Azure Virtual Desktop · Deploys into your Azure
Azure Virtual Desktop, designed and deployed from your browser
AVD Deploy takes you through the design one step at a time, checks it against your subscription, deploys it and finishes the tenant setup. You install nothing and run no scripts.
How it works
From design to first sign-in
Nothing in your tenant changes until you press Deploy, and every tenant-wide change waits for you to confirm it.
- 1
Design
Six short pages: Azure, desktops, identities, network, access, and power and names. Sized for your people as you go.
- 2
Review
Quota, VM size, permissions, names and leftover devices are checked against your subscription. Nothing changes yet.
- 3
Deploy
Entra groups, the foundation, the host pool and the session hosts, with progress for each step.
- 4
Finish setup
RDP sign-in, the storage app, Conditional Access and FSLogix permissions, each shown before and after.
- 5
Ready
How your people sign in with Windows App, what's left for a person, and removing the deployer's access.
The design
The choices that matter, and sensible defaults for the rest
Only regions where your subscription has compute quota can be chosen, and the session hosts are sized from how many people use them at once.
Pooled or personal
Multi-session desktops shared by many, or a desktop each. Pick the worker profile and how many people, and the sizing follows.
Any suitable VM size
The recommended size by default, or any D, E, F or B-series size your subscription can use in that region, with its free quota.
Microsoft 365 Apps or Intune
Microsoft's multi-session image with Microsoft 365 Apps, or plain Windows 11 and your apps from Intune.
Cloud-only or hybrid
FSLogix profiles on Azure Files with Entra Kerberos, for cloud-only (preview) or hybrid identities.
Your network or a new one
A new virtual network with a NAT gateway on a free range, or your existing network and subnet.
Groups for access and Intune
Users and admins groups, new or existing, and an optional dynamic device group of the session hosts for Intune.
Security
Your tenant, your sign-in, your secrets
Runs in your browser, as you
Every change is made with your own sign-in, from the page. Andy Kemp Consulting receives no Microsoft tokens, passwords or tenant data.
The admin password stays in your Key Vault
Generated in the page or typed by you, it goes once to Azure as a secure value, straight into your Key Vault. Session hosts read it from there.
Short-lived registration
The host pool registration token is created just before the session hosts are deployed, and revoked straight after.
Profile storage stays private
FSLogix storage sits behind a private endpoint. The folder permissions are set from a session host inside your network; the storage firewall is never opened.
Tenant-wide changes wait for you
Each one shows the settings before and after and waits for you to type APPLY. In Conditional Access, only the storage app is added to policies' excluded apps; nothing else in them changes.
Checked, pinned templates
Each version's templates and scripts are published once and never edited. The page checks every file's fingerprint before it uses it.
Get started
Sign in and design
Sign in at deploy.andykemp.com/avd, connect your tenant and work through the design. Review tells you anything that would stop the deployment before it starts.
- An Azure subscription: Owner, or Contributor plus Role Based Access Control Administrator
- Groups Administrator, if it creates the Entra groups
- Cloud Application Administrator, and Conditional Access Administrator for FSLogix, to finish setup
- Entra ID P1 for the Intune device group (optional)
Questions
Frequently asked
How do we get access?
Using AVD Deploy needs an Andy Kemp Consulting account with access to it: talk to Andy. What it deploys runs in your own Azure subscription and is billed to you by Microsoft.
What do we need before we start?
An Azure subscription where you're Owner, or Contributor plus Role Based Access Control Administrator. To create groups, Groups Administrator; for Finish setup, Cloud Application Administrator, and Conditional Access Administrator for pooled desktops with FSLogix. Your users need a licence that includes Azure Virtual Desktop, such as Microsoft 365 E3 or Business Premium.
Is Microsoft 365 Apps included?
If you choose it, pooled desktops use Microsoft's Windows 11 multi-session image with Microsoft 365 Apps, the newest one in your region. Or choose plain Windows 11 and deploy your apps with Intune to the session host device group. Personal desktops use Windows 11 Enterprise.
Review says a VM size isn't available. What now?
Some sizes are restricted in some subscriptions and regions. Review says so and offers sizes with the same vCPUs that are available, or you can go back and pick another size or region.
What about devices left from an earlier deployment?
Review looks for Entra devices named like the new session hosts with no VM behind them. Delete them in Entra ID and Intune first, or choose another prefix, so the new hosts don't get duplicate records.
Can we run it again?
Yes. Finish setup can be run at any time and only changes what's missing. Deploying the same prefix and resource group again updates that estate.
Click through it before you connect anything
The demo is the real AVD Deploy with a made-up organisation and subscription in it. Design, review, deploy and finish setup: nothing is created and nothing connects to Microsoft.