Enabling user access
Before users can sign in to the session hosts within the Azure AD-joined host pool, you must configure the required permission using Role-Based Access Control (RBAC). First, we need to add the required users and Azure AD groups to the host pool default desktop application group. We also need to add the Virtual Machine User Login RBAC role.
Important Note
The Virtual Machine User Login RBAC role is not an Azure Virtual Desktop role. This is required to enable access to sign in to a VM. The Azure role enables logon by applying the DataAction permission.
Depending on your requirements and host pool deployment, you may want to review the scope for this role. For example, assigning an Azure AD group at the resource group level may make more sense than assigning the RBAC role for each user per VM.
Important Note
It is not advised to set the Virtual Machine User Login RBAC role at the subscription level; you would essentially give all assigned users the...