Migrate from NFA (RDS) to Nerdio Manager (AVD)

Prerequisites

Before you begin, ensure you meet the following prerequisites:

• Provision Nerdio Manager into your MSP tenant. For details, see Install Nerdio Manager.

• Review the recommended guidance in Plan for a successful NFA to Nerdio Manager migration.

• Ensure a new FSLogix profile is created for each user.

• NFA Remote Desktop Services (RDS) included SMS-based MFA, which doesn't migrate to AVD. For details, see Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access.

New to Nerdio Manager?

If you are new to Nerdio Manager, review the following articles that may help you support this new environment:

• Troubleshoot Active Directory Domain Join Errors

• Troubleshoot desktop image Sysprep errors

• Troubleshoot FSLogix profile mount errors

Part 1: Add an RDS account to Nerdio Manager

To add an account, you must have the following:

• An Entra ID login to the customer's tenant, with Global Administrator and Subscription Owner roles.

• If you are using an existing Active Directory, you need the domain name, admin username, and admin password.

To add an account, see:

• Add an Account

• Migration diagram:

  

Since you're connecting to an existing NFA account, complete the following steps as described in the corresponding sections:

• Step 1: Link to customer's Entra ID tenant

• Step 2: Networking

• Step 3: Active Directory

• Step 4: FSLogix storage

Step 1: Link to customer's Entra ID tenant

• In this step, from the Indicate your Active Directory setup dropdown, select Use existing Active Directory.

  

Step 2: Networking

In this step, provide the details of your current NFA RDS account:

• Select the region of the existing NFA account and the LAN subnet of the existing VNET.

  This will be the default subnet for new hosts.

Note: We recommend creating a new resource group (RG) for the Nerdio Manager host VMs to keep them separate from the NFA resources. However, it is acceptable to select the existing RG if you have no intention to create a new one for the Nerdio Manager resources.

Step 3: Active Directory

Provide details about the current AD DS in NFA RDS.

Step 4: FSLogix storage

In this step, you can do one of the following:

• Create a new Azure Files Premium share (Nerdio-recommended). For details, see Manage Azure Files shares.

• Provide an existing FS01 UNC share path from NFA RDS. This will be used for storing new FSLogix profiles.

For details, see FSLogix Share Permissions.

Example of creating a new Azure Files storage:

Part 2: Customize the account in Nerdio Manager and configure integrations

Complete the following steps:

• Step 1: Link the network and resource group

• Step 2: Add a desktop image

• Step 3: Create a host pool and assign users via a security group (new or existing)

• Step 4: Configure Auto-scaling

• Step 5: Install local Windows Desktop client on client workstations

Step 1: Link the network and resource group

If you did not specify the existing NFA resource group when connecting to the NFA account, you can do it in this stage.

To link the network and resource group:

1. In Nerdio Manager, at the account level, go to Settings > Azure.

2. Link the network:

   1. In the Linked networks tile, select Link.

   2. From the Select network dropdown, select your existing DMZ subnet.

3. Link the resource group:

   1. In the Linked resource groups tile, select Link.

   2. From the Select resource group dropdown, select your existing NFA resource group. This allows you to see and manage the VMs in the NFA resource group from Nerdio Manager.

Step 2: Add a desktop image

• Add a desktop image in Nerdio Manager as described in Overview of desktop images.

• For troubleshooting desktop images, see Troubleshoot desktop image Sysprep errors.

Step 3: Create a host pool and assign users via a security group (new or existing)

Next, create a host pool in Nerdio Manager as described in Overview of host pools.

For details about users and groups, see:

• Overview of Users

• Overview of Groups

Step 4: Configure Auto-scaling

You are prompted to configure Auto-scaling once the pool creation is completed. For details about configuring Auto-scaling in Nerdio Manager, see Auto-scale settings for host pools.

Step 5: Install local Windows Desktop client on client workstations

To install local Windows Desktop client on client workstations, see Use the Remote Desktop client to connect to Azure Virtual Desktop.

Part 3: Complete the migration

Follow the steps below to complete the migration.

To complete the migration:

1. Remove SafeDNS.

   Note:

   • SafeDNS was an inclusive feature of NFA and isn't available in Nerdio Manager. You need to modify current DNS settings and consider what DNS service you want to use going forward.

   • If you imported your desktop image from NFA, you may need to uninstall the SafeDNS client from the image.

   Warning: Your SafeDNS account will be deprovisioned once you transition to Nerdio Manager. Failure to follow the instructions may result in connectivity issues.

   To remove SafeDNS:

   1. From firewall:

      1. From DC01, open the DNS Manager, and then right-click DC01 and select Properties.

      2. On the Forwarders tab, select Edit and add an IP address to a public DNS server, such as Google (8.8.8.8, 8.8.4.4) or CloudFlare (1.1.1.1).

      3. In NFA, navigate to Network > Firewall.

      4. Select Add Rule.

      5. Allow outbound traffic on port 53 from any source to the IP address of the new forwarder. Specify the protocol as ANY or UDP.

         Note:

         • The default SafeDNS rule provisioned by NFA selects ANY for the protocol.

         • Don't select the TCP protocol, as it will not work.

      6. Ensure that priority is above the existing system rule titled Allow DNS to SafeDNS (use a number lower than 501).

      7. Save the rule and confirm that DNS is functioning as expected.

   2. From image(s):

      Note: The standard uninstall process requires the SafeDNS username and password.

      1. Obtain or set your SafeDNS password:

         1. In NFA, go to Settings > Security > SafeDNS.

         2. Next to Password, select Reset.

         3. In the new dialog box, copy your existing password or set a new one.

         4. Select Confirm.

            

      2. Uninstall SafeDNS from your image after import.

2. Have all users sign in once to create their new FSLogix profile containers.

   For details, see:

   • FSLogix Settings and Configuration

   • Troubleshoot FSLogix Profile Mount Errors

3. Copy existing redirected items from FS01 location into new FSLogix profile (desktop, documents, images).

   Note: If you are no longer using folder redirection, make sure to migrate user folders into the new FSLogix profile container.

4. Begin the cutover process or staged user migration(s) and break down NFA resources.

5. Remove user assignment(s) in NFA.

6. Disable Auto-scaling on NFA host pools.

   To disable Auto-scaling:

   1. In the NFA portal, navigate to Servers.

   2. Locate your host pool and from the Manage hosts menu, select Manage auto-scale.

      

   3. In the NFA portal, complete the following tasks:

      1. Shut down all old host pools.

      2. Disable Auto-scaling on all servers and personal desktops.

   4. Configure Auto-scaling on servers in Nerdio Manager. For details, see Auto-scale Settings for Servers.

7. Remove RDS resources in NFA.

   Server list:

   • RDGW01 – RDS Gateway Server

   • RDSH0”X” – RDS Session Hosts

   • RDS Collections

   • RDSCB0"X" - Collection Brokers

   • PRX01 (if Domain is only Managed)

   • Any dedicated desktops that weren’t migrated

8. Remove remaining resources in NFA and destroy the account.

   For details about post-migration cleanup, see Migrate to Nerdio Manager via automations.