Configure Azure AD Permissions for Azure Virtual Desktop (AVD) Scaling Plans to Operate

Azure Virtual Desktop Scaling Plans allows us to set on a schedule the amount of our Session Host hosts which are available to service AVD Host Pools. In order for us to do this, we must create a new role assignment and bind it to the Azure Virtual Desktop service object. This is set at the subscription level, which hosts the AVD service. 

From the Azure Portal, search for Subscriptions. 

Click on Access Control (IAM), and click under Role Assignments. Then click on Add.

From the Add Role Assignment wizard, search for a predefined role assignment called Desktop Virtualization Power On Off Contributor and select it. 

From the tab which allows us to choose where to bind this role assignment to, click Users, Groups and Service Principals. From here, use the side menu to search for Azure Virtual Desktop and select it.

Click Next and Complete to complete the role assignment.

With this configuration in place you will now be able to configure Scaling Plans for your AVD Host Pools. 

Azure Virtual Desktop - Adding MSIX package to AVD Host Pool fails with "The MSIX Application metadata expand request failed on all Session Hosts that it was sent to. Session Host: pooled-0, Error: App contains untrusted signature. (Code: 400)"

When trying to add a new MSIX application package to an existing AVD Host Pool it fails with....

Error: ActivityId: 454-x Error: The MSIX Application metadata expand request failed on all Session Hosts that it was sent to. Session Host: pooled-0, Error: App contains untrusted signature. (Code: 400).

This error was due to the certificate which was used to sign the MSIX package was not installed correctly on the AVD Session Hosts. For the avoidance of doubt the certificate (PFX with the private key included) is required on all of the AVD Session Hosts. This would typically be issued centrally from an enterprise PKI (like AD CS in Windows Server) and distributed via Group Policy. However, in my development lab I created a self-signed certificate, therefore this PXF file had to be distributed to each of the AVD Session Hosts.

This certificate must be installed under Local Machine\Trusted People on each Session Host. I can honestly say I have never seen this part of the certificate store used for any other purpose. An automated install of the certificate will install it to the wrong place and you will get the 400 error listed above.