Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use this guide to plan an Azure Virtual Desktop (AVD) session-host workload and its network connectivity in Azure Enclave. For end-to-end AVD deployment steps, including host pools and session hosts, see Deploy an Azure Virtual Desktop workload in Azure Enclave. This article focuses on associating the workload resource group and configuring the enclave network path; it doesn't replace the AVD deployment instructions.
An Admin VM is a virtual machine configured to allow administrators to make changes from within the isolated enclave network. Its reachability to other resources depends on the configured network routes and security controls.
Where Azure Bastion is enabled for an enclave, it can provide secure connections to virtual machines by using private IP addresses. If your organization requires another access pattern, you can configure AVD session hosts as an alternative entry point. AVD connectivity still depends on the routes, network security groups, firewall rules, and Enclave endpoint rules in your design.
Prerequisites
Before you begin:
- Create a community and an enclave.
- Review the AVD deployment requirements and network destinations for your chosen identity and deployment configuration.
- Decide which resource group will contain the AVD resources and ensure you have permission to create or associate it with a workload.
Create and associate the workload resource group
- Create a workload in the enclave. Use a workload name such as
wl-avd-management. - During workload creation, create or add a workload resource group for your AVD resources. For example, use
wl-rg-avd-sessionhostsfor the workload resource group name. For details, see Create a workload resource group. - Deploy the AVD components by following Azure Virtual Desktop deployment guidance. For each deployment step that targets a resource group, use the workload resource group you created (for example,
wl-rg-avd-sessionhosts). If you follow the Deploy an Azure Virtual Desktop workload in Azure Enclave instructions, review the prerequisites and parameters.
Configure network connectivity
- Create a community endpoint with rules for the AVD destinations required by your deployment. Check that the selected endpoint rule types and community firewall SKU support those destinations.
- Create an enclave endpoint for the required destinations in the enclave. Configure the destination IP addresses or CIDR ranges, ports, and protocols needed by your design.
- Create an enclave connection to establish the configured network path between the enclave and community. Creating the connection alone doesn't guarantee AVD connectivity; validate that the endpoint rules and other network controls allow the required traffic.
