.8.0" language: "en" --- # Cloud PC Settings ## Overview The Cloud PC Settings page provides a consolidated view of Cloud PC-related settings across tenants. You can create, edit, assign, and delete supported setting types from this page, including: * [User settings](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#User-Settings) * [Cloud PC configurations](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Cloud-PC-Configuration) * [Windows App settings](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Windows-App-Setting) * [Remote Connection Experience](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Remote-Connection-Experience) ## Cloud PC Settings Table | **Column** | **Description** | |--------------|----------------------------------------------------------------------------| | Tenant | The tenant associated with the setting. | | Name | The name of the setting or configuration. | | Assigned | Indicates whether the setting is assigned to users or groups. | | Type | Identifies the setting type, i.e., User setting or Cloud PC configuration. | | Last updated | Shows the most recent date and time the setting was updated. | | Priority | Shows the priority order for the setting, when applicable. | | Edit | Provides access to edit or manage the selected setting. | ![Frame 2309.png](https://docs.loginvsi.com/__attachments/a_1615e11240f6998c77bf1fc0f4c6770979a8df1d22c040f4a3aee5fab66fced7/Frame%202309.png?cb=8c27689721e3b66a5f164cde071f6965) ## Creating a New Setting Select the **+** button in the top-right corner of the table to create a new setting. A prompt window appears with the following options: | **Option** | **Description** | |------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| | User Settings | Creates a user setting. For details, see [User Settings](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#User-Settings). | | Cloud PC Configuration | Creates a Cloud PC configuration. For details, see [Cloud PC Configuration](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Cloud-PC-Configuration). | | Windows App Setting | Creates a Windows App setting. For details, see [Windows App Setting](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Windows-App-Setting). | | Remote Connection Experience | Creates a Remote Connection Experience setting. For details, see [Remote Connection Experience](https://docs.loginvsi.com/hydra/2.8.0/cloud-pc-settings.md#Remote-Connection-Experience). | ![Frame 2305.png](https://docs.loginvsi.com/__attachments/a_9d1b0d7554c4da7749f3b309d64220450eb801ef74819eb6a2bc67cc9fe2fcc4/Frame%202305.png?cb=079443e434484284f9f77e1b9b3fc941) ### User Settings User settings let you configure how Cloud PCs behave for specific users or groups. This includes enabling local admin permissions, allowing users to reset their Cloud PCs, configuring point-in-time restore options, applying optional disaster recovery, and selecting the provisioning image source. #### Settings Tab ##### General * **Tenant**: Select the tenant for the user setting. * **Name**: Enter a descriptive name for the user setting. * **Enable local admin**: Makes the end user a local administrator on all of their Cloud PCs. * **Enable users to reset their Cloud PCs**: Allows targeted users to reprovision their Cloud PC from the Windows 365 app or web app. ##### Point-in-time restore service Allows restoring a user's Cloud PC to a backup taken at a specific point in time. Users will lose any data stored on the Cloud PC disk between the current time and the recovery point. For details, see [Point-in-time restore for Windows 365 Enterprise](https://learn.microsoft.com/en-us/windows-365/enterprise/restore-overview). * **Allow user to initiate restore service**: Allows users to start their own point-in-time restore for supported Cloud PCs. * **Frequency of restore-point service**: Choose how often Windows 365 creates restore points for eligible Cloud PCs. ##### Optional Business Continuity and Disaster Recovery Before configuring, purchase and assign optional disaster recovery licenses to users. Note that Disaster Recovery Plus cannot be configured for Frontline Cloud PCs, and optional disaster recovery cannot be configured for Government Cloud PCs. To learn more, see [Cross region disaster recovery in Windows 365](https://learn.microsoft.com/en-us/windows-365/enterprise/cross-region-disaster-recovery). * **Enable additional DR for this user setting**: Adds extra resilience for Cloud PCs with optional disaster recovery. Additional licenses may be required. ##### Provisioning source type * Select the image source: * **Default**: Use the image from the provisioning policy. * **From Snapshot**: Use an uploaded personal image if available. Provisioning fails if no snapshot exists for the user. ![Frame 1578.png](https://docs.loginvsi.com/__attachments/a_47d5716c457ce9bb867868f00d48d46f8ed4cbba83ae7daae1cf2fa6e8ed7b09/Frame%201578.png?cb=172115df339724ad31a8b3c9c31356a2) #### Assignments Tab 1. After configuring settings, switch to the **Assignments** tab. 2. Assign groups to the tenant. 3. Click **Update** to save the user setting. **Note** : Updating an existing user setting follows the same procedure: open the dialog via the **gear** icon, modify the desired configuration, then save. ### Cloud PC Configuration Cloud PC Configurations let you configure how Cloud PCs behave for specific users or groups. This includes defining configuration settings, applying scope tags, and assigning the configuration to users or groups. #### Settings Tab ##### General * **Tenant**: Select the tenant for the Cloud PC configuration. * **Name**: Enter a descriptive name for the Cloud PC configuration. * **Description**: Enter a description for the Cloud PC configuration. ##### Configuration settings Supported on higher-spec devices (8 vCPU, 32 GB RAM, 256 GB storage, and above). Not configured by default. When enabled, the hybrid compute framework is installed and allows the user's device to use AI-enabled features. For more information, see the [AI-enabled Cloud PC (Frontier Preview)](https://learn.microsoft.com/en-us/windows-365/enterprise/ai-enabled-cloud-pcs). ![Frame 1639.png](https://docs.loginvsi.com/__attachments/a_cba371a845238ae47b52ffa34cc78db69b1cb391f71d8d555083066b3876b0fb/Frame%201639.png?cb=fc232e74a02a2b848bd660e2c67c7a78) #### Scope Tags Tab Use scope tags to control which administrators can view and manage the Cloud PC configuration. To manage scope tags, first select a tenant on the Cloud PC configuration page. Select the configuration, then choose **Edit** and select the **Settings** (gear) icon. The **Scope tags** window opens. Here, you can: * Search for scope tags by name. * **Select all** to assign all available scope tags. * Select **Default** to assign the default scope tag. * Select or clear individual scope tags as needed. ![Frame 1640.png](https://docs.loginvsi.com/__attachments/a_a64e24dbac5d03c4865facec4fed57deca297172c73b60482932718ccb16a44b/Frame%201640.png?cb=f0a8e8c3614a404a6b4d844d3dfd7562) #### Assignments Tab Use the **Assignments** tab to specify which groups receive the Cloud PC configuration. Here, you can: * Search for groups by name. * Select all to assign the Cloud PC configuration to all available groups in the selected tenant. * Select or clear individual groups to update the assignment. ![Frame 1641.png](https://docs.loginvsi.com/__attachments/a_8d262a9102522e876607ccc156112e3686f0b91e53be774f60fcd501bb022746/Frame%201641.png?cb=f703187891ba381e899dcf412312d18e) ### Windows App Setting Use Windows App Setting to configure user self-service actions for Cloud PCs and Cloud apps. These settings apply to the selected users on both managed and unmanaged devices. #### Settings Tab ##### General * **Tenant**: Select the tenant where the setting applies. * **Name**: Enter a name for the setting. * **Description**: Enter a description for the setting. ##### User self-service actions Choose which self-service actions are available to users in the Windows app. These settings apply across all Cloud PCs and Cloud apps for a user, on both managed and unmanaged devices. * **Enable users to reset their Cloud PC**: Allows selected users to reprovision their Cloud PCs from the Windows 365 app or web app. * **Allow users to initiate a restore**: Allows users to start a point-in-time restore for supported Cloud PCs. * **Enable users to provision new Cloud PC instances**: Allows selected users to provision their Reserve Cloud PCs from the Windows 365 app or web app. Additional Reserve licenses may be required. Each self-service action supports the following options: | **Option** | **Description** | |----------------|---------------------------------------| | Not configured | Uses the default setting. | | Enable | Makes the action available to users. | | Disable | Prevents users from using the action. | ![Frame 2190.png](https://docs.loginvsi.com/__attachments/a_705d4a4415eef500b5cabfe02deccaf6c3b8a22034fb67748dac16080a19edc1/Frame%202190.png?cb=516cf83cb3dc56d96b245dfa861e48db) #### Scope Tags Tab Use the Scope Tags tab to add scope tags to the Windows App setting. Search for tags by name, select the tags you want to apply, and then click **Save**. ![Frame 2186.png](https://docs.loginvsi.com/__attachments/a_0e493279bd6b57efa30fc666fd86d42d3c78436a40b6e5aaec3c9ee661e2e646/Frame%202186.png?cb=e01019f1513b7438f4d90b5968d7bb5f) #### Assignments Tab Use the **Assignments** tab to assign the Windows App setting to groups. Search for groups by name. Enter at least three characters to search, select the groups you want to assign, and then select **Save**. ![Frame 2187.png](https://docs.loginvsi.com/__attachments/a_a1a9334715d4f1d89a1f3114468f892f8ece18509d2597ab414de8d548ef75d4/Frame%202187.png?cb=0f26eea3ecd92c9762709ac1c367635e) ### Remote Connection Experience Use the Remote Connection Experience setting to configure restrictions that should apply to the remote connections. #### Settings Tab ##### **General** * **Tenant**: Select the tenant where the setting applies. * **Name**: Enter a name for the setting. * **Description**: Enter a description for the setting. ##### **Windows Cloud I/O Protection** Blocks keyboard input from local devices from entering the remote session. Only input generated within the remote session is accepted, improving isolation and reducing the risk of interference. This action supports the following options: |----------------|-----------------------------------------------------| | **Option** | **Description** | | Not configured | Uses the default setting. | | Enable | Makes the setting apply to assigned users. | | Disable | Makes the setting not applicable to assigned users. | ![Frame 2310.png](https://docs.loginvsi.com/__attachments/a_ed0dc4d4ca6a6145cf6bd8dbec776857c45afa9b71832c012fa42bc0075f1cbe/Frame%202310.png?cb=369c1b1a643671c2406b2dc44d81f007) #### Scope Tags Tab Use the **Scope Tags** tab to add scope tags to the Remote Connection Experience setting. Search for tags by name, select the tags you want to apply, and then select **Save**. ![Frame 2307.png](https://docs.loginvsi.com/__attachments/a_35f7c5ca9ca091f951d97b7a833ab8e814ed8bc48464589e090960c6d510e75f/Frame%202307.png?cb=8d85bf3bb78794b34fc096b828d80227) #### Assignments Tab Use the **Assignments** tab to assign the Remote Connection Experience setting to groups. Search for groups by name. Enter at least three characters to search, select the groups you want to assign, and then select **Save**. ![Frame 2308.png](https://docs.loginvsi.com/__attachments/a_49916865cd0e6fc7874ee219cc65a4887d29b16cd11d631ff7c429192fde1e2d/Frame%202308.png?cb=ff559e13ee7c50de67dfebaafa4c0a3c) --- version: "Hydra 2.8.0" language: "en" --- # Configuring Hydra to Remove Entra and Intune Devices ## Overview You can only deploy new hosts in Entra ID if no device with the same name exists in Entra. There are two primary approaches to automating the removal of Entra and Intune devices via Hydra: The first, and generally safer, method leverages the VM's own identity to perform deletion. Here, you configure a script to execute within the virtual machine itself. When the VM is scheduled for deletion, this script authenticates using the VM's credentials and requests the removal of its device object from Entra. For more details, see [AAD Only - Join and re-join hosts](https://github.com/MarcelMeurer/WVD-Hydra?tab=readme-ov-file#aad-only---join-and-re-join-hosts). The second method involves granting Hydra's service accounts or managed identity additional permissions at the directory level and in Intune. With these broader rights, Hydra can centrally remove corresponding Entra device records (and, if desired, matching Intune device entries) whenever a VM is deleted and before a new deployment to prevent potential conflicts. This central management might simplify administration, but it means the Hydra service has elevated permissions, which may be less desirable from a security perspective. ## Adding Administrative Permissions ### Device Administrator Role on an Administrative Unit An additional way to enhance security while still enabling automated device removal is to scope Hydra's permissions more narrowly using Entra's administrative units. Instead of granting directory-wide rights, you can assign Hydra the "Cloud Device Administrator" role specifically for an administrative unit that contains only the relevant devices. By organizing Entra devices into an administrative unit based on a naming convention, such as all devices with names starting with "AVD," you ensure that Hydra's elevated permissions apply solely to those matching devices. This targeted approach limits the impact of Hydra's access, allowing it to manage only the intended subset of Entra devices while maintaining tighter overall security. 1. Go to **Entra** in the**Azure Portal \> Administrative units**. ![Frame 2355.png](https://docs.loginvsi.com/__attachments/a_bca58d01b15dcc998a44c07fcf94fda48ccc34b695af6da491b4934d4df2d0b6/Frame%202355.png?cb=a0986af709e977e49644497c83b911b3) 2. Click **Add** and enter a matching Name like **AU-Hydra-DeviceAccess** and a description. ![Frame 2357.png](https://docs.loginvsi.com/__attachments/a_bbf9e6b46f39b4c8e36f64e179b96db7627c6a2bbd9866eed9ff0d9895976956/Frame%202357.png?cb=12326b63beede4087b260ea9a7a36bba) 3. Assign the role **Cloud Device Administrator** after clicking **Next**. ![Frame 2358.png](https://docs.loginvsi.com/__attachments/a_cc55c1f30c9f994d0e3d4e842454c3fb2492887c7e65fe2ec57bc82bc8ddd680/Frame%202358.png?cb=0b2d74697a417585987b3eb1431dfaec) 4. Create the new administrative unit. The new unit shows up after a few minutes. ![Frame 2359.png](https://docs.loginvsi.com/__attachments/a_e3014095722949ba7e16c61227714430135b2d3fdf5d1ce5a5cc7b1ba1e68754/Frame%202359.png?cb=5db7484821b80ca7f4c39e8eadd0bba2) 5. Edit the unit by clicking on its name. Navigate to properties and select the Membership type **Dynamic Devices**: ![Frame 2360.png](https://docs.loginvsi.com/__attachments/a_e4c2af71f6c800e8cdbc9c9b37ecd5ea37a543ae9dad34ed1fcb6e7326365940/Frame%202360.png?cb=718bbed31775ff9e36d0738bb71345b9) 6. Click **Add dynamic query** to narrow down the permission of the role to specific devices only. You can filter the devices by name starting with (e.g.) "AVD". In this case, the administrative units narrow down the permissions to devices starting with the name "AVD....". ![Frame 2367.png](https://docs.loginvsi.com/__attachments/a_08c1d3d1ca4ce7efa348e79625285df4d955eaed17d96113ee4e88d7a5ab4f33/Frame%202367.png?cb=a11b672e4fe1dac82d7947932c5998cb) 7. Click **Roles and administrators** and then **Cloud Device Administrator**. ![Frame 2361 (2).png](https://docs.loginvsi.com/__attachments/a_f013fb8ca7fcf4108783f94ebdb2a13a2d29318b1426677d7f3cd8c3ea736db3/Frame%202361%20(2).png?cb=1b0cf9cbbfa4bf76105d450506621116) 8. Click **Add assignments** . The selected scope is the administrative unit focusing on the devices starting with AVD. Click**Select member(s)** and your Hydra service principal(s) (from the tenant menu in Hydra) or managed service identity if you are using this one. ![Frame 2362.png](https://docs.loginvsi.com/__attachments/a_8374df29518e8f782b0948b9df1d323bd8121f84013a3cdcc8299162b74758f3/Frame%202362.png?cb=b23a0d7d24ba86ac57964023c68463fd) 9. Click **Select** and **Next**. 10. In the following dialog, choose **Active** and **Permanently assigned** (not shown in all tenants). Enter a justification and select **Assign**. Hydra now has the administrative role for the devices in the administrative unit. ### Graph API Permissions The Hydra service principal(s) need additional permission to find the devices in Entra (before removing them from the configuration). 1. Open the **Azure Portal** , navigate to **Entra \> App registrations**. 2. In **All applications**, search for the first service principal of Hydra. You can also search for the ID of the service principal. You can find the ID in the tenant configuration of Hydra. 3. Select the service principal and, in **Manage,** select **API permissions** : ![Frame 2363 (1).png](https://docs.loginvsi.com/__attachments/a_d5bf8ca034ab62bb2b6c54a9f7417318246a2160fcbb67f0a113f036fd9dd883/Frame%202363%20(1).png?cb=2950b7f92581b1b8ca1aa5169f95a3ed) 4. **Remove Entra device**: Add the following permissions by clicking Add permissions: | **Part** | **Value** | |-------------|-------------------------| | API: | Microsoft Graph | | Type: | Application permissions | | Permission: | "Device.Read.All" | ![Frame 2364.png](https://docs.loginvsi.com/__attachments/a_e3b19bc01828bd473aad7f5c414dbf2ae3cd44342c6e7dfd50a58c6d6cfcee34/Frame%202364.png?cb=53fabba6ad5715cc83c36830618f793d) 5. **Remove Intune devices**: To let Hydra also remove Intune devices, add the permission: | **Part** | **Value** | |-------------|-----------------------------------------------| | API: | Microsoft Graph | | Type: | Application permissions | | Permission: | DeviceManagementManagedDevices.ReadWrite.All" | ![Frame 2365.png](https://docs.loginvsi.com/__attachments/a_93d1def48d02851ed914b059d463b12e864db2e2f0770cf5a336ec79b0213de2/Frame%202365.png?cb=e0c97c9e3867107a404f604375a692af) This permission is valid for all (!) devices in Intune and cannot be narrowed down like the Entra devices. Use it carefully and monitor your environment, probably. Use private endpoints for Hydra and disable public access to the Hydra app service. **Allow Hydra to show users and groups**: Hydra can display users and groups in the directory for various purposes, such as assigning a user or group to an application group in AVD. To allow that, add the following permission: | **Part** | **Value** | |-------------|-------------------------------------------| | API: | Microsoft Graph | | Type: | Application permissions | | Permission: | "Group.Read.All" and "User.ReadBasic.All" | **Note**: This permission is valid for all users and groups. Use it carefully and monitor your environment, probably. Use private endpoints for Hydra and disable public access to the Hydra app service. **Giving admin consent**: The added permissions need consent from a privileged administrator and shown as "not granted" in the status field: ![Frame 2368.png](https://docs.loginvsi.com/__attachments/a_1c167b59970a56731dd824baa17716b52f61802afe26f07e4a134bbfc56daee6/Frame%202368.png?cb=c101a2f75f68d3cecacda14246dc2c17) Clicking **Grant admin consent for company** starts the consent process. After the completion, the service principal has the permissions: ![Frame 2366.png](https://docs.loginvsi.com/__attachments/a_8ac575dfe9a88efb84a30f8eebcc6f21c75a8da94009a7b74d3c51aba6ffa2a8/Frame%202366.png?cb=e1471c1e8b191a3be124869cc7549ebf) * **Additional service principals**: Repeat this step for each service principal you are using in Hydra (listed in the tenant configuration of Hydra). * **Managed Service Identity**: PowerShell is needed to give the MSI the API permission, like in the configuration of the service principals. ## Configuring a Host Pool to Remove Entra and Intune Devices on Demand 1. Go to the **Host Pool Configuration** of a pool **\>** **New session host rollout**. 2. Enable the following checkbox or checkboxes to allow Hydra to remove devices on a delete event and on rollout (if devices with the same name exist). ![Frame 2369.png](https://docs.loginvsi.com/__attachments/a_abd91703ac71abb79862666b10fb46601b6dd60df0d5b53aa5150a32f96ebcc3/Frame%202369.png?cb=40e622b998560b304fd9758968d4e8ab) **Important**: An administrator in Hydra could potentially specify the name of an existing Intune device, which is not an AVD device, thereby causing it to be deleted unintentionally. Example for a deletion process with Entra and Intune devices: ## Example of a Deletion with Devices ![Frame 1468.png](https://docs.loginvsi.com/__attachments/a_c2e55226bee7cfd4c18a94ca7339bfb8990cf1220732ba5020cad908447a054a/Frame%201468.png?cb=6b5b7dfd398c3d48ac17bb8c5e0c92d0) --- version: "Hydra 2.8.0" language: "en" --- # Configuring Hydra to Support AVD Hybrid Environments ## Installing the Hydra Preview Version Hydra version 2.5.1 is the preview version of Hydra supporting Microsoft's Public Preview of AVD Hybrid on Hyper-V nodes and clusters. If we have received your Azure Tenant ID and Hydra Instance name, you should see the Preview version available for installation in the Hydra Update Center. For this, click on the avatar icon in the top left of the Hydra UI and select **Update Center**. ![Frame 2449.png](https://docs.loginvsi.com/__attachments/a_06b1bc81b74988ea547c54b91e20fc719724ff9935e2e1405519b1c2b02ccc9d/Frame%202449.png?cb=b1414e9d746ecc3012cb9484e634984b) ## Using the Hydra Proxy We are using our Hydra Proxy feature to perform operations on-premises on behalf of the Hydra instance running in Azure. For more information on Hydra Proxy, see [Installing and Using the Hydra Proxy (Preview)](https://docs.loginvsi.com/hydra/2.8.0/installing-and-using-the-hydra-proxy-preview.md). When using AVD Hybrid, the Hydra Proxy is responsible for: * Starting VMs * Stopping VMs * Restarting VMs * Deleting VMs and their disks * Creating new VMs / session hosts, including * Azure Connected Machine Agent (ARC) Installation * Azure Virtual Desktop (AVD) Agent * Domain join (AD and Entra) * Azure Monitoring Agent (if selected) * Imaging of existing Golden Master VMs (note: a Golden Master VM must have the ARC agent installed) * Etc. ## Grouping Hybrid Locations in Hydra Proxy Configuration File The Hydra Proxy can handle multiple groups of Hyper-V nodes (servers) as a "Hybrid Location". All nodes in a group are represented by their Location ID. That is similar to custom locations as it relates to Azure Local. The group of nodes can also be part of a failover cluster. **Note**: Don't mix clusters and nodes across different Hybrid Locations. ## Preparing Hyper-V Nodes All Cluster Nodes and stand-alone Hyper-V servers must be configured similarly: * At least one Network Switch with the ++same name++ across all nodes * One or more local folders to store the virtual machines. (**Note**: SYSTEM, SERVICE, and Administrators should have FULL CONTROL access to those folders): * C:\\LocalStorage (for nodes without cluster shares) * C:\\ClusterStorage\\UserStorage_1 (for nodes with cluster shares) ## Preparing an Image Gallery Hyper-V Virtual Machine images are sysprep'd VHDX files. Hydra needs a shared resource to store those files. For a stand-alone Hyper-V server Hybrid Location, a local folder would work. For clusters with multiple nodes, use a cluster share, or a share on a file server. (**Note**: SYSTEM, SERVICE, and Administrators should have FULL CONTROL access to those folders). If a network share is used, add the Everyone full permission (to let the NTFS permission apply). To access the network share, each node needs permission to this share in the right context. Examples: * C:\\LocalStorage\\Images * C:\\ClusterStorage\\UserStorage_1\\Images * [\\\\Server\\Images](file://server/Images) ## Installing the Hydra Proxy 1. To start, enable and install the Hydra Proxy (always use the newest version for this preview). For steps, see [Installing and Using the Hydra Proxy (Preview)](https://docs.loginvsi.com/hydra/2.8.0/installing-and-using-the-hydra-proxy-preview.md). **Note** : Follow the documentation through the step that [creates the HydraProxy.json file](https://docs.loginvsi.com/hydra/2.8.0/installing-and-using-the-hydra-proxy-preview.md#Installing-the-Hydra-Proxy)[++.