A company needs to give contractors access to an internal application without installing it on unmanaged laptops. Shared passwords and publicly exposed Remote Desktop ports would create more problems than they solve.
The practical starting point is to create a host pool in Azure Virtual Desktop, then connect properly configured session hosts, publish a desktop, and authorize a pilot group. Creating the host pool alone does not provide a working desktop; identity, networking, licensing, and user assignments complete the solution.
This tutorial walks through a pooled desktop deployment with Microsoft Entra joined session hosts and explains what must be tested before expanding access.
Understand the Azure Virtual Desktop Architecture
Azure Virtual Desktop, or AVD, delivers Windows desktops and applications remotely. Its main components have different responsibilities:
| Component | Role |
|---|---|
| Host pool | Groups session hosts with common configuration |
| Session host | Windows virtual machine where users run applications |
| Application group | Publishes a desktop or selected applications |
| Workspace | Makes registered application groups discoverable to users |
| Client | Connects the user to an authorized desktop or application |
A pooled host pool lets multiple users share session-host capacity. A personal host pool assigns desktops to individual users.
For an internal employee-portal application, pooled Windows 11 Enterprise multi-session hosts can improve resource utilization. A personal desktop may fit users who need a dedicated machine or persistent machine-specific customization. Licensing and application compatibility still require validation.
For a service overview, review what Azure Virtual Desktop is.
Pro Tip: I recommend drawing the user-to-workspace-to-application-group path before deployment. It makes missing assignments much easier to identify later.
Before You Create a Host Pool in Azure
Use a small pilot rather than deploying the entire organization immediately.
Example design:
- Resource group:
rg-avd-pilot-eastus. - Host pool:
hp-employee-desktop-pilot. - Workspace:
ws-employee-pilot. - Two session hosts using the same supported image.
- Microsoft Entra security group:
sg-avd-pilot-users. - An existing virtual network and dedicated session-host subnet.
An Azure subscription provides the billing and governance boundary. A resource group logically organizes resources; separating pilot hosts from unrelated workloads also simplifies permission scoping.
Choose the session-host region based on user proximity, application dependencies, storage latency, and VM availability. The host pool’s metadata location is a separate choice from the session-host VM region.
Confirm licensing, permissions, and quotas
Each user needs an eligible license. Requirements differ for internal employees, external commercial users, Windows client desktops, and Windows Server session hosts. Do not assume that paying for Azure VMs includes every access right.
Administrators need permission to create AVD, compute, and networking resources. Assigning user roles requires separate role-assignment privileges.
Check regional vCPU quota and VM-family availability before deployment. For background, see resource groups versus subscriptions.
Cost warning: creating session hosts incurs charges for compute, disks, and associated services.
Pro Tip: I recommend testing licensing and regional cap