An Azure Virtual Desktop landing zone for cloud-native organizations: Entra ID-joined, Intune-managed, private by default, deployed end to end from one Bicep template.
Built
Personal project. Research and learning only. Not for production. No warranty.
Built on my own time for research and learning. Not affiliated with, endorsed by or supported by my employer, Liquidware or Microsoft.
Don't run any of it in production or against tenants that matter. Test in a dedicated lab subscription and tenant first.
Provided "as is", without warranty of any kind, under each repo's license. You use it at your own risk and own the Azure charges it incurs.
Contributions and forks are welcome and encouraged. See Contribute.
What it does
One opinionated path: no domain controllers, no line of sight to on-premises, no post-deployment scripts.
FSLogix on Premium Azure Files with Entra Kerberos and no storage keys; session hosts on Trusted Launch with encryption at host.
No default outbound access, AVD Private Link, Azure Policy, Defender for Cloud and a budget that switches hosts off when it runs out.
Strict Bicep linting, PSScriptAnalyzer, PSRule for Azure and what-if on every pull request; deploys through an environment-gated workflow.
A deployment portal in the browser that sizes the host pool and walks you through Cloud Shell, one pasted output at a time.