++](https://docs.loginvsi.com/hydra/2.5.0/installing-and-using-the-hydra-proxy-preview#Installing-the-Hydra-Proxy) Then, continue to step 2 below. 2. For AVD Hybrid, add a new custom location. Here is an example: { "CustomLocations":[ { "LocationType":"HyperV", "LocationId":"almere-datacenter", "LocationName":"Almere", "ClusterName":"HYPERV-ALMERE.almere.nl", "ClusterNodes":[ "HYPERV-ALMERE-0.almere.nl", "HYPERV-ALMERE-1.almere.nl", "HYPERV-ALMERE-2.almere.nl" ], "ClusterShares":[ "C:\\LocalStorage", "D:\\ClusterStorage\\UserStorage_2" ], "Networks":[ { "Name":"External-vSwitch" }, { "Name":"Internal High Security" } ], "ImageGalleries":[ { "Name":"Default", "GalleryLibraryPath":"C:\\LocalStorage\\Images\\Repository.json" }, { "Name":"AdvancedRemote", "GalleryLibraryPath":"C:\\LocalStorage\\Images\\Repository-Secure.json" }, { "Name":"On-Share", "GalleryLibraryPath":"\\\\HYPERV-ALMERE-0\\Images-FileShare\\Repository-Share.json" } ] } ] } Custom location properties: | **Property** | **Description** | |---------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | LocationType | The configuration type for different environments. Choices are currently: * **HyperV** (use this type for AVD Hybrid on Hyper-V). * **AzureLocal** (use this type for Azure Local). | | LocationId | A given name of the location: LocationId can only include alphanumeric, underscore, parentheses, hyphen, period (except at end), and Unicode characters that match the allowed URL-safe characters. | | LocationName | A given short name. | | ClusterName | If a failover cluster is representing the Hybrid Location, use the FQDN of the failover cluster (also handle this name like the cluster nodes in the documentation (giving permission) -- Note: We will add the functionality to publish a VM to the failover cluster soon. | | ClusterNodes | Specifies the fully qualified domain names (FQDN) of the nodes / Hyper-V servers. | | ClusterShares | A list of the local folders or cluster shares from [Preparing Hyper-V Nodes](https://docs.loginvsi.com/hydra/2.8.0/configuring-hydra-to-support-avd-hybrid-environments.md#Preparing-Hyper-V-Nodes). | | ImageGalleries | A list of image galleries. | | ImageGallery.Name | A given name of the location: ImageGallery.Name can only include alphanumeric, underscore, parentheses, hyphen, period (except at end), and Unicode characters that match the allowed URL-safe characters. | | ImageGallery.GalleryLibraryPath | Path to the folder for the gallery, including the name of a JSON file. This file will contain the content of the gallery. The JSON file must not exist. It will be created automatically (or add an empty text file with an open and closed square bracket: "\[\]"). Example: C:\\LocalStorage\\Images\\Repository.json | | Networks | A list of the network switches. Each node must have a switch with the same name. | | Network.Name | Name of the network switch. | 3. Continue with [Installing and Using the Hydra Proxy (Preview)](https://docs.loginvsi.com/hydra/2.8.0/installing-and-using-the-hydra-proxy-preview.md) and skip the test of creating a local image on Azure Local. 4. Ensure that the Hydra Proxy is running. For testing purposes, we recommend running it as an administrator: ![Frame 2450.png](https://docs.loginvsi.com/__attachments/a_9c320ad3c890ca6e9b56b5e327c334194d6547c0bb6ecf87dd93d8cd579ddded/Frame%202450.png?cb=8e1580e2779aa56d111013ea6ee1c1b9) ## Configuring a Host Pool for AVD Hybrid Create a new Host Pool for your AVD Hybrid deployment in Hydra (**Azure Resource** \>**Virtual Desktop**) or in the Azure Portal. Please ensure the following configurations: 1. Enable the validation environment option. 2. If not already done, grant the Hydra service principal the appropriate permissions (such as our custom role **Hydra - Resource Access Role** ). For more information on roles, see [Assigning Roles in Hydra](https://docs.loginvsi.com/hydra/2.8.0/assigning-roles-in-hydra.md). 3. In the **Azure Portal** , enable the Host Pool's **System-assigned** **managed identity** for later use. To learn more, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-managed-identity?tabs=portal1%2Cportal2%2Cportal3%2Chybridportal&pivots=system-assigned). ![Frame 2440 (1).png](https://docs.loginvsi.com/__attachments/a_f99ae742cb246c4eebd282d0be66eca26ab2c9c8e9044879e71406e6104eb3b8/Frame%202440%20(1).png?cb=f0b44924cee01af979bc95b7f084a7c4) 4. If you haven't already, create a service principal with a secret in [https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/\~/RegisteredApp](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps). The new service principal is needed for the automated ARC deployment. 1. Add a name, like ARC.Onboarding. 2. Generate a secret and store it for later use. 3. Store the application ID for later use. 5. Create or use a resource group for our ARC objects and add the account ARC.Onboarding (from the previous step) to the resource group with the role "Azure Connected Machine Onboarding" (for a new resource group, also add the Hydra service principal). 6. Add the managed identity of the Host Pool as a "Reader" to the resource group for the ARC objects. Example: Permissions on the resource group for the ARC objects: ![Frame 2441.png](https://docs.loginvsi.com/__attachments/a_bff44a453799395e0aec99498e1039d008f75ca85e15efdd8c4fc59d673d1ed4/Frame%202441.png?cb=5b6052ed3cbcff27453aa52bf3bf81ac) ## Preparing a Golden Master Before we can capture an image to roll out new session hosts, we need a new Golden Master VM on one of our nodes. If you want to use Entra ID-only joined hosts, we recommend Windows Server 2025. 1. Create a new VM with your operating system on a Hyper-V node 2. Rename the computer hostname to match the name of the VM in Hyper-V (!) 3. Install necessary updates 4. Install your applications 5. Install the Azure Connected Machine Agent (ARC) 1. Choose **Onboard** in the Azure Portal for more instructions: 2. If asked for a resource group to store the ARC object, select the same resource group referenced in "Configuring a Host Pool for AVD Hybrid." The ARC object should be visible in Azure: ![Frame 2442.png](https://docs.loginvsi.com/__attachments/a_724e15f3b7d13094ef272265acd5807f71775d726b4efba5fadcc6faf21e8d8e/Frame%202442.png?cb=17513d6773175afa918e396e9a3f9538) ## Capturing an Image 1. Go to Imaging in Hydra and select your tenant. If the Hydra Proxy is connected and configured successfully, you should be able to select your Hybrid Location in the drop-down list "Hybrid Location". 2. After that, select your Golden Master from the Virtual Machine list and your Target Image Gallery (that is the name from your HydraProxy.json configuration): 3. Click **Create Image** to start the imaging process. ![Frame 2443.png](https://docs.loginvsi.com/__attachments/a_b4a3cd0d23828d68006432154f56e7e9f04724ce31a96e4ff4b6784dcf3fdd0d/Frame%202443.png?cb=06a9782160478ed015342a9f7f37ff79) The image is stored in the folder and added as an entry to the JSON file. Example: ![Frame 2444.png](https://docs.loginvsi.com/__attachments/a_0224e1c8ec7dbdf469af9f48f479d5ba61b25d9b46f203e559d034213498c166/Frame%202444.png?cb=fce9da2717c34943f980155b8fac39d0) ## Rolling Out a Host in a Pool 1. To adjust the rollout configuration in Hydra, click on the menu icon in the **Host Pool** tile: ![Frame 2445.png](https://docs.loginvsi.com/__attachments/a_1fb50babd30836c1ccd33c95693c86c1d656368152fb5a98eca475b916c27509/Frame%202445.png?cb=ac8fc9a0625898e9e331f21d8d6a2d1f) 2. Selecting a network switch from Hyper-V is the trigger for Hydra to let you configure the settings related to AVD Hybrid. You can find the switches (similar to the name in the HydraProxy.json) at the bottom of the list: ![Frame 2446.png](https://docs.loginvsi.com/__attachments/a_95b49c65b7e27850f1dbfbfd8bca05c39b969540d0066439f440920a4d88260b/Frame%202446.png?cb=12e1109a4adf741ef506bfe5c69c9b9a) 3. Fill out the missing parameters to describe how a session host should be built in this pool. There are some AVD Hybrid-specific settings in **Host Pool Configuration** \>**New Session Host Rollout**: | **Field** | **Description** | |--------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | Image | Contains a list of images available for the Hybrid Location | | Cluster Storage Path | A list of available storage paths. Auto can be used to let Hydra decide where to store the data of the next VM. | | Node | A specific node or auto. Auto will use the host with the least number of VMs. | | Service principal for ARC join | The service principal and secret from the previous step to join a computer as an ARC object (the resource group is the target for the ARC object). | ![Frame 2447.png](https://docs.loginvsi.com/__attachments/a_ce2e5580e5657b93fe2dc6b35cae0c73675728b6100a4305f2612fc6b5a3310e/Frame%202447.png?cb=fe0b2579fd60a9cb9e520a09540cc68d) **Note** : In **New Session Host Rollout** \>**Advanced Settings**, there is an option to use an incremental disk. We don't suggest this for performance reasons. The local administrator's name is not forced yet. It will be inherited from the Golden Master. All local administrators on the newly deployed session hosts will get the new administrator password. 4. Click **Save** to apply the changes. ## Rolling Out New Hosts: Starting, Stopping, Restarting Clicking on the Host Pool tile opens the session host list. There are several actions to start, stop, restart, or roll out a new host (similar to native Azure Virtual Machines): ![Frame 2448.png](https://docs.loginvsi.com/__attachments/a_86d99bf527e7197784aff615b645cc7f6dec0184448e6f6e8ae3c2eac415a55c/Frame%202448.png?cb=7faad23a3587b87d38ea494e4318dea4) ## Known Limitations * Currently works only in Azure Global (not GOV-cloud tenants). * The configured local admin username for a rollout is ignored. The name is the same as on the Golden Master (Administrator). * All local administrator accounts of the Golden Master are reset to the configured local admin password. --- version: "Hydra 2.8.0" language: "en" --- # Configuring New Session Host Rollout ## Introduction In order for autoscaling, host replacement, and other automated rollout actions to function, you must first define a New Session Host Rollout configuration. ## Configuring New Session Host Rollout To add new Session Hosts, a **New Session Host Rollout** configuration is required: 1. From the **Host Pool Configuration** page, open the **New Session Host Rollout** section. ![Frame 1425.png](https://docs.loginvsi.com/__attachments/a_2d9e272f583077d4d4fb2cf46d391d0a4f07a63b376d81a2aa3bda7db349f7a7/Frame%201425.png?cb=10d82881c176003dcd218091ad26411d) 2. In the **Deployment Configuration** section, fill in the following details: * **Naming schema**: Specifies the naming convention for session hosts. Names should end in ### to enumerate session hosts, e.g., AVD-PROD-### becomes AVD-PROD-001. * **Naming mode**: Determines how to enumerate session hosts, either Count up from the highest number or Use and reuse free numbers. * **Network \& Subnet**: Configures the Virtual Network and Subnet used by the Session Host Network Cards. * **Image**: Specifies the base image Name or Image Version if using an Azure Compute Gallery * **Virtual Machine Size**: Dictates the VM size of Session Hosts. * **Resource Group**: Specifies the resource group where Session Host VM resources should be created. * **Availability (optional)**: Configures Availability Zones or Availability Sets. Choose between automatic, single, or mixed Availability Zones (e.g., Zone 1, Zones 1 and 2, automatic, etc...). * **Disk Type**: Configures the disk type used by Virtual Machines -- Microsoft recommends Premium SSD. * **Disk Size in GByte**: Specifies the size of the OS disk -- can be determined by image. * **Local Administrator Name**: Specifies the username of the local admin account. * **Local Administrator Password**: Specifies the password of the local admin account. * **Run Script or Script Collection After Deployment**: Allows for additional customization or preparation using PowerShell scripting. * **GPU Acceleration Extension**: Installs the GPU drivers via extension, but should typically be left disabled. * The recommendation is to perform the driver installs on the golden image. * **Entra ID / AAD Only**: Determines whether the Session Host will be joined to a traditional AD-domain, or Entra ID only. * Note that a **Service Account** must be used for Active Directory deployments. This Service Account must have delegated rights to create and delete machines within the given OU. Refer to [Create and Delegate a Service Account in AD](https://docs.loginvsi.com/hydra/2.8.0/creating-and-delegating-a-service-account-for-ad.md) and [Microsoft Documentation](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/delegation-control-wizard) for details. * **Join Intune** :Determines whether to enroll the device in Intune. * **Entra ID / AAD: Try to delete old device**: Determines whether to attempt deleting devices with the same name to avoid conflicts in Entra. * **Client License Mode**: Configures Windows licensing to avoid additional costs for OS licensing. * **Accelerated Network Card**: Determines whether to deploy Accelerated Network Cards (not supported by all VM sizes). * **Install Hydra Agent**: Determines whether the Hydra agent should be installed as part of the session host rollout. * **Download the newest AVD agent during the rollout**: Determines whether to force new session hosts to download the newest AVD agent binaries, as opposed to using the binaries stored from the imaging process. * **Try to enable host for hibernation**: Determines whether to enable the host for hibernation (supported on limited VM sizes). 3. After configuring the **New Session Host Rollout** menu, click **Save**. ![Frame 1426.png](https://docs.loginvsi.com/__attachments/a_e69f96d4ec38d5b04aa44a0f34f56b20cfd7b30bb04fe095f1a650242d976a27/Frame%201426.png?cb=cd5337f90d0db891c19aae723d2bf884) --- version: "Hydra 2.8.0" language: "en" --- # Configuring the Base Settings ## Introduction To manage an Azure Virtual Desktop host pool and configure its base settings: 1. Find the host pool that new Session Hosts should be added to, and open its **Configuration**. ![Frame 1421.png](https://docs.loginvsi.com/__attachments/a_b9c56ede1d00fda125fd058a700d46bfebabc0a7dc77bcaa4fa41a4bce41895b/Frame%201421.png?cb=33282f8f8ab2490aeb49f48f424b0cbd) Configuration button in the host pools dashboard. ![NewSessionHostDetailsActionConfig.png](https://docs.loginvsi.com/__attachments/a_248510a7f6aa19af47bee8aa8662783d9335f8089d64458f896312d896d6d6d5/NewSessionHostDetailsActionConfig.png?cb=94f6a51d83176d49a94a65d4e1c32739) Configuration button in the session host details page. By default, this will open the Base configuration of the host pool. 2. In the **Base Configuration** section, fill in the following details: * **Local time zone** of the host pool, which will trigger any scheduled actions;the default time zone is UTC. * **Time span** to measure logins per minute is used to measure new logins per minute, powering the Autoscale engine and the Host Pool details dashboard; the default Time span is 15 minutes. ![Frame 1422.png](https://docs.loginvsi.com/__attachments/a_4442574334957821a6d838729d07a9e6478c055c45015891b3a0e6b943e003c4/Frame%201422.png?cb=23b6f7413a432644082a4205c0225831) ## Configuring Host Pool Automatic Disk-Swap Auto-change disk type can automatically switch the defined SSD Disk to a lower-cost HDD when a VM is deallocated, then restores it to the selected SSD tier (Standard or Premium) on restart, maximizing performance and optimizing costs. In the **Run script or collection on specific events** section, optionally select a Script or Script Collection to run when a Session Host is deleted. For example, you may consider running the **Built-in: Remove device from Entra ID** script to avoid Entra ID Device conflicts from autoscaling operations. ![Frame 1423.png](https://docs.loginvsi.com/__attachments/a_555f7a5fc4239e29fe78ac798e17299911afa845859ff241baa7d8f2d847f917/Frame%201423.png?cb=1c0ee0e6eba132cec8349a5a290379e3) ## Configuring a Host Pool Service Account In the **Service Account** section, optionally provide Service Account credentials that are used for deleting FSLogix profiles, in addition to any custom tasks within custom Scripts or Collections. ![Frame 1424.png](https://docs.loginvsi.com/__attachments/a_2587138179a24073a7c6990e7c09b941ec0924be894872f8faf9b36022b6f257/Frame%201424.png?cb=ca05486fb45ad1f2414f20d68e7540ea) --- version: "Hydra 2.8.0" language: "en" --- # Creating and Delegating a Service Account for AD ## Overview Often, session hosts must still be part of an Active Directory domain to host applications that depend on an AD environment. To join a host (computer object) to AD, a service account with proper permissions is needed. Never use domain admin accounts for automating these kinds of tasks, and never store domain admin credentials in Hydra. Instead, use a service account with the least privileges necessary to perform this action. ## Creating the Service Account for the Domain Join 1. Open **Active Directory Users and Computers** and select a proper OU to store the new service account. **Right-click \> New \> User**. ![Frame 1469.png](https://docs.loginvsi.com/__attachments/a_629d98cd7129c5d268432e22147bad72420496370ac8088f5db459987a0667d4/Frame%201469.png?cb=d13d9e36c02510e97489ecedeca89fa1) 2. Enter a name for the service account. E.g., "srv-DomainJoin-AVD." ![Frame 1470.png](https://docs.loginvsi.com/__attachments/a_d564d634f1a3a161583541ebd71dbc0270b8ecba1d8d962956857ce1ad5f9cca/Frame%201470.png?cb=b0ef2bbb3380db1a575c08b44f32ab95) 3. Enter a long and complex password for the account and tick both password options. Ensure the password is rotated regularly and keep it updated in Hydra when it is time to do so. ![Frame 1471.png](https://docs.loginvsi.com/__attachments/a_3e6572af0c2d7a1fabb44d57d790b00abfaeed73b3e1c3f7ba09923e18bf4d96/Frame%201471.png?cb=cf2527c36c8368a29a414a0d67e14c2a) 4. Finish the creation of the service account. ![Frame 1472.png](https://docs.loginvsi.com/__attachments/a_ce84ebd5bf17e86db5d21a9d4aac01b9a0b18bc468cb5d40862fbbbe6bed9fad/Frame%201472.png?cb=8745460392e2f3d29a00705a84ae9a07) ## Delegating Service Account Permissions in AD 1. After you create one or more OUs for your hosts/computer accounts, delegate the permission at the top-level OU for your computers. In this example, that is **AVD-Hosts**. Sub-OUs are used here to organize the host pools where the delegation will propagate down. ![Frame 1473.png](https://docs.loginvsi.com/__attachments/a_899969a832e9481be3232b5174a3094d774cf59c40c2a6e736a155a1effb756d/Frame%201473.png?cb=984cdda4af4e58b429337ae84d7472f4) 2. Right-click the **OU** and click **Delegate Control**. ![Frame 1474.png](https://docs.loginvsi.com/__attachments/a_a6f82ac88266a53cc0045f844ffc68b904a7c5f0ca23c6ab6d6daedefc0b9309/Frame%201474.png?cb=d915e226920969c03e09ba24de5eac59) 3. Click **Next**. ![Frame 1475.png](https://docs.loginvsi.com/__attachments/a_d9ee3d5fbee8bf87b5065b107f05335942bcff4b67ec2f1876a4e2b6faa34c78/Frame%201475.png?cb=6fd3604d638b822d082d02b7f346c9bc) 4. Click**Add** and select the previously created service account. ![Frame 1476.png](https://docs.loginvsi.com/__attachments/a_e0f1c78a24011a88c5c4aca3146142d85999197f717a0be9109b37d79a1b90cc/Frame%201476.png?cb=237cb534b188b63afb844772519332ed) 5. Next, select **Create custom task to delegate**. ![Frame 1477.png](https://docs.loginvsi.com/__attachments/a_f30dd9010be3d3722e39631042913636165801a4b119e8e66183602714a19837/Frame%201477.png?cb=22d2b023c7fbc71868258e35c5a9c077) 6. Select the proper **Create/Delete** options. Make sure to only select **Computer objects** for delegation: ![Frame 1478.png](https://docs.loginvsi.com/__attachments/a_ce5ab64220496b599112c1b63dbcd8d275984cb71a76b246c5a3cad9e89c0905/Frame%201478.png?cb=2375690bdebf12d30d918195720789a0) 7. Click **Next**. Configure the selected options only: ![Frame 1479.png](https://docs.loginvsi.com/__attachments/a_7dc2b3e5ad1fb7ccb7143ecd7c6bbd3a6082e321f2458d5f43e30571ba44a030/Frame%201479.png?cb=0bfeebae9f200d1b55db25023010baaf) 8. Click **Next** and then **Finish**. ![Frame 1480.png](https://docs.loginvsi.com/__attachments/a_001ec627269a6ee3d3ebbcfdccf2ca7f253f8a537111332cdb1feabdd311eb52/Frame%201480.png?cb=f061a966bd17def0a355add2bcb9414a) The service account now has the correct permissions. Ensure proper auditing of the service account is in place to prevent malicious or unintended use. ## Adding the Service Account to Hydra 1. Select properties of the OU where you want to store the hosts/computer