Virtual Desktop Strategy

Azure Virtual Desktop (AVD) is not a replacement for physical endpoints: it is a targeted tool for specific user profiles and risk scenarios. This chapter frames the strategic decision, establishes the architecture principles that govern all AVD deployments in this guide, and provides a pre-deployment discovery checklist for RPO engagements.

For implementation steps, see Scenario: Azure Virtual Desktop.

---

When to Use AVD

GCC High

The primary driver for AVD in a CMMC environment is keeping CUI off unmanaged endpoints. A contractor connecting from a personal laptop is the canonical use case: AVD delivers a compliant Windows 11 session without requiring the organization to provision, ship, or manage a physical device.

User Profile	Preferred Strategy	Rationale
Full-time employee	Physical GFE	Better daily-use experience; offline capability; no session latency
Contractor / subcontractor	AVD	Zero CUI footprint on their device; instant provisioning and deprovisioning
Temporary auditor or assessor	AVD	Controlled access window with no residual data after session ends
"Break glass" user	AVD	Physical device lost or stolen: user can resume work from any browser
High-risk CUI workflow	AVD	CUI stays inside the Azure datacenter; drive and clipboard redirection blocked at the protocol level

For full-time employees who handle CUI, both physical GFE and AVD are defensible architectures. The deciding factors are workforce distribution (remote-first teams benefit more from AVD), device management overhead, and whether the client already has Azure Government infrastructure.

Commercial

Commercial environments generally do not need to deploy a secure enclave to handle CUI. AVD remains useful in specific scenarios: delivering a consistent managed desktop to remote contractors, providing a controlled environment for high-risk workflows, or reducing physical hardware overhead for distributed teams, but it is not driven by a regulatory enclave requirement.

Use Case	Rationale
Contractor / BYOD user needing managed apps	AVD delivers a corporate desktop without requiring device enrollment
Remote workforce with inconsistent hardware	Guaranteed performance baseline regardless of end-user device
Application delivery for legacy or GPU workloads	Centralize specific workloads without imaging every endpoint
"Break glass" access	User can reach a managed desktop from any device when their assigned machine is unavailable

---

Architecture Principles

All AVD deployments in this guide follow a cloud-native architecture. Hybrid Join for AVD is explicitly rejected.

Principle	Decision	Why
Identity	Entra ID Join: no Domain Controllers	Eliminates DC dependency, supports RBAC-based login without GPO
Management	Intune: no SCCM/MECM	Consistent policy plane with physical devices; no on-prem management infrastructure
Join model	Cloud-only (AADLoginForWindows)	Hybrid Join adds complexity with no compliance benefit for new GCC High deployments
Host pool type	Personal (assigned)	One VM per user; no FSLogix; clean audit trail; no cross-session data contamination risk
Network egress	Azure Firewall with deny-all default	No direct internet path from session hosts; all egress explicitly enumerated
Region	US Gov Virginia or US Gov Arizona	FedRAMP High boundary; data residency requirement

The rationale for the personal pool decision is detailed in Scenario: AVD → Host Pool Model. That section also covers the deliberate exception: a pooled multi-session variant for at-scale or sparse-use fleets, where per-user VMs become cost-prohibitive.

---

Security Baseline for Session Hosts

Trusted Launch

All session hosts must use Trusted Launch virtual machines. This is required for Windows 11 and for Intune BitLocker compliance via vTPM.

Setting	Required Value
Security type	Trusted Launch Virtual Machines
Secure Boot	Enabled
vTPM	Enabled
Integrity Monitoring	Enabled

Set these on the host pool wizard's Virtual machines tab: Security type is Trusted launch virtual machines by default, which selects Secure boot and vTPM; add Integrity monitoring there. An existing Generation 2 VM can be upgraded: deallocate it, change Security type to Trusted launch (PowerShell, CLI, or a template when the VM came from a Compute Gallery image, which the portal refuses), and start it. Check the size family, OS image, Enhanced backup policy, and Site Recovery prerequisites first (existing-VM procedure).

Encryption Tiers

Standard Azure Storage Service Encryption (AES-256, platform-managed keys) applies to all managed disks by default. For environments with higher sensitivity requirements:

Tier	Mechanism	When to Use
Standard	Platform-managed keys (SSE) + BitLocker (Intune)	Baseline: satisfies compliance requirements for most organizations
Enhanced	Customer-managed keys (CMK) via Key Vault + Disk Encryption Set	Organizations with contractual or internal requirements for key lifecycle control

If using CMK: create the Disk Encryption Set and Key Vault in the same Azure Government subscription and region as the session hosts. Keys must remain within the US Gov boundary.

---

Pre-Deployment Discovery Checklist

Use these questions before scoping an AVD deployment. The answers drive architecture decisions that are difficult to change after host pool creation.

