Skip to content

Commit beb69f3

Browse files
author
Angela Fleischmann
authored
Merge pull request #8591 from ErikjeMS/win365gccD
41357190 - gcc config tenant
2 parents ecf836f + 8585cda commit beb69f3

2 files changed

Lines changed: 132 additions & 0 deletions

File tree

‎windows-365/enterprise/TOC.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,10 @@ items:
8383
href: add-device-images.md
8484
- name: Convert image to Gen 2
8585
href: device-images-convert-generation-2.md
86+
- name: Prepare for Windows 365 Government
87+
items:
88+
- name: Set up tenants for Windows 365 Government
89+
href: set-up-tenants-windows-365-gcc.md
8690
- name: Provisioning
8791
items:
8892
- name: Create and assign provisioning policy

‎windows-365/enterprise/set-up-tenants-windows-365-gcc.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
# required metadata
3+
title: Set up tenants for Windows 365 Government
4+
titleSuffix:
5+
description: Learn how to set up tenants for Windows 365 Government.
6+
keywords:
7+
author: ErikjeMS
8+
ms.author: erikje
9+
manager: dougeby
10+
ms.date: 10/3/2022
11+
ms.topic: overview
12+
ms.service: cloudpc
13+
ms.subservice:
14+
ms.localizationpriority: high
15+
ms.technology:
16+
ms.assetid:
17+
18+
# optional metadata
19+
20+
#ROBOTS:
21+
#audience:
22+
23+
ms.reviewer:
24+
ms.suite: ems
25+
search.appverid: MET150
26+
#ms.tgt_pltfrm:
27+
ms.custom: intune-azure; get-started
28+
ms.collection: M365-identity-device-management
29+
---
30+
31+
# Set up tenants for Windows 365 Government
32+
33+
For Windows 365 to function in the Government Community Cloud (GCC) environment, customers must prepare one commercial Azure domain (.com) tenant with an onmicrosoft.com address. If you want to use configuration options described in this article, you must also prepare one Azure Government domain (.us) tenant with an onmicosoft.us address.
34+
35+
## Commercial Azure tenant (.com)
36+
37+
The commercial Azure tenant includes:
38+
39+
- Windows 365 subscription.
40+
- Enterprise Mobility + Security (EMS)/Microsoft Endpoint Manager subscription.
41+
- Azure Active Directory (Azure AD) information such as Users and Groups.
42+
43+
## Azure government tenant (.us)
44+
45+
The Azure Government tenant includes Microsoft Azure subscription and associated services, such as:
46+
47+
- Azure Virtual Network (vNet).
48+
- Azure ExpressRoute connections.
49+
- Other Azure Resources, including Cloud PC resources.
50+
51+
>[!NOTE]
52+
> While the GCC users' Cloud PCs are hosted and secured in the Azure Government cloud, the admin and end user experience is similar to the commercial business uer experience. This is because the endpoints for admins and end users are in the commercial Azure domain.
53+
54+
## Azure AD options
55+
56+
If you want to use Azure AD join or hybrid Azure AD join, consider these preparations:
57+
58+
**Azure AD joined Cloud PCs**: If you want to use an Azure AD join infrastructure and your own network, you'll need a tenant and Azure subscription in the Azure Government cloud. The tenant in the Azure commercial .com domain must be mapped to the tenant in the Azure Government .us domain.
59+
60+
**Hybrid Azure AD joined Cloud PCs**: If you want to use a hybrid Azure AD join infrastructure, you'll need to configure your commercial (.com) tenant and your government (.us) tenants before creating your Azure Virtual Networks.
61+
62+
## Map the commercial and government tenants
63+
64+
To connect the two tenants, the TenantMapping.ps1 PowerShell script must be run. This script will give admins either or both of the following abilities:
65+
66+
- Upload custom images for use with Windows 365 Government Cloud PCs.
67+
- Define Azure Network Connections so that the Windows 365 Government Cloud PCs can access on-premises or Microsoft-hosted resources.
68+
69+
1. Find the following information. It will be used later in these steps.
70+
- [Commercial Azure tenant ID](/azure/active-directory/fundamentals/active-directory-how-to-find-tenant).
71+
- Commercial Azure Global administrator user name and password.
72+
- [Azure Government tenant ID](/azure/active-directory/fundamentals/active-directory-how-to-find-tenant).
73+
- Azure Government Global administrator credentials user name and password.
74+
2. Make sure you have Windows PowerShell version 5.1. Other versions may result in errors when running the script.
75+
3. Go to the [Windows 365 PowerShell GitHub repository](https://github.com/microsoft/Windows365-PSScripts).
