Enforce recommended guardrails for Virtual Desktop

Azure Landing Zones (ALZ) Policy Initiative (PolicySet)

Policy types

Policy states

Policy categories

Total Policies: 2
Builtin Policies: 2
Static Policies: 0
ALZ Policies: 0

GA: 2

1 categories:

Desktop Virtualization: 2

Rows: 1-2 / 2

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Policy DisplayName

Policy Id

Category

Effect

Roles#

Roles

State

Type

policy in AzUSGov

Configure Azure Virtual Desktop hostpools to disable public network access

2a0913ff-51e7-47b8-97bb-ea17127f7c8d

Desktop Virtualization

Default
Modify
Allowed
Modify, Disabled

Desktop Virtualization Host Pool Contributor

BuiltIn

unknown

Configure Azure Virtual Desktop workspaces to disable public network access

ce6ebf1d-0b94-4df9-9257-d8cacc238b4f

Desktop Virtualization

Default
Modify
Allowed
Modify, Disabled

Desktop Virtualization Workspace Contributor

BuiltIn

unknown

Role

Role Id

#Policies

Policies

Desktop Virtualization Workspace Contributor

21efdde3-836f-432b-bf3d-3e8e734d4b2b

Configure Azure Virtual Desktop workspaces to disable public network access

Desktop Virtualization Host Pool Contributor

e307426c-f9b6-4e81-87de-d99efb3c32bc

Configure Azure Virtual Desktop hostpools to disable public network access

{

policyType: "Custom",
displayName: "Enforce recommended guardrails for Virtual Desktop",
description: "This policy initiative is a group of policies that ensures Virtual Desktop is compliant per regulated Landing Zones.",
metadata: {4 items
- version: "1.1.0",
- category: "Desktop Virtualization",
- source: "https://github.com/Azure/Enterprise-Scale/",
- alzCloudEnvironments: [3 items
  - "AzureCloud",
  - "AzureChinaCloud",
  - "AzureUSGovernment"
  ]
},
parameters: {2 items
- avdWorkspaceModifyPublicNetworkAccess: {3 items
  - type: "string",
  - defaultValue: "Modify",
  - allowedValues: [2 items
    - "Modify",
    - "Disabled"
    ]
  },
- avdHostPoolModifyPublicNetworkAccess: {3 items
  - type: "string",
  - defaultValue: "Modify",
  - allowedValues: [2 items
    - "Modify",
    - "Disabled"
    ]
  }
},
policyDefinitions: [2 items
- {5 items
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ce6ebf1d-0b94-4df9-9257-d8cacc238b4f Configure Azure Virtual Desktop workspaces to disable public network access ,
  - policyDefinitionReferenceId: "Modify-Workspace-PublicNetworkAccess",
  - definitionVersion: 1.*.*1.0.0,
  - groupNames: [],
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('avdWorkspaceModifyPublicNetworkAccess')]"
      }
    }
  },
- {5 items
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/2a0913ff-51e7-47b8-97bb-ea17127f7c8d Configure Azure Virtual Desktop hostpools to disable public network access ,
  - policyDefinitionReferenceId: "Modify-Hostpool-PublicNetworkAccess",
  - definitionVersion: 1.*.*1.0.0,
  - groupNames: [],
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('avdHostPoolModifyPublicNetworkAccess')]"
      }
    }
  }
],
policyDefinitionGroups: null

}