avd-opsavd-landing-zone
Personal project. Research and learning only. Not for production. No warranty.
- Built on my own time for research and learning. Not affiliated with, endorsed by or supported by my employer or Microsoft.
- Don't run any of it in production or against tenants that matter. Test in a dedicated lab subscription and tenant first.
- Provided "as is", without warranty of any kind, under each repo's license. You use it at your own risk and own the Azure charges it incurs.
- Contributions and forks are welcome and encouraged. See Contribute.
How it's built and changed from here. An Azure Virtual Desktop landing zone for cloud-native organizations: Entra ID-joined, Intune-managed, private by default, deployed end to end from one Bicep template.
The repo is the source of truth: nickprignano/avd-landing-zone. This page says where it fits.
What it does
- No domain controllers, no line of sight to on-premises, no post-deployment scripts.
- FSLogix on Premium Azure Files with Entra Kerberos and no storage keys; session hosts on Trusted Launch with encryption at host.
- No default outbound access, AVD Private Link, Azure Policy, Defender for Cloud and a budget that switches hosts off when it runs out.
- A deployment portal in the browser that sizes the host pool and walks you through Cloud Shell, one pasted output at a time.
How it fits
- With avd-current-state it forms a self-contained pair that never depends on the layer on top.
- Can read a C14 target-state manifest from avd-second-brain when one exists, and works without one.
- Its lessons are recorded in avd-second-brain's knowledge base.