objects. ![Frame 1481.png](https://docs.loginvsi.com/__attachments/a_2bd428ec351a630e787a9fbeb0a5564e10f72943d33e3cb8903da6035c025146/Frame%201481.png?cb=4af2839bd19ef9befb4466c524124611) 2. Select the **Attribute Editor** tab and double-click on **distinguishedName**. You can now copy the OU path for later use: ![Frame 1482.png](https://docs.loginvsi.com/__attachments/a_cae5ed5990a4d38e5405a0ee4c8d09ce4599f9168b145a1f16b8820885eb1842/Frame%201482.png?cb=20977b347d2deec922934c3e9d5f62ad) 3. In **Hydra** , open the **New Session Host Rollout** configuration of a host pool and enter the service account, domain, and OU path: ![Frame 1483.png](https://docs.loginvsi.com/__attachments/a_5fbb708b2e1e78e8ef28e0fbb2cab935a6a02b875fca369cb7fd6646b1cdc198/Frame%201483.png?cb=db38d4389499af20dc888bc93facf71e) **Security tips**: * Follow service account best practices by not allowing interactive logins for this user. * Never use this service account for anything else. The user is for the domain join only. --- version: "Hydra 2.8.0" language: "en" --- # Creating Host Pools, Workspaces, and Application Groups ## Overview Starting in v1.2, Hydra can create Host Pools, Workspaces, and Application Groups. This allows AVD administrators to create all of the foundational constructs for an AVD deployment within the Hydra portal and not have to jump back and forth between the Azure and Hydra portals. ## Terminology First, it is important to understand the terminology behind the various components and how they interoperate. Specifically, Host Pools, Application Groups, and Workspaces. Microsoft defines these in their [documentation](https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology). ## Icon Legend See below for the various icons and what they represent. This will make it easier to understand the tree menu while navigating, modifying, and creating the various resources: ![Frame 1490.png](https://docs.loginvsi.com/__attachments/a_f121b82d968b4972257225fd54c5d8e5c729a66eddc75932cec93e89375aca53/Frame%201490.png?cb=30be2873f64a82444a9fb3ead1df3b73) ## Creating a Host Pool To create a host pool, navigate to **Azure Resources \> Virtual Desktop** on the left-hand navigation menu. ![Frame 1491.png](https://docs.loginvsi.com/__attachments/a_2434a9d4b76d37a151b60834dbb3dd97c0f329acd947bb54029ce18181d6abbd/Frame%201491.png?cb=cdfb452fd8c2df14552759334794f835) You will notice two sections: **Host Pools** and **Workspaces**: ![Frame 1492.png](https://docs.loginvsi.com/__attachments/a_4fb05c632254f7ae2647f23b95363f278b786a9f63abd7160bed0d586b338f9a/Frame%201492.png?cb=fdc600b7d8b4af6019388ecbceeacfbf) The majority of the configuration will be completed on the **Host Pools** section, while the **Workspaces** section will simply contain the association of App Groups to Workspaces. To get started, select either the Host Pools top-level container or the specific subscription and click **Add** to start the**Add New Host Pool Wizard**: ![Frame 1493.png](https://docs.loginvsi.com/__attachments/a_c5dfc2c68d9d04586bb7b53bafe772a8d8eaf7259d6ca1e3dd18fbef6b052643/Frame%201493.png?cb=2a149c57669d912e8207839b2fb5de28) Fill out the various fields and configurations. Notice that even the RDP properties and configuration can be accomplished within the same wizard, streamlining the deployment compared to creating it via the Azure Portal. For more information, see the [Microsoft Documentation](https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop?pivots=host-pool-standard&tabs=portal-standard%2Cportal-session-host-configuration%2Cportal). ![Frame 1494.png](https://docs.loginvsi.com/__attachments/a_84322c6e93dbf3b5a8dd92bc61532f8572e54a0caa3b243d652701139d7d3fce/Frame%201494.png?cb=356e6f1b01bda31b545a897b94d54a04) ![Frame 1495.png](https://docs.loginvsi.com/__attachments/a_ba5448daed81efdc6202a13974a17071f10a07687775e11aef01c9dd136358dd/Frame%201495.png?cb=40b05750f04959cab4b0de8b8fdb3af0) Once the Host Pool is created, you will see it automatically populate underneath the Subscription. ## Creating an Application Group The next step is to create an **Application Group**under the Host Pool. To do this: 1. Expand the **Host Pool** and select the **App Groups**container underneath. ![Frame 1496.png](https://docs.loginvsi.com/__attachments/a_3e11f8479bc9596664d0f02a23a99f67faee57da6ffa115e75d117c3e7852b6e/Frame%201496.png?cb=d9aa1ef4da3b20010fdca34ff2b2de00) 2. Select the appropriate **App Group** you wish to create, depending on whether you are delivering Published/Remote Apps or full desktops. This will trigger the **Add Remote Application Group Wizard**: ![Frame 1497.png](https://docs.loginvsi.com/__attachments/a_ae4088539991438864c35a3f5e777f96706ab6f82019cfd383434d095f00457c/Frame%201497.png?cb=63894ddf7ed41e0b39072d1b5d1b24f7) ### Adding Remote Apps to an Application Group If the Application Group supports Remote Apps, you can then add Remote Apps and their respective configuration. Select the RA-enabled Application Group, and select one of the two options: * **Add app from start menu**: Queries the session host for apps present in the Start Menu. Note that at least one session host must be online for this to function. This allows for many of the various properties, such as the executable path, to be prepopulated. * **Add app manually** : Manually add the Remote App by inputting these various properties, as defined in the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/virtual-desktop/publish-applications-stream-remoteapp?tabs=portal): ![Frame 1498.png](https://docs.loginvsi.com/__attachments/a_561374e9901382d2eeb848357e445ac1eb5d10783ef9c58d297a9bcb8009be9d/Frame%201498.png?cb=d726d51ba5df9774109a4606d51bc571) ### Assigning an Application Group Note that the Service Principal configured within the **Tenants** page must have the following permissions and admin consent to read the Entra objects before assignments can occur. Without these, the search will appear blank: | **API / Permission Name** | **Type** | **Description** | |---------------------------|-------------|-------------------------------| | User.Read | Application | Sign in and read user profile | | User.Read.All | Application | Read all users' full profiles | | Group.Read.All | Application | Read all groups | Before users can see the desktops or remote apps presented, they must be entitled to them. Use the **Assign** button next to the **Application Group** to entitle the appropriate users or groups: ![Frame 1499.png](https://docs.loginvsi.com/__attachments/a_0efd0c663385c9acb2e826631d04c6a7611edd08399c6007236bfe961a0ea207/Frame%201499.png?cb=42c906cf120dd679ddfc8bd871b32f47) Notice that you also have the ability to unassign users within this window: ![Frame 1500.png](https://docs.loginvsi.com/__attachments/a_f3e610011ba266e4b1a0f5cf363067816460b6e71b173924e68689737f65298c/Frame%201500.png?cb=0fcc5e333083ba0f7d0c3c7b392fa8d9) ### Creating a Workspace Application Groups must also be associated with a Workspace for users to access them. A Workspace is a logical container within the Windows App or Remote Desktop app to organize and group the various apps and desktops for the user. **To create a Workspace**: 1. Select the top-level **Workspaces** container or **Subscription** in the **Workspaces** section, typically on the far-right side, and click **Add**: ![Frame 1501.png](https://docs.loginvsi.com/__attachments/a_4911f2aa6254abfc80f94f5df0ae281156177b9f3075fa0137d6633de40375fb/Frame%201501.png?cb=6cc96377b33a29bcd946c041edde7b14) 2. Input the Subscription / Resource Group, the Workspace name, Location, and optional tags, and select **Add.** ![Frame 1502.png](https://docs.loginvsi.com/__attachments/a_b8d18bd1f36671d30ef512ce81c5601bda03c4070860711e2aca5a8093cd89d0/Frame%201502.png?cb=7a2bc5253a461554b78b6ba99fd321c9) ### Associate an Application Group with a Workspace To associate or link an **Application Group** with a **Workspace**: 1. Select the **Workspace** and click **Link application group**: ![Frame 1503.png](https://docs.loginvsi.com/__attachments/a_093b32e100e279930102c64e34d4584435e02a8187457ba103b7705051bbacb8/Frame%201503.png?cb=52795cf2ccea21fbe2b8e8f1938b9432) A list of unassociated Application Groups will appear. 2. Select all of the Application Groups you wish to link to this Workspace, and click **Save**. ![Frame 1504.png](https://docs.loginvsi.com/__attachments/a_c5367b6690286a7cc58ecf7530f4829dcc868f6d667d390d1077350ad8828a85/Frame%201504.png?cb=3708db1517b12e625279635c800493e7) 3. To unlink the Application Group, select the Application Group and click **Unlink**: ![Frame 1505.png](https://docs.loginvsi.com/__attachments/a_83a25be6f7ee971c18a452eda45bd0ee8b7f6ad05daa0a478ede895162860c9b/Frame%201505.png?cb=41c0de99759c5ece86f30ab4296ac440) ### Modifying Existing Properties If you wish to modify the existing objects after creation, select the Host Pool, App Group, or Workspace, and click **Properties**. Note that some fields cannot be edited due to Azure limitations. ![Frame 1506.png](https://docs.loginvsi.com/__attachments/a_6fcb95f5b31d456ee3f6a68170aaf542a9659366145acfc61323f151cab75847/Frame%201506.png?cb=6c74bf181daa4ca8d3266c2aa2439176) ![Frame 1507.png](https://docs.loginvsi.com/__attachments/a_325e1509acf8a95b063af8661b455cf7cbf9e0ac6b79055858b20d1063d2c23c/Frame%201507.png?cb=6f027baec808c3ef060c473af0f4c696) --- version: "Hydra 2.8.0" language: "en" --- # Creating New Session Hosts Once the Session Host Rollout configuration is saved, new Session Hosts can be deployed using previously configured settings. To do so: 1. Return to the main **Dashboard**. 2. Find the host pool where new **Session Hosts** should be deployed, and open the **Details** page using the monitor icon. ![Frame 1427.png](https://docs.loginvsi.com/__attachments/a_ee631e1f82942d7700d41da0c06283fbf882550f3d5840296e7944afe6e4b18f/Frame%201427.png?cb=f29c411e34f430900a41b3ad6773afdb) 3. From the **Host Pool Load** page, in the **Session hosts for host pool** table, click the **Add new session host(s)** button. ![NewSessionHostDetailsAction_NewSessionHost.png](https://docs.loginvsi.com/__attachments/a_92507cca2e52b55b7f725e3aefd90dd6924e12ce6cb45d9e6892aab6494ffe42/NewSessionHostDetailsAction_NewSessionHost.png?cb=0b24f7a5c869469f2f6ed86f860c0fc4) **Note** : The **Utilization** data shown in the above example requires the installation of the [Hydra Agent](https://docs.loginvsi.com/hydra/2.8.0/hydra-agent.md). 4. In the dialog that appears, specify: 1. The Number of session hosts to roll out from 1-999. 2. Whether to enable drain mode. 3. Whether to use the default rollout configuration from the host pool configuration. 5. Click **OK** to start the deployment process. ![Frame 1429.png](https://docs.loginvsi.com/__attachments/a_fbac0a918744e0aee311c9b5a58f28cd7e33b3189d826f0e12fc6885cf8d86d4/Frame%201429.png?cb=cd4d38cf6f3b853bc95228116ad99b81) During the creation process, the Session Host will appear within the Session hosts for the host pool table alongside progress logs: ![Frame 1430.png](https://docs.loginvsi.com/__attachments/a_bdbc64d2488a1b79b342db1d10548fd119e8abec0be5cf70f8b5914f69f5614d/Frame%201430.png?cb=976e940c5c4bbafa847c132e082f03eb) Once the deployment completes, you should see the capacity chart change, indicating the new Capacity of your Session based on the configured Max session limit. Note that hosts created manually using this method will be flagged as **permanent** hosts and will use deallocating/allocating as their scale-down/scale-up operations. --- version: "Hydra 2.8.0" language: "en" --- # Custom Images ## Overview Custom images let you import and manage operating system images for use in Windows 365. You can add images from different Azure sources: managed images or from an Azure Compute Gallery image. ## Choosing an Image Source * **Managed image**: Use this option to import a single managed image from your Azure subscription. * **Azure Compute Gallery image** :Use this option to import an image from an Azure Compute Gallery, where images are organized by definition and version. ## Viewing Custom Images 1. In **Windows 365** , select **Custom Images**. 2. (Optional) In the search box, enter a keyword to filter images. The table describes the information shown for each image: | **Column** | **Description** | |-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Tenant | The tenant associated with the image. | | Image name | The name of the custom image. | | Image version | The version of the image in `Major.Minor.Patch` format (for example, `1.0.0`). | | Status | The current state of the image. Possible values: * **Pending**: The image is being processed. * **Ready**: The image is available for use. * **Failed**: The image couldn't be processed. | | Operating system | The operating system of the image (e.g., Windows 10 Enterprise). | | OS support status | Indicates whether the operating system is currently supported. | | Date modified | The date and time when the image was last updated. | ![Frame 2195.png](https://docs.loginvsi.com/__attachments/a_595902093840f40d3b7b12367baa31f41a658ea8bd92f6fa6f5b996b736cae41/Frame%202195.png?cb=2e7f38f0ac6b7c0bcbc1500b34e3b6e3) ## Adding a Managed Image **Important** : Before you begin, you must have access to the Azure subscription. Windows 365 may be granted the **Reader** role for the subscription. For details, see the [Microsoft documentation](https://learn.microsoft.com/en-us/windows-365/enterprise/customer-permissions). 1. To the right of the **Custom Images** table, click "**+** " and then select ![image-20260317-111209.png](https://docs.loginvsi.com/__attachments/a_8913c3da6cd68f0da638f1b458d6677545c9817047b66a29d221f48193e56e24/image-20260317-111209.png?cb=c3d4aae5a7b801c847072712ef0a5413) (**Add Managed Image)**. 2. In **Add Managed Image**, enter the following: 1. **Tenant**: Select a tenant. 2. **Image name**: Enter an image name. Allowed: letters (A--Z, a--z), numbers (0--9), and characters (-, _, .) 3. **Image version** : Enter an image version. The version must follow `Major.Minor.Patch` format (for example, `1.0.0`). Note that the combination of image name and version must be unique within a tenant. 4. **Subscription**: Select a subscription. Note that as part of this process, you grant Windows 365 permissions in your Azure subscription. 5. **Source image**: Select a source image. This list includes images in the selected Azure subscription. Images must be generalized from generation 2 VMs running Windows 10 Enterprise or later. 3. Click **Save**. ![Frame 1972.png](https://docs.loginvsi.com/__attachments/a_dc29a2d704a1c7b88a131f1b82b2315ad7cfcfa7a0df4c880ac3855c931ca90a/Frame%201972.png?cb=81217a62083804b5519fb41df7d23bac) ## **Adding an Azure Compute Gallery Image** **Important** : Before you begin, you must have the **Compute Gallery Image Reader** role. To learn more, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#compute-gallery-image-reader). 1. To the right of the **Custom Images** table, click "**+** " and then select ![Frame 1969.png](https://docs.loginvsi.com/__attachments/a_88527df3196219ba1a3fe2d8f5f5842a113a5f7059cbe289146bc84a1885c709/Frame%201969.png?cb=e0e438e6619a148b0c361e8bd7ccb780) (**Add Azure Compute Gallery Image**). 2. In **Add Azure Compute Gallery Image**, enter the following: 1. **Tenant**: Select a tenant. 2. **Image name**: Enter an image name. Allowed: letters (A--Z, a--z), numbers (0--9), and characters (-, _, .) 3. **Image version** : Enter an image version. The version must follow `Major.Minor.Patch` format (for example, `1.0.0`). Note that the combination of image name and version must be unique within a tenant. 4. **Subscription**: Select a subscription. Note that you grant Windows 365 permission to access this subscription. 5. **Azure Compute Gallery**: Select a gallery. This is the Azure Compute Gallery that includes the image you want to import. 1. **Image definition**: Select an image definition. The image definition contains the image version you want to import. 2. **Image version**: Select an image version from the gallery. Note that the available versions depend on the selected image definition. 3. Click **Save**. ![Frame 1973.png](https://docs.loginvsi.com/__attachments/a_532592d7f64a1dfc4dcd10f5401d4a0092b1277aeb6b566a97924b51fbb2720e/Frame%201973.png?cb=e3c8be8cbf2c6b1061b0b5b7a83501ad) ## Updating Images 1. Select one or more images in the table. 2. Click **Update**. ## Deleting Images 1. Select one or more images in the table. 2. Click the **Delete** (trash) icon. 3. Confirm the deletion. **Note**: The delete option is unavailable until you select at least one image. --- version: "Hydra 2.8.0" language: "en" --- # Dedicating an AVD Host Pool for Images ## Overview Hydra enables a streamlined approach to Azure Virtual Desktop (AVD) image management by allowing image creation and capture directly from a virtual machine, even from session hosts that are already joined to an AVD host pool. This removes the need for separate "gold image" virtual machines or temporary imaging infrastructure. By dedicating an AVD host pool specifically for image management, organizations can standardize image creation while leveraging Azure Marketplace images as a consistent and supported baseline. ## Key Benefits Using a dedicated host pool for image management with Hydra provides the following advantages: * **Simplified architecture**: No separate imaging VMs or resource groups are required * **Consistency**: All images originate from the same baseline configuration using the New Session Host Rollout parameters * **Repeatability**: Image creation follows a predictable, automated workflow * **Marketplace support**: Images are built on Microsoft-supported Marketplace images ## Dedicated Host Pool Concept In this model, a specific AVD host pool is reserved exclusively for image creation and maintenance. This host pool is not used for end-user access and is not subject to production scaling or user assignment policies. Session hosts in this pool are deployed directly from Azure Marketplace images and can be utilized as static images with ongoing updates, or even dynamic images that are fetched brand new each update cycle with configurations and installs automatically deployed using Hydra's [Script Collections](https://docs.loginvsi.com/hydra/?contextKey=script-collections&version=latest). You can also use the imaging pool as a template to easily copy many of the common configurations to other host pools using Hydra's **Copy Configuration from an Existing Hostpool** in the top-right corner: ![Frame 2387.png](https://docs.loginvsi.com/__attachments/a_eae43b079c0e941a0238af1338fd2de0e1e3be0e5be0c0a619f84d5e575b5c58/Frame%202387.png?cb=dd50b081adcaa3991a70ff2224f85535) ## Image Creation Workflow A typical image management workflow using Hydra includes the following steps: 1. **Create a dedicated AVD host pool for images** * No user assignments * No production autoscaling configuration * Used exclusively for image creation 2. **Deploy session hosts from Azure Marketplace** * Windows 10 or Windows 11 multi-session * Microsoft 365 Apps images, if required * Other supported Marketplace baselines 3. **Apply customizations using Hydra** * Utilize the *Run script/collection after deployment* option for customizations across all images (optimizations, company-wide software on all endpoints, etc.) * Agent deployment and updates 4. **Capture the image** * Image-specific installs and updates can occur on the VM using the *Run a Script or Collection on the Master first* option in the Image Builder * Hydra automatically copies and generalizes the cloned VM * The image is captured as a Custom Image or Azure Compute Gallery Definition * The original session host image VM remains available for future changes 5. **Reuse the host pool VMs for imaging** * The same host pool VM can be used for future image updates, including [automated scheduling](https://docs.loginvsi.com/hydra/?contextKey=storing-an-image-configuration&version=latest) * New Marketplace versions can be introduced as needed, using the automations above to build the image instead of manual software installs and customizations ## Summary Hydra allows organizations to simplify and standardize AVD image management by using a dedicated host pool as an image creation environment. Images can be built and captured directly from Marketplace-based session hosts that are already joined to the pool, reducing complexity while improving consistency and governance across the environment. --- version: "Hydra 2.8.0" language: "en" --- # Deleting User FSLogix Profiles ## Overview Leveraging FSLogix for profile management can enhance user experience, but also introduce issues that require help desk support. Hydra simplifies this process by providing a single pane of glass for these tasks. The **User and profile manager role**(or higher) is required to delete FSLogix profiles. There are two methods Hydra users can use to remove user profiles. **Note** : This feature is **completely independent** of the Azure File/NetApp monitoring and auto-scaling setup. It does not require the Service Principal used in the other feature. ## Prerequisites Deleting FSLogix profiles requires a Service Account configured on the Host Pool. For more information, see [Configuring a Host Pool Service Account](https://docs.loginvsi.com/hydra/2.8.0/configuring-the-base-settings.md#configuring-a-host-pool-service-account). The Service Account must meet the following requirements: * Must be an **Active Directory (AD) service account** . Pure Entra DS is not sufficient. For details, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/azure-netapp-files/create-active-directory-connections). * Must have **modify or delete NTFS permissions** on the share/folder where FSLogix profiles are stored. Assigning these permissions via File Explorer's Security tab is sufficient. * You can validate the permissions by mapping the share with the Service Account and manually attempting to delete a test profile. For monitoring and auto-scaling of Azure File Shares or NetApp Files, see [Managing Azure File Shares](https://docs.loginvsi.com/hydra/2.8.0/managing-azure-file-shares.md). ### Delete the FSLogix Profile of the Active Session The Service Account configured for the Host Pool will be used to authenticate to the share, locate the user's profile via registry lookup, and perform the deletion. 