Architecture Overview

Understand the infrastructure components deployed by this template and how they work together to provide a secure, cost-optimised Azure Virtual Desktop environment.

High-Level Architecture

Internet User
    ↓
[Azure Virtual Desktop Client]
    ├─ Windows App (Recommended)
    ├─ Web Client
    └─ RDP Client
    ↓
[Azure Virtual Desktop Service]
    (Secure reverse connection, no public IPs)
    ↓
[Azure Virtual Network (10.0.0.0/16)]
    ├─ Subnet: 10.0.1.0/24
    ├─ Session Host VMs (Entra ID joined)
    ├─ Public IPs (outbound only)
    └─ Network Security Group
    ↓
[Your Desktop Environment]

Key principle: VMs do not accept inbound connections. All connections originate from the VM to the Azure Virtual Desktop service.

Component Overview

Network Layer

Virtual Network (VNet)

Subnet

Network Security Group (NSG)

Public IPs

Azure Virtual Desktop Layer

Host Pool

Workspace

Application Group

Registration Token

Compute Layer

Session Host VMs

VM Identity

VM Extensions

Cost Model

⚠️ Important: Costs are estimates, in GBP, based on pricing information available publically in February 2026 and are subject to change by Microsoft at any time. You should use the official Azure Pricing Calculator to determine your potential costs before deployment.

Monthly Costs by Component

Component Deallocated Running Notes
Session Host VM £0 £90–120 Largest cost driver (D2s_v3)
OS Disk £2–3 £2–3 Always charged
Public IP £0 £2–3 Deleted when stopped
Network & Services £0 £0 Free (VNet, NSG, AVD service)
Total £2–3 £94–126 98% savings when deallocated

Cost Optimisation Features

Public IP Lifecycle Management

Workload Sizing

Deallocate vs. Delete

Security Architecture

Authentication & Access Control

Entra ID-Joined VMs

Role-Based Access Control (RBAC)

Network Security

Reverse Connection Model

Network Segmentation

Data Encryption

Administrative Access

Compliance Features

Trusted Launch VMs

Audit & Diagnostics

Resource Naming & Lifecycle

Naming Convention

Resource names are deterministically generated using uniqueString(resourceGroup().id):

avd-[environment]-[resource]-[uniqueString]

Examples:
  avd-dev-vnet-abc123m  (VNet)
  avd-dev-nsg-abc123m   (NSG)
  avd-dev-vm-0-abc123m  (First session host)
  avd-dev-dag-abc123m   (Application group)
  avd-dev-hp-abc123m    (Host pool)

Benefits:

Idempotency

This template is fully idempotent:

Resource Dependency Graph

Resource Group (avd-occasional-rg)
├── Virtual Network
│   ├── Subnet ──────────────────────────────┐
│   └── Service Endpoints                    │
├── Network Security Group ──────────────────┤
├── Host Pool                                │
├── Workspace ──→ Application Group ────────┐│
│                                            ││
├── Session Host VMs (1-5)                   ││
│   ├─ Network Interface ←─────┬─────────────┘│
│   ├─ Public IP (managed lifecycle)          │
│   ├─ OS Disk                                │
│   ├─ Managed Identity                       │
│   └─ Custom Script Extension                │
│       └─ [Installs AVD Agent via Host Pool←─┘
│           Registration Token]

Deployment order:

  1. Network (VNet, NSG, Subnet with Service Endpoints).
  2. Host Pool (creates registration token).
  3. Workspace.
  4. Application Group.
  5. VMs and network interfaces.
  6. Public IPs.
  7. VM extensions (registers with host pool).

Outbound Connectivity (March 2026 Compliance)

Starting March 31, 2026, Azure requires explicit outbound connectivity for new virtual networks. This template implements compliance through:

Explicit Outbound Methods

1. Standard Public IPs on NICs

2. Service Endpoints

3. Network Defaults

Why This Approach

✅ Compliant – Meets March 2026 Azure requirements.
✅ Cost-optimised – IPs deleted when VMs stopped (saves ~£2–3/month).
✅ Transparent – All outbound routes visible and auditable.
✅ Functional – Full internet access for updates, downloads, browsing.
✅ Secure – Combined with NSG, provides tight security posture.

Deployment Customisation Options

Configurable Parameters

Parameter Default Allowed Values Cost Impact Use Case
environment dev dev, test, prod None Environment naming
workloadSize moderate light, moderate HIGH Light: £35/mo, Moderate: £100–120/mo
location ukwest Any Azure region Regional pricing variance Geographic proximity
vmCount 1 1–5 HIGH Linear cost scaling (£100/mo per VM added)
adminUsername avdadmin Any valid Windows name None VM admin login
tags Auto-set Custom tags object None Cost tracking, compliance

Not Customisable (By Design)

Last Updated: February 2026