Distributing Golden Images from Your Company's Azure Storage

If your corporate policies require hosting your company's Golden Images behind tightly controlled, authenticated access, but you would still like to keep the installation/deployment process seamless for the users, you may want to use the integration between Parallels Management Portal and Microsoft Azure Storage that became available in June 2026.

Note: This method of distribution is not supported in mainland China and requires Parallels Desktop version 26.4 or newer.

How the integration works

Whenever end users request an installation from your company's Golden Image, their copy of Parallels Desktop receives a short-lived link from the Parallels backend, which in turn fetches the file directly from your company's Azure Storage.

The files remain in your organization's Azure tenant. Parallels Management Portal only holds the reference and the metadata supplied when the file is registered, and authentication with Azure is handled server-to-server using delegated permissions you grant during setup. Download links expire automatically within minutes of being issued.

Your end users never see the storage URL, never enter Azure credentials, and are never prompted to sign in to anything. From their perspective, downloading a Golden Image works exactly as it does today.

Setting up the integration

To set up the integration, you will need:

1. An Azure Storage account with at least one container holding the files you intend to distribute.

2. An Entra ID account with privileges to grant admin consent to a third-party application in your tenant and to assign storage roles.

Attention: The integration can be disabled at any time by revoking admin consent for Parallels Desktop in Microsoft Entra ID.

To commence the setup process, click on the Settings icon in the bottom-left of your Parallels Management Portal page, switch to the Integrations tab, locate the Azure Storage card in the Storage Providers section, and click Connect, launching the integration setup wizard.

The setup wizard guides you through four sequential steps: granting admin consent, assigning storage roles, configuring CORS, and verifying access to a specific container.

Each step must be completed before the next one becomes available, and your progress is saved automatically, enabling you to close the wizard and return later.

Step 1: Granting admin consent

In this first step, you authorize Parallels Desktop as a third-party application in your Entra ID tenant. This is a one-time action per tenant, not per container.

1. Click Authorize via Microsoft. You'll be redirected to a standard Microsoft sign-in screen.

2. Sign in with an account that has permissions to grant admin consent in your tenant.

3. Review the requested permissions and click Accept.

When Microsoft redirects you back to the Portal, Step 1 is marked complete and Step 2 becomes active. If authorization fails or is cancelled, the wizard shows an inline error, and you can retry. If the failure is persistent, check with your Entra tenant's designated administrator, as admin consent is sometimes restricted to specific accounts by policy.

Step 2: Assign storage roles

For Parallels Desktop to read files from your container and to mint download links on the fly, two Azure roles must be assigned to the Parallels Desktop application: Storage Blob Delegator and Storage Blob Data Reader. Each is assigned at a different level of your Azure resource hierarchy.

1. Click Assign in Azure Storage to open the Azure Storage center, which lists all storage accounts in your subscription. Open the storage account you plan to use for Golden Image distribution.

2. Assign Storage Blob Delegator at the storage account level:

   1. From the storage account sidebar (without navigating into any specific container), open Access control (IAM).

   2. Click + Add > Add role assignment.

      
   3. Search for Storage Blob Delegator and select it. Click Next.

      
   4. Click + Select members, find and select Parallels Desktop, then click Select and Next.

      
   5. Click Review + assign.

3. Assign Storage Blob Data Reader at the container level:

   1. From the storage account, navigate into the specific container you plan to use.

   2. From the container sidebar, open Access control (IAM).

   3. Click + Add > Add role assignment.

   4. Search for Storage Blob Data Reader and select it. Click Next.

   5. Click + Select members, find and select Parallels Desktop, then click Select and Next.

   6. Click Review + assign.

Note: Azure role assignments can take up to 30 minutes to propagate. If verification in Step 4 fails immediately after assigning roles, wait a few minutes and try again before troubleshooting elsewhere.

When both roles are assigned, return to the wizard and click Mark as complete.

Step 3: Configure CORS

This step allows your browser, while you're signed in to Parallels Management Portal, to list files in your container — for example, when you're picking a file to attach to a golden image record. Without a CORS rule, file selection from the Portal UI won't work, although end-user downloads to Parallels Desktop will still function.

To add the CORS rule, click Configure in Azure Storage. This opens the Azure Storage center; select the storage account you're using for the integration, then navigate to Settings > Resource sharing (CORS) and in the Blob service tab add a new rule with the following values:

1. Allowed origins: https://desktopadmin.parallels.com

2. Allowed methods: GET

3. Max age: 86400

Save the rule, then return to the wizard and click Mark as complete.

Step 4: Verify access to a container

In the final step, you point Parallels Management Portal at a specific container and confirm that everything is wired up correctly.

1. Container link: The full URL of the container, e.g., https://yourstorage.blob.core.windows.net/golden-images. You can find this URL in your Azure portal by navigating to the container and copying the URL from its Properties page.

2. [OPTIONAL] Container name: A friendly name for this container as shown in the Portal, e.g., Windows 11 images for accountants. If left empty, the name will be taken from the provided container URL.

3. Click Verify Configuration.

The verification probes the container with the credentials and permissions you set up in the previous steps. If everything checks out, the integration is set to active and you can start using it. Otherwise, the wizard returns you to the relevant earlier step with an explanation of what went wrong — missing roles send you back to Step 2, an incorrect CORS rule to Step 3, and an authorization problem to Step 1.

Once the integration is active, the Azure Storage card in the Integrations tab shows the connected container and the time of the most recent successful verification.

Using a connected container

With the integration active, you can browse your container directly when creating or editing a Golden Image record.

1. In the Golden Image record, locate the Image file field.

2. Click Browse storage. The Portal opens a file picker scoped to your connected container.

3. Select the appropriate file.

4. Supply the SHA-256 checksum of the file. The Portal does not compute checksums for you; the value should match what your build pipeline records when the file is uploaded to the container.

5. Save the Golden Image record.

When an end user's Parallels Desktop downloads this golden image, it requests a short-lived signed download URL for the specific file from the Portal. The Portal issues the URL only if the user's copy of Parallels Desktop is activated with your company's license. The user is never prompted to sign in, never provides credentials, and never sees the storage URL.

Managing the integration

You can manage your integration at any time under Settings > Integrations > Azure Storage > Manage. You can do one of the following things:

• Rename a container to give it a friendlier display name in the Portal. The change is internal to the Portal and does not affect the container in Azure.

• Remove a container to disconnect it from the Portal.

Note: Once you remove a container, the Portal can no longer issue download links for files in it, so any Golden Images referencing those files become unavailable for new deployments. Reconnect the container or move the files elsewhere to restore availability. Downloads already in progress continue until their existing download link expires.

• Reset the integration to fully disconnect Parallels Management Portal from your Azure tenant. This deletes the container record and the file references on the Portal side.

Attention: Resetting the integration on the Portal side does not affect your Azure tenant. To complete the disconnection cleanly and avoid leaving behind orphaned role assignments, perform the following in your Azure portal, in this order:

1. Remove the Storage Blob Data Reader role assignment from the container's Access control (IAM).

2. Remove the Storage Blob Delegator role assignment from the storage account's Access control (IAM).

3. Remove Parallels Desktop from Microsoft Entra ID > Enterprise Applications.