Azure Virtual Desktop Landing Zone (Terraform + AVM)
A reference-grade AVD application landing zone built entirely from Azure Verified Modules in Terraform and shipped through OIDC GitHub Actions with no stored secrets. It is CAF-aligned, Entra ID-joined, private-only, and mapped against every Microsoft AVD design area.
AVD-LZ Repository- Role
- Cloud Solutions Architect
- Org
- Personal build
- Period
- 2026
Context
I built this to work an Azure Virtual Desktop landing zone end-to-end the way it should be done in production, not a portal click-through but a composable, reviewable, secret-free Infrastructure-as-Code deployment that maps cleanly onto Microsoft’s published guidance. It’s an application landing zone that assumes a CAF platform landing zone (connectivity, identity, management) already exists, following the AVD Landing Zone design guide and the avdaccelerator baseline.
Approach
The whole estate is composed from Azure Verified Modules in Terraform and deployed through OIDC-federated GitHub Actions, with no long-lived cloud secrets anywhere.
- Eight focused modules behind one composition root: networking (spoke VNet, NSG/ASG, routes, hub peering), FSLogix storage, security (Key Vault), management plane (host pool, app group, workspace, scaling plan), session hosts, monitoring, and shared services (Compute Gallery, Automation), with every module pinned to a specific AVM version.
- Entra ID join as the identity baseline, with FSLogix profiles on Premium Azure Files via Entra Kerberos, and no domain controllers deployed.
- Private-only PaaS. Storage and Key Vault have public access disabled and are reached through private endpoints with private DNS; RBAC throughout.
- OIDC CI/CD with explicit deploys. PRs run
fmt+validate+plan; the only apply path is a manual, confirmation-gatedworkflow_dispatch, with production apply/destroy behind a required-reviewer Environment gate. There is intentionally no merge-triggered apply. - Design rigor as first-class artifacts. The repo carries a full design-area (A–I) mapping, Architecture Decision Records, naming/tagging standards, an acceptance checklist, and RTO/RPO targets, plus CMK-encrypted remote state with deterministic, reproducible resource names.
Outcome
A clean-room AVD landing zone that stands up from nothing through reviewed, secret-free pipelines and tears down just as cleanly, demonstrating the AVM-first, OIDC, private-by-default pattern a senior architect is expected to bring. It doubles as a reusable kit: the modules and the four-role review workflow transfer directly to client engagements.