When using Windows Virtual Desktop the public IP of which you are NATed to the internet changes consistently. In some cases you would want to have the traffic origination the WVD hosts to use the same public IP adress. So that it can be whitelisted to use some external service, or so that it can be used as a trusted location for Conditional Access. This way users can connect to Windows Virtual Desktop and be prompted for MFA, but once they are signed in, in a managed environment they aren’t prompted for MFA again.
Traditionally you could accomplish this setup by using an Azure Load Balancer. I didn’t find this very easy to implement, luckily Microsoft introduced a new service called Virtual NAT Gateway which make this a lot easier to implement. By using a Virtual NAT Gateway you can NAT your outbound connections through one, or more Public IP addresses. This way all the VM’s within a certain subnet of your virtual network will use a dedicated public IP to make outbound connections.
Please note that the Virtual NAT Gateway is still in preview, so I wouldn’t recommend using this in production environments.
To get started you will need a Virtual Network with some subnets, with a Virtual Machine deployed in that Virtual Network.
To create a NAT gateway, you select create resource and look for NAT Gateway.
Select your subscription, resource group and give the NAT Gateway a name and continue to the next step.
Here you can create or select a public IP address, if you need more one PIP you can also choose to create a whole range of PIPs. Notice that the SKU and assignment are Standard and Static, this means that the PIP you select won’t change over time.
Select a virtual network with the subnet(s) you want to associate the NAT Gateway, add tags and Create the NAT Gateway.
After the deployment is ready you can verify your settings by logging into the VM and checking your public IP on a website like https://www.myip.com/
You could then add this IP as a trusted location to use with Conditional Access so users wont have to two-factor authenticate within a WVD session.
hey man, thanks for this.
This is just what I’ve been searching for. Thank you!