TEHUTI EKEMA
All work End-User Compute · Landing Zones

Azure Virtual Desktop Landing Zone (Terraform + AVM)

A reference-grade AVD application landing zone built entirely from Azure Verified Modules in Terraform and shipped through OIDC GitHub Actions with no stored secrets. It is CAF-aligned, Entra ID-joined, private-only, and mapped against every Microsoft AVD design area.

AVD-LZ Repository
Role
Cloud Solutions Architect
Org
Personal build
Period
2026
Azure Virtual DesktopTerraformAzure Verified ModulesGitHub ActionsOIDCFSLogixEntra IDCAF Landing Zone

Context

I built this to work an Azure Virtual Desktop landing zone end-to-end the way it should be done in production, not a portal click-through but a composable, reviewable, secret-free Infrastructure-as-Code deployment that maps cleanly onto Microsoft’s published guidance. It’s an application landing zone that assumes a CAF platform landing zone (connectivity, identity, management) already exists, following the AVD Landing Zone design guide and the avdaccelerator baseline.

Approach

The whole estate is composed from Azure Verified Modules in Terraform and deployed through OIDC-federated GitHub Actions, with no long-lived cloud secrets anywhere.

  • Eight focused modules behind one composition root: networking (spoke VNet, NSG/ASG, routes, hub peering), FSLogix storage, security (Key Vault), management plane (host pool, app group, workspace, scaling plan), session hosts, monitoring, and shared services (Compute Gallery, Automation), with every module pinned to a specific AVM version.
  • Entra ID join as the identity baseline, with FSLogix profiles on Premium Azure Files via Entra Kerberos, and no domain controllers deployed.
  • Private-only PaaS. Storage and Key Vault have public access disabled and are reached through private endpoints with private DNS; RBAC throughout.
  • OIDC CI/CD with explicit deploys. PRs run fmt + validate + plan; the only apply path is a manual, confirmation-gated workflow_dispatch, with production apply/destroy behind a required-reviewer Environment gate. There is intentionally no merge-triggered apply.
  • Design rigor as first-class artifacts. The repo carries a full design-area (A–I) mapping, Architecture Decision Records, naming/tagging standards, an acceptance checklist, and RTO/RPO targets, plus CMK-encrypted remote state with deterministic, reproducible resource names.

Outcome

A clean-room AVD landing zone that stands up from nothing through reviewed, secret-free pipelines and tears down just as cleanly, demonstrating the AVM-first, OIDC, private-by-default pattern a senior architect is expected to bring. It doubles as a reusable kit: the modules and the four-role review workflow transfer directly to client engagements.