Create Your First Golden Image

Build your first Azure Virtual Desktop golden image with Atlas AVD: prepare a source VM, create a Compute Gallery and image definition, and more.

Before you begin

  • A connected Azure subscription
  • An Atlas AVD administrator account: creating a Compute Gallery and an image definition is limited to administrators, and creating a gallery also needs the Compute Gallery create permission
  • The image-swap permission to capture an image version and to change a pool's base image
  • Rights in the Azure portal to create a virtual machine in your subscription
  • Azure Bastion in the source VM's virtual network, or the Atlas Reach agent on the VM, so you can connect to it from Atlas

How the pieces fit together

Atlas stores images in Azure Compute Gallery, which has three levels. A gallery holds image definitions. An image definition describes one image (for example, Windows 11 multi-session for finance) and holds its numbered versions. Each version is one capture of your source VM: 1.0.0, then 1.0.1, and so on. A host pool deploys from a definition, either always using the latest version or pinned to a specific one.

Create one image definition per distinct desktop, not one per month. Monthly updates become new versions of the same definition, so a pool picks them up without changing its settings.

Create the source VM in Azure

Atlas captures images from a VM that already exists in your subscription. It does not deploy the source VM for you, so create it in the Azure portal (Virtual machines → Create). Use these choices so the image works well for Azure Virtual Desktop:

  • Image: Windows 11 Enterprise multi-session + Microsoft 365 Apps for a pooled desktop, or Windows 11 Enterprise for a personal one.
  • Security type: Trusted launch virtual machines, which uses a Generation 2 image. Note the generation and security type, because your image definition must match them.
  • Region: the region your host pools run in. Atlas always replicates the image to the source VM's region.
  • Networking: a virtual network that has Azure Bastion, so you can connect from Atlas. No public IP is needed.
  • Leave the VM off your domain and out of Entra ID. Session hosts are joined to the directory your host pool uses when Atlas provisions them.

Keep the source VM after you capture it. You make next month's changes on the same VM and capture a new version from it.

Install your apps and updates

Go to Imaging in the sidebar (under Workspace) and open the Edit tab. Search for the VM by name (type at least 2 characters), star it so it stays under Favorite VMs, and power it on. Use Connect to open a session through Bastion in the browser, download an RDP file, or connect with Atlas Reach. Then set the VM up the way every user's desktop should look.

  1. Install Windows updates and restart until none are pending.
  2. Install the applications every user of the pool needs, and apply machine-wide settings.
  3. Test the apps, sign out, and leave the VM running or stop it. Atlas handles either state when it captures.

Don't install the AVD agent, FSLogix or new Teams by hand. Atlas can pre-install them during the build (see Capture version 1.0.0 below), and leaving them out keeps the source VM clean for the next version.

Create a gallery and an image definition

Open the Image Gallery tab and click Create Definition. If your tenant has no gallery yet, Create Definition stays disabled until you add one: choose New gallery next to Compute Gallery and enter a Gallery Name (letters, numbers, underscores and periods only, no hyphens), Location, Resource Group and an optional Description, then click Create Gallery. Next, fill in the Create Image Definition panel:

  • Image Definition Name: a name such as win11-avd-base (letters, numbers, periods, hyphens and underscores).
  • OS Type: Windows.
  • OS State: Generalized. This matches the default Sysprep build in the next step.
  • VM Generation and Security Type: match the source VM. For a Trusted launch VM, choose Generation 2 and Trusted Launch (TPM), which are the defaults.
  • Image Identifier: a Publisher, Offer and SKU that identify the image, for example your company name, windows-11-avd and finance.

Atlas doesn't check that the definition matches the source VM. A Generalized definition expects a Sysprep build, and the generation and security type must be the same as the VM's. Get these right now, because Azure doesn't let you change them after the definition exists.

Capture version 1.0.0

Open the Create tab. Under Select Source VM & Target Image, choose the source VM and the image definition you just created. Because the definition has no versions yet, Next Version is 1.0.0. Then set the build:

  1. Build options: leave Sysprep on. Atlas generalizes a temporary copy of the VM and captures that, so your source VM is never modified. With Sysprep on you can also pre-install the AVD agent, FSLogix and new Teams.
  2. Replication Regions: the source VM's region is always included. Add every region where a host pool will deploy from this image.
  3. Replication Mode: choose Standard (Full) for any image a production pool uses. Shallow is quick, but it is for development and testing and can't deploy many hosts at once.
  4. Release Notes: optionally, note what is in this version. Notes support Markdown and stay with the version.
  5. Check the Build summary, then click Create Image.

Watch the build

The build runs in the background, so you can leave the page. Image Creation Progress shows the percentage, the status of each replication region, and a live build log, and running builds are listed under Active Image Builds. A first build usually takes from half an hour to over an hour. Deploying the temporary VM and running Sysprep take most of that, and each extra region adds replication time. When the build finishes, it shows Ready to use, and the version appears under the definition on the Image Gallery tab.

Every build is recorded on the History tab with its duration and full log. Open it first if a build fails.

Deploy session hosts from your image

Open the host pool and, under Settings in its left-hand menu, choose Compute & Deployment → Image & Size. Under Base Image, choose your new image definition. For the version, leave it on Latest to pick up each new version automatically, or pin 1.0.0. Confirm with Apply Image Change. Then click Create Host on the pool's page to deploy session hosts from the image.

If the pool has no base image yet, Create Host asks for one first and lists your gallery images under Your gallery images. The image you choose there is saved to the pool.

If something isn't where you expect

  • Imaging isn't in the sidebar: your account needs the host pool provisioning permission, and the Images module must be turned on for the tenant.
  • Create Definition is disabled: the tenant has no Compute Gallery yet. An administrator with the Compute Gallery create permission can add one with New gallery.
  • Target Image Definition says No compute galleries found for this tenant: this also appears when galleries exist but contain no image definitions. Create a definition on the Image Gallery tab, then come back.
  • Connect says No Bastion in this VM's virtual network: deploy Azure Bastion in that VNet, or install the Atlas Reach agent on the VM and connect with Atlas Reach.
  • The VM doesn't appear in search: check the subscription, resource group and status filters, and that the VM is in a subscription connected to Atlas.

Next steps