Microsoft Entra ID Conditional Access What If

Microsoft Entra ID Conditional Access What If

An underrated feature of Entra ID Conditional Access is the What If tool. The Conditional Access What If tool can help you troubleshoot or design Conditional Access policies.

Typically, when building a Conditional Access policy, you target a test user and then expand testing using report-only mode. Testing can be difficult if the workflow is complex or uncommon. Fortunately, the Conditional Access What If tool lets you simulate logins and policy impacts to test or troubleshoot without logging in multiple times or waiting for changes to propagate and the Entra sign-in logs to populate.

In this post, I will show you step by step how to use the Conditional Access What If tool.

The Process

  • Login to the Microsoft Entra admin center.
  • Click on Entra ID > Conditional Access.
  • Click on Policies.
  • Click on What if.
  • Now we need to configure all the settings for the What If tool.
  • For identity type, select whether to test Users, Guest or external users, Workload identities, or Agent identities.

In my example, I will select Users.

  • Select the identity to simulate a login for.

Depending on which identity type you selected, your options will differ.

In my example, I will select my user account.

…

Read More Read More

Microsoft Entra ID Conditional Access

Microsoft Entra ID Conditional Access

Microsoft Entra ID (formerly Azure AD) has an awesome feature called Conditional Access that can add an extra layer of security to your Microsoft 365 tenant. The power of Conditional Access really shines when you position Entra as your IdP (Identity Provider). Conditional Access is one of my favorite features in Entra.

To use Conditional Access policies, you need an Entra ID P1 or P2 license. Without one, your tenant likely has Security Defaults enabled. Security Defaults is a basic version of Conditional Access that does not allow any customizations. It provides protections, such as requiring all users to register for MFA and prompting for MFA when Microsoft deems it necessary.

The power of Conditional Access is that it lets you use identity signals such as user, location, application, and device, to name a few, and make decisions based on those signals, such as allowing or denying access or requiring additional verification.

Conditional Access processes policies using if-then conditions (not top-to-bottom like a firewall). Conditional Access policies take effect after first-factor authentication is completed (such as entering a valid password).

The best way I’ve found to think about Conditional Access is to compare it to airport security when traveling from Canada to the United States. Before you can board your flight, you need to clear security. If we wrote this as a conditional access policy, it would be: if the user is logging in, then MFA is required.

When traveling to the United States from Canada, you complete customs pre-clearance before boarding your flight. After clearing security, you have to clear U.S. customs. Customs checks whether you have a valid passport and whether you pose a risk to the country. You could technically say that to access customs, you need to clear security and have a valid passport. If we wrote this as a conditional access policy, it would be: if a user wants to log in to the VPN portal, then MFA and a compliant device are required. Since the user just performed MFA, the policy won’t prompt for MFA again, and as long as the device is compliant, it allows the user to log in to the VPN portal. At a high level, that’s how Conditional Access policies work.

Here are a few tips when creating and using Conditional Access policies:

…

Read More Read More

Configure VCF Installer Online Depot

Configure VCF Installer Online Depot

Once you have deployed the VCF Installer, you need to configure a depot connection to access the binaries needed to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation).

In this post, I will show you step by step how to configure an online depot connection for the VCF Installer and download the binaries for VCF or VVF.

Before VCF 9.1, you configured the VCF Installer online depot connection using a download token. In VCF 9.1, the process has changed. You now need to register the VCF Installer in the VCF licensing portal.

Prerequisites

  • VCF Installer deployed.

If you need to learn how, my blog post Deploy VCF Installer details the steps.

  • Internet access on the VCF Installer appliance.

A list of URLs that the VCF Installer needs access to is available from Broadcom here.

The Process

  • Login to the VCF Installer as the admin@local user.
  • In the Get Started section, in the Download Binaries tile, click on Depot Settings and Binary Management.
  • In the Online Depot tile, click on Configure.
  • Copy your Download Service ID.
  • Click on Software Depot Registration.
…

Read More Read More

Deploy VCF Installer

Deploy VCF Installer

When you want to deploy VCF (VMware Cloud Foundation) or VVF (VMware vSphere Foundation), you typically use the VCF installer. Even though the VCF installer has VCF in its name, it can be used to deploy VVF.

In this post, I will show you step by step how to deploy the VCF installer on VMware ESX.

Prerequisites

  • Static IP for the VCF Installer appliance.
  • FQDN for the VCF Installer appliance with forward and reverse DNS records.
  • Enough resources to run the VCF Installer VM.
    • The VCF Installer VM will need:
      • 4 vCPU
      • 16GB RAM
      • 914GB disk space
  • A root password for the VCF Installer appliance.
  • A local user password for the VCF Installer appliance.
  • NTP Servers.

