Add Azure Virtual Desktop personal and pooled workspace services by marrobi · Pull Request #5075 · microsoft/AzureTRE

Marcus Robinson (marrobi) · 2026-09-11T15:08:18Z

Resolves #517 and #1014

Closes #517
Closes #1014

What is being addressed

Provide Azure Virtual Desktop within a TRE workspace, with personal desktops assigned to individual researchers and workspace-managed pooled desktops. Support multiple personal desktops per user with VM-specific connection links, meaningful desktop names, and workspace-group authorization.

This PR remains a draft until the outstanding acceptance checks below are completed. Both host-pool types use Standard management; the separate Session Host Configuration experiment is not included.

How is this addressed

Add Personal and Pooled host pools, private endpoints, Entra authentication, start-on-connect, and diagnostic logging. Host-pool type is fixed at creation; pooled host count is configurable at creation. The schema marks the count updateable, but API-driven resizing remains blocked as described below.
Assign personal child VMs explicitly to their owners and emit direct Windows App URLs using the session-host object ID. Apply workspace, service, and personal resource display names to the corresponding AVD resources, with CAF resource-name prefixes.
Grant desktop application-group access to workspace Owners and Researchers groups. Personal VM ownership alone does not grant application-group entitlement.
Enforce clipboard policy during bootstrap, restart before registration, pin and verify the portal configuration archive, renew registration tokens under a storage lease with bounded initialization retries, and remove session-host registrations on uninstall/scale-down.
Default Windows 11 images to 25H2. Add a pooled multi-session image selector, image-specific licensing/Secure Boot/vTPM settings, and Premium SSD pooled OS disks. Availability-zone distribution is deferred from v1.
Offer optional service-scoped SSO device pre-consent, disabled by default. Document required permissions, tenant prerequisites, licensing, and security limitations.
Add required core DNS allow-list suffixes, the shared AVD private DNS zone and VNet links, base-workspace NSG paths, and workspace-owned Terraform storage RBAC. Use the documented public-cloud KMS IPs (20.118.99.224 and 40.83.235.53) on TCP 1688, avoiding a DNS-proxy/network-FQDN dependency unsupported by Azure Firewall Basic. No shared firewall DNS-proxy change is included.
Add both bundles to deployment publication and registration matrices. Update documentation, navigation, and changelog. Versions: AVD 1.0.0, personal session host 1.0.0, base workspace 2.9.0, core 0.17.0, DevOps 0.6.3.

Validation completed

Review fixes pushed in 6f046c4. Nine schema/catalogue/workflow/bootstrap regression tests and ten registration-initialization retry cases pass.
Terraform validation for core, base and both AVD bundles; Porter lint and parent/child image builds; configuration archive SHA-256 verification and git whitespace checks.
Earlier strict MkDocs build and focused checks of immutable pool type, lifecycle wiring, display-name fallbacks, distinct VM-specific links, and IP-based activation rules.
Published development v1 bundles and deployed isolated Standard personal and pooled 25H2 tests. Both hosts became Available; guest checks confirmed Entra join, running agents, expected clipboard policy values and a reboot after policy application.
Live pooled testing exposed a Windows command-length failure. Reusing the personal UTF-8 bootstrap wrapper fixed it; a regression test covers command length. Pooled image, Premium SSD, licensing, encryption at host, Trusted Launch, Secure Boot and vTPM were verified.
Both isolated Standard services and their VMs were uninstalled; shared DNS and storage permissions were preserved.
Earlier testing confirmed distinct personal connection outputs, names and assignments. The user confirmed interactive Windows App browser sign-in to Desktop 1 using a temporary direct application-group entitlement; this does not establish group-only authorization or v1 client acceptance.

