KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#typescript #ai-agents #developer-tools #cli #codex #claude-code #dsh-plugin #mcp #react #agent #dsh #deepseek-harness

azure-avd-lab

★ 93 Open GitHub ↗

Learn Azure Virtual Desktop with this cost-conscious Terraform lab. Deploys a pooled Windows 11 multi-session host pool with Entra join, RemoteApps, FSLogix profiles, autoscale, Start VM on Connect, Log Analytics, diagnostics, and AVD Insights.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Azure Virtual Desktop Lab

Terraform-powered Azure Virtual Desktop lab for demos, training, and proof-of-concept work. It follows a landing-zone style layout while keeping the default deployment focused on AVD fundamentals instead of expensive perimeter services.

> [!NOTE]
> Azure costs only start when you run `terraform apply`. Keep the `lab` profile for demos and destroy the environment when you are finished.

## What You Get

| Capability | Default build | Why it matters |
| --- | --- | --- |
| Pooled host pool | 2 x Windows 11 Enterprise multi-session hosts | Real AVD pooled behavior without a large VM footprint. |
| Microsoft Entra join | No domain controllers | Modern sign-in path and lower lab complexity. |
| Desktop and RemoteApps | Desktop, Microsoft Edge, Notepad | Demonstrates both common app group patterns. |
| FSLogix profiles | Azure Files with Microsoft Entra Kerberos | Shows profile containers and roaming profile behavior. |
| Autoscale and start | Scaling plan plus Start VM on Connect | Shows AVD power management and cost controls. |
| Observability | Log Analytics, diagnostics, AVD Insights workbook | Gives the lab an operations story, not just a deployment. |
| Safety guardrails | No public IPs on hosts, Key Vault, optional policy/budget | Keeps the default lab practical and reviewable. |

No Azure Firewall, VPN Gateway, Application Gateway, AKS, Bastion, or domain controllers are deployed by default.

## Architecture At A Glance

The lab separates service, compute, storage, security, monitoring, and networking concerns:

```text
User -> AVD workspace -> Desktop or RemoteApp -> Host pool -> Session host
                                                          |
                                                          +-> FSLogix profile share
                                                          +-> AVD diagnostics
```

## Documentation

Start with the wiki-style documentation in [wiki/README.md](wiki/README.md), or use the guided docs below.

| Guide | Purpose |
| --- | --- |
| [Full lab guide](docs/full-lab-guide.md) | End-to-end walkthrough from prerequisites to destroy. |
| [Demo runbook](docs/demo-runbook.md) | A presenter-friendly script for showing the lab. |
| [Operations checklist](docs/operations-checklist.md) | Day-2 checks, cost controls, and cleanup steps. |
| [Architecture overview](wiki/architecture/overview.md) | Resource layout and design goals. |
| [Network topology](wiki/architecture/network-topology.md) | CIDRs, traffic flows, NSGs, and Private Link notes. |
| [Identity model](wiki/architecture/identity-model.md) | Entra groups, RBAC, VM sign-in, and app access. |
| [Testing guide](wiki/testing/lab-testing-guide.md) | Connectivity, crash tests, and acceptance criteria. |
| [Troubleshooting guide](wiki/troubleshooting/common-issues.md) | Common deployment, sign-in, profile, and drift fixes. |

## Guided Path

| Phase | Command or page | Outcome |
| --- | --- | --- |
| 1. Plan | [Full lab guide](docs/full-lab-guide.md) | Understand prerequisites, cost posture, and inputs. |
| 2. Configure | `terraform.tfvars` plus `environments/lab.tfvars` | Subscription, owner, region, and Entra group IDs are set. |
| 3. Deploy | `terraform apply -var-file="environments/lab.tfvars"` | AVD lab resources are created. |
| 4. Validate | `./scripts/Test-AvdLabConnectivity.ps1 -StartStoppedHosts` | Control plane, session hosts, FSLogix, and network checks pass. |
| 5. Break and recover | `./scripts/Invoke-AvdLabCrashTest.ps1 -RunChaos` | Restart, drain, deallocate/start, and recovery behavior is tested. |
| 6. Destroy | `terraform destroy -var-file="environments/lab.tfvars"` | Azure resources are removed when the lab is done. |

## Quick Start

PowerShell:

```powershell
Copy-Item terraform.tfvars.example terraform.tfvars
terraform init
terraform fmt -check -recursive
terraform validate
terraform plan -var-file="environments/lab.tfvars"
```