The Process

The entire VCF Installer deployment process is divided into two sections.

Download VCF Installer

Before we can deploy the VCF Installer, we need to download it first.

  • Click on Software > VMware Cloud Foundation > My Downloads.
  • Click on VMware Cloud Foundation or VMware vSphere Foundation.
  • Click VMware Cloud Foundation 9 or VMware vSphere Foundation 9 to expand the releases, then click the release you want.
  • Beside VCF Installer click on View Group.
  • Before you can download anything, you need to read and review the Terms and Conditions and the Compliance Reporting Terms and Conditions.
  • Click on Terms and Conditions to read them.
  • Click on Compliance Reporting Terms and Conditions to read them.
  • After reading, if you agree to the Terms and Conditions and the Compliance Reporting Terms and Conditions, select I agree.
  • Download the VCF SDDC Manager Appliance OVA.

Technically, you are downloading the VCF SDDC (Software Defined Datacenter) Manager.

The SDDC Manager has two purposes:

  1. The VCF Installer for VCF and VVF
  2. The SDDC Manager for VCF.
    • If you deploy the VCF Installer on an ESX host that will be part of your VCF management domain, the VCF Installer will convert into your SDDC Manager.

Deploy VCF Installer

Now that we have the VCF Installer downloaded, we can deploy it.

If you deploy the VCF Installer to an ESX host that will be used for the VCF Management Domain, it will convert to the SDDC Manager and can no longer be used as an installer.

  • To use the VCF Installer, you need to deploy it to something. The following are supported:
    • VMware vCenter
    • VMware ESX
    • VMware Workstation
    • VMware Fusion

In my example, I will deploy the VCF Installer to an ESX host. The process will be similar on other platforms.

  • Login to VMware ESX.
…

Read More Read More

I’m Going to VMware Explore 2026

I’m Going to VMware Explore 2026

I’m super excited that I can attend VMware Explore in Las Vegas this year. The last time I attended VMware Explore was in 2024, and I learned so much. I’m eager to learn even more this year and build on what I’ve learned since last time.

If you want to read about my experience at VMware Explore 2024, check out my blog post I Went to VMware Explore 2024.

If you aren’t familiar with VMware Explore, it used to be called VMworld. VMware Explore is a conference hosted by Broadcom about all things VMware. The main VMware Explore event takes place in Las Vegas, and there’s a smaller version called VMware Explore on Tour, which visits a few different cities. In 2026, VMware Explore on Tour will be at the following locations.

  • Mumbai (September 29th to 30th)
  • Singapore (October 1st to 2nd)
  • Frankfurt (October 13th to 14th)
  • Tokyo (October 20th to 21st)
  • London (November 18th to 19th)
  • Washington, D.C. (December 8th)

VMware Explore in Las Vegas will take place from August 31st to September 3rd.

At VMware Explore in Las Vegas, there are over 250 sessions. Thankfully, the sessions are recorded, as it’s impossible to attend all of them. Here are a few of the sessions I’m planning to attend.

…

Read More Read More

Passing VCP-VCF Architect Exam

Passing VCP-VCF Architect Exam

I recently passed the VCP-VCF Architect exam, specifically the 2V0-13.25 version, and I want to share my experience with the VMware Certified Professional – VMware Cloud Foundation Architect exam.

My VMware Certified Professional – VMware Cloud Foundation Architect Certification

In this post, I will share my experience taking the VCP-VCF Architect exam and studying tips.

Exam Details

The VMware Cloud Foundation Architect 2V0-13.25 exam contains 60 multiple-choice questions, and you have 135 minutes to complete the exam. You need a score of 300 points or higher to pass the exam. The exam may contain unscored questions (you won’t know which questions are unscored).

During the exam, you can flag questions you are unsure about for review, so you can circle back to them before submitting the exam for grading. To help narrow down your choices, you can right-click an answer to add a strikethrough.

The 60 questions you get are pulled from a pool of questions, meaning if two people take the exam, they may not have the same questions.

Studying

The way I prepared for the VCF Architect exam was a bit different from how I prepared for the VCF Admin exam. There was a weekly study session, but unfortunately, there was only one session. The study session was recorded and posted to YouTube. Here is the YouTube playlist of the VCF Architect exam study session.

There’s also an exam guide published by Broadcom, you can find the official exam guide here. The study session covers sections 1 and 2 from the exam guide. I found that the study session was fundamental for preparing me for the exam.

…

Read More Read More

Deploy Horizon Edge Gateway on VMware vSphere

Deploy Horizon Edge Gateway on VMware vSphere

If you have an Omnissa Horizon subscription, you should deploy the Horizon Edge gateway appliance to license your Omnissa Horizon setup.