Pending before ready for review / merge

Fix shared API conditional PATCH validation and verify pooled host-count changes, scale-out and scale-in. PATCH of only pooled_session_host_count currently fails because validation lacks the existing host_pool_type; the updateable flag alone is insufficient.
Complete v1 personal and pooled interactive sign-in, intended VM destination checks, and end-to-end clipboard-direction acceptance tests.
Verify group-only access and access removal without temporary development entitlements.
Verify fresh core/base provisioning, cross-subscription deployment, and the deployment workflow. Existing DNS/RBAC prerequisites were already present in the live test workspace.
Complete explicit Windows activation acceptance checks, including the Azure Firewall Basic SKU scenario.
Verify optional SSO pre-consent with a non-admin user and B2B guest.
Complete spelling validation: the local yaspeller pre-commit hook stalled and was interrupted; only that hook was skipped for commit 6f046c4 with explicit approval. Other hooks were not disabled.

Deployment notes

Deploy the required core/base prerequisites before AVD. This is the initial v1 release; no migration compatibility for the pre-release naming is provided. The activation IP list targets Azure public cloud; sovereign clouds require their corresponding endpoints. No shared firewall DNS-proxy cleanup is included. In development environments where DNS proxy was enabled during testing, replace FQDN network rules and check for other dependencies before disabling it. Do not remove temporary direct user entitlements until workspace-group access is established and verified.

…t user resource Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

…fault Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

)

Copilot

🔵 Needs a closer look

Deployment integration and DNS prerequisites have unresolved issues, and several live acceptance checks remain incomplete.

Pull request overview

Adds Azure Virtual Desktop workspace services supporting personal and pooled desktops, with secure networking, Entra authentication, access controls, and operational documentation.

Changes:

Adds AVD host pools, session hosts, private endpoints, diagnostics, registration, and SSO pre-consent.
Adds personal desktop user resources with VM-specific connections and clipboard controls.
Updates workspace networking, DNS, versions, and documentation.

File summaries

File	Description
`templates/workspaces/base/terraform/network/security.tf`	Adds AVD and activation egress rules.
`templates/workspaces/base/porter.yaml`	Bumps base workspace version.
`templates/workspace_services/avd/user_resources/README.md`	Documents personal session hosts.
`.../avd-personal-sessionhost/terraform/variables.tf`	Defines user-resource inputs.
`.../avd-personal-sessionhost/terraform/providers.tf`	Configures Terraform providers.
`.../avd-personal-sessionhost/terraform/prepare_session_host.ps1.tftpl`	Applies clipboard policy before restart.
`.../avd-personal-sessionhost/terraform/outputs.tf`	Exposes VM and connection details.
`.../avd-personal-sessionhost/terraform/main.tf`	Provisions and assigns personal desktops.
`.../avd-personal-sessionhost/terraform/locals.tf`	Defines naming and configuration values.
`.../avd-personal-sessionhost/terraform/ensure_registration.sh`	Renews registration credentials.
`.../avd-personal-sessionhost/terraform/data.tf`	Resolves parent AVD resources.
`.../avd-personal-sessionhost/terraform/configure_session_host.ps1.tftpl`	Registers and configures the VM.
`.../avd-personal-sessionhost/terraform/.terraform.lock.hcl`	Locks provider versions.
`.../avd-personal-sessionhost/template_schema.json`	Defines personal desktop options.
`.../avd-personal-sessionhost/porter.yaml`	Defines the personal desktop bundle.
`.../avd-personal-sessionhost/parameters.json`	Maps bundle environment parameters.
`.../avd-personal-sessionhost/Dockerfile.tmpl`	Builds the personal bundle image.
`.../avd-personal-sessionhost/Configuration.zip.sha256`	Pins the bootstrap artifact checksum.
`.../avd-personal-sessionhost/.env.sample`	Adds sample deployment settings.
`.../avd-personal-sessionhost/.dockerignore`	Configures bundle build exclusions.
`templates/workspace_services/avd/terraform/variables.tf`	Defines AVD service inputs.
`templates/workspace_services/avd/terraform/providers.tf`	Configures Azure providers.
`templates/workspace_services/avd/terraform/prepare_session_host.ps1.tftpl`	Applies pooled-host policy.
`templates/workspace_services/avd/terraform/pooled_session_hosts.tf`	Provisions pooled session hosts.
`templates/workspace_services/avd/terraform/outputs.tf`	Exposes service connection outputs.
`templates/workspace_services/avd/terraform/network.tf`	Creates AVD private endpoints.
`templates/workspace_services/avd/terraform/main.tf`	Provisions core AVD resources.
`templates/workspace_services/avd/terraform/locals.tf`	Defines service naming and policies.
`templates/workspace_services/avd/terraform/ensure_registration.sh`	Manages registration tokens.
`templates/workspace_services/avd/terraform/data.tf`	Resolves supporting Azure resources.
`templates/workspace_services/avd/terraform/consent.tf`	Implements optional SSO pre-consent.
`templates/workspace_services/avd/terraform/configure_session_host.ps1.tftpl`	Configures pooled session hosts.
`templates/workspace_services/avd/terraform/.terraform.lock.hcl`	Locks service provider versions.
`templates/workspace_services/avd/template_schema.json`	Defines service configuration and pipelines.
`templates/workspace_services/avd/porter.yaml`	Defines the AVD service bundle.
`templates/workspace_services/avd/parameters.json`	Maps service environment parameters.
`templates/workspace_services/avd/Dockerfile.tmpl`	Builds the AVD bundle image.
`templates/workspace_services/avd/Configuration.zip.sha256`	Pins the bootstrap artifact checksum.
`templates/workspace_services/avd/.env.sample`	Adds sample service settings.
`templates/workspace_services/avd/.dockerignore`	Configures bundle exclusions.
`mkdocs.yml`	Adds AVD documentation navigation.
`docs/tre-templates/workspace-services/azure-virtual-desktop.md`	Documents deployment and operation.
`core/version.txt`	Bumps the core version.
`core/terraform/allowed-dns.json`	Allows Windows App DNS suffixes.
`CHANGELOG.md`	Records the AVD enhancement.