76+
4. Navigate to the **Windows 365 GCC** folder > right-click **TenantMapping.ps1** > **Save link as** > save the file to a location on your computer.
77+
5. Open Windows PowerShell 5.1 and run the PowerShell script.
78+
>[!NOTE]
79+
>If the script was previously run successfully, you'll see the error **HttpStatusCode Conflict**. This warning can be ignored to execute the script functions Add and Get.
80+
6. In PowerShell 5.1, type **I** to initiate tenant mapping.
81+
7. After the Initialization completes, type **A** at the prompt. When prompted, type the following information:
82+
- Your Commercial tenant ID, which can be found here: https://portal.azure.com/.
83+
- Your Azure Government tenant ID, which can be found here: https://portal.azure.us/.
84+
8. When prompted, press Enter to open a web browser and enter your user name and password for your commercial tenant ([email protected]).
85+
9. When prompted, press Enter to open a web browser and enter your credentials for your Azure Government tenant ([email protected]).
86+
10. After the mapping completes, you'll see **Added tenant mapping successfully!**
87+
88+
## Set permissions to upload custom images
89+
90+
If you're going to use Gallery images to provision Cloud PCs using the Microsoft-hosted network, no further configurations are required.
91+
92+
Extra steps are needed to upload custom images on the Microsoft-hosted network. In this case, follow these steps before uploading your custom image:
93+
94+
1. Make sure you've already run the TenantMapping.ps script above to connect the Government cloud and Commercial cloud.
95+
2. Make sure you have both commercial and government credentials.
96+
3. Go to the [Windows 365 PowerShell GitHub repository](https://github.com/microsoft/Windows365-PSScripts).
97+
4. Navigate to the **Windows 365 GCC** folder > right click **GrantSPRolesInTenant.ps1** > **Save link as** > save the file to a location on your computer.
98+
5. Run the PowerShell script.
99+
6. For Azure AD join infrastructures, you don't need to enable permissions for creating ANC just to upload custom images. Therefore, at the prompt, type **1** to enable custom image uploads.
100+
7. For hybrid Azure AD join infrastructures, creating ANCs is a requirement for uploading custom images. Therefore, at the prompt, type **3**.
101+
102+
## Set permissions to connect to on-premises resources
103+
104+
When provisioning Windows 365 Cloud PCs without the Microsoft-hosted network, you must define an [Azure Network Connection](azure-network-connections.md) (ANC) that the Cloud PCs will use to connect with other resources, including your on-premises infrastructure. To grant permissions for admins to create ANCs in the Government cloud, follow these steps:
105+
106+
1. Gather the following information. It will be used later in these steps.
107+
- Commercial Azure tenant ID.
108+
- Commercial Azure Global administrator username and password.
109+
- Azure Government tenant ID.
110+
- Azure Government Global administrator credentials username and password.
111+
- Subscription in the Azure Government tenant.
112+
- Resource Group in the Azure Government tenant.
113+
- Virtual Network in the Azure Government tenant.
114+
2. Make sure you have Windows PowerShell version 5.1. Other versions may result in errors when running the script.
115+
3. Go to the [Windows 365 PowerShell GitHub repository](https://github.com/microsoft/Windows365-PSScripts).
116+
4. Navigate to the **Windows 365 GCC** folder > right-click **GrantSPRolesInTenant.ps1** > **Save link as** > save the file to a location on your computer.
117+
5. Open Windows PowerShell 5.1 and run the PowerShell script. First step is to sign in to your Azure Government cloud tenant.
118+
6. At the prompt, type one of the following options:
119+
- **2** to grant permissions to create ANCs.
120+
- **3** to grant permissions to create ANCs and upload custom images.
121+
7. The script lists the subscriptions available for the Azure Government cloud tenant. Select the subscription that you want to grant permissions to.
122+
8. The resource groups for that subscription are listed. Select the group that you want to use.
123+
9. Select your vNet.
124+
10. The script grants the permissions and lists what was configured.
125+
126+
## Next steps
127+
128+
[Learn more about Windows 365 Government](introduction-windows-365-government.md)

0 commit comments

Comments
 (0)