Tutorial 2-1: Plan your architecture for Azure Virtual Desktop and AKS workloads in Azure Enclave

This tutorial helps you plan your Azure Enclave architecture for deploying Azure Virtual Desktop and Azure Kubernetes Service (AKS) workloads. Proper planning ensures optimal security, network isolation, and resource organization.

In this tutorial, you learn how to:

• Plan your enclave topology for workload isolation
• Calculate subnet sizing requirements for Azure Virtual Desktop and AKS
• Identify required network endpoints and connectivity
• Design enclave connections for inter-enclave communication
• Organize workload resource groups effectively

Prerequisites

This tutorial assumes understanding of concepts from these tutorials:

• Tutorial 1-1: Deploy a community
• Tutorial 1-2: Create enclaves inside a community
• Tutorial 1-3: Create workloads inside an enclave
• Tutorial 1-4: Use the service catalog
• Tutorial 1-5: Create enclave endpoints and connections
• Understanding of Azure Virtual Desktop
• Understanding of Azure Kubernetes Service

Architecture overview

The following diagram shows the architecture tutorials 2-1 through 2-4. The architecture includes a community hub with firewall, separate enclaves for Azure Virtual Desktop and AKS workloads, and the necessary endpoints and connections.

Key planning decisions

Enclave topology

You need to decide whether to deploy Azure Virtual Desktop and AKS in separate enclaves or a shared enclave.

Recommendation: For production environments with strict security requirements, use separate enclaves for Azure Virtual Desktop and AKS and a third enclave for shared services and common resources. This tutorial series walks through the separate enclaves approach.

Subnet sizing for Azure Virtual Desktop

Azure Virtual Desktop requires at least two subnets in the enclave:

Example calculation for Session Hosts Subnet:

• 50 session hosts planned
• Formula: (50 + 5) × 1.2 = 66 IPs needed
• Recommended: /26 (64 IPs) or /25 (128 IPs) for growth

Subnet sizing for AKS

AKS requires at least three subnets in the enclave:

Example calculation for Node Subnet (30 pods per node, 3 max nodes):

• Formula: (3 + 1) + ((3 + 1) × 30) = 4 + 120 = 124 IPs needed
• Recommended: /25 (128 IPs) minimum

Network requirements

Azure Virtual Desktop required endpoints

Azure Virtual Desktop requires connectivity to the following endpoints via community endpoints:

Reference: Azure Virtual Desktop required URLs

AKS required endpoints

AKS requires connectivity to the following endpoints via community endpoints:

Reference: AKS required outbound network rules

Inter-enclave communication

If using separate enclaves, you need enclave endpoints and connections for:

Resource organization

Workload resource groups

Each workload should have one or more resource groups. Consider this organization:

Azure Virtual Desktop workload Resource Groups:

• rg-avd-controlplane - Host pools, workspaces, application groups
• rg-avd-sessionhosts - Session host VMs and related resources
• rg-avd-storage - FSLogix storage accounts
• rg-avd-shared - Shared resources like Key Vault, managed identities

AKS workload Resource Groups:

• rg-aks-cluster - AKS cluster user resource group
• rg-aks-nodes - AKS managed resource group (created automatically)
• rg-aks-shared - Shared resources like Key Vault, managed identities

Shared Services workload Resource Groups (if using shared services enclave):

• rg-shared-security - Key Vaults, managed identities, disk encryption sets
• rg-shared-network - Private DNS zones
• rg-shared-monitoring - Log Analytics workspaces

Common dependencies planning

Both Azure Virtual Desktop and AKS require these common dependencies:

Recommendation: Reduce duplicate resources by deploying common dependencies in a shared services enclave or workload.

Security considerations

Network isolation

• Use separate subnets for different resource types
• Apply network security group (NSG) rules to subnets
• Use private endpoints for Azure PaaS services
• Minimize community endpoints to endpoints required for your needs

Encryption

• Enable customer-managed keys (CMK) for all data at rest
• Use disk encryption sets for VM disks
• Enable encryption at host for AKS nodes
• Store all keys in Azure Key Vault and assign the least privilege access permissions

Access control

• Use Azure role assignments for resource access
• Implement just-in-time (JIT) access for administrative operations
• Use managed identities instead of service principals where possible
• Apply principle of least privilege to all role assignments

Monitoring

• Enable diagnostic settings on all resources
• Configure Azure Virtual Desktop Insights for session host monitoring
• Configure Container Insights for AKS monitoring
• Send all logs to a centralized Log Analytics workspace

Next steps

Now that you planned your architecture, the next tutorial guides you through creating the Azure Enclave environment for your workloads.

Related content

• Azure Virtual Desktop architecture
• AKS baseline architecture
• Best practices for Azure Enclave
• What is an enclave?
• What is a workload?