1. Enter username(s) (UPN format, e.g., [username@loginvsi.com](mailto:username@loginvsi.com)) into the search bar. ![Frame 1362.png](https://docs.loginvsi.com/__attachments/a_1d9514cb92cff7b8b6faaef9a9238810fac59e581999e877e41b86b68dad279c/Frame%201362.png?cb=47db1b31bfa7d061fb86991a198f90c2) 2. Once the user account is shown in the **User Sessions** table, select it by clicking the check box. ![Frame 1363.png](https://docs.loginvsi.com/__attachments/a_43afca6d4aa505daf321859a37632db3a742709cdb3068a09b2969046d68c43d/Frame%201363.png?cb=9feb6c7d40cdaf3ddf68aa3f23121d55) 3. Click the hamburger menu to display available actions, and click the left-most icon to Delete FSLogix Profile. The user will be logged off the active session. ![Frame 1364.png](https://docs.loginvsi.com/__attachments/a_f07bded09421c35ecb30ff43c7cb4f516cc4ceba08572a3db4afe122e6aa12a8/Frame%201364.png?cb=be837ba5d95078864dba89eb745bbf50) 4. Click **OK** to confirm the profile deletion. ![Frame 1365.png](https://docs.loginvsi.com/__attachments/a_9436464bbfb9d40954ed702c18e3d152c49a1fd9126c8992cb17639ac6d9d133/Frame%201365.png?cb=112ea93fd7197214785d521c32fcc139) #### Delete FSLogix Profile of Inactive Session Select the corresponding host pool and enter a list of users separated by ;. Ensure that the users are not logged in and that at least one session host is available in the selected host pool. 1. Click the hamburger menu to display available actions, and click the middle icon to Delete FSLogix Profile by Name and Host Pool. ![Frame 1366.png](https://docs.loginvsi.com/__attachments/a_c604a23d3021b623fed9ab71a9ed46450dd64e3b0c8b44e2c3b739d1fad6df01/Frame%201366.png?cb=8bffb10bf2d5143a7b6e29564cec67aa) 2. In the window that appears: 1. Select the host pool where profiles should be deleted from. 2. The usernames (semi-colon separated) whose profiles should be deleted. 3. Click **OK** to confirm. ![Frame 1367.png](https://docs.loginvsi.com/__attachments/a_ec9ac7d548a98797cdcc84b8e49529fa9525b593c6eafa15b7d6a78646f8d746/Frame%201367.png?cb=82453ef4e6bd65d5ef0e3bfa1aceeb10) **Note**: Ensure the Service Account has appropriate permissions on the share. Without this, deletion will fail even if all other steps are correct. ![Frame 1368.png](https://docs.loginvsi.com/__attachments/a_127d62a3d3caa5e4bd072aa98317902a912cc5a3d9aae3436d056bc534ddd306/Frame%201368.png?cb=7a9c72168820570419a06963ac9ae663) --- version: "Hydra 2.8.0" language: "en" --- # Deploying Hydra Manually ## Introduction Currently, a manual deployment must be done in the Azure Government Cloud. This manual deployment model also applies to organizations in Commercial Cloud, where marketplace restrictions exist, but you must ensure any references to [azure.us](http://azure.us/) are replaced with the typical [azure.com](http://azure.com/) or [azurewebsites.com](http://azurewebsites.com/) commercial URL. ## Determining a Name for the Deployment First, determine a unique name for your Hydra instance. It must be a lower-case, 4-22-character name, not starting or ending with a "-", and must be globally unique. If the name is not valid, the configuration and the deployment must be redone. **Valid examples (up to 22 characters)**: * gov-avd-hydra-company * avd-hydra-gov-department * hydra-gov-facility ## Configuring the Service Principal for Web Authentication 1. Open the **Azure Portal** in the destination tenant, and go to **Entra ID \> App registrations**. 2. Click **New Registration**. 3. Enter a name (e.g., svc-HydraWebAuthentication) and the Redirect URI. 4. **Redirect URI type**: Web. 5. **Redirect URI** (where my-unique-name is the name determined above): Enter the full URL, including .azurewebsites.us/signin-oidc: . ![Frame 1338.png](https://docs.loginvsi.com/__attachments/a_5a8da947315024432a2c5af64ccc22e507fb793178f8b46df44e0b5031677657/Frame%201338.png?cb=6ea426430337e5f60b02d7121354cff5) 6. Click **Register**. 7. Go to **Certificates and Secrets** and add a new secret with "New client secret". 8. Copy the **secret value** (not the ID) for later use. ![Frame 1339 (1).png](https://docs.loginvsi.com/__attachments/a_71413c70f8871558d96ca7da87fae00191432d45f4d7897bbcc332b65c36c570/Frame%201339%20(1).png?cb=da674cfc94bdba7478c63d9c57eef364) 9. Go to the overview and copy the **Application (client) ID**. This is the ID of the service principal we need later. ![Frame 1340.png](https://docs.loginvsi.com/__attachments/a_8969cdb826a41559b5070b7ac646aded582f136398a5ec300f9884f9f92492c9/Frame%201340.png?cb=30d8e8d41fceceb915bd732bf5712dbe) ## Deploying Hydra 1. Go to the**Azure Portal \> Custom Deployment \>** [**Build your own template**](https://portal.azure.us/#create/Microsoft.Template). ![Frame 1341.png](https://docs.loginvsi.com/__attachments/a_229ce72d29b748746827530a3124d3d75d81211d7ca195637508e7c46544a29f/Frame%201341.png?cb=9646bf3bcb653003d32969187beacb86) 2. Copy the given deployment script [mainTemplate.json](https://docs.loginvsi.com/__attachments/a_9c8c2b7f3cd231d62d39d2525bdf1d7c3f63d0567f5fa57217aab8e69ad7cbc9/mainTemplate.json.md?cb=71212068dd0e1cf872ee2323e81b4263) into the editor and save: ![Frame 1342 (1).png](https://docs.loginvsi.com/__attachments/a_1f2666e9bdeab5e1e16f862a8b59dc45ccbcaf4a778c8945edc63a5cdc5c066a/Frame%201342%20(1).png?cb=0149e79e389c2df363ef006e0b2bea40) 3. Fill out the **Instance details**, as follows: 1. **Region**: Your cloud region. 2. **Site name**: As defined before (lowercase, 4-22 characters, do not start or end with a "-", globally unique). 3. **Sp ID**: The service principal ID we created before. 4. **Sp Secret**: The secret of the service principal we created before. 5. **Admins**: Your administrator UPN name to log in after the deployment. 6. **_artifacts Location** : Contents must be replaced with a URI in an accessible blob storage account, such as 4. Click **Review and create \> Create**. ![Frame 1343 (1).png](https://docs.loginvsi.com/__attachments/a_78b603c0c349210ea7096e8ab945b6b6dc2f79986c760ad0b0f26844dde3742c/Frame%201343%20(1).png?cb=d659ea9feed25cfe356e50c111dcfbda) ![Frame 2484.png](https://docs.loginvsi.com/__attachments/a_5c03a28be0288399b6e153220974f8a5de99cf5ba224370e989d43f79fd0a172/Frame%202484.png?cb=a22c5dbe2a16d49f53c0ee6da4455710) ## Post Deployment 1. Open the Hydra website: [https://my-unique-name.azurewebsites.us](https://my-unique-name.azurewebsites.us/) and consent or request application access on behalf of your organization, if prompted. 2. Continue configuring a Service Principal for resource access and add it to the tenant configuration in Hydra. For details, see [Adding a Tenant](https://docs.loginvsi.com/hydra/2.8.0/adding-a-tenant.md). 3. If **Gov Cloud** , ensure that you navigate to **Advanced Settings** and change the Azure Cloud type as needed. ![Frame 1344.png](https://docs.loginvsi.com/__attachments/a_fe3fe0eb53a905c8983c3e0d9538e8b177eb3fe40299e85a28767cef7dda16b2/Frame%201344.png?cb=a71f00ea7fbb7c516b9e44d148329b76) --- version: "Hydra 2.8.0" language: "en" --- # Deploying Hydra via Azure Marketplace ## Getting Started The easiest way to deploy Hydra is via the Azure Marketplace. To get started, head to the [Hydra Marketplace page](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/itprocloudgmbh1628775137215.hydra-deploy-d1?tab=overview). ## Deploying Hydra in the Azure Portal Click **Create** to begin configuration of the Hydra instance. ![Frame 2064.png](https://docs.loginvsi.com/__attachments/a_84692ed0a702db24cb2aed66a9a05155aa38f960834c85d117488968b2d05065/Frame%202064.png?cb=4e4c3228494ef0d11bc21b56625c48bb) ## Basics 1. Enter the **Subscription** where Hydra should be deployed. 2. Hydra needs an empty **Resource Group** for new deployments. Specify an existing Resource Group that contains no resources, or create a new one. 3. Specify the **region** that Hydra should be deployed into. 4. Specify the **Name of your deployment** , which is used as the hostname for the URL that Hydra will be accessible from. For example, "myhydra" will be accessible from "[myhydra.azurewebsites.net](http://myhydra.azurewebsites.net/)". ![Frame 1330.png](https://docs.loginvsi.com/__attachments/a_4e9c9fde1fd97eefe433addfd297b6033d4f57dc2662c39883054496be6848a6/Frame%201330.png?cb=5339718a6815697970dcd3e311f4009b) 5. Click **Next** to proceed to the [Service Principal](https://docs.loginvsi.com/hydra/2.8.0/deploying-hydra-via-azure-marketplace.md#Service-Principal) configuration. ## Service Principal Hydra uses a Service Principal for authentication to the web app. This can be created manually or using the provided PowerShell snippet on the **Service Principal** page. ![Frame 1331.png](https://docs.loginvsi.com/__attachments/a_40ba2cc94fdb48d7f827661bb4c555b6c486745997852e04f2c1db9c7f221465/Frame%201331.png?cb=3a0a36e0d0d1a28deff8d324ba2ca6b7) 1. Open the Cloud Shell within the Azure Portal, using the shell icon within the toolbar in the top right. ![Frame 1332.png](https://docs.loginvsi.com/__attachments/a_0110ee9ed8975cca0dbe3a696806737aaa603ed5c7e2237067011d7717fe7d26/Frame%201332.png?cb=cc572d825e9316203691f1573f779b7a) 2. Copy and paste the PowerShell snippet **Create the service principal with powershell in the Cloud Shell** into the Cloud Shell, and press the **Enter** key to run it. This will output the **Application Id** of the new Service Principal, and its corresponding **Secret**. ![Frame 2163.png](https://docs.loginvsi.com/__attachments/a_ee13487b7cb2967f70b02c84305bbdb00a74287cef30926494b2b90c0fd970f5/Frame%202163.png?cb=dd4fa983cc1f5cf38ccb925ccb583c92) ![Frame 1333.png](https://docs.loginvsi.com/__attachments/a_8fc6a7abdf6072a5a50899b0e701413bf8fef0f1a74988a6789aa530cbe3c8fe/Frame%201333.png?cb=3ea841323342f3f0a792ad85114696a2) 3. Paste the Service Principal's **Application Id** and **Secret** into the respective fields. ![Frame 1334.png](https://docs.loginvsi.com/__attachments/a_88471b5c1c2ed834aad609beb2ce8dbc9293291252aee218d396a31b11c1c362/Frame%201334.png?cb=07a48c1193c3ef4df171ec900bb7a692) 4. Click **Next** to proceed to configure [Administration](https://docs.loginvsi.com/hydra/2.8.0/deploying-hydra-via-azure-marketplace.md#Administration). ## Administration During the deployment, an Administrator must be defined. This user can log on after the deployment without additional configuration and has unlimited access within the Hydra instance. 1. Enter the UPN of an administrator account who should have unlimited permissions within the Hydra instance, e.g., [username@domain.com](mailto:username@domain.com). ![Frame 2162.png](https://docs.loginvsi.com/__attachments/a_79c759f243e2a4f72a6dc18a649131d72b393263cc2a3347feb607813cdb6031/Frame%202162.png?cb=0e695123b3b640d6c7d362b6da67cfcd) * **Enable private endpoints for the Database and Key Vault**: Creates private endpoints for the database and Azure Key Vault in an isolated virtual network (VNet). The App Service is also integrated into this new isolated VNet. Network access to the database and Key Vault is restricted to the new isolated VNet. * **Enable Websocket for the Hydra Agent and Hydra Proxy** : Enables WebSocket support for the [Hydra Agent](https://docs.loginvsi.com/hydra/2.8.0/hydra-agent.md) and [Hydra Proxy](https://docs.loginvsi.com/hydra/2.8.0/installing-and-using-the-hydra-proxy-preview.md). Before these options were added, WebSocket was disabled by default. Now that this option is available, web sockets are enabled by default, making it easier if you use Hydra Agent and Hydra Proxy. 2. Click **Next** to proceed to the [Tags](https://docs.loginvsi.com/hydra/2.8.0/deploying-hydra-via-azure-marketplace.md#Tags) configuration. ## Tags Tags can be useful for specifying the business criticality, projects, and cost attribution. Optionally, specify the tags to apply to the Hydra resources within the Resource Group under **Basics \> Resource Group**. ![Frame 1336.png](https://docs.loginvsi.com/__attachments/a_9c2117f68a4b553a2f182b0be5ad41d37038bfb07175bf154b73bc7f67fe6581/Frame%201336.png?cb=ce8430fe41a2ed284f7fc620290fa1d3) ## Review + Create Once the Basics, Service Principal, and Administration configuration are completed, proceed to **Review and Create** the Hydra instance. ![Frame 1337.png](https://docs.loginvsi.com/__attachments/a_44b3e1d1369cdd3d30f24c51b3c7b73d2101d5307b53b3a976624a16a0bf0441/Frame%201337.png?cb=fa2984749d42155776a50884fd62b53b) ## Next Steps Once Hydra is successfully deployed, it will become available within a few minutes after all of the services start. You should then be able to access the Hydra URL you specified above. Upon accessing the Hydra portal for the first time, you will be prompted to perform the initial update. This typically takes anywhere between 20 and 30 minutes. After clicking **Update**, it is important that you let it take as long as necessary and do not attempt to restart the app service during this process. ![Frame 2161.png](https://docs.loginvsi.com/__attachments/a_0314ed282df469100981b8979ef0c29da1780150e961af6016922dcbdec8e836/Frame%202161.png?cb=be8f9ca445ccee0769be90c6cb00b179) Next, you will need to [add your first tenant](https://docs.loginvsi.com/hydra/?contextKey=adding-a-tenant&version=latest). ## Cost Savings Tips for Smaller Environments If you are using Hydra to manage only a few host pools that contain a few session hosts each, you can reduce the app service cost by changing the service plan from S1 to B1. For more information on this process, see [Scale up an app in Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up). --- version: "Hydra 2.8.0" language: "en" --- # Endpoint Management ## Prerequisites Endpoint management is currently in public preview and can be used to manage Windows 10 and 11 physical and Cloud PCs. Endpoint Management utilizes the Hydra Agent, and the following prerequisites must be enabled: * Web sockets must be enabled. For details, see the [Hydra Agent](https://docs.loginvsi.com/hydra/2.8.0/hydra-agent.md) instructions. * Endpoint Management must be enabled under Global Settings: ![Frame 1388.png](https://docs.loginvsi.com/__attachments/a_eba4d613e49d45692bf283816c60f1383e015bea1d88fbe2b2b4c5047e124e3f/Frame%201388.png?cb=1faebc80a46844bd007a8aeccaf310ca) ## Installation 1. Download the agent from your Hydra instance: https://\.azurewebsites.net/helpers/HydraAgent.zip 2. Get the secret for the Hydra agent in the Hydra portal: Endpoints -\> Get the secret for the Hydra Agent 3. Bring the HydraAgent.exe into a folder on the endpoints (e.g., C:\\Program Files\\Hydra Agent for Endpoints) 4. Start the installation with admin permissions: *HydraAgent.exe -u wss://\.azurewebsites.net/wsx -s \ --EndpointMode -i* **Note**: You can also utilize Scripts or Intune to deploy the Hydra Agent. ## Restrictions and Configuration Some actions on the endpoints are restricted by default and must be enabled. Set the following reg values to allow the specific actions: Set-RegistryKey -Key Path: HKLM\\SOFTWARE\\ITProCloud\\HydraAgent * Allow remote update of the agent Allow-UpdateAgent, DWord, Value 1 * Allow remote reboot of the endpoint Allow-Reboot, DWord, Value 1 * Allow remote shutdown of the endpoint Allow-Shutdown, DWord, Value 1 * Allow remote running a script on the endpoint Allow-RunScript, DWord, Value 1 --- version: "Hydra 2.8.0" language: "en" --- # General Configuration ## Overview Windows 365 Management is disabled by default. To access Windows 365 UI in the Hydra platform, you must first enable the functionality globally and then enable it for each tenant you want to manage. The Windows 365 UI remains hidden until both steps are completed. ## Enable Windows 365 Management in Global Settings 1. In the top-right corner of the Hydra platform, click your **profile icon**. 2. Select **Global Settings** from the drop-down menu. 3. Under **Features** , select the checkbox **Enable Windows 365 Management**. 4. Reload the Hydra page to apply the change. ![Frame 1540.png](https://docs.loginvsi.com/__attachments/a_64b5132ca572bae69a4b15fc30f554ffae8a2d9d6efaf935eb348f1b8a64c4cb/Frame%201540.png?cb=23a93a4f8cae2719dd21da5617dc8738) **Note**: This global setting activates Windows 365 capabilities across the Hydra platform. Tenant-specific settings depend on this being enabled. ## Enable Windows 365 Management for Each Tenant 1. In the left-hand navigation menu, select **Tenants**. 2. Choose the tenant you want to configure. 3. Select the checkbox **Enable Windows 365 management**. ![Frame 2386.png](https://docs.loginvsi.com/__attachments/a_cc3a17057ecc7efda77a418a5cd2c7d584c31a692d2328434adbf08290cf2a36/Frame%202386.png?cb=1e8e0695e52dda2bced92a3dc85f4d39) **Note**: This step enables Windows 365 features specifically for the selected tenant. Each managed tenant must be enabled individually. ## Enable Graph API Permissions for Cloud PCs **Allow Hydra to perform actions on Cloud PCs.** Hydra can perform actions on Cloud PCs, like Intune Sync, Reprovision, Restart, Restore, and more. To allow that, add the following permissions: |------------|----------------------------------------------------------------------------------------------| | **Part** | **Value** | | API | Microsoft Graph | | Type | Application | | Permission | CloudPC.ReadWrite.All, DeviceManagementRBAC.Read.All, DeviceManagementConfiguration.Read.All | **Note**: These permissions are valid for all Cloud PCs. Use private endpoints for Hydra and disable public access to the Hydra app service if possible. An Entra admin must also grant consent on behalf of the organization for these permissions. To enable more fine-grained permissions against specific Cloud PCs, you can use Administrative Units. For more information, see [Adding Administrative Permissions](https://docs.loginvsi.com/hydra/2.8.0/configuring-hydra-to-remove-entra-and-intune-devic.md#adding-administrative-permissions). Once these requirements are met, the Windows 365 Management sections (Admin Dashboard, All Cloud PCs, Provisioning Policies, Migration Snapshots, etc.) become visible and functional. --- version: "Hydra 2.8.0" language: "en" --- # Getting Started How to get started with Hydra. **Note**: For both automated and manual deployments, you need the following roles: * A **Subscription Owner** for the subscription where Hydra is deployed. This role is required to automatically assign the managed identity to resources. * An **Entra Global Administrator** to create app registrations and grant consent for API permissions. --- version: "Hydra 2.8.0" language: "en" --- # Host Pool Management Configuration of Host Pools in Hydra, including default host configuration, autoscaling, and session timeouts. --- version: "Hydra 2.8.0" language: "en" --- # Hydra Agent ## Overview The Hydra agent adds an optional feature set to Hydra, including the ability to measure session host performance (CPU, Memory, CPU \& Disk Queue Length), and show user processes on the session or session host. ### Prerequisites The Hydra Agent uses WebSocket for secure communication with the Hydra app service. To configure this: * Open your Hydra instance Configuration within the Azure Portal. * From the Settings section, find and open the Configuration pane. * Find the Platform settings section, and set Web sockets to On to enable Hydra Agent communication. ![Frame 1377.png](https://docs.loginvsi.com/__attachments/a_3eee5cae1fc275d47b8e8cfcf2811ef8a720e8c1d08adb62d48ae8b3233ac3af/Frame%201377.png?cb=452428252b9b521758c8e440f0309bee) ## Installing the Hydra Agent Once Web Sockets are enabled on the Hydra app service, the Hydra Agent can be installed. There are two ways to achieve this: * You can set automatic installs as part of the New Session Host Rollout * Or, the Hydra Agent can be installed as part of a Script Collection, which can be set to run as part of the New Session Host Rollout. ### New Session Host Rollout: Install Hydra Agent Within the New Session Host Rollout page, there is an option to automatically install the Hydra Agent to session hosts. For more information on the New Session Host Rollout configuration, see [Configuring New Session Host Rollout](https://docs.loginvsi.com/hydra/2.8.0/configuring-new-session-host-rollout.md). Within the New Session Host Rollout configuration, check the **Install Hydra Agent** option. ![Frame 1378.png](https://docs.loginvsi.com/__attachments/a_806b5bb103ae870c51ea5c70c42dddaf29b24c26023feab7dab3eb4c1d937ed6/Frame%201378.png?cb=097be92f22812a2b7703f4d038c6cd6e) ### Script Collection: VM -- Deploy Hydra Agent Script Collections can couple PowerShell **Scripts** with built-in VM-level actions, such as restarts or deletion. For more information on Script Collections, see the [Script Collections](https://docs.loginvsi.com/hydra/2.8.0/script-collections.md). To deploy the Hydra Agent as part of a Script Collection: 1. Open the Script Collection where Hydra Agent deployment is desired. ![Frame 1379.png](https://docs.loginvsi.com/__attachments/a_c5623c09591a1724ed7bf4bba0d1f247a08d91594ad00bd0bff91fa35b96129a/Frame%201379.png?cb=76ddb33b98944839658b3fe955d9e18f) 2. Click the **Add new script or action** button to add an action to the Collection. ![Frame 1380.png](https://docs.loginvsi.com/__attachments/a_6569d7bc6713af8ebe7e9d26d5c7af06a63078cf296c397161c05dfb34b7972b/Frame%201380.png?cb=a99d11568e0344a89261a84d13b7a271) 3. From the **Actions and Script** item that was added, select **VM -- Deploy Hydra Agent**from the dropdown menu. ![Frame 1381.png](https://docs.loginvsi.com/__attachments/a_c76c1d37487bbe172c6b55c7f9060c25d219d9a332678a28560066392c9cedd9/Frame%201381.png?cb=2e17812f597cc7770506134e349d8d29) Below, an example Script Collection is shown to demonstrate the usage of the **VM -- Deploy Hydra Agent** action. In this example, failed installs of the Hydra Agent will delete the Session Host VM. ![Frame 1382.png](https://docs.loginvsi.com/__attachments/a_e31d58560f3193da570842c7552e4afc3bbc8d0db3d884c4e8cd4358ca6bb754/Frame%201382.png?cb=20a5a15bebdc31c4e14a9ac4c96109e7) ## Session Host Remote Task Manager Once the Hydra Agent is installed on a deployed session host in a host pool, Utilization metrics can be displayed from the **Host Pool details** page: 1. Open the Host Pool details, and locate the **Session hosts for the host pool** table. ![Frame 1383.png](https://docs.loginvsi.com/__attachments/a_2b4203dd0291b2f3788cacb48a6a948c141e3258508c77a0eca5c1c352bd548b/Frame%201383.png?cb=28ed92028300c85331aef3d23d6e357b) 2. Click the **Show processes** button to show Hydra Agent telemetry from the session host. ![Frame 1384.png](https://docs.loginvsi.com/__attachments/a_6d198acd7cc5435dd0f18b68850677dd0fccee983efcc87239a58280af115095/Frame%201384.png?cb=71b249b28d3f946bbfb76670b613dd6c) 3. In the **User Processes** window that appears, there are two tabs: Processes and System. ![Frame 