Azure Virtual Desktop Architecture Diagram: A Complete Guide to Enterprise VDI

Core Components of Azure Virtual Desktop Architecture

The Azure Virtual Desktop service comprises many components that connect users to their desktops and apps. Most components are Microsoft-managed, but some are customer-managed.

Microsoft-Managed Components

Additionally, Azure Virtual Desktop uses global Azure services such as Azure Traffic Manager and Azure Front Door to direct users to their closest entry points.

Customer-Managed Components

Customers manage:

• Active Directory Domain Services (AD DS) and Microsoft Entra ID (formerly Azure AD)
• Azure subscriptions
• Virtual networks (VNets)
• Storage – Azure Files or Azure NetApp Files for FSLogix profile containers
• Host pools and workspaces
• Session hosts – including OS image customizations, applications, virtual network connectivity, resiliency, and backup/recovery
• User identities and access control

Customer-Managed Session Hosts

You can use other Azure services to meet your requirements:

Key Logical Components

Beyond the service components, Azure Virtual Desktop includes several logical constructs that customers manage.

Host Pools

A host pool is a collection of session hosts (Azure VMs) that provide desktops and applications to users. Host pools can be:

• Pooled – Multi-session VMs shared by multiple users
• Personal – Each user has their own dedicated VM

Workspaces

Workspaces are logical containers that group application groups. Users see workspaces in their feed, providing access to the desktops and applications published to them.

Application Groups

Application groups define which desktops or applications are available to which users. Application groups can contain:

• RemoteApps – Individual applications published to users
• Desktops – Full desktop sessions

Common Azure Virtual Desktop Architecture Patterns

Pattern 1: Baseline Architecture

A typical architectural setup for Azure Virtual Desktop follows a baseline implementation.

Download a Visio file of this architecture: virtual-desktop-get-started-diagram.vsdx

Key components:

• On-premises network – Application endpoints in the customer's on-premises network
• ExpressRoute – Extends the on-premises network into Azure
• Microsoft Entra Connect – Integrates on-premises AD DS with Microsoft Entra ID
• Control plane – Web access, gateway, broker, diagnostics, and extensibility components
• Customer-managed – AD DS, Azure subscriptions, virtual networks, storage, host pools, and workspaces

The application endpoints are in the customer's on-premises network. Azure ExpressRoute extends the on-premises network into Azure, and Microsoft Entra Connect integrates AD DS with Microsoft Entra ID.

Pattern 2: Hub-Spoke Architecture for Enterprise Scale

For enterprise-scale deployments, organizations typically use a hub-spoke architecture with multiple Azure subscriptions.

Layout:

┌─────────────────────────────────────────────────────────────────────────────┐
│                        Hub VNet (Central Services)                         │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐                       │
│  │  Azure      │  │  Azure      │  │  Azure      │                       │
│  │  Firewall   │  │  Bastion    │  │  VPN/       │                       │
│  │             │  │             │  │  ExpressRoute│                       │
│  └─────────────┘  └─────────────┘  └─────────────┘                       │
└─────────────────────────────────────────────────────────────────────────────┘
        │                 │                 │
        ▼                 ▼                 ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│   Spoke VNet  │ │   Spoke VNet  │ │   Spoke VNet  │
│  (Production) │ │  (Staging)    │ │  (Development)│
│  ┌─────────┐  │ │  ┌─────────┐  │ │  ┌─────────┐  │
│  │ Session │  │ │  │ Session │  │ │  │ Session │  │
│  │ Hosts   │  │ │  │ Hosts   │  │ │  │ Hosts   │  │
│  └─────────┘  │ │  └─────────┘  │ │  └─────────┘  │
│  ┌─────────┐  │ │  ┌─────────┐  │ │  ┌─────────┐  │
│  │ FSLogix  │  │ │  │ FSLogix  │  │ │  │ FSLogix  │  │
│  │ Storage  │  │ │  │ Storage  │  │ │  │ Storage  │  │
│  └─────────┘  │ │  └─────────┘  │ │  └─────────┘  │
└───────────────┘ └───────────────┘ └───────────────┘

Why this works:

• Centralized security – Hub contains shared services like Azure Firewall and Bastion
• Isolation – Spokes isolate different environments or workloads
• Scalability – Multiple subscriptions across hubs increase capacity
• Connectivity – Virtual network peering connects spokes to the hub

To increase capacity, enterprise customers use two Azure subscriptions in a hub-spoke architecture and connect them via virtual network peering.

Pattern 3: Enterprise-Scale Landing Zone Architecture

The Azure Virtual Desktop landing zone accelerator provides a specific architectural approach and reference implementation for enterprise deployments.

Download a Visio file of this architecture: avd-accelerator-enterprise-scale-alz-architecture.vsdx

Key design areas:

Pattern 4: Multi-Region Business Continuity and Disaster Recovery (BCDR)

For organizations requiring high availability across regions, the multi-region BCDR architecture provides guidance for deploying Azure Virtual Desktop with business continuity and disaster recovery.

