Configuring the prerequisites
To connect your Azure subscription to Parallels DaaS, you need to complete several preliminary steps.
You can do this in two ways:
(Recommended) By using a script provided by Parallels
Before you begin
Before configuring prerequisites, make sure that you have the right to create a Standard B1ms instance in your Azure region and subscription.
To configure the prerequisites using a script
To configure prerequisites using a script:
Download the PowerShell script from https://github.com/Parallels/Parallels-DaaS.
Log in to Microsoft Azure with an account with the Owner role in your subscription and the Global Administrator role in Microsoft Entra ID. Make sure that MFA for this account is enabled.
Launch the PowerShell script in PowerShell version 7.3 or later.
The script checks which Azure tenants you have access to. Select the Azure Tenant you want to use.
The script checks which Azure subscriptions you have access to. select the Azure Subscription you want to use.
The script checks which regions you are able to deploy the resources in. Select the location you want to use.
Provide the name of the application you want to create.
Provide the name of the resource group that will be used for all infrastructure-related resources.
Provide the name of the resource group that will be used for all virtual machines.
(Optional) Provide the name of the Azure Key Vault to create. The App Registration secret will be safely stored in this Azure Key Vault. This name needs to be unique in Azure globally.
Log in to the Microsoft Azure portal.
Open the portal menu and select Microsoft Entra ID.
On the left pane, select App registrations.
Select your application and on the left pane, select API permissions.
Click the Grant admin consent button and then Yes.
Upon completion, all prerequisites will be installed, and the script will output the parameters that you can easily copy to the Azure Subscription wizard.
Next, you need to connect your Microsoft Azure subscription.
To configure the prerequisites manually
To configure prerequisites manually, you need to go through several steps.
Step 1. Create a Microsoft Entra ID application
Log in to the Microsoft Azure portal.
Open the portal menu and select Microsoft Entra ID.
On the left pane, select App registrations.
Click New registration (at the top of the right pane). The Register an application blade opens.
In the Name field, type the name you want to use for the application.
In the Redirect URI section, make sure that Web is selected in the drop-down list and add the following URI.
Click Register (at the bottom left).
The new Microsoft Entra ID app is created, and its blade is displayed in the portal. Make a note of the application (client) ID once the registration is completed.
On the left pane, select Authentication
In the Web Redirect URIs section add the following URI:
Scroll down and enable "ID tokens (used for implicit and hybrid flows)"
Step 2. Add custom roles to Azure subscription
In the Azure portal menu, select Subscriptions.
In the left pane, select Access control (IAM).
Click Add and select Add custom role.
Enter Daas Role Assignment as the name of the custom role and Allows to add and delete role assignments as the description.
Select Clone a role and choose the Virtual Machine Contributor role.
In the Permissions tab, clear all permissions and select only the following two permissions:
Microsoft.Authorization/roleAssignments/write
Microsoft.Authorization/roleAssignments/delete
In the Assignable scopes tab, clear all scopes and select only your subscription as the assignable scope.
On the Review + create tab, confirm that the configuration is correct and click Review + create.
Go back to Access control (IAM).
Click Add and select Add role assignment.
In the Privileged administrator roles tab, select the Daas Role Assignment role.
In the Members tab, select the Microsoft Entra ID application created in Step 1.
In the Conditions tab, select Allow user to assign all roles (highly privileged).
On the Review + assign tab, confirm that the configuration is correct and click Review + assign.
Step 3. Assign Required Permissions to the Microsoft Entra ID application
Select your application and on the left pane, select API permissions.
Click Add a permission.
Click the Microsoft Graph card.
Click the Application permissions card.
Select the following permissions:
Domain.Read.All
GroupMember.Read.All
User.Read.All
Click Add a permission.
Click the Microsoft Graph card.
Click the Delegated permissions card.
Select the following permissions:
openid
email
profile
Click Add permissions.
Click Grant admin consent for...
Confirm you want to grant admin consent by clicking Yes.
Step 4. Configure a token
Select your application and on the left pane, select Token configuration.
Click Add optional claim.
In the Token type section, select ID.
Select email and upn.
Click Add.
Click Add groups claim.
Select Security groups.
Click Add.
Step 5. Create a client secret for the Microsoft Entra ID application
If you are not on the application page anymore, navigate to it from the Home page by selecting Microsoft Entra ID > App registration and then clicking the app in the right pane.
In the left pane, click Certificates & secrets.
In the right pane, click New client secret.
Type a client name and select a desired expiration option.
Click Add. The new client secret appears in the Client secrets list.
Warning: Copy and save the client secret (the Value column). If you leave this page without copying the secret, it will be hidden and you will not be able to retrieve it later.
Step 6. Assign Contributor Role to the Microsoft Entra ID application
In the Azure portal menu, select Subscriptions.
In the left pane, select Access control (IAM).
Click Add and select Add role assignment.
Choose Contributor as the role and search for your application by name.
Select the application you created as a member.
Save the assignment.
Step 7. Create Azure resource groups
In the Azure portal menu, select Resource groups.
Create a resource group for the Parallels DaaS Infrastructure (e.g. Parallels_DaaS_Infra) in the region of your choice.
Create a resource group for the Parallels DaaS virtual machines (e.g. Parallels_DaaS_VMs) in the region of your choice.
Make a note of the names of these resource groups.
Step 8. Set rights for the resource groups
In the Azure portal menu, select Resource groups.
Click a resource group where the infrastructure resources will reside.
In the left pane, select Access control (IAM).
In the right pane, locate the Grant access to this resource box and click Add role assignment.
On the Role tab of the Add role assignment page, select Privileged administrator roles, then the Contributor role.
Click Next.
On the Members tab, select the User, group, or service principal option.
Click on the Select members link and enter the name of the previously created application in the Select field. Select the application in the drop-down list and click Select.
Click Next.
On the Review + assign tab, confirm that the configuration is correct and click Review + assign.
Perform the same steps for the virtual machines resource group.
Step 9. Save settings for future use
Save the following information for use in the Parallels DaaS Management Portal setup:
Azure Tenant ID
Azure Subscription ID
Application (client) ID
Infrastructure resource group name
Virtual machines resource group name
Make sure to securely store the client secret and other sensitive information.
Next, you need to connect your Microsoft Azure subscription.
Last updated