1385.png](https://docs.loginvsi.com/__attachments/a_b1e8dec05c298d7cf522672e62d6e2eb0218cf856f80c70e1aa7a58d89e843d3/Frame%201385.png?cb=fbb19b44a852be8003b4d5357957a467) ### Processes The **Processes** tab shows real-time user processes on individual session hosts. This may be useful for helpdesk support and troubleshooting activities. You can also sort using the column headers, for example, to display the processes using the most CPU or Memory. #### Terminate Process To remotely terminate a session host process: * Scroll through the Processes table and locate the desired process. * Clicking the **Terminate** button will terminate the process without confirmation. ![Frame 1386.png](https://docs.loginvsi.com/__attachments/a_cd9d001b4e000432655d615b05406d61b24aeab9246fca3d1aaf0b6359bdb515/Frame%201386.png?cb=74150ac852912011e7e8c00dd02f6a60) ### System The **System** tab shows real-time Session Host CPU and Memory Usage, in addition to Processor and Disk Queue Length. It provides a dashboard to analyze system performance for correlation at the help desk. The chart displays data for the last hour, and hovering over the tooltip will display the raw timestamp, with each metric and its measurement. ![Frame 1387.png](https://docs.loginvsi.com/__attachments/a_3834d0cfcf5363735eb6f9f9bccdb0e5dee681e1e264d7fc83e499752785ce29/Frame%201387.png?cb=5d0eaa7f9039395d11b293831fd1825d) --- version: "Hydra 2.8.0" language: "en" --- # Hydra Agent for Cloud PCs ## Overview The Hydra agent enables administrators to view device resources and latency information and [perform remote actions on Cloud PCs](https://docs.loginvsi.com/hydra/2.8.0/hydra-agent-for-cloud-pcs.md#Hydra-Agent-in-Cloud-PC-Overview). ## Installing the Hydra Agent 1. Go to the **Tenant Configuration** page. 2. Click **Hydra Agent** for installation details and download. ![Frame 1549.png](https://docs.loginvsi.com/__attachments/a_97d6f6a8b782fb672f0bba362492722619f6e4a5702b92ebfdc91efc0d510037/Frame%201549.png?cb=4bb873c9f60b355c9648d46a5121d920) Once the Hydra agent is downloaded, follow the instructions to install the agent as a scheduled task by running the following command in a command shell with administrative permissions. **Note**: For the Windows 365 Hydra Agent support, there are 2 secrets required (i.e., -s and -t). ![Frame 1548 (1).png](https://docs.loginvsi.com/__attachments/a_d85e57aa501dd3b706b6a0e10b09d6a351e0125f948aa5f8b36575bbbda292c3/Frame%201548%20(1).png?cb=e5310f6e78b1d1340ef53d40fe7c6c52) ## Hydra Agent in Cloud PC Overview You can click on the Hydra Agent icon only if some Cloud PCs (CPCs) are selected. There are different actions that you can do. All actions happen on the selected CPC, if a Hydra Agent is available: * Restart the Intune service (triggered from the CPC if the management extension for Intune is installed) * Sync the Client with Intune (triggered from the CPC if the management extension for Intune is installed) * Request the internet-facing IP address * Update Hydra agent * Run a script \* ![Frame 2146.png](https://docs.loginvsi.com/__attachments/a_018d10716d6646f270cc16735167f80760a28fddcf4c255b48dd4ac4f2c449bc/Frame%202146.png?cb=374c2e00d42a5607a73b3409a6edd35a) To use "Update Hydra agent" or to "Run a Script", the Cloud PC must be configured to allow these actions to be taken. You can do this after the Hydra Agent is installed. To enable actions on endpoints set the following registry values: `Set-RegistryKey -Key Path: HKLM\SOFTWARE\ITProCloud\HydraAgent` * Allow remote update of the agent Allow-UpdateAgent, DWord, Value 1 * Allow remote running a script on the endpoint Allow-RunScript, DWord, Value 1 **Note**: You can select CPC with or without a Hydra Agent, but the operation is only triggered on CPC with a Hydra agent for this sub-menu. See the screenshot below for details. ![Frame 2147 (1).png](https://docs.loginvsi.com/__attachments/a_f12631093afb12a64a7120071bef2f4589bbef09a9c349500da2e78c76a29d29/Frame%202147%20(1).png?cb=e725d51ca6d1e97ea1fdae4fe4e5f64c) --- version: "Hydra 2.8.0" language: "en" --- # Hydra Lens Hydra Lens is a reporting feature in Hydra that allows you to view [Azure Virtual Desktop insights](https://docs.loginvsi.com/hydra/2.8.0/azure-virtual-desktop.md) as well as [usage and licensing](https://docs.loginvsi.com/hydra/2.8.0/usage-and-licensing.md). --- version: "Hydra 2.8.0" language: "en" --- # Hydra REST API ## Overview Hydra has a limited set of REST web API calls to manage session hosts, scripts, and images. To enable this feature, create a new secret in the Key Vault deployed with Hydra (you have to give yourself access to the secrets of the Key Vault first). | **Name** | **Secret value** | |------------------|--------------------------------------------------------------------------------------------------------------| | Hydra-RESTAccess | A complex (URL encoded) self-defined secret with at least 32 characters. Make this complex to secure access. | **Note**: If the secret doesn't exist, is empty, or has fewer than 32 characters, Hydra will not accept REST calls. After creating or changing the secret, a restart of Hydra (the app service) is necessary. Do this only if no imaging or deployment is currently running. You can restart Hydra by: 1. Clicking on the**Avatar menu** (upper-right corner). 2. Selecting **Restart Engine**. ## Authorization Hydra REST API uses the `Authorization` header for authentication. | **Header** | **Value** | |---------------|--------------| | Authorization | "SharedKey " | ## Available Endpoints ### Create a new host | **Endpoint** | **Request body** | **Response** | |-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------| | POST`/rest/hostpools//addhostspartial` | Can contain: * **VmSize**: String; e.g., Standard_D8as_v5 * **AssigneUser** : String; e.g., [user@domain.com](mailto:user@domain.com) (only for personal pools) * **DiskSizeInGb**: Number; Size of the OS disk * **PoolGroup**: string; custom, only valid if the host pool Guid is Guid.Empty (must match one of the pools with the deployment tag "AVD.PoolGroup" * Other properties are used from the default deployment configuration of the host pool | A GUID to query the state of the task. | ### Delete a host with VM | **Endpoint** | **Request body** | **Response** | |----------------------------------------------------|------------------|----------------------------------------| | GET `/rest/sessionhosts//delete` | - | A GUID to query the state of the task. | ### Change VM size and/or OS-disk size a host with VM **Note**: VM will be started and stopped. | **Endpoint** | **Request body** | **Response** | |-----------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------| | POST `/rest/sessionhosts//resize` | Can contain (one or both settings): * **VmSize**: String; e.g. Standard_D8as_v5 * **DiskSizeGb**: Int; Size of the OS-Disk in GByte (increase only; the VM is also started to expand the partition) | A GUID to query the state of the task. | ### Get assigned session hosts for a user | **Endpoint** | **Request body** | **Response** | |---------------------------------------------------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------| | GET `/rest/hostpools//sessionhosts` | - | A list of session hosts where the user is assigned. If HostPool-Guid is a GUID. Empty, all assigned hosts in all pools are returned. | ### Get available scripts for a user | **Endpoint** | **Request body** | **Response** | |---------------------|------------------|--------------------| | GET `/rest/scripts` | - | A list of scripts. | ### Get available script collections | **Endpoint** | **Request body** | **Response** | |-------------------------------|------------------|-------------------------------| | GET `/rest/scriptcollections` | - | A list of script collections. | ### Run a script or script collection on a host | **Endpoint** | **Request body** | **Response** | |-----------------------------------------------------------------------|------------------------------------------------------------|----------------------------------------| | POST `/rest/sessionhosts//scriptorscriptcollection` | Should contain the ID of the script or collection as text. | A GUID to query the state of the task. | ### Get the list of imaging definitions | **Endpoint** | **Request body** | **Response** | |--------------------------------------|------------------|------------------------------| | GET `/rest/azure/imagingDefinitions` | - | A list of ImagingDefinition. | ### Save and run a imaging definition | **Endpoint** | **Request body** | **Response** | |----------------------------------------------------------|-----------------------|----------------------------------------| | POST `/rest/scenes//StartStoredImageDefinition` | \ | A GUID to query the state of the task. | ### Get the state of tasks | **Endpoint** | **Request body** | **Response** | |----------------------------------|------------------|------------------------------------------------------------------------------| | GET `/rest/actions/ ` | - | * 200: Done successfully * 404: Not found * 202: Still running * 409: Failed | ### **Optional filtering** HTTP-Get commands to query VMs by user or to delete a host can have an additional filter in the header: | **Filter** | **Value** | **Description** | |------------------------|-----------------------------------------------------------------------------|------------------------------------------------| | "LimitToSubscriptions" | "49f90bf9-ddf8-48b2-bf90-629f3dbef550,f7f733a1-92f8-4ff4-8e49-6ecd7c3533f3" | Filters by subscriptions of the VMs/hosts. | | "LimitToPoolGroups" | "engineering,sales" | Filters by pool groups. | | "LimitToPoolType" | "personal" | Filters by host pool type: personal or pooled. | --- version: "Hydra 2.8.0" language: "en" --- # Image Management Hydra can create an image from a source Virtual Machine without destroying the source by creating a temporary copy of the virtual machine that is deleted once the image is created. This process leaves the master machine untouched. --- version: "Hydra 2.8.0" language: "en" --- # Installing and Using the Hydra Proxy (Preview) ## Overview The Hydra Proxy is an agent that executes actions on Azure Local and Azure Virtual Desktop (Hybrid) on behalf of the Hydra Instance. It acts as an extension for orchestrating hypervisors and enables features that are not available natively in Azure, such as local image creation on Azure Local. ## Architecture The Hydra Proxy runs on a server in the data center and orchestrates or interacts with local hypervisors for a custom location. A single Hydra Proxy installation can support multiple "custom locations" and nodes. You can install multiple Hydra Proxy devices for redundancy. The Hydra Proxy communicates with the Hydra instance over WebSocket/HTTPS by using an outbound connection to [http://\.azurewebsites.net](#). Technically, the Hydra Proxy is a Hydra Agent running in a specific mode. As a result, the application that hosts the Hydra Proxy must be configured to allow WebSocket connections. **Important**: The Hydra Proxy must be installed on a Windows Server. The server must be secured, and only a valid administrator should be able to log in. Never use a multi-user or terminal server. ## Prerequisites for the computer hosting the Hydra Proxy Install the following Windows features and capabilities: `Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Tools-All ` `Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Management-PowerShell ` `Add-WindowsCapability -Online -Name Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0 ` **Note**: A restart is required after installation. ## Enabling Hydra Proxy in the Hydra Instance To enable the feature, first activate it at the Global settings level: 1. Open **Global settings** from the application menu in the upper-right corner. 2. Select the checkbox next to **Enable Hydra Proxy (Support Preview)**. ![Frame 1568.png](https://docs.loginvsi.com/__attachments/a_16563d12f6caa4f700e0b47cf5bb6e91d597f6dad0c56cf6fe2a935a2767f18d/Frame%201568.png?cb=037d903f32d74eb3aad3beb1b37d0dcb) ## Enable Hydra Proxy in the Tenant menu Then, enable the feature at the Tenant level: 1. Open the **Tenant** configuration from the application's left-hand menu. 2. Select the checkbox next to **Enable Hydra Proxy Support Preview**. 3. The tenant menu will display the **Get Hydra Proxy**option, along with the download link and configuration settings. ![Frame 1569.png](https://docs.loginvsi.com/__attachments/a_2817a8c9307d2596f06c060165aa9306561f3adf5066c8079e78cadaa001c3c4/Frame%201569.png?cb=a82f131cb1f6a4702430cad60a6cd316) 3. Download the Hydra Proxy (Hydra Agent) and copy the installation parameter for later use. ![Frame 1577.png](https://docs.loginvsi.com/__attachments/a_673db2cb4f4fd357f709670367ff8c9fca1174f60082626929cc2897e01ef800/Frame%201577.png?cb=079401e6a83f72cc1a009e452675c9a4) **Note** : Only **Full Admins** in Hydra can get and configure this data. ## Installing the Hydra Proxy 1. Create a folder for the Hydra Proxy, e.g., C:\\Program Files\\Login VSI\\Hydra Proxy, and extract the file from the ZIP archive into it. 2. Create the configuration file named **HydraProxy.json** in the same folder, and open it in a text editor. 3. Paste the configuration content into the file and modify it as needed. Here's an example of HydraProxy.json: { "CustomLocations": [ { "LocationType": "AzureLocal", "LocationId": "/subscriptions/dcdce2ee-c9c0-4765-acd5-197126d21978/resourceGroups/Azure-Stack-HCI/providers/Microsoft.ExtendedLocation/customLocations/Cologne", "LocationName": "Cologne", "ClusterNodes": [ "azlocal01.itprocloud.de", "azlocal02.itprocloud.de" ], "ClusterShares": [ "C:\\ClusterStorage\\UserStorage_1\\e9fa154a447fff7", "C:\\ClusterStorage\\UserStorage_2\\e4d1dcac690e49a" ] } ] } **Note**: * **LocationId** must match the resource ID of the custom location shown in **Azure LocationType: AzureLocal**. * **LocationName** is the last part of the **LocationId**. * **ClusterNodes** specifies the fully qualified domain names (FQDN) of the Azure Local nodes. * **ClusterShares** specifies the path of the **UserStorage** folder, plus a random identifier. ## First Test 1. To test the Hydra Proxy connection to Azure Local, run an administrative PowerShell as a user with local administrator permissions on the Azure Local nodes (e.g., azlocal01.contoso.com) **Important**: For security reasons, it is not recommended to teach Windows to access the nodes in your user context. If necessary, this can be done using the following commands: `cmdkey.exe /add:azlocal01.contoso.com /user:domain\username /pass:xxxxxxxxxxxxxxxx` `cmdkey.exe /add:azlocal02.contoso.com /user:domain\username /pass:xxxxxxxxxxxxxxxx` You can validate the connection by opening a file share on a node and running: `\\azlocal01.contoso.com\c$` 2. Start the Hydra Proxy using the command line you captured from the **Tenant** menu, but **omit** `/i` to prevent installation. This allows you to run it interactively. The expected output, including the number of VMs detected on Azure Local, should look as follows: ![Frame 1571.png](https://docs.loginvsi.com/__attachments/a_3b8ef28ff9bb8d59d957a63000dba738e4916fb69cd5b5fa8648d008cd744ad1/Frame%201571.png?cb=0285334bf3b91c0fb7e98eccb8d2c814) If the number of returned VMs is 0, and you know this is incorrect, first verify that you can retrieve the data using an administrative PowerShell session in the same context: `Get-Vm -ComputerName azlocal01.contoso.com ` 3. If the data is correct, confirm that the Hydra Proxy can communicate with the Hydra backend. Open the Hydra instance in a browser and add the path, as shown in this example: `https://.azurewebsites.net/debug/ws ` The Hydra Proxy should appear after a few seconds. Refresh the page if it does not appear immediately. ![Frame 1572.png](https://docs.loginvsi.com/__attachments/a_7403f97cddadec5cf4409c935ec04531512c1180e91b5fab4773d23435a7eccd/Frame%201572.png?cb=02961d665d95a21c4bb417dfd947152f) 4. Let the Hydra Proxy run. ## Creating a local image You can capture an ARC-enabled VM that appears in the Azure Portal using the Hydra Proxy. 1. In**Hydra** , go to **Image Builder** \>**Create an Image** and select your tenant. 2. If the Hydra Proxy is working correctly, the **Hybrid Imaging Location** list box will display your custom locations. 3. Select a custom location supported by the Hydra Proxy. The **Virtual Machine** selector will then show the local VM instead of Azure VMs. 4. Select your **Template VM** on Azure Local, choose a resource group to store the image, and click **Create Image**. ![Frame 1573.png](https://docs.loginvsi.com/__attachments/a_7efa7800e23778dc2a91710c4262108e7d086b92f06fb22ce6c599dd1ea7b307/Frame%201573.png?cb=9be0a2fb767cdd7997042892a4282c2e) ## Helpful Tips on Installing the Azure Proxy The Hydra Proxy can be installed using the full command-line string, including `/i`. This creates a scheduled task named `"ITPC-AVD-Hydra-Helper"`. A logfile is written to the installation folder, with additional logs to `"C:\windows\System32\LogFiles\HydraProxy"`. While the scheduled task runs in the system context (and no longer in your context), this may prevent the Proxy from accessing Azure Local. To resolve this, change the task to run under a functional user account with local administrator permissions on both the server hosting the Hydra Proxy and the Azure Local nodes. **Important** : Alternatively, you can run the same `cmdkey` commands in the system context. This is **not recommended** because it grants any service or application running in the system context access to the nodes. To run `cmdkey` in the system context, use **PSExec** from Microsoft. ## Updating the Hydra Proxy It is important to keep the Hydra Proxy up to date whenever Hydra itself is updated to take advantage of the latest features and bugfixes. To update the Hydra Proxy: 1. Stop the process or task of the Hydra Agent. 2. Rename the original directory above (eg., C:\\Program Files\\Login VSI\\Hydra Proxy) to Hydra Proxy.old. 3. Download the latest version from the Hydra portal using the same steps above for the initial installation. 4. Copy the HydraProxy.json settings from the original directory, now with the .old name. 5. Start the Hydra Proxy process or task again. --- version: "Hydra 2.8.0" language: "en" --- # Introduction Reference Architecture provides a comprehensive reference architecture for **Hydra** , a modern platform designed to streamline, secure, and scale **Azure Virtual Desktop (AVD)** and**Windows 365 Cloud PC** environments. Whether you're deploying a small proof-of-concept or managing a global virtual desktop infrastructure, this architecture guide is intended to assist architects, administrators, and decision-makers in understanding the foundational components, design considerations, and integration points of the Hydra platform. Hydra simplifies AVD lifecycle management by offering a unified control plane for automated provisioning, configuration, policy enforcement, and monitoring. By abstracting the complexity of native Azure components, Hydra allows organizations to focus on delivering secure and performant desktop experiences to end users, with reduced operational overhead. The Hydra Reference Architecture outlines: * The core components of the Hydra platform and how they interact. * Logical and physical deployment models. * Security and scalability considerations. * Integration with enterprise systems like Active Directory, Microsoft Entra ID, FSLogix, and third-party identity and endpoint solutions. * Operational guidance for deploying and managing Hydra in production. This architecture is based on proven design principles validated in real-world enterprise deployments and aligned with best practices for Azure Virtual Desktop, Cloud PC, and Microsoft cloud services. --- version: "Hydra 2.8.0" language: "en" --- # Key Use Cases ## Overview Hydra supports a broad range of scenarios for organizations managing Azure Virtual Desktop (AVD) environments. Below are the primary use cases that highlight its flexibility and operational value: ## Multi-Tenant AVD Management Hydra provides native support for managing multiple logical tenants or departments from a single control plane. Each tenant is logically isolated with its own permissions, policies, and resource scope - enabling secure delegation and simplified operations across business units or customers. This is ideal for Managed Service Providers (MSPs), acquisitions, or test tenants. ## Strong Image Management Hydra simplifies and enhances the entire image lifecycle for Azure Virtual Desktop. It supports image creation from standalone, Active Directory-joined, and Entra ID-joined master VMs - regardless of whether applications were deployed manually or through Intune. Hydra's imaging process is non-destructive, preserving the original master VM even after the image is captured. Furthermore, Hydra enables fully unattended updates of master images and automates the imaging process itself, reducing administrative effort while maintaining consistency and control across environments. ## Automated Host Pool Provisioning Hydra enables blueprint-driven provisioning, allowing administrators to define reusable templates for host creation. This ensures consistency across environments and accelerates the deployment of new desktops, session hosts, and supporting infrastructure. ## Power Management and Cost Optimization Built-in scheduling and scaling capabilities allow Hydra to start and stop session hosts based on working hours, user activity, or capacity thresholds. This results in significant cost savings by avoiding unnecessary compute usage in off-hours or low-demand periods. Hydra can also create temporary session hosts and utilize disk swapping for further cost savings. ## Real-Time Session Monitoring and Diagnostics Hydra offers built-in monitoring capabilities for tracking session activity, session host health, processes, and user experience metrics. These insights allow operations teams to proactively troubleshoot issues, respond to incidents, and maintain high service availability. --- version: "Hydra 2.8.0" language: "en" --- # Licenses ## Overview The Licenses page allows you to view Microsoft 365 and Windows 365 Cloud PC licensing information across your tenants. This page is intended to help in reviewing license availability, usage, status, and billing account details in one place. Filter the table by tenant, SKU, usage, status, or billing account to quickly find specific licensing records. ### Licenses