The Horizon Edge Gateway for vSphere is a VM that you deploy on your VMware vSphere environment. In addition to automatically licensing your Horizon setup, the Horizon Edge gateway also serves as a connector to the Horizon Control Plane hosted by Omnissa, enabling Omnissa and you to monitor your Horizon setup for issues. In older versions of Horizon, the Edge Gateway was called the Cloud Connector.

In this post, I will show you step by step how to deploy the Omnissa Horizon Edge Gateway on VMware vSphere.

Prerequisites

  • Static IP for the Horizon Edge Gateway appliance.
  • FQDN for the Horizon Edge Gateway appliance with forward and reverse DNS records.
  • Enough resources in vSphere for the Edge Gateway VM.
    • The Edge Gateway will need
      • 8 vCPU
      • 16GB RAM
      • 40GB disk
  • A Root password for the Horizon Edge Gateway appliance.
  • An Admin password for the Horizon Edge Gateway appliance.
  • Service Account configured as an admin in Horizon.

If you need to add the service account as an admin to Horizon, my blog post, Add Administrators to Omnissa Horizon covers how to do so.

The Process

  • Under the Launch Services section, click Horizon Cloud.
  • In the Get Started section, in the Horizon 8 tile, click Select.
  • In the Horizon Edge tile, click Start Deployment.
…

Read More Read More

Schedule VMware Exam

Schedule VMware Exam

In this post, I will show you step by step how to schedule a VMware exam.

The Process

The entire process is split into a few stages.

Testing Portal Login

  • In the Additional Resources section, on the Education Portal tile, click Explore.
  • On the new page that opened up under the Addition Resources section, click on Certification.

If you want, you can skip those clicks and go directly to the following URL https://cp.certmetrics.com/vmware/en/home/dashboard

  • Under Features, click on Schedule your exam.
  • Click on SSO to Vue.

Private Access Codes

If you are taking a VMware exam at a conference, you will likely have a private access code to access the on-site exam center.

  • Click Private Access Code, type in the Private Access Code, then click Enter.

Exam Selection

  • Click on View exams.
  • Depending on the exam you are taking, you may need to click on VMware Professional Level Exams or VMware Advanced Level Exams. You can also search for the exam.
…

Read More Read More

Deploy Claude Desktop on Non-Persistent VDI

Deploy Claude Desktop on Non-Persistent VDI

In this post, I will show you step by step how to deploy Claude Desktop on Non-Persistent VDI.

The Process

The entire setup is split into a few stages.

Install Claude Desktop

To deploy Claude Desktop for Non-Persistent VDI, you need to use the Claude Desktop MSIX.

Add-AppxProvisionedPackage -Online -PackagePath "Claude.msix" -SkipLicense -Regions "all"Code language: PowerShell (powershell)

Now, when a user uses the updated non-persistent VDI desktop, Claude Desktop will be installed.

Disable Claude Desktop Updates

Claude Desktop gets updates very frequently, but you do not need to install them right away. Fortunately, Anthropic provides a way to disable updates on Claude Desktop. It’s also recommended to disable application auto-updates when used on non-persistent VDI.

  • Create the following registry key HKLM:\SOFTWARE\Policies\Claude
  • Create a DWORD named disableAutoUpdates with the value of 1
Registry setting to disable Claude Desktop updates.

When you launch Claude Desktop, it will no longer automatically check for updates, and the option to check for updates will be disabled.

Claude Desktop with updates disabled.

Manually Update Claude Desktop

When you want to update Claude Desktop on your non-persistent VDI gold image, you need to remove it first.

  • Run the following PowerShell command to remove the Claude Desktop MSIX deployment.
Get-AppxProvisionedPackage -online | where DisplayName -like *Claude* | Remove-AppxProvisionedPackage -OnlineCode language: PowerShell (powershell)
  • Run the following PowerShell command to remove the Claude Desktop MSIX installation.
Get-AppxPackage *Claude* -allusers | Remove-AppxPackage -allusersCode language: PowerShell (powershell)
  • Now you can download the updated MSIX from Claude and install the new version using the same process as Install Claude Desktop.

Claude Desktop User Settings Capture

When a user launches Claude Desktop for the first time, their settings are stored in the MSIX redirected location %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude and %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude-3p

Claude Desktop saving user settings to LocalAppData LocalCache.

Depending on how you capture the user’s AppData, the default MSIX redirected location can cause issues. Solutions such as FSLogix ignore the %LOCALAPPDATA%\Packages\*\LocalCache folders regardless of your configuration.

…

Read More Read More