Bash:

```bash
cp terraform.tfvars.example terraform.tfvars
terraform init
terraform fmt -check -recursive
terraform validate
terraform plan -var-file="environments/lab.tfvars"
```

Set at least these values in `terraform.tfvars`:

```hcl
subscription_id    = "00000000-0000-0000-0000-000000000000"
owner              = "Your Name"
avd_users_group_id = "00000000-0000-0000-0000-000000000000"
```

Optional:

```hcl
avd_admins_group_id = "00000000-0000-0000-0000-000000000000"
alert_email         = "admin@example.com"
```

Leave `admin_password = ""` to generate a password and store it in Key Vault.

## Deploy

```powershell
terraform apply -var-file="environments/lab.tfvars"
```

After apply, capture the outputs:

```powershell
terraform output
```

Key outputs:

| Output | Use |
| --- | --- |
| `avd_webclient_url` | User access URL. |
| `host_pool_name` | Host pool lookup and troubleshooting. |
| `session_host_names` | VM validation and crash tests. |
| `fslogix_share_path` | Profile container location. |
| `avd_insights_workbook_id` | Monitoring workbook. |

## Validate

Run the full non-destructive health check:

```powershell
./scripts/Test-AvdLabConnectivity.ps1 -VarFile "environments/lab.tfvars" -StartStoppedHosts
```

Run a dry-run crash test:

```powershell
./scripts/Invoke-AvdLabCrashTest.ps1
```

Run live resilience tests:

```powershell
./scripts/Invoke-AvdLabCrashTest.ps1 -RunChaos -Scenario DrainHost,SingleHostRestart,AllHostsRestart,SingleHostDeallocateStart,AllHostsDeallocateStart
```

The live crash test intentionally disrupts hosts. Use it only when no one needs an active session.

## Deployment Profiles

| Profile | Purpose | Defaults |
| --- | --- | --- |
| `lab` | Lowest-friction demo | 2 x `Standard_D2s_v5`, StandardSSD, FSLogix Standard LRS, auto-shutdown on |
| `dev` | Small development profile | Same cost posture as lab, separate environment naming |
| `prod` | Production-like comparison | 4 x `Standard_D4s_v5`, Premium disks, Premium/ZRS FSLogix, governance on |

Use the [Azure Pricing Calculator](https://azure.microsoft.com/en-us/pricing/calculator/) for current pricing.

## Feature Toggles

| Flag | Default | What it adds |
| --- | --- | --- |
| `deploy_fslogix` | `true` | Azure Files profile share and SMB RBAC |
| `deploy_remote_app_group` | `true` | RemoteApp app group with demo apps |
| `deploy_scaling_plan` | `true` | Weekday AVD autoscale schedule |
| `enable_start_vm_on_connect` | `true` | Host pool Start VM on Connect |
| `deploy_monitoring` | `true` | Log Analytics, diagnostics, workbook, alerts |
| `deploy_custom_image` | `false` | Azure Compute Gallery scaffolding |
| `deploy_private_endpoints` | `false` | Private endpoints for Key Vault and Azure Files |
| `deploy_avd_private_link` | `false` | Private Link for host pool and workspace |
| `deploy_governance` | `false` | Azure Policy assignments and budget |

## Repository Map

## Important Notes

- Start VM on Connect and autoscale require Azure Virtual Desktop service-principal RBAC.
- AVD autoscale owns host-pool load balancing during schedule windows, so Terraform ignores `load_balancer_type` drift on the host pool.
- FSLogix with Entra Kerberos requires tenant and storage prerequisites.
- Private endpoint modes are off by default because local public laptops often cannot reach private-only data-plane endpoints during bootstrap.
- Keep local `terraform.tfstate` private. It can contain sensitive values.

## References

- [AVD cost estimation](https://learn.microsoft.com/en-au/azure/virtual-desktop/understand-estimate-costs)
- [Entra-joined session hosts](https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-ad-joined-session-hosts)
- [FSLogix storage](https://learn.microsoft.com/en-us/azure/virtual-desktop/store-fslogix-profile)
- [FSLogix with Entra ID](https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid)
- [AVD autoscale](https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan)
- [AVD Insights](https://learn.microsoft.com/en-us/azure/virtual-desktop/insights)

## License

MIT. See [LICENSE](LICENSE).

azure-avd-lab

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README