Table | **Column** | **Description** | |-----------------|-----------------------------------------------------------------------------------------------------------------| | Tenant | The tenant associated with the license. | | SKU | The license SKU or product identifier, such as a Microsoft 365 or Windows 365 Cloud PC license. | | Usage | Shows how the license is currently being used, such as assigned and available quantities. | | Status | Indicates the current license state. Possible values include **Active** , **Expiring soon** , and **Disabled**. | | Billing Account | The billing account associated with the license. | ![Frame 2198.png](https://docs.loginvsi.com/__attachments/a_966b6bb59f6eb7dd35e0c14745f1448a94ff3730d8a34901f7d66175f0bf7dd8/Frame%202198.png?cb=91e86a26e177f905501af24f69df97a1) The **Update** button refreshes the license data shown in the table. ### Permissions For Hydra to show the Billing account information for the licenses, the Hydra service principal must be given the "Billing account reader" role. ![Frame 2181.png](https://docs.loginvsi.com/__attachments/a_0c6563cd893050d127eac90dd9b46c555ff5b0294c9151777b9cd022ade95b5b/Frame%202181.png?cb=25cb2441a637b8af7d7c975edd150bc8) --- version: "Hydra 2.8.0" language: "en" --- # List of Required URLs ## Overview To ensure successful session host rollouts, whitelist the following URLs in your network firewall and proxy settings. ## Hydra App Service (in addition to the known Microsoft endpoints) | **Service** | **URL** | |---------------|-----------------------------------------------------------------------------------------------------------------------| | Licensing | [https://itpc-business-product-callback.azurewebsites.net](https://itpc-business-product-callback.azurewebsites.net/) | | Log Analytics | [https://api.loganalytics.azure.com](https://api.loganalytics.azure.com/) | | Updates | | | Updates | [https://itpcupdateweu.blob.core.windows.net](https://itpcupdateweu.blob.core.windows.net/) | | Updates | [https://itpcupdateeus2.blob.core.windows.net](https://itpcupdateeus2.blob.core.windows.net/) | | Updates | [https://itpcupdatesea.blob.core.windows.net](https://itpcupdatesea.blob.core.windows.net/) | ## Session Hosts (in addition to the known Microsoft endpoints) | **Service / Component** | **URL** | |--------------------------------------------|-------------------------------------------------------------------------------------| | Hydra Agent (wss=WebSocket) and Automation | https://\.azurewebsites.net | | FSLogix download (optional) | | | AVD Agent | | | AVD Bootloader | | | AVD Bootloader | [https://query.prod.cms.rt.microsoft.com](https://query.prod.cms.rt.microsoft.com/) | --- version: "Hydra 2.8.0" language: "en" --- # Logical Architecture and Components The Hydra platform is designed with a modular, cloud-native architecture that aligns with the principles of scalability, tenant isolation, and operational simplicity. Its components work together to automate session host provisioning and deliver centralization across distributed AVD environments - all while integrating securely with your existing Azure frameworks. At a high level, Hydra operates as a control plane layered over Azure Virtual Desktop. It interacts with existing AVD host pools, Azure Resource Manager (ARM), and identity services to manage virtual desktops within defined tenant boundaries. Each tenant is mapped logically within Hydra's configuration, allowing for delegated access and scoped resource provisioning, ideal for MSPs. The architecture separates control and data planes, ensuring that administrative workflows and operational automation can operate independently of end-user sessions. This also allows for role-based access control (RBAC), including self-service. The following diagram illustrates the key components and their relationships within the Hydra logical architecture: ![Frame 1389.png](https://docs.loginvsi.com/__attachments/a_3279ee3da0b9f35f6e87220ad80e9c1ee092d9a53097c1e8d3a189dbd7e7c103/Frame%201389.png?cb=496881322b7731a35974f9497f859546) The following detailed diagram also includes Hydra Proxy for on-premise AVD management: ![image-20260828-124236.png](https://docs.loginvsi.com/__attachments/a_2971086aa9b3589f696a3ad02c05389928ffadf14e669e43b51786c5b13d22e8/image-20260828-124236.png?cb=1317acccb06bdde586cf38304c6bcae8) --- version: "Hydra 2.8.0" language: "en" --- # Maintenance and Operations Maintenance and operation details of the Hydra deployment, including upgrades and backups. --- version: "Hydra 2.8.0" language: "en" --- # Managing AVD on Azure Local with Hydra ## Overview Starting with version 1.0.6, Hydra supports hosts on **Azure Local,** starting with **Azure Stack HCI 23H2**. This means you can leverage the feature set of Hydra to handle hosts on Azure Local in the same way as hosts in Azure Cloud: * Autoscaling of pooled and personal host pools * Let the user start their personal hosts * Create images from Azure VMs and store them in a custom location (on HCI) * Create multiple hosts with a click * Replace hosts with hosts based on an updated image * Automate the daily tasks with scripts and collections * Handle user sessions independently from the host type (HCI vs. Azure VM) * Using the Hydra agent to show and terminate processes * ...and more! ## Hydra Integrations with Hosts on Azure Local There is no need for a special configuration. If Hydra reads a custom location in Azure, it automatically offers the networks in the location as a target to roll out new hosts. Existing hosts on HCI are also automatically handled by Hydra. The only **requirement is Azure Stack HCI 22H3** with a configured resource bridge. From Hydra's perspective, there is almost no difference between hosts in Azure or on Azure Local. Theoretically, a host pool can contain both Azure Cloud and Azure Local hosts. The primary difference between hosts is the location/custom location. ## Configuring Autoscaling Autoscaling works in the same way as hosts in Azure. For configuration steps, refer to the [Autoscaling](https://docs.loginvsi.com/hydra/2.8.0/autoscaling.md) section. ![Frame 1486.png](https://docs.loginvsi.com/__attachments/a_679f11e68087799395b7020ad127de6efbc5459ee074038ecb73ac108280162c/Frame%201486.png?cb=e9d6038e8d0b9fe86cab377b4335ab39) ## Creating a Custom Image and Completing a Rollout Creating images based on a "Golden Image" is one of the strengths of Hydra. Compared to the manual approach in native AVD, Hydra always runs the imaging process from a clone of the Golden Image. Due to this, the Golden Image remains usable after the imaging process. Administrators can use the original Golden Master to update and maintain the image the next time. The imaging process looks like this: ![Frame 1487.png](https://docs.loginvsi.com/__attachments/a_8127262fbea4f4d9e8fa1002e2a98c2c45af98da09065b2251e4c5be8af7628a/Frame%201487.png?cb=72d0dab90212e7ea60412bb308b9e0ac) After creating the image, the clone is deleted during the clean-up. Imaging for Azure Local works in the same way, but with the following caveat: only Azure cloud VMs can be used as an image; VMs running on Azure Local are not supported. You can create a custom image for Azure Local with the following steps: 1. Create your **Golden Image VM** in **Azure Cloud**: 1. Use a **Windows 11 (multi-user)** marketplace image. 2. Security type: **Standard**. 2. Log in to the VM. 3. Optionally: Join an AD domain. 4. Install Windows Updates. 5. Install Applications. 6. Go to the **Hydra portal \> Image Builder \> Create an Image**. 7. Select your Golden Master VM. 8. Select a **Target Resource Group** to store the Azure image. 9. In the **Azure Local**section, select the custom location. 10. Optionally configure the other options. 11. Click **Create Image**. **Important**: Never let Hydra delete an image version being used by a virtual machine. VMs can no longer be started or stopped if the base image version is deleted. ![Frame 2232.png](https://docs.loginvsi.com/__attachments/a_d61f345bb60187eca9dc3118f0b9e255ece99339a4c12da8e1efc2fb222b7cfe/Frame%202232.png?cb=931c39b526d91565540aecbe27f9bc7d) The VM will be cloned, and the image will be transferred to the custom location, which could take some time depending on network bandwidth. After that, you can create new hosts in a host pool by selecting the image in the [New Session Host Rollout](https://docs.loginvsi.com/hydra/2.8.0/configuring-new-session-host-rollout.md) configuration. Azure Local rollout image selection is now location-aware. Hydra automatically filters images based on the Host Pool's Custom Location, helping prevent cross-region image selection errors. Note that session hosts can be configured with Trusted Launch. ![Frame 2314.png](https://docs.loginvsi.com/__attachments/a_bc0594277f3171ad61f146f45728c94211e9708330142497f532e78358431d0b/Frame%202314.png?cb=0310262a0b16f6976c954e6bf2b58aff) Alternatively, click on the plus icon in the session host list of a host pool to roll out hosts with the custom image. For more information, see [Creating New Session Hosts](https://docs.loginvsi.com/hydra/2.8.0/creating-new-session-hosts.md). ### Using a Storage Account for Azure Local Copies As of 1.2.1, you can also use a storage account. By default, Hydra creates a SAS URL for the generalized disk used to download to Azure Local Storage. This method is sometimes unreliable due to the size of the disk being copied. By using the **Use storage account**  option under the **Azure Local** section, Hydra can create a temporary storage account in the same region as the Image VM. Hydra will then copy the disk to the storage account, create a SAS URL on that disk object, and then copy it to Azure Local. ![Frame 1556.png](https://docs.loginvsi.com/__attachments/a_22a65b7909b8556bf102e6ed6bbde2b89a287005a851402e9d083051a511ab9d/Frame%201556.png?cb=a2f1876f601870c00f07592b638e4dfb) To use a Storage Account for Azure Local Copies, two permissions must be added to the [Hydra Resource Access Custom Role](https://docs.loginvsi.com/hydra/2.8.0/adding-a-tenant.md#custom-roles) for the Service Principal. The storage account will be created in the Azure Resource Group selected for the image creation. The service principal(s) need the following permissions on the resource group: 1. **Storage Account Contributor** (Microsoft.Storage/storageAccounts/write) ![Frame 2233.png](https://docs.loginvsi.com/__attachments/a_fc661f383b7f0a933746ad985841c1a17768616f0aed197d02546a8cfb4cdc6d/Frame%202233.png?cb=b0b8bbe0c104ba74496df718af950d4b) 2. **Storage Blob Data Contributor**(Microsoft.Storage/storageAccounts/blobServices/containers/blobs/\*) ![Frame 2234 (1).png](https://docs.loginvsi.com/__attachments/a_2ce1a6daff35f947795a56c58d709dcf4fb1bd1c254741ecd83fe91c80fad824/Frame%202234%20(1).png?cb=8a9f9f132c7bf9c78c696530bb01ba8a) ## Current Limitations The following features are unavailable or limited when managing AVD on Azure Local using Hydra: * Power-on Connect * Changing disk types * Sourcing the golden image from an Azure Local host without the use of Hydra Proxy --- version: "Hydra 2.8.0" language: "en" --- # Managing Azure File Shares ## Overview Hydra can manage Azure File Shares and Azure NetApp Files for monitoring and auto-scaling, and can also clean up FSLogix profiles, which is configured separately using a Service Account. Hydra can auto-expand/shrink Azure File Shares. For Azure File Shares, it can even release file handles (locks) on FSLogix virtual disks if a user's session was not properly logged out. ## Azure File Permissions For Hydra to properly interact with the Azure File Share, Contributor permissions, or the Custom Resource Access role are required by the Service Principal or Managed Identity in the target tenant. ## Azure NetApp File Permissions For Hydra to properly interact with Azure NetApp Files, the Service Principal (SP) or Managed Identity in the target tenant must have the appropriate permissions: * The Monitoring Reader role must be assigned at the Subscription level. Assigning it only at the Resource Group level will not work for auto-scaling or monitoring. * NetApp permissions must be granted at either the Resource Group or Subscription level. If using the built-in Contributor role, no additional configuration is needed. If using a Custom Resource Access role, ensure all required permissions are included (see below). **Note** : The SP used here is only for monitoring and managing Azure File Shares/NetApp Files. It is **not used for FSLogix profile cleanup** . For that task, see [Deleting User FSLogix Profiles](https://docs.loginvsi.com/hydra/2.8.0/deleting-user-fslogix-profiles.md). ![Frame 1651.png](https://docs.loginvsi.com/__attachments/a_6a0be42e13cf15597533a7569592dadfae4c1e14e65dfd2ca15a9fea93fff2ec/Frame%201651.png?cb=1463c4774fd1433843d69b6fcefd4119) If you created the [Custom Resource Access role](https://docs.loginvsi.com/hydra/2.8.0/adding-a-tenant.md#custom-roles) before Hydra 2.1.0, you must add new permissions to this role. These permissions are: * "Microsoft.NetApp/netAppAccounts/read", * "Microsoft.NetApp/netAppAccounts/providers/Microsoft.Insights/metricDefinitions/read", * "Microsoft.NetApp/netAppAccounts/capacityPools/providers/Microsoft.Insights/metricDefinitions/read", * "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/providers/Microsoft.Insights/metricDefinitions/read", * "Microsoft.NetApp/netAppAccounts/capacityPools/read", * "Microsoft.NetApp/netAppAccounts/capacityPools/write", * "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read", * "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/write" See an example of a JSON-formatted view of a Custom Access Role, including Azure NetApp Files permissions: ![Frame 1652.png](https://docs.loginvsi.com/__attachments/a_c58716e522c2941f24423a47c3b36df6c30ccefdec7c7cb1e51fb0e5feead793/Frame%201652.png?cb=fe770a0f7d41bf33f71d04cd8b5848de) **Important** : If you want to use Hydra to clean up FSLogix profiles, that is a separate process that uses a Service Account, not the SP above. See [Deleting User FSLogix Profiles](https://docs.loginvsi.com/hydra/2.8.0/deleting-user-fslogix-profiles.md) for setup instructions. ## Adding a File Share Configuration File Share Configurations allow Hydra to know when to trigger alerts and auto-expand/shrink file shares to ensure both zero downtime and decreased storage costs. To add a File Share Configuration: 1. Navigate to**Azure Resources** \> **File Shares** on the left-hand navigation bar. ![Frame 1677.png](https://docs.loginvsi.com/__attachments/a_5a48b7a661d3f7ae16046dc02e58fc41c5dbff70c7b231b439cda834af72d0fa/Frame%201677.png?cb=53d47b5b6c0556dc2af2d71033b13aae) You should see all of the File Shares that the identity has access to. 2. Click the **Settings** icon and scroll down if needed. 3. Click **+ Add** to add the configuration. ![Frame 1678.png](https://docs.loginvsi.com/__attachments/a_a64403ee6ae1145ae7a497e9acbf260fa09394291b242a09d1bfd903a7b4279a/Frame%201678.png?cb=42c04bcc702aaaa364d2535efc5b3f9f) 4. Input the parameters below as required: * **Enabled**: Enables the configuration. * **Free space threshold (GB)**: Triggers an alert in the top-right notifications section in Hydra if the free space is less than the configured value. Also triggers resizing when the free space falls below this value. * **Auto-Adapt**: Enable auto-adapt for this share. Auto-adapt can resize the share if needed. It starts when free space drops below the configured trigger value. * **Add enough capacity to reach this amount of free space when threshold is triggered (GB)**: If an alert is triggered, auto-adapt resizes the share to maintain the configured free space. * **Auto-shrink once a day**: When enabled, Hydra shrinks the share once a day if free space exceeds the configured auto-adapt free space capacity above. The operation occurs 24 hours after the last resize. * **Maximum share size (GB)**: Auto-adapt never increases the share above the configured value. ![Frame 1653.png](https://docs.loginvsi.com/__attachments/a_eb11eb60c3eb4bb341273e90d168ae3468f3676a503b43c39fa34477672c0989/Frame%201653.png?cb=53eaeb272ac40e6e1fa2258669f0e4a4) ## Managing File Handles Hydra can also release file handles, or locks, on the file share. This only applies to Azure File Shares. This can be handy for releasing locks on VHDs if a session host has not properly released the lock after logoff, potentially causing the user's subsequent login to hang. To show the **File Handles** table: 1. Click on the **Usage Percentage** graph in the **Usage** column of the targeted file share: ![Frame 1679.png](https://docs.loginvsi.com/__attachments/a_abfd9371753fd7e7f5a567dd05638f3436b8b314461ddb8c1f7e2d4c7375ee1b/Frame%201679.png?cb=4074a3e3541edca6eac71bf8b7830364) This will display the **File Handles** table at the bottom of the page. 2. Scroll down if necessary, select the file in scope, and click **Release handle** to force the release. **Important**: Ensure the user is completely logged off before doing this. ![Frame 1680.png](https://docs.loginvsi.com/__attachments/a_081eb5534e133b07e4a5154b5815e188b65217448542855fbfd5da8fdc16a7a0/Frame%201680.png?cb=f9b63158383334ab281a4648c99d53d7) --- version: "Hydra 2.8.0" language: "en" --- # Managing User Sessions ## Overview The User Sessions page allows you to search for users, tenants, host pools, and session hosts. You can also filter sessions by various criteria, including State, User Principal Name, Source, Tenant, Pool, Host/Device, Session ID, Start Time, Disconnected Time, and Type. To access **User Sessions** , from the **Dashboard** in the left-side menu, click **User Sessions**: ![Frame 2148.png](https://docs.loginvsi.com/__attachments/a_9c1f08c2f89c889356007c8a7dd7efee7647592fb826a4fa46cac55820fd7061/Frame%202148.png?cb=1a4006c1ce64b6c9adb7801b5be467d5) ## Logging Off Users Hydra can force user logoffs through the Hydra portal. From the **User Sessions** page: 1. Enter username(s) (UPN format, e.g., [username@loginvsi.com](mailto:username@loginvsi.com)) into the User Sessions search bar. 2. Once the user account is shown in the **User Sessions** table, select it by clicking the check box. 3. Click the **Logoff** icon. ![Frame 2149.png](https://docs.loginvsi.com/__attachments/a_eb7518c79b7701b311c36a37be8d83b0c63bd2087a4e3b6ae8ce5284084ffb50/Frame%202149.png?cb=55fcb9b364d38da173ccc0ff710eee02) 4. Click **OK** to confirm the user logoff. ![Frame 1357.png](https://docs.loginvsi.com/__attachments/a_ac69c3f1cf4aed19f414afbaa01b6a83aa0e0e82b69e07eb17e23e64b39ca9d6/Frame%201357.png?cb=eade2a92a7bfe411db3cbf791d65749e) ## Sending Message to Users Hydra can send messages to active user sessions through the Hydra portal. From the **User Sessions** page: 1. Enter username(s) (UPN format, e.g., [username@loginvsi.com](mailto:username@loginvsi.com)) into the User Sessions search bar. 2. Once the user account is shown in the **User Sessions** table, select it by clicking the check box. 3. Click the **Message** button to open the Message details. ![Frame 2150.png](https://docs.loginvsi.com/__attachments/a_bf7bb27840c7477cf0395643894793f07a9dbad3f4b770b6750977a0205d5c67/Frame%202150.png?cb=41301478d2dc68e8c4293446e9392631) 4. In the **Send message** window, optionally change the subject line, and enter the desired message, e.g., "This is a message from your IT department." Click **OK** to send the message. ![Frame 1361.png](https://docs.loginvsi.com/__attachments/a_06763152a70debd9ba8d4842fad78f13bac124a2594641bd802cd70fd2426d98/Frame%201361.png?cb=cc781e746a488d85eefa86af4deab811) --- version: "Hydra 2.8.0" language: "en" --- # Migration Snapshots ## Overview The Migration Snapshots page displays snapshots created for Cloud PCs, allowing administrators to track, review, and delete migration snapshots. This page is primarily for monitoring and deleting snapshots; no other management actions are available. ## Search Use the search field to locate snapshots by Tenant, User principal name, Status, etc. ## Migration Snapshots Table The table lists snapshots with the following columns: | **Column** | **Description** | |---------------------|--------------------------------------------| | Tenant name | The tenant associated with the snapshot | | User principal name | The user for whom the snapshot was created | | Usage status | Current usage status of the snapshot | | Import status | Status of the snapshot import | | Start date | Snapshot start date | | End date | Snapshot end date | All columns (except **Start date** and **End date**) have a Filter icon, allowing you to search or select specific values. ![Frame 2196.png](https://docs.loginvsi.com/__attachments/a_726b8049733ff82415c120fc3bd354c3824826c4abf67fcae3e30bf3acd94f0a/Frame%202196.png?cb=7855d94c88ce5cd60f78467c689c8fc6) ## Actions * Select one or more snapshots in the table to delete them. * Use the **Select page**option at the bottom of the table to perform bulk deletions. --- version: "Hydra 2.8.0" language: "en" --- # Monitoring Host Pool and Session Utilization ## Overview As covered in the [Reference Architecture](https://docs.loginvsi.com/hydra/?contextKey=logical-architecture-and-components&version=latest), Hydra automatically deploys a Log Analytics Workspace within its resource group. This Log Analytics Workspace contains the following tables: * **Hydra_Actions_CL**: Contains all of the admin and automated tasks that are seen in the Logs module within the Hydra portal but are not subject to the 14-day limitation. * **Hydra_ConcurrentUserUsage_CL**: Contains overall concurrent session counts approximately every 10 minutes. This data is automatically deduplicated and can be used to track license utilization. * **Hydra_HostPoolStatistics_CL**: Contains session and host information per host pool. By default, this is collected every 30 seconds per pool. * **Hydra_Logs_CL**: Contains the Engine logs, even beyond the last engine restart time. ## Accessing the Tables The most common way to view the tables above is to: 1. Navigate to **Logs** \>**Tables** within the Log **Analytics Workspace** in the Azure Portal. 