Azure Virtual Desktop Support for External Identities Without FSLogix (Preview) – Part II

In part 1 of the blog here, I have written about the support of external identities of Microsoft.

In part 2 of this blog, I will try to put the Concepts into Practice with the help of PowerShell.

In Part 1, we introduced the groundbreaking preview feature allowing the use of Azure Virtual Desktop (AVD) with external identities (Guest Users) directly from Microsoft Entra ID (formerly Azure AD), overcoming a significant historical limitation. We discussed the key scenarios—such as enabling access for contractors, partners, and training participants—and the important current limitation: the lack of FSLogix profile support, which means these sessions are non-persistent.

Now, in Part 2, we move from theory to action. This section provides a complete, step-by-step guide on how to configure your environment and onboard an external user. Whether you prefer the graphical interface of the Azure Portal or the efficiency of PowerShell automation, we have you covered.

Now, I will show how you can automate the entire process with PowerShell.

PowerShell – Automating External Identity Onboarding

For administrators who prefer automation and scripting for bulk operations or streamlined processes, here is how you can perform the external user invitation and assignment using Azure PowerShell and the Azure AD module.

Step 1: Install and Connect to Required Modules

Before you begin, ensure you have the necessary modules installed and connect to your Azure environment.

Step 2: Invite the External User to Your Tenant

This step uses the New-AzureADMSInvitation cmdlet to send a formal invitation email to the external user.

Step 3: Retrieve the Guest User’s Object ID

Once the invitation is sent, a guest user object is created. We retrieve their unique Object ID, which is required for role assignment.

Step 4: Assign the User to the AVD Application Group

Finally, we grant the user the necessary Azure Role-Based Access Control (RBAC) role to access resources within the specific AVD Application Group.

Step 5: Verify the Role Assignment

To confirm the assignment, you can quickly check the role assignments scoped to the Application Group.

You should see the external user listed with the Desktop Virtualization User role assignment. That’s all about this. Part 1 of the blog you can read here.