Review details

Files not reviewed (2)

templates/workspace_services/avd/terraform/.terraform.lock.hcl: Generated file
templates/workspace_services/avd/user_resources/avd-personal-sessionhost/terraform/.terraform.lock.hcl: Generated file

Files reviewed: 43/45 changed files
Comments generated: 6
Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

microsoft#1014)

Copilot

🟡 Changes recommended

Pooled scaling remains blocked, sensitive credentials were exposed in diagnostics, and deployment prerequisites and automated test execution remain incomplete.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (2)

templates/workspace_services/avd/terraform/.terraform.lock.hcl: Generated file
templates/workspace_services/avd/user_resources/avd-personal-sessionhost/terraform/.terraform.lock.hcl: Generated file

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

templates/workspace_services/avd/terraform/network.tf:2

AVD Private Link requires Microsoft.DesktopVirtualization to be re-registered on each target subscription before private endpoints are used, but the repository's provider-registration bootstrap does not include it and the AVD prerequisites do not mention this step. Existing subscriptions can therefore fail while creating these endpoints; add the re-registration/preflight for the workspace subscription or make it an explicit prerequisite.

Files reviewed: 52/54 changed files
Comments generated: 4
Review effort level: Balanced

+| `host_pool_type` | `Personal`/`Pooled` (Default: `Personal`) | Select personal child VMs or workspace-managed pooled VMs |
+| `enable_sso_preconsent` | `true`/`false` (Default: `false`) | Automate a service-owned dynamic device group for pre-consent; consider licensing and optional Graph write permissions |
+| `maximum_sessions` | 1-50 (Default: 10) | Maximum concurrent sessions on each pooled host |
+| `pooled_session_host_count` | 1-10 (Default: 1) | Updateable number of multi-session hosts in a pooled deployment |


Copilot

🟡 Changes recommended

Conditional PATCH validation still prevents the advertised pooled host-count update workflow, and the draft acceptance checks remain incomplete.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (2)

templates/workspace_services/avd/terraform/.terraform.lock.hcl: Generated file
templates/workspace_services/avd/user_resources/avd-personal-sessionhost/terraform/.terraform.lock.hcl: Generated file