2. Highlight the table you wish to query and select **Run** to query the table. ![Frame 1681.png](https://docs.loginvsi.com/__attachments/a_8f21fe67878a46cd0e00f13bc06d86778af16b4c4eda03e030748582aad8cab6/Frame%201681.png?cb=a5d4ba623f80454b71062f57d7501614) It may be useful to view some tables in a visual format, such as the Concurrent Usage table. Simply click the **Chart** tab and adjust the filters as needed: ![Frame 1682.png](https://docs.loginvsi.com/__attachments/a_f6bd1f31b819667176aa888d16892ba58bb0cb2e107106985f0c9c0d9fc571a9/Frame%201682.png?cb=b8d598fc219e5b8dd14946b61452c4e2) ## Data Retention The Log Analytics Workspace deploys with a default retention period of 90 days. If you wish to retain data beyond that, [configure different retention periods](https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/log-analytics/billing/configure-data-retention) for both individual tables and the entire Workspace. --- version: "Hydra 2.8.0" language: "en" --- # Network Architecture ## Overview Hydra's network architecture is designed to be secure, modular, and cloud-native, with support for both public and private access models. All core services can run within a dedicated Azure Resource Group and communicate over secure Azure networking channels by using private endpoints configured by the customer. The platform is composed of the following key components: * **Hydra App Service**: The central logic layer handling API requests, automation workflows, and tenant operations. * **SQL Server + Database**: Stores configuration data, tenant metadata, and operational state. * **Log Analytics Workspace**: Collects telemetry for diagnostics, health monitoring, and platform insights. * **Key Vault**: Stores application secrets and a cryptographical key. ## Connectivity and Flow * The **Hydra App Service** communicates *outbound* with: * The **SQL Server** via Azure SQL's secure endpoints. * **Log Analytics** for telemetry output ([https://api.loganalytics.azure.com](https://api.loganalytics.azure.com/)). * **Azure Resource Manager APIs** to perform AVD and Azure-related operations (e.g., host creation). * **Key Vault** for secrets and keys * **GitHub**for installs and updates * **License URL** for automatic license polling ([https://itpc-business-product-callback.azurewebsites.net](https://itpc-business-product-callback.azurewebsites.net/)) * All traffic flows over **secure channels (TCP 443, 1433)** * **Hydra App Service** receives communication *inbound* with: * **Users and Admins** using the HTTPS web service * **Hydra Agent** using 443-based WebSockets (must be enabled). For more information, see the [Microsoft Documentation](https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/websocket?wt.mc_id=knwlserapi_inproduct_azportal#how-the-websocket-protocol-works). ## **Networking Models** Hydra supports two deployment options: 1. **Public Access (Default)** * App Service and database are reachable via Azure public endpoints. * Simpler to deploy and manage. * Secured using Entra, HTTPS, and optional network-level firewall rules. 2. **Private Networking (Recommended for Production)** * Hydra services are integrated with **Azure Private Endpoints**, allowing access only from within a private VNet. * Enhances security by eliminating public exposure of App Service, Key Vault, and SQL endpoints. * Ideal for enterprise environments with strict egress and segmentation requirements. * For a video on how to configure the various components with **Private Endpoints** , see [Securing an App Service, a Key Vault, and a Database with Private Endpoints](https://blog.itprocloud.de/Securing-an-app-service,-a-key-vault,-and-a-database-with-private-endpoints/). --- version: "Hydra 2.8.0" language: "en" --- # Network Connections ## Overview The Network Connections page provides an overview of all Windows 365 network connections across tenants where the feature is enabled. It allows administrators to search, filter, review key details for each connection, delete, and [configure connection settings](https://docs.loginvsi.com/hydra/2.8.0/network-connections.md#Configuring-Network-Connection-Settings). ## Search Use the search field to locate a specific network connection by Tenant, Name, Virtual network Status, etc. ## **Network Connections Table** The table lists all provisioning policies with the following columns: | **Column** | **Description** | |-----------------|---------------------------------------------------------------------------| | **Tenant** | The tenant where the network connection is applied. | | Name | Name of the network connection. | | Virtual network | The Azure virtual network associated with the network connection. | | Status | The current status of the network connection. | | Created by | The administrator who created the network connection. | | Join type | The directory join type used by Cloud PCs that use the network connection | | Subscription | The Azure subscription that contains the virtual network. | | Domain | The domain associated with the network connection. | | Region | The Azure region where the network connection is hosted. | | Edit | Opens the Network Connections configuration for editing. | ![Frame 2194.png](https://docs.loginvsi.com/__attachments/a_fefd931194bcfb06ed17abfd115e7faf84341030a77a961b8767d7b8567f31c7/Frame%202194.png?cb=ad9df2808fb2a46b0e07561da040821c) Each column has a Filter icon allowing you to search, select all, or select specific values relevant to that column. ## Configuring Network Connection Settings You can add, configure, or delete network connections from the Network Connections page. To add a network connection, select the **+** icon to the right of the connections table, and then choose one of the following options: * [Add Microsoft Entra join connection](https://docs.loginvsi.com/hydra/2.8.0/network-connections.md#Adding-a-Microsoft-Entra-Join-Connection) * [Add a Hybrid Microsoft Entra join connection](https://docs.loginvsi.com/hydra/2.8.0/network-connections.md#Adding-a-Hybrid-Microsoft-Entra-Join-Connection) Each option opens a configuration dialog. ### Adding a Microsoft Entra Join Connection Use this option to create a network connection for Microsoft Entra joined devices in Microsoft Entra ID within Microsoft Azure. 1. Select the **+** icon. 2. Select **Add Microsoft Entra join connection** . ![image-20260218-143521.png](https://docs.loginvsi.com/__attachments/a_b7295a9496637caf5dac1e967e99fdc019bac878003c9c5c30b6a5fc15c4bf33/image-20260218-143521.png?cb=369969550a11d788821ab87807121434) 3. Complete the required settings in the dialog. #### Network Details Tab Provide the following information: * **\*Name**: Enter a connection name that is easy to identify when provisioning Cloud PCs. * **\*Tenant**: Select the Microsoft Entra tenant. * **\*Subscription / Resource group**: Select the Azure resource group that will contain the network interface cards (NICs) created by the Windows 365 service. * **\*Virtual network**: Select the virtual network to which the Cloud PCs will connect. For provisioning to succeed, the virtual network must be connected to a Microsoft Entra domain. * **\*Subnet**: Select the subnet from which Cloud PCs will be assigned IP addresses. For provisioning to succeed, the subnet must be routed to a network that has access to a domain controller. For disaster recovery purposes, ensure that at least 50% of IP addresses remain available at all times. **Note** :Join type is automatically set based on the type of new connection you selected. ![Frame 1684.png](https://docs.loginvsi.com/__attachments/a_df45cb780ec44e726cad5d425da3c08d66952c64f36b14357d0f9ea0edcf353f/Frame%201684.png?cb=ba89b07923555ab9575ec4d6cda60119) #### Scope Tags Tab Use scope tags to control visibility and management access. * Select a tenant before selecting scope tags. * After a tenant is selected, choose the appropriate scope tags as needed. ![Frame 1688.png](https://docs.loginvsi.com/__attachments/a_bf4b93b120f55697e9a19d1fe20aef89a934f448f0733a7f8d89b03f2d386aac/Frame%201688.png?cb=230ec54458ba3b64f8113d6613a5768a) When you finish configuring the settings, save the connection. ### Adding a Hybrid Microsoft Entra Join Connection Use this option to create a network connection for hybrid Microsoft Entra joined devices. This configuration includes additional Active Directory settings. 1. Select the **+** icon. 2. Select **Add Hybrid Microsoft Entra join connection setting** ![image-20260218-143643.png](https://docs.loginvsi.com/__attachments/a_57d420c5c3ed55d8aba98fcd467b70ac0aeb9b3014b517db3aa61b815de129c5/image-20260218-143643.png?cb=a64c78be97242f7c86fd6a822139d2aa) 3. Complete the required settings in the dialog. The dialog includes the following tabs: #### Network Details Tab Provide the same information described in the [Network details](https://docs.loginvsi.com/hydra/2.8.0/network-connections.md#Network-Details-Tab) section. ![Frame 1685.png](https://docs.loginvsi.com/__attachments/a_69ccabcf9ec46dbe9865237df71df7c460b6cf17b6b3981727674148dc3acf39/Frame%201685.png?cb=9427d190c3788b1ecc48b557d6fe2938) #### AD Domain Tab Provide the following Active Directory details: * **\*AD DNS domain name** : Enter the name of the domain that you want the Cloud PC to join. The name must be in a fully qualified domain name (FQDN) format (for example, `ad.contoso.com`). The domain must be resolvable on the network specified in the **Network details** tab. * **\*AD username UPN** : Enter the user principal name (UPN) of an Active Directory user account that has sufficient permissions to perform a domain join (for example, `domainjoin@ad.contoso.com`). * **\*AD domain password**: Enter the password for the specified Active Directory user account. * **\*Confirm AD domain password**: Re-enter the password for the specified Active Directory user account. * **Organizational Unit** : Enter the organizational unit (OU) where Cloud PC objects will be created after provisioning succeeds. The OU must be specified in distinguished name (DN) format (for example, `OU=CloudPCs,DC=ad,DC=contoso,DC=com`). ![Frame 1689.png](https://docs.loginvsi.com/__attachments/a_093cda815cf1414e280435e01fcec9f749aa320b457870a172594084d997c598/Frame%201689.png?cb=940e82e3b143b3fe9a8a13ac715185f1) #### Scope Tags Tab * Select a tenant before selecting scope tags. * After a tenant is selected, choose the appropriate scope tags as needed. ![Frame 1687.png](https://docs.loginvsi.com/__attachments/a_56aee17e712902d62b8e798de24c5e1eec29ac57d12dbf66bd9bda5905d73ab4/Frame%201687.png?cb=2e06afc13dd59ed85bdb7d668b5d2663) When you finish configuring the settings, save the connection. --- version: "Hydra 2.8.0" language: "en" --- # Previous Release Notes ## Hydra 2.7.0 **Release Date: July, 22, 2026** **Important** : This release includes a change in data logging for the Log Analytics workspace. For instructions on updating your environment, see the [migration guide](https://docs.loginvsi.com/hydra/2.7.0/updating-hydra-for-azure-monitor-s-new-dcr-based-log-ingestion). **Note** : AVD Hybrid support is still in private preview and isn't included in the 2.7.0 release. If you'd like to try AVD Hybrid on Hyper-V support, [contact us](https://support.loginvsi.com/hc/en-us/requests/new). **Features** * **Show/Hide Columns on Tables**: Choose which columns are visible across most tables in Hydra, including Host Pools, User Sessions, Cloud PCs, Provisioning Policies, and more. * **Resize Table Columns**: Drag the resize handle on a column header to adjust the column width. The handle appears when you hover over the header, and the column updates as you drag. **Changes/Improvements** * **Log Analytics Migration to DCR-based Ingestion** : Hydra's logging backend has been migrated from the legacy Log Analytics data ingestion method to the new Azure Monitor DCR-based Log Ingestion API. This critical infrastructure change requires customers, especially MSPs that use logging for invoicing, to follow the [migration guide](https://docs.loginvsi.com/hydra/2.7.0/updating-hydra-for-azure-monitor-s-new-dcr-based-log-ingestion) and update their Log Analytics workspace configuration ## Hydra 2.6.0 **Release Date: June, 24, 2026** AVD Hybrid support is in private preview and is not included in the 2.6.0 release. **Features** * [Configure Remote Connection Experience](https://docs.loginvsi.com/hydra/2.6.0/cloud-pc-settings.md#Remote-Connection-Experience) in Windows 365 to control how remote connections are handled for Cloud PCs * [Configure column visibility on the Host Pools dashboard table](https://docs.loginvsi.com/hydra/2.6.0/avd-admin-dashboard.md#Display-the-Host-Pools-Dashboard-as-a-Table) to show or hide columns based on your needs. This capability will be extended to additional tables in future releases. **Changes/Improvements** * The Image Builder and Imaging Log tables now use the modernized generic table component, adding tenant-aware columns, sorting, filtering, and improved pagination * Rollout image selection is now location-aware for Azure Local. Hydra automatically filters available images to match the Host Pool's Custom Location, preventing cross-region selection issues * You can now configure Trusted Launch on Azure Local VMs **Bug Fixes** * The Host Pool Friendly Name doesn't appear on the dashboard when configured * Tenant configuration incorrectly uses the Azure Cloud type in advanced settings, even when Tenant ID and Application ID fields are empty * Local imaging on Azure Local fails due to incorrect location selection from the cluster instead of the template VM ## Hydra 2.5.0 **Release Date: May, 28, 2026** **Features** * The [Windows 365 Licenses](https://docs.loginvsi.com/hydra/2.5.0/licenses.md) page has been added to give administrators a read-only view into Microsoft 365 licensing for their tenant(s) **Changes/Improvements** * All Cloud PC settings are now available on the Windows 365 \> [Cloud PC settings](https://docs.loginvsi.com/hydra/2.5.0/cloud-pc-settings.md) tab. These settings include User settings, Cloud PC configurations, and Windows App settings * Consistent with updated Microsoft branding, Frontline Cloud PCs are now called Flex Cloud PCs. Note: You will still see "Frontline" in the All Cloud PCs table as we wait for Microsoft to update the naming in their API * Self-service users can now [set the time and time zone for auto-start settings](https://docs.loginvsi.com/hydra/2.5.0/user-portal.md#Start-Schedule) * The Host Pools table view now uses the generic table component for a consistent experience across Hydra * Updated the drag-and-drop area for reordering rows in the Autoscaling, Script Schedules, and Session Timeout tables * Enabled support for copying the Hydra proxy image to a different destination region **Security** * Added missing authentication controls for three API endpoints identified during penetration testing * Corrected site-wide reflected XSS in the Hydra HTTP message parameter identified during penetration testing * Enhanced host security through stricter permissions on monitoring components used by Hydra **Bug Fixes** * The Agent tools visual doesn't render correctly in the All Cloud PCs view * The Inactive state for Network Connections doesn't function correctly * Updating a Workspace friendly name unlinks associated App Groups * Hydra instance restart and update doesn't work for Gov cloud customers * Custom Image Definition version numbering doesn't account for existing versions ## Hydra 2.4.0 **Release Date: April 22, 2026** **Changes/Improvements** * [Provisioning Policy management page for Windows 365](https://docs.loginvsi.com/hydra/2.4.0/provisioning-policies.md) with support for create, edit, and delete * [Updated Hydra Agent for Windows 365](https://docs.loginvsi.com/hydra/2.4.0/hydra-agent-for-cloud-pcs.md#Hydra-Agent-in-Cloud-PC-Overview), supporting instant Intune sync and restart, getting the remote endpoint IP address, updating the agent, and running scripts * Extend the REST API to create images based on the Imaging definition and trigger a rollout of a host in a pool * Manually assign Azure Compute Gallery image version, image replica counts, and disk type * Delete a session host object (if it exists) in the clean-up phase during the rollout * The [User Sessions](https://docs.loginvsi.com/hydra/2.4.0/managing-user-sessions.md) table has been modernized with improved filtering, sorting, and selection * Updated favicon and Hydra Logo ## Hydra 2.3.0 **Release Date: March 18, 2026** **Changes/Improvements** * [Custom Images Management](https://docs-loginvsi.atlassian.net/wiki/spaces/DP/pages/253100033/2.3.0+Custom+Images) page for Windows 365 * A Feedback button for submitting feedback and feature requests * Hydra can now download cloud images to Azure Local using Hydra Proxy * Updated Provisioning Policies table * Important messages in the header, e.g., trial license expiration warnings, have been moved to banners * Removed the Power-on-Connect toggle, previously used to allow scaling Session Hosts down to 0. Now, a warning banner is displayed when scaling down to 0 is configured * The session host object is now deleted before the VM. If the host can't be deleted, the VM isn't deleted * All gallery versions are shown in the rollout configuration. If a version is not ready yet, a note is shown behind the version * The "Delete and rebuild hosts after logoff" scaling option doesn't rebuild temporary hosts. It deletes them only * Hybrid automations now use remote scripts by default for commands on Azure Hybrid and Azure Local when the compressed script size exceeds 400 bytes, and the VM must have HTTPS access to the Hydra instance; this behavior can be changed in Global Settings under "Use the remote script engine for Hybrid VMs if the size is higher than" **Bug Fixes** * Resolved an issue that caused failures when 20 or more Session Hosts were recreated or replaced simultaneously * When the same image version exists in multiple regions, duplicate entries are no longer shown in the Replace/recreate session hosts option * SID was not interpreted if FSLogix removes the profile if SIDDirNameMatch is using this variable ## Hydra 2.2.0 **Release Date: February 18, 2026** This version of Hydra completes the Azure Network Connections for Windows 365 devices. It applies the updated Community Mode limitations to existing deployed Hydra instances and includes other user experience improvements. Updates from this version forward will happen via Update Center, not GitHub. Customers may be asked once to remove the GitHub connection when starting an update. Hydra will reboot once before starting the update. All future updates will not require an additional reboot. **Changes/Improvements** * Community mode limits for existing installations: 1 Tenant, 5 Host Pools, 5 Session Hosts per Pool, and 100 User Sessions * Create, edit, and delete Azure Network Configurations in Windows 365 * Add a Tenant column to the User Sessions table to let you sort and filter by tenant * Improve table sorting for Session Hosts to make it easier to sort unassigned Session Hosts * Text and tooltip improvements across the UI **Bug Fixes** * In some cases, the RuncommandAPI could return an HRPC500 error related to script size. You can now configure the maximum script size as needed. ## Hydra 2.1.1 **Release Date: January 28, 2026** **Features** * W365 Cloud PC Configuration parity with Intune (View, Create, Edit, and Delete now available) * W365 Cloud PC Azure Network Configuration display **Changes/Improvements** * **New Community Mode limits** for new installations only - 1 tenant, 5 host pools, 5 session hosts per pool, and 100 user sessions. **If upgrading to 2.1.1**, it will be the last upgrade before these new limits take effect on the following release * **Improved control over Hydra updates** -Hydra updates will be retrieved from an Azure Storage Account, allowing flexibility for updates and rollbacks * Updated pagination and table formatting for W365 Cloud PC * The Script Collection Action "Others - Quit on hosts with sessions" can now be utilized ## Hydra 2.1.0 **Release Date: December 19, 2025** **Features** * User Settings in Windows 365: including creating, editing, and deleting them * Install and use the Hydra Proxy (Public Preview) * Azure NetApp Files has been added as an additional file share provider * Email subscription for administrators to receive updates on new releases, features, etc **Changes/Improvements** * Filter by tenant on AVD and Windows 365 Admin Dashboards * Dashboard search now includes tenant names * Drag and drop schedules or script actions * Improved pagination component * Improved clean-up during imaging, migration snapshots, and AVD Agent reinstallation * Disable Windows Update in *New Session Host Rollout \> Advanced configuration* **Bug Fixes** * Migration snapshot creation fails for disks in specific zones * Various grammatical corrections throughout the product ## Hydra 2.0.0 **Release Date: November 20, 2025** **Features** * Windows 365 Support * View all Cloud PCs in a managed tenant * Perform basic actions (Intune sync, Restart Cloud PC, Create restore point, restore Cloud PC, and reprovision) * Windows 365 dashboard by Provisioning Policy * View all Cloud PC User sessions * Build AVD Migration Snapshots to import into Windows 365 * View all Provisioning Policies and state * Hydra Agent updated for Windows 365 support (enables advanced reporting and control) **Changes/Improvements** * Improved sorting and filtering by Column Title in Windows 365 Tables * Force Logoff during consolidation has been added to the *Host Pools \> Autoscaling* **Technical Notes** * You need to add Graph API permissions to the Hydra Service Principal to see Windows 365 support * You need to add 2 permissions to be able to create a storage account for the 1.2.1 Azure Local Image Copy ## Hydra 1.2.1 **Release Date: October 30, 2025** **Features** * Improved Azure Local Image Copy to be more resilient **Changes/Improvements** * Added the ability to execute scripts against active hosts only * Improved validation against the session host name * Show additional details on logging pop-ups and the active operations folder * Improved UI for default browser zoom on certain resolutions, where buttons were cut off * Fixed quote/quota typo on File Shares page ## Hydra 1.2.0.1 **Release Date: October 10, 2025** **Changes/Improvements** * Added a selection for storage path for Azure Local configurations **Bug Fixes** * Fixed an issue that caused Image Definition configurations to appear blank when reconfiguring ## Hydra 1.2.0 **Release Date: September 30, 2025** **Features** * [Create Host Pools, Application Groups, and Workspaces](https://docs-loginvsi.atlassian.net/wiki/spaces/DP/pages/67895648/1.2.0+Creating+Host+Pools+Workspaces+and+Application+Groups) from Hydra * Run scripts against powered on hosts only * Enable Boot Diagnostics in rollout configuration * Option to tag hosts that are scheduled for power operations **Changes/Improvements** * Corrections