Enterprise-grade Azure Virtual Desktop deployment automation for Azure Commercial, Government, Secret, and Top Secret clouds
New to this repo? Open GitHub Copilot Chat and ask "How do I get started with FederalAVD?" — Copilot is pre-loaded with repo context and can guide you through deployment decisions, parameter choices, and troubleshooting.
The Federal AVD solution provides comprehensive automation for deploying and managing Azure Virtual Desktop environments across all Azure cloud environments with built-in Zero Trust security controls, multi-cloud support, and enterprise-scale capabilities.
| Component | Description | Documentation |
|---|---|---|
| 🌐 Networking | Virtual network, subnets, NSGs, NAT gateway, hub peering, route tables, private DNS zones | Quick Start - Networking |
| 🔒 AVD Shared Services | Secrets and Encryption Key Vaults, optional shared Log Analytics and AVD Insights resources, and an optional shared FSLogix Recovery Services vault and Azure Files backup policy. | Quick Start - AVD Shared Services |
| 🏢 Host Pools | Standard or AVD-managed pooled host pools with networking, storage, monitoring, and security | Choose a Management Approach |
| 📦 Image Management | Central artifact storage and management for software packages | Artifacts & Image Management |
| 🎨 Custom Images | Automated custom image builds with artifact-based software deployment | Image Build Guide |
| 🔧 Add-Ons | Lifecycle automation and operational tools | Add-Ons |
✅ Azure Commercial • ✅ Azure Government • ✅ Azure Government Secret • ✅ Azure Government Top Secret
Ready to deploy? The Quick Start Guide walks you through the complete deployment process with decision trees, prerequisites, and step-by-step instructions.
New to FederalAVD? → Start with the PoC callout in Step 4 (existing VNet + marketplace images, no CMK) | Top 5 first-deployment mistakes
👉 Get Started Now → — choose your path (PoC · custom images · enterprise CMK), review prerequisites, and follow step-by-step instructions. All clouds and all deployment methods (Blue Button, Template Spec, PowerShell/CLI) are covered there.
Central storage and management for software artifacts. Required for custom image builds or session host customizations.
Resources Created:
- 🗄️ Storage Account with blob container for artifacts
- 🆔 Managed Identity with RBAC for secure access
- 🖼️ Compute Gallery for custom images
- 🔐 Private endpoints (optional, for Zero Trust)
Learn More:
Automated custom image build pipeline with artifact-based customizations.
Features:
- Automated software installation from artifacts
- Windows Updates and optimizations
- Supports marketplace or custom base images
- Regional image replication
- Build automation with PowerShell script
Learn More:
Complete AVD environment deployment with enterprise features.
FederalAVD provides two host-pool deployments. Choose the management approach before deployment:
- Standard Host Pool supports pooled and personal desktops in every supported Azure cloud. You own the session-host VM lifecycle and can automate image replacement with Session Host Replacer.
- Automated Host Pool is a Commercial-only preview for pooled desktops. Azure Virtual Desktop owns VM creation, update, scaling, and deletion through Session Host Configuration.
The choice can't be changed on an existing host pool. See Choose a Host Pool Management Approach before deploying Step 4.
What's Included:
- AVD host pool, workspace, and application groups
- Session host virtual machines (pooled or personal)
- FSLogix profile storage (Azure Files or NetApp Files)
- Monitoring with Log Analytics and Application Insights
- Key Vault for secrets management (inline or pre-deployed via AVD Shared Services)
- Private endpoints and network security (Zero Trust)
- Backup and recovery configuration
- Customer Managed Keys: disk encryption sets and storage encryption UAIs deployed early in the deployment chain, giving RBAC propagation time before VMs are created
Learn More:
- Choose a Host Pool Management Approach
- Host Pool Deployment Guide
- Automated Host Pool Deployment
- Features
- Design
Optional add-ons extend the base AVD deployment with advanced lifecycle management and operational automation:
| Add-On | Purpose | Documentation |
|---|---|---|
| 🔄 Session Host Replacer | Automates rolling image replacement for standard-management host pools; don't use with automated host pools | Session Host Replacer |
| 📊 Storage Quota Manager | Monitors and automatically increases Azure Files Premium share quotas for FSLogix storage | Storage Quota Manager |
| 🔑 Update Storage Keys | Updates FSLogix storage account keys on session hosts for Entra ID-only deployments | Update Storage Keys |
| 📝 Run Commands on VMs | Execute scripts on selected virtual machines from a resource group | Run Commands |
| 🖥️ Session Hosts | Deploy session hosts into an existing standard-management host pool without touching control-plane infrastructure | Session Hosts |
This solution is architected to align with Microsoft's Zero Trust principles for Azure Virtual Desktop:
| Layer | Capability |
|---|---|
| 🌐 Network | Private endpoints, no public IPs, network segmentation |
| 🔐 Identity | Managed identities, Entra ID authentication, conditional access |
| 📁 Data | Customer-managed keys, encryption at rest/transit, private connectivity |
| 🎯 Access | RBAC least privilege, Azure Policy enforcement, user assignment restrictions |
| 📊 Monitoring | Centralized logging, diagnostic data collection, threat detection |
| ⚙️ Configuration | Immutable infrastructure, artifact-based deployment, integrity verification |
Zero Trust Architecture Details
Support for multiple identity configurations to meet organizational requirements:
| Identity Solution | Description | Use Case |
|---|---|---|
| Active Directory Domain Services | Traditional hybrid identity with AD domain join | Enterprise hybrid environments with on-premises AD |
| Entra Domain Services | Managed domain services in Azure | Cloud-focused without on-premises AD infrastructure |
| Entra Kerberos (Hybrid) | Entra ID-joined hosts with AD user accounts | Modernizing while maintaining AD user accounts |
| Entra Kerberos (Cloud-Only) | Entra ID users with Kerberos authentication | Cloud-native with Kerberos for FSLogix |
| Entra ID | Pure cloud identity solution | Fully cloud-native deployments |
- 📖 Quick Start Guide - Step-by-step deployment instructions with path selection (PoC / custom software / enterprise CMK)
- 🤖 End-to-End Automation Guide - Chaining steps together and passing outputs
- 🏗️ Design - Architecture and resource organization
- ⚙️ Parameters Reference - Per-solution parameter documentation index
- 🏢 Host Pool Deployment - Deploy AVD host pools
- 🎨 Image Build Guide - Build custom images
- 📦 Artifacts & Image Management - Software artifact system
- 🔧 Update-ImageArtifacts Script - Script usage guide
- ✨ Features - Detailed feature descriptions
- 🚫 Limitations - Known limitations and workarounds
- 🔧 Troubleshooting - Common issues and solutions
- 🔐 Entra Kerberos Setup - Kerberos configuration
- 🌐 Air-Gapped Clouds - Secret/Top Secret deployment
- 🔄 Session Host Replacer
- 📊 Storage Quota Manager
- 🔑 Update Storage Keys
- 📝 Run Commands on VMs
- 🖥️ Session Hosts
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution.
When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately. Simply follow the instructions provided by the bot.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with questions or comments.
This project is licensed under the MIT License - see the LICENSE file for details.
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.