Files reviewed: 51/53 changed files
Comments generated: 0 new
Review effort level: Balanced

…osoft#5075) Add a schema-only count fallback and generic API conditional-PATCH tests. Run isolated, locked AVD schema and registration suites in Build Validation; exclude test dependencies from the bundle image. Bump AVD, API and DevOps patch versions and distinguish local validation from pending live scaling acceptance. Validation: 30 resource repository tests, 11 Node checks, 10 registration scenarios and clean npm ci for the isolated suite passed. Flake8 passed; stalled yaspeller hook skipped for this commit with explicit approval. Additional follow-ups: live scale-out/scale-in and remaining client/deployment acceptance; separate shared diagnostic security remediation and operational credential/record handling. The experiment and local validation report are excluded. Existing UI dependency/lockfile inconsistencies are not changed.

…soft#5075) Remove implementation history and test-status commentary from the service guide while retaining operational prerequisites and precautions. Yaspeller skipped with explicit approval after its external API returned HTTP 307 with an empty response.

Copilot

🔵 Needs a closer look

The PR remains a draft with critical interactive access, scaling, cross-subscription, workflow, activation, and authorization checks still pending.

Review details

Files not reviewed (3)

templates/workspace_services/avd/terraform/.terraform.lock.hcl: Generated file
templates/workspace_services/avd/tests/package-lock.json: Generated file
templates/workspace_services/avd/user_resources/avd-personal-sessionhost/terraform/.terraform.lock.hcl: Generated file

Files reviewed: 55/58 changed files
Comments generated: 0 new
Review effort level: Balanced

Copilot AI and others added 6 commits November 27, 2025 09:51

Initial plan

6482822

Add Azure Virtual Desktop workspace service with personal session hos…

832e2fa

…t user resource Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

Fix code review issues: correct aadJoin setting and remove invalid de…

8a9fa3c

…fault Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

Add configurable clipboard redirection for AVD workspace service

2b72feb

Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>

Complete AVD personal and pooled desktops (microsoft#517, microsoft#1014

c00de67

)

Show AVD settings conditionally (microsoft#517, microsoft#1014)

b25915a

Marcus Robinson (marrobi) requested a balanced review from Copilot September 11, 2026 15:59

Copilot started reviewing on behalf of Marcus Robinson (marrobi) September 11, 2026 16:00

View session

Copilot AI reviewed Sep 11, 2026

View reviewed changes

Sven Aelterman (SvenAelterman) reviewed Sep 11, 2026

View reviewed changes

Address AVD v1 review feedback and validate deployments (microsoft#517,

6f046c4

microsoft#1014)

Marcus Robinson (marrobi) requested a balanced review from Copilot September 12, 2026 08:24

Copilot started reviewing on behalf of Marcus Robinson (marrobi) September 12, 2026 08:25

View session

Copilot AI reviewed Sep 12, 2026

View reviewed changes

Remove local AVD validation report from PR (microsoft#5075)

26ad8ee

Marcus Robinson (marrobi) requested a balanced review from Copilot September 12, 2026 10:20

Copilot started reviewing on behalf of Marcus Robinson (marrobi) September 12, 2026 10:20

View session

Copilot AI reviewed Sep 12, 2026

View reviewed changes

Marcus Robinson (marrobi) added 2 commits September 12, 2026 13:42

Marcus Robinson (marrobi) requested a balanced review from Copilot September 12, 2026 14:36

Copilot started reviewing on behalf of Marcus Robinson (marrobi) September 12, 2026 14:36

View session

Copilot AI reviewed Sep 12, 2026

View reviewed changes

Conversation

Marcus Robinson (marrobi) commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resolves #517 and #1014

What is being addressed

How is this addressed

Validation completed

Pending before ready for review / merge

Deployment notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Files not reviewed (2)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Files not reviewed (2)

Suppressed comments (1)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Files not reviewed (2)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Files not reviewed (3)

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Marcus Robinson (marrobi) commented Sep 11, 2026 •

edited

Loading