on several typos ## Hydra 1.1.2 **Release Date: September 1, 2025** **New Features** * [Recreate session hosts with a new image](https://docs-loginvsi.atlassian.net/wiki/spaces/DP/pages/67502491/1.1.2+Replacing+Recreating+Hosts) * [Deploy updated images to a select set of session hosts](https://docs-loginvsi.atlassian.net/wiki/spaces/DP/pages/67502491/1.1.2+Replacing+Recreating+Hosts) **Changes/Improvements** * Update to ARM NuGet Packages * Pointed various documentation links in Hydra to the articles within this support site * Add more logging during host creation --- version: "Hydra 2.8.0" language: "en" --- # Provisioning Policies ## Overview The Provisioning Policies page provides an overview of all Windows 365 provisioning policies across tenants where the feature is enabled. You can use this page to: * Search and review existing policies * Understand how Cloud PCs are configured * [Create new provisioning policies](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Creating-a-Provisioning-Policy) * Delete policies that are no longer needed ## Search Use the search field to locate a specific policy by: Tenant, Name, Image, Created by, Azure network connection, etc. ## **Provisioning Policies Table** The table lists all provisioning policies with the following columns: | **Column** | **Description** | |--------------------------|-----------------------------------------------------------------------| | Tenant | The tenant where the policy is applied | | Name | Name of the provisioning policy | | Image | The OS image assigned to the policy | | Experience | Whether users get a full desktop or access to cloud apps only | | Image status | Status of the image assigned to the policy | | Created by | Administrator or service that created the policy | | License type | Type of license assigned to the policy | | Azure network connection | The Azure network used by Cloud PCs created with this policy | | Assigned | Indicates whether the policy is currently assigned to users or groups | ![Frame 2192 (1).png](https://docs.loginvsi.com/__attachments/a_dbb817e2ee786b38eb54c22b249504a4bb21bab95d1cf06eb1a9e42af03e0db0/Frame%202192%20(1).png?cb=a0678d81f6b3a793e8db21427fc441a6) Each column has a Filter icon that allows you to search, select all, or select specific values for that column. ## Creating a Provisioning Policy To create a new provisioning policy, click the **+** icon in the top-right corner of the table. The Create a provisioning policy window opens with several tabs guiding you through the setup. ### Settings This is where you define the core behavior of the Cloud PCs created by this policy. #### General * **Tenant**: Select the tenant where the policy will be applied * **Name**: Enter a name for the policy * **Description**: (Optional) Add a description ![Frame 2086.png](https://docs.loginvsi.com/__attachments/a_3aa1f85b646524337a879a126f980ab5e720742a52c623ef29e255159f7a863c/Frame%202086.png?cb=69d050d2ae50d0f41d3bac45f4d150a5) #### Experience Select how users will access their Cloud PCs: * **Full Cloud PC desktop**: Users get a complete Windows desktop experience. * **Cloud apps only**: Users access individual applications running in the cloud. ![Frame 2088.png](https://docs.loginvsi.com/__attachments/a_1c2311b0b85b5ff1c41dcdcae79193a31a6310ba95b6441463b4a4d13f4a27fc/Frame%202088.png?cb=7ade9363a9db05627cc42067f1e89d7f) #### License Type The available license options depend on the experience you selected: * For **Full Desktop Access**, you can choose from 3 license types, such as: * **Enterprise** * **Frontline** * **Dedicated** * **Shared** * **Reserve** For detailed information on License Types, see [Licence Type Definitions](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#License-Type-Definitions). ![Frame 2089.png](https://docs.loginvsi.com/__attachments/a_86d82229aa7e5395ab10893bafd6a9781a06c4bb33c8098e438d1140484e31f1/Frame%202089.png?cb=4a9369e91092f15d31693a8d056be59b) * For **Cloud Apps Only**, a Frontline (Shared type only) is used. ![Frame 2090.png](https://docs.loginvsi.com/__attachments/a_13a0200be623e36a758798e219fdfa583f027b20e4fbcef724f09ad5557bb3cd/Frame%202090.png?cb=99f611b7136c7c181bd35e1e37b6400b) Depending on the type of license selected (Enterprise or Frontline), you need to [provide the join type details](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Join-Type-Details-(Enterprise-/-Frontline-Only)). #### Join Type Details (Enterprise / Frontline Only) This is where you need to select the join type for the Cloud PCs assigned to this policy. For details on the join types, see the [Microsoft documentation](https://learn.microsoft.com/en-us/windows-365/enterprise/identity-authentication#device-join-types). 1. **Join type** allows you to specify how the Cloud PC will be connected to the Microsoft Entra ID: 1. **Microsoft Entra Join** 1. **Network**: 1. Depending on the selection, configure: 1. **Microsoft hosted network**: Geography, Region groups/regions, and enable Microsoft Entra SSO. 2. **Azure network connection** : Select the connection and enable Microsoft Entra SSO. For more information, see [Network Connections](/hydra/2.8.0/network-connections.md). 2. **Hybrid Microsoft Entra Join** 1. **Azure network connection**: Select the connection and enable Microsoft Entra SSO. ![Frame 2085.png](https://docs.loginvsi.com/__attachments/a_8b582b5bcc5bd6aeef066980bec1bfd3e06a197771c459c2a7d101937638afe9/Frame%202085.png?cb=3366ccf80540d5b4b84ace6742506f79) If you select the license type as **Reserve**, additional configuration is as follows: 1. **Geography**: Select a region 2. **Use Microsoft Entra single sign-on**: Select the checkbox if you want to use a single prompt to authenticate users for Windows 365 and their PCs. ![Frame 2091.png](https://docs.loginvsi.com/__attachments/a_ba1799ad8cd1d107ec9dfcfb853940dbab9c765940c3c303595eeed9e9e9e84e/Frame%202091.png?cb=a8d639f5326cf8f04af46463cd5e4f2b) 3. Finally, click **Save** . The next step is to [select an Image](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Image). ### Image In this step, you select the image that will be used to provision Cloud PCs. To select an image: 1. Next to **Image type**, select the type of image: 1. **Gallery images**: Provided by Microsoft. 2. **Custom images** : Created and uploaded by your organization. For more information, see [Custom Images](https://docs.loginvsi.com/hydra/2.8.0/custom-images.md). 2. Click **Select image**. 3. From the list, choose the image you want to use, then click **Select**. 4. Click **Save**. After saving, proceed to the next step: [Configuration](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Configuration). ![Frame 2108.png](https://docs.loginvsi.com/__attachments/a_9d5f4e841b72b1b96f11fe125bb4acf9cddb1a03f818d7b7761de425a8633a59/Frame%202108.png?cb=fd4cde1495a24eced5bdd9d3c8a54c8d) ### Configuration In this step, you configure how Cloud PCs are set up, including [Windows settings](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Windows-settings), [Cloud PC naming](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Cloud-PC-naming), and [Windows Autopilot (Preview)](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Windows-Autopilot-(Preview)). #### Windows settings In **Language \& Region**, select the preferred language and region (or country) for Cloud PCs. Your selection will apply to all Cloud PCs created using this policy. ![Frame 2113.png](https://docs.loginvsi.com/__attachments/a_97f96eb4dd7bed858289f4f82720cb01e9c55717f5b9cc6248841583dd09bc88/Frame%202113.png?cb=25d4641a31f5ba399daa6b5469a0583b) #### Cloud PC naming You can define a naming template for Cloud PCs created with this policy. To configure device naming: 1. Select the **Apply device name template** checkbox. 2. In the **Enter a name template**, provide a naming pattern using the following rules: 1. Must be between 5 and 15 characters. 2. Can include letters, numbers, and hyphens. 3. Spaces are not allowed. 4. Must include at least one randomized string. 1. Supported macros: * `%USERNAME:x%` Inserts the first *x* characters of the username. * `%RAND:y%` Inserts a random alphanumeric string of length *y* (*y must be 5 or more*). ![Frame 2114.png](https://docs.loginvsi.com/__attachments/a_d67e5b32eb5119db1036b964bce66000e09c58518403a3b3370e8e29cd812a77/Frame%202114.png?cb=0d821b9287c97d4aeeae18aee2f42a1e) #### Windows Autopilot (Preview) Use this section to link an Autopilot device preparation policy to ensure Cloud PCs are ready for users after provisioning. 1. In **Autopilot Device preparation policy** , select **Automatic Device Proflie** from the dropdown. **Note**: Only 'Automatic' device preparation policies are supported. 2. In **Minutes allowed before device preparation fails** , select a value between **30 and 360**minutes. 1. This defines how long Windows 365 waits for apps and scripts to complete before timing out 3. Select **Prevent users from connecting to Cloud PC upon installation failure or timeout** to control user access: 1. **Selected**: 1. Cloud PCs that fail preparation are marked as **Failed** 2. Users cannot connect 2. **Not selected**: 1. Cloud PCs are marked as **Provisioned with warnings** 2. Users can still connect 4. Click **Save**. After saving, proceed to the next step: [Scope Tags](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Scope-Tags). ![Frame 2115.png](https://docs.loginvsi.com/__attachments/a_f9f5a33da16953b03d3beec5cb91c0964f639ec9d8811284cab596a98916e9ba/Frame%202115.png?cb=c27f52fd6a72118712817a3f7f26bbd7) ### Scope Tags In this step, you assign scope tags to control which administrators can view and manage this provisioning policy. To add scope tags: 1. In the **Search** field, type the name of a tag to find it 2. Select the checkbox next to the desired tag(s) * Or select the checkbox to choose all available tags. After selecting the required scope tags, proceed to the final step: [Assignments](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Assignments). ![Frame 2111 (1).png](https://docs.loginvsi.com/__attachments/a_cd5464b8f59f4a2cf5589f4f841da93471e6a0e76fa4415bb96910d5b04449c8/Frame%202111%20(1).png?cb=3ad8bbc2cc0a6e0dc513e8e9b90513b5) ### Assignments In this step, you select the groups whose users will receive Cloud PCs. Cloud PCs are provisioned only for users who have valid Windows 365 licenses and will be configured according to this provisioning policy. To assign groups: 1. In the **Search** field, type the name of a group to find it. 2. Select the checkbox next to the desired group(s). * Or select the checkbox to choose all available groups. 3. Click**Save** to apply the provisioning policy configuration. ![Frame 2112.png](https://docs.loginvsi.com/__attachments/a_5c3db16ef412c79362b94d9ca3ed398997714c3d3ae022127191bd19a1db0e26/Frame%202112.png?cb=3f2d9859ba5f0bfaab62c14ee06151cf) #### Frontline License Scenario If you selected a **Frontline** license type in the [Settings](https://docs.loginvsi.com/hydra/2.8.0/provisioning-policies.md#Settings) step, additional configuration is required when assigning groups. After adding a group: 1. Under **Cloud PC size** , click **Select**. ![Frame 2144.png](https://docs.loginvsi.com/__attachments/a_2ddebd59dceebc97831583eb37444ba5db670af9508588d4e16c7158cb2c2a9d/Frame%202144.png?cb=95ee841c02c091d3675422c3a5ff34f1) 2. In the **Select Cloud PC size** window: 1. Underthe **Selected group**, view the selected group details: 1. **Name** 2. **Total members** 2. In**Cloud PC size**, choose a Cloud PC size from the available options. Note: Availability may take time to update after recent changes. 3. In the**Assignment**, configure how shared Cloud PCs will be allocated: 1. **Assignment name** 1. Enter a friendly name to help identify this assignment in reports within the Intune portal. 2. The name cannot contain the following characters: `< > ( ) $ | , ; " ^` 3. The name cannot start or end with spaces. 2. **Number of Cloud PCs** 1. Specify how many Cloud PCs to provision. 2. Must be between **0 and 900**. 3. Cannot exceed the number of available shared licenses. 3. Click **Select** to confirm the assignment. ![Frame 2145.png](https://docs.loginvsi.com/__attachments/a_50ab650de3e3234e33fdfed398475260da0766b3703c50b724f72cdfe0284d01/Frame%202145.png?cb=3fb59b2f06470327c700aeb8f43fc842) ## Appendix ### License Type Definitions * **Enterprise**: Each user will get their own Cloud PC without restrictions on when they can connect to it. * **Frontline** : For each license, assign a Frontline Cloud PC to up to 3 users. Only 1 of these users can connect to their Cloud PC at a time. For information on Windows 365 Frontline, see the [Microsoft documentation](https://learn.microsoft.com/en-us/windows-365/enterprise/introduction-windows-365-frontline). * **Type** * **Dedicated**: Recommended for users who need part-time access to their Cloud PCs or follow a set schedule, such as shifts. A single license lets you provision up to three Cloud PCs that can be used non-concurrently, each assigned to a single user. Provides one concurrent session. * **Shared**: Recommended for users who use Cloud PC for a short period of time and do not require data to be preserved. A single license lets you provision one Cloud PC that can be shared non-concurrently among a group of users. Provides one concurrent session. * **Reserve**: Users will receive access to Cloud PC for up to 10 days annually. The Cloud PC can be provisioned on demand to individual users after a provisioning policy is created. --- version: "Hydra 2.8.0" language: "en" --- # Reference Architecture A comprehensive reference architecture to assist architects, administrators, and decision-makers in understanding the foundational components, design considerations, and integration points of the Hydra platform. --- version: "Hydra 2.8.0" language: "en" --- # Release Notes and Support Statements The latest release notes and support statements for [Hydra 2.8.0](https://docs.loginvsi.com/hydra/2.8.0/what-s-new-in-hydra.md). --- version: "Hydra 2.8.0" language: "en" --- # Replacing/Recreating Hosts ## Overview As of 1.1.2.3, there are two wizards available within Hydra for streamlined rollouts of new images. First, it is important to understand the difference between **replace** and **recreate.** * **Replace** will first roll out a brand new session host. Once that host is available and Hydra confirms it is healthy, it will go back and delete the original host targeted for replacement. This option is the safest because there is a check to ensure the new host is available prior to deleting the old one. * **Recreate** will immediately delete and recreate the selected host(s) with the same name. This may be desirable in some environments where creating hosts with new names is limited. It is also handy for quickly pre-staging some hosts with a new image for production pilot purposes, such as OS updates. There are two wizards available in Hydra for replacing and recreating: * **Replace/recreate selected hosts** , where you can use the **Select** checkboxes on the hosts to quickly replace **or** recreate the selected hosts in the Details page for the host pool. * **Replace session hosts wizard**, where you can roll out brand new hosts to replace the original ones. This can also handle automated messaging to users for the cleanup of the old hosts. ## Replace/Recreate Selected Hosts **Note**: This feature is only available starting in 1.1.2.3. 1. To begin this wizard, first choose the **Details** page of the host pool you are targeting. ![Frame 1443.png](https://docs.loginvsi.com/__attachments/a_34efb1c5a258534d72f8776aa58fdca795ca6cb1038c192cdf7c0edfbef77e92/Frame%201443.png?cb=2e9219abb4c17df166e8d165ded8a997) 2. Select the hosts you wish to target for replacement or recreation: ![Frame 1444.png](https://docs.loginvsi.com/__attachments/a_4e8af8daa449f58a97931580704c88bf45af5faecc355ae1245b3fb2fc64dff1/Frame%201444.png?cb=da216f313bb1e5dcc3ad1c0ab6648799) 3. Select the far-right collapsed/hamburger menu button, and then select the **Replace/recreate selected hosts** option: ![NewSessionHostDetailsActionReplaceRecreate.png](https://docs.loginvsi.com/__attachments/a_a0c0e8ae5da7d7132ef115db6802508311f5c08d1bd169bd628f1fb99633bdb3/NewSessionHostDetailsActionReplaceRecreate.png?cb=d7869aee5a9d5761739e8c0751aa4b0a) 4. Choose the various options below. Note that users will not be notified using this method, so ensure proper warning has been given or that the targeted hosts are already drained. ![Frame 1446.png](https://docs.loginvsi.com/__attachments/a_dbb5122b598cf17ed9b17329dc67e3a2d7e607cf53cf8ca9d99432941720c119/Frame%201446.png?cb=7e54da7437ca461793c36391cdc93cb9) The **Suggested Images** section will automatically show any other versions of the image that are in use by this pool, helping streamline the rollout process. Notice that both **Recreate** and **Replace**are available with this method: ![Frame 1447.png](https://docs.loginvsi.com/__attachments/a_f0d1f0e6d7501016862a3319903472d8f334af4fdc16339a51ca4e398507247c/Frame%201447.png?cb=a3bc50576d633da903db5c840a1fdb63) ## Replacing Session Hosts Wizard This option can be used to massively roll out new images and notify users. **Only recreate** is available with this method, meaning new session hosts are rolled out first, and then the old hosts are deleted after the new ones are healthy and available. Users can also be notified, and the action can even be ignored on some hosts if the new image is already partially rolled out. This can be useful if previous hosts were already staged using the **Replace/recreate selected hosts**wizard, preventing unnecessary forced logoffs. 1. To begin this wizard, first choose the Details page of the host pool you are targeting. ![Frame 1448.png](https://docs.loginvsi.com/__attachments/a_0b26dbbc3e2b67d1f1d389bc0f4699ba523f8d66c85e5d05b6207855feae12d8/Frame%201448.png?cb=ee2b955390f30555df9afa3a5e36cd82) 2. Choose **Replace session hosts Wizard**: ![NewSessionHostDetailsActionReplace.png](https://docs.loginvsi.com/__attachments/a_9acb56811856cb2a75627e12fed10f4d31e253a7a093c7ff1327b49e558ce58d/NewSessionHostDetailsActionReplace.png?cb=515f454c947e712a7efa02f1315e7beb) 3. Select from the various options, noting the ability to target specific hosts, such as only those without sessions or ones in drain mode, the ability to stagger the rollout, ignore hosts on the same image, and send messages to users prior to forcing logoffs: ![Frame 1450.png](https://docs.loginvsi.com/__attachments/a_bcd16ea5a4de7535c09d7706b36bbbc75f31e8a6ac25692c881ce2f66d419bfb/Frame%201450.png?cb=e091333559ba4033beeff8439368182a) --- version: "Hydra 2.8.0" language: "en" --- # Restoring Hydra from Backup ## Introduction If, for some reason, Hydra needs to be restored from a backup, you can do so by restoring both the app service and database. ## Before You Begin Before proceeding with the restore, [raise a ticket](https://support.loginvsi.com/hc/en-us/requests/new) with Support. We need to understand exactly what led to the scenario that prompted the restore so that we can: * Gather necessary logs to understand the root cause. * Guide you through the process. * Better our products. Please provide as much detail as possible, including screenshots, error messages, logs, and any actions that were taken that left Hydra in an undesirable state. ## Stopping the App Service First, stop the Hydra app service within Azure: ![Frame 1393.png](https://docs.loginvsi.com/__attachments/a_e2c9b09d41bcaf9b10a99fde17613b4887259f1fa5f9192d63263082b35e83a4/Frame%201393.png?cb=d1a237bf8fb8099c66edb8bd3f059c38) ## Restoring the Database 1. Navigate to the **Hydra SQL Database** in Azure and click **Restore**: ![Frame 1394.png](https://docs.loginvsi.com/__attachments/a_64f3f56d49f7a65c004537e296dad43febb39e1610f7faa99532b6712d9c7f81/Frame%201394.png?cb=8d0e6cdee468efa7b5bca7e32f518be5) 2. Choose a **Point-in-time** restore in **UTC** when Hydra was in a known good state, such as before an outage, change, or update. ![Frame 1395.png](https://docs.loginvsi.com/__attachments/a_cad5690d3eaf0aa9d648e3f289e1e0ee72c3f84c4eaf91ed5629f70caf10c485/Frame%201395.png?cb=7894e089f91f1054ce284129028fe6e5) 3. Keep the database name the default, or rename it to, for example, *Hydra_restore*. Monitor the restore process and ensure that both databases appear in the SQL server before proceeding to the next step: ![Frame 1396.png](https://docs.loginvsi.com/__attachments/a_da0489b9cc5066acf00c434a91e8d2de7cf148fe0a8402871f4dafc520cf1ea7/Frame%201396.png?cb=b7fc331f2ed3690e5ff5586063428b04) ## Deleting the Hydra Database Once the Hydra database restore is complete, delete the original Hydra database: ![Frame 1397.png](https://docs.loginvsi.com/__attachments/a_49c642049cbc2f10b917abeeea1720847fbb48fef063327257095ceb1f3b980c/Frame%201397.png?cb=725421721b1dc2103c9fd53902dc78a4) ## Restoring the Previously-Restored Hydra Database Because Azure does not support database renames, we must restore the restored database with the name *Hydra* . Choose any time after the previous database was restored. Monitor the restore process and continue once the new *Hydra* database is available. ![Frame 1398.png](https://docs.loginvsi.com/__attachments/a_6c519280cbf17db9f7ade1c05b40e833f331f614a4a89ad4f5b83e9723f2b1e4/Frame%201398.png?cb=0b15da7e38f1e6aa70b536b9ab9d8baa) ## Restoring the App Service Once the database is available, it is now time to restore the Hydra App Service. Navigate to the stopped App Service, and head to **Settings \> Backups**. Choose a restore point nearest to the time that the SQL database was restored; before the outage, change, or bad update: ![Frame 1399.png](https://docs.loginvsi.com/__attachments/a_7f77f8d5b40758711b1b6edeecbabb1d82f254ef37f27c3ed0f0f707986d44d5/Frame%201399.png?cb=a7bebc8e2c86fd6db52f12e53f80a20a) Because overwriting the existing app deployment, choose the already-existing deployment slot. You should be presented with the following warning: ![Frame 1400.png](https://docs.loginvsi.com/__attachments/a_439b0fc9627b301c22691e34f8908b74ebc5c2de53df6d8f565113497a9c1b0a/Frame%201400.png?cb=272bf079c1e454a1d77a91c97ea22719) The app service restore may take some time. Once it is finished, it will likely automatically go into the Running state. ## Wrapping-Up Once the app restoration is completed, Hydra should be available again. The original database will show up in the**Deleted Databases** section of the SQL Server in case further analysis is required. [Next Page](https://docs.loginvsi.com/llms-full.txt/1)