topic Re: Terminal Service Agent with Azure Virtual Desktop in Next-Generation Firewall Discussions

Terminal Service Agent with Azure Virtual Desktop

MarceloM — Thu, 09 Nov 2023 19:36:15 GMT

Our organization is moving away from Citrix VDI and exploring Azure Virtual Desktop (AVD). One of Security's requirements is that we get userID from the endpoints. We have successfully installed the TS Agent on the AVD and can get UserID; no issues here.

The challenge we have is that our Desktop team is planning to dynamically stand up and tear down AVD machines, and would like to have the ability to add/remove TS Agent entries on the firewall via API. -which we have done successfully. the problem is that granting them access to add/remove TS Agent entries into the config also allows them to add/remove other configuration. therefore giving them write access to the firewall is not possible.

I am looking for a way to dynamically add/remove TS Agents into the config, ideally via API or CLI, without them having more access than needed. Or, if there is a way to have a 'range' of IPs for the TS Agent configuration.

Thanks

Marcelo

Re: Terminal Service Agent with Azure Virtual Desktop

Kendric — Thu, 14 Nov 2024 21:31:01 GMT

Did you come up with a solution for this?

Re: Terminal Service Agent with Azure Virtual Desktop

MarceloM — Thu, 12 Dec 2024 17:05:05 GMT

sort of. We have a script that performs the add/remove TS Agent entries and only allow the other team to call the script remotely with their variables (IP entries). we also monitor the account for what it commits.

Re: Terminal Service Agent with Azure Virtual Desktop

Kendric — Mon, 16 Dec 2024 18:42:00 GMT

I assume you are using the PAN API for this. Can you share the script?

Re: Terminal Service Agent with Azure Virtual Desktop

warwick — Tue, 06 May 2025 02:02:07 GMT

It would be great if someone could share a copy of this script.