Key considerations:

• Regional expansion – Deploy a new VNet with non-overlapping IP address space in the secondary region
• Global VNet Peering – Connect the new region to the primary region with Gateway Transit enabled
• On-premises access – Ensure the new region can access on-premises resources via VPN or ExpressRoute
• Profile storage – Deploy storage for user profiles in the new region
• Domain controllers – Optionally deploy a domain controller in the new region

FSLogix stores user profiles in virtual hard disk (VHD) containers. Cloud Cache can replicate profiles across regions for disaster recovery.

Pattern 5: Azure Virtual Desktop on Azure Local

For hybrid and edge scenarios, Azure Virtual Desktop can be deployed on Azure Local (formerly Azure Stack HCI).

High-level architecture:

• Control plane – Azure portal, ARM templates, Bicep templates, Azure CLI and tools at the top
• Azure Local infrastructure – Physical hardware running Azure Local provides compute, storage, and networking
• Identity – Microsoft Entra ID integration

FSLogix Profile Containers

FSLogix is the recommended user profile solution for Azure Virtual Desktop. It is designed to roam profiles in remote computing environments.

How FSLogix Works

FSLogix containers redirect user profiles to a network location:

• Profiles are placed in VHDx files and mounted at run time
• Mounting and using a profile on the network eliminates delays often associated with solutions that copy files
• The Windows Service agent needs to be installed in the VDI image

Common Storage Options

User Connection Flow

When a user wants to access their desktops and apps, there are two separate sequences:

1. Feed Discovery

The feed is the list of desktops and apps available to the user:

1. The user might be located anywhere in the world
2. Azure Traffic Manager routes the user's device to the closest Azure Virtual Desktop web service instance based on geographic traffic routing
3. The web service connects to the Azure Virtual Desktop broker service in the same Azure region
4. The broker retrieves the RDP files and application icons from the geographical database and resource directory

2. RDP Connection

After feed discovery, the user establishes an RDP connection to a session host.

Best Practices for Azure Virtual Desktop Architecture

Identity and Access Management

Key recommendations:

• Use Microsoft Entra ID as the primary identity source for modern deployments
• Hybrid identity with AD DS and Microsoft Entra Connect for existing on-premises environments
• Azure Policy to promote consistency across Azure Virtual Desktop environments

Networking

Key recommendations:

• Use hub-spoke network topology for enterprise deployments
• The hub acts as a central point of connectivity to spoke virtual networks
• The hub can also be the connectivity point to on-premises datacenters
• Private endpoints for secure access to Azure services
• Azure Firewall for centralized network security

Storage

Key recommendations:

• Use FSLogix profile containers for user profiles
• Azure Files is the most common storage option for AVD deployments
• For high-performance requirements, consider Azure NetApp Files

Reliability

Key recommendations:

• Reliability is a fundamental pillar in an Azure Virtual Desktop environment
• Pay meticulous attention to both Azure services and on-premises infrastructure components
• Use Azure Availability Zones to distribute session hosts
• Use Azure Backup and Azure Site Recovery for disaster recovery

Performance

Key recommendations:

• Optimize host pools and session hosts for reliable, cost-effective, and high-performance remote desktops
• Align with the Azure Well-Architected Framework pillars

Tools for Creating Azure Virtual Desktop Architecture Diagrams

Official Microsoft Resources

AI-Powered Tools

AI-powered tools are transforming how architects create Azure Virtual Desktop architecture diagrams. Instead of manually dragging boxes, you describe your VDI architecture in natural language, and the tool generates a professional diagram.

AI Line Studio: Generates Azure architecture diagrams from natural language descriptions in seconds. Describe a VDI architecture—"a secure Azure Virtual Desktop deployment with host pools, FSLogix profiles, hub-spoke networking, and multi-region disaster recovery"—and it produces a structured diagram with official Azure icons. For Azure-specific workflows, use the dedicated AI cloud diagram generator.

Visual Paradigm AI Cloud Architecture Studio: A browser-based AI tool that aligns your infrastructure with Azure Well-Architected Framework and enterprise best practices.

GenAI-DrawIO-Creator: An AI-powered diagram generation tool that creates, modifies, and enhances diagrams through natural language commands with support for Azure, AWS, GCP, and Kubernetes.

Manual Diagramming Tools

Draw.io (diagrams.net): A free, browser-based tool with a built-in Azure shape library. Enables you to create professional Azure Virtual Desktop architecture diagrams with official Azure icons.

Microsoft Visio: The recommended tool for creating Azure architecture diagrams. Reference architectures in the Azure Architecture Center include downloadable Visio files.

Summary

Key takeaways:

• Azure Virtual Desktop follows a shared responsibility model—Microsoft manages the control plane; you manage session hosts, storage, and identity
• Enterprise deployments typically use a hub-spoke network topology with multiple Azure subscriptions
• FSLogix profile containers (with Azure Files or Azure NetApp Files) are the recommended user profile solution
• Azure Availability Zones, Backup, and Site Recovery provide reliability and disaster recovery
• Microsoft Entra ID and AD DS integration provides hybrid identity for enterprise environments
• Official Visio files are available from the Azure Architecture Center for baseline, enterprise-scale, and landing zone architectures
• AI-powered tools can generate Azure Virtual Desktop architecture diagrams from natural language in seconds

To start building your own Azure Virtual Desktop architecture diagrams, explore the Azure architecture diagram tool for templates and examples. For automated diagram generation, try the AI cloud diagram generator to turn a VDI description into a visual instantly.