Terraform-powered Azure Virtual Desktop lab for demos, training, and proof-of-concept work. It follows a landing-zone style layout while keeping the default deployment focused on AVD fundamentals instead of expensive perimeter services.

No Azure Firewall, VPN Gateway, Application Gateway, AKS, Bastion, or domain controllers are deployed by default.

The lab separates service, compute, storage, security, monitoring, and networking concerns:

User -> AVD workspace -> Desktop or RemoteApp -> Host pool -> Session host
                                                          |
                                                          +-> FSLogix profile share
                                                          +-> AVD diagnostics

Start with the wiki-style documentation in wiki/README.md, or use the guided docs below.

PowerShell:

Copy-Item terraform.tfvars.example terraform.tfvars
terraform init
terraform fmt -check -recursive
terraform validate
terraform plan -var-file="environments/lab.tfvars"

Bash:

cp terraform.tfvars.example terraform.tfvars
terraform init
terraform fmt -check -recursive
terraform validate
terraform plan -var-file="environments/lab.tfvars"

Set at least these values in terraform.tfvars:

subscription_id    = "00000000-0000-0000-0000-000000000000"
owner              = "Your Name"
avd_users_group_id = "00000000-0000-0000-0000-000000000000"

Optional:

avd_admins_group_id = "00000000-0000-0000-0000-000000000000"
alert_email         = "admin@example.com"

Leave admin_password = "" to generate a password and store it in Key Vault.

terraform apply -var-file="environments/lab.tfvars"

After apply, capture the outputs:

terraform output

Key outputs:

Run the full non-destructive health check:

./scripts/Test-AvdLabConnectivity.ps1 -VarFile "environments/lab.tfvars" -StartStoppedHosts

Run a dry-run crash test:

./scripts/Invoke-AvdLabCrashTest.ps1

Run live resilience tests:

./scripts/Invoke-AvdLabCrashTest.ps1 -RunChaos -Scenario DrainHost,SingleHostRestart,AllHostsRestart,SingleHostDeallocateStart,AllHostsDeallocateStart

The live crash test intentionally disrupts hosts. Use it only when no one needs an active session.

Use the Azure Pricing Calculator for current pricing.

.
|-- main.tf
|-- variables.tf
|-- outputs.tf
|-- environments/
|-- landing-zones/
|-- modules/
|-- scripts/
|-- docs/
|-- wiki/
|-- policies/
`-- tests/

• Start VM on Connect and autoscale require Azure Virtual Desktop service-principal RBAC.
• AVD autoscale owns host-pool load balancing during schedule windows, so Terraform ignores load_balancer_type drift on the host pool.
• FSLogix with Entra Kerberos requires tenant and storage prerequisites.
• Private endpoint modes are off by default because local public laptops often cannot reach private-only data-plane endpoints during bootstrap.
• Keep local terraform.tfstate private. It can contain sensitive values.

• AVD cost estimation
• Entra-joined session hosts
• FSLogix storage
• FSLogix with Entra ID
• AVD autoscale
• AVD Insights

MIT. See LICENSE.