Large-scale VDI deployment management with Active Directory and domains

Question

Hello

I am working for a start up and deployed RDS persitent VDI for just one enterprise which works perfectly.

Now office wants to offer Persitent VDI to multiple company. I don't have much experience and would appreciate a guidance and solution for large-scale deployment.

Do i have to create one Forest or multiple Forest?
Do i have to create a Parent Domain then multiple child domain?
Do i have to create multiple Domains?

I don't want the Enterprise to be able to see each other or access other Enterprise files or software. like Teams and others.

I intend to create multiple vlans per enteprise, my concern is Active Directory, RD broker, RD gateway and RD web.

I will appreciate feedback, insight on how to create the domains and trust relationship.

Best regards

Answer 1

Ossniper,

Thanks for asking this question. If I understand correctly, you have a need to provide AVD as a VDI solution to multiple customers.

I do have some clarifying questions, but I will also provide some general suggestions to point you in the right direction.

First, when you say your "office" -- are you an MSP or a large enterprise with multiple business units/enterprises? Will billing for these resources be separated?

Second, are there any other business requirements outside of simply keeping these enterprises separate?

1. Are there local network resources, services, etc. that need to be accessible by the VDI?
2. Does an on-premises domain already exist? Is AD Connect already in place?
3. Are there any regulatory requirements?
4. Are there any conditional access requirements from a cybersecurity standpoint? Any tools that need to be installed?
5. Will profiles be stored separately with FSLogix and apps with MSIX App Attach to allow for scaling?
6. How many users will be accessing each host pool? What applications will be needed?

These are just a few of the considerations needed prior to deployment.

When architecting something to a large scale, it's important to gather as many requirements as possible from the beginning and try to best fit the solution within a best practice framework.

If you are an MSP - I would recommend looking at Azure lighthouse for management of multiple subscriptions. Also, the Microsoft Well Architected Framework provides patterns and practices that can help design a solution from the beginning.

There are a few different 3rd party vendors that are providing management planes for AVD -- most notable Nerdio, but also Citrix and VMWare. It might be worthwhile to investigate these options though there is cost associated.

I would also recommend reaching out to another Microsoft Partner for guidance here, there are many that have developed expertise with AVD and it sounds like this is a larger project than the Q&A forum can help you with.

Please provide more context and I will help as best as I can.

Resources:

• https://learn.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop?context=%2Fazure%2Fvirtual-desktop%2Fcontext%2Fcontext
• https://learn.microsoft.com/en-us/azure/lighthouse/overview
• https://learn.microsoft.com/en-us/azure/architecture/framework/
• https://appsource.microsoft.com/en-us/marketplace/partner-dir

If this answer was helpful, please accept it as an answer. It's appreciated.

Blessings,
Eric

Answer 2

Hello there,

Do i have to create one Forest or multiple Forest?

-First, determine if there are any organizational requirements that require a completely separate set of security policies. Frame the conversation with a focus on data security:
-Are there over-arching policies you can set at the AD forest level?
-Do you need additional domains with different security policies or segregated network connectivity?
-Are there legal or application requirements that require separate domains in the forest?

Multi-forests do provide an extra layer of security across the two domains, but at a significant increase to IT cost. Multi-forests do not make you more secure by default. You still need to configure GPOs and permissions appropriately for each AD forest.

Do i have to create a Parent Domain then multiple child domain?Do i have to create multiple Domains?

The below facts will drive the decision:

-Keeping two separate IT teams, each team supporting and having full control on their branch.
-Users may travel between branches.
-There is a decent VPN connection between the two branches.
-Will have one Exchange hosted service (office 365) with the same domain (@TheCompany.com).
-Two separate DNS in each branch managed by the branch's IT team.

-----------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 3

Hello connections.

Thank you so much for your response. I really appreciate your feedback.

We are a Startup data center targeting Mid-size organization from 5-50 users.

1. We want to provide VDI, M365, Mail, Onedrive, Azure backup, Azure Storage, Lighthouse and all Microsoft services through our Account.
2. VDI's will be hosted at our data center as each organization have different requirement viz, accounting, designing, drafting, documenting, high graphics, etc etc
3. We want each organization to be separate, but controlled by our domain.
4. There can be more than 300 organization with 5-50 users under each organization.
5. Customer Billing will be done, under our company, as we are providing different services to different organizations.
6. We will have our own AD, DNS, DCHP for on premises IT infrastructure.
7. We plan to sync AD to Azure AD via AD Connect.
8. Important concern is, 'AAA' organization shouldn't be able to commnicate with 'BBB' organization.
   Neither, organization should be able to see / view organization under our domain.

like aaa.aaa.com shouldn't be able to communicate / view bbb.aaa.com or ccc.aaa.com... can this be done by GPO or third-party ?

9. Should we consider sub-domain topology or any other is suggested ?

I look forward to your feedback

Best Regards