Compute & Applications

• What is the reset model: persistent or ephemeral? Personal pools normally retain the user's workspace on the assigned VM. Pooled hosts are not inherently ephemeral: decide the image lifecycle and profile persistence explicitly. The detailed AVD chapter includes a pooled multi-session variant; validate FSLogix and storage/identity prerequisites before selecting it.

• Do any applications require a GPU? Standard D-series VMs are CPU-only. CAD, engineering simulation, and media encoding workloads require NV-series VMs. GPU quota in US Gov regions must be requested in advance: lead time can be 2–4 weeks.

• Is nested virtualization required? Docker, Hyper-V, and Android emulators inside AVD require a VM size that supports nested virtualization (v4/v5 series). Confirm with the development or DevOps team before selecting VM size.

Network & Egress

• Does the client require source IP anchoring for SaaS apps? Identify the actual egress device. In this guide's forced-tunnel design, the session-host default route points at Azure Firewall, and external services see its configured outbound public IPs. A NAT Gateway on the session-host subnet does not override that route. NAT Gateway can be integrated at the firewall subnet where appropriate (egress precedence).

• Is Azure Firewall Premium with TLS inspection in scope? Do not TLS-inspect required AVD service traffic. Deploying a trusted inspection root is not sufficient to make unsupported inspection work. Follow Microsoft's AVD firewall guidance and the Intune/MDE endpoint-specific exclusions; inspect other traffic only where supported and tested.

• Is RDP Shortpath (UDP 3390) a requirement? UDP 3390 is the inbound listener for managed-network Shortpath only (ExpressRoute or VPN clients). Public-network Shortpath needs no inbound port: the session host opens outbound UDP to the client's discovered address (STUN, any destination, ports 49152 to 65535 by default) or to Microsoft's TURN relay (20.140.236.0/22 on UDP 3478 in Azure Government), and behind Azure Firewall's symmetric NAT the TURN path is the one that connects. Learn's AVD Shortpath page lists STUN and TURN as generally available for Azure Government (its configuration and Multipath pages still say preview or public-cloud-only; confirm with avdnettest.exe from a session host). Enabling it means two outbound UDP network rules on the firewall. This guide's baseline leaves Shortpath off and uses TCP reverse connect (Shortpath modes).

Identity & Authentication

• Will users connect from GFE or personal/BYOD devices? This drives Conditional Access policy design. GFE users can use silent sign-on; BYOD users should see "MFA every time" and download blocks enforced at the policy level.

• Is FIDO2 / PIV card passthrough into the session required? The standard PIV flow authenticates once at Entra and carries the token into the session via SSO: no card passthrough needed. If a use case requires the physical card inside the session (e.g., signing documents inside the VM), RDP properties redirectsmartcards:i:1 and redirectwebauthn:i:1 must be set, and the target application must support it over RDP.

• Is screen capture protection required? Enabling AVD screen capture protection blocks capture of the session, so a screen shared via Teams or Zoom renders as protected frames to recipients. It breaks only screen sharing: audio and microphone redirection are unaffected, so voice-only Teams collaboration coexists with it. Where users must screen-share their session, confirm with the client before enabling; where the requirement is voice-only meetings from a CUI enclave, it costs nothing. See Scenario: Azure Virtual Desktop.

Operations

• What is the patching model for personal pool VMs? Personal pool session hosts cannot be re-imaged on a schedule the way pooled hosts can: the VM is the user's persistent workspace. The default approach is Intune Windows Update for Business policies applied to the session hosts. Confirm the client's tolerance for coordinated maintenance windows. (Clients who maintain a custom image pipeline may also rebuild VMs from a refreshed image on cadence; that path is out of scope for the standard process.)

• What is the idle disconnect and session logoff policy? 3.1.10 addresses session/device lock; 3.1.11 addresses session termination under defined conditions. A disconnect preserves applications and the host session; a logoff closes them. Set and evidence lock, disconnect, and logoff behavior separately according to the organization's policy.

• Who owns the golden image and what is the update cadence? A custom image with pre-installed applications requires an Azure Compute Gallery, a build VM, and a documented update process. If the client cannot commit to a quarterly or monthly image build cycle, the Microsoft-managed gallery image with Intune app deployment is the lower-maintenance alternative.

---

AVD Next Steps

Next Step	Article
Implementation checklist (host pool, RBAC, data storage policy, verification)	Scenario: Azure Virtual Desktop
Azure Firewall rule reference (FQDN tables, network rules, KQL)	AVD Firewall Reference
Deployment timeline (65-hour greenfield estimate)	AVD Deployment Timeline
Compliance control mapping for AVD	Scenario: AVD → Control Mapping