Public sector
Council AVD support without Azure Portal access
A local authority wanted to keep privileged Azure with a small cloud team, and let service desk or a service owner act on their own pools without a ticket.
Example setup for this sector. Not a named customer, and not a results claim.
The estate
Pooled AVD for social care, revenue, and civic staff, hosted in UK South.
The problem
Service desk could not act on a locked session after 5pm. Service owners logged tickets to the cloud team and waited hours. Security would not approve Portal access for first line or the business.
What they set up
- 1
Register an Entra app the cloud team owns. Grant only Desktop Virtualization roles on the AVD subscription.
- 2
Limit help desk to the civic and social-care pools. Invite a social-care service owner with help desk on that pool only.
- 3
Keep the finance pool for session admins. Encrypt the client secret and rotate it from settings when it nears expiry.
- 4
Keep SSO and SCIM off until the directory team is ready. Email and password is enough for the first users.
What that gives them
- First line and a service owner work in a browser console. They never see the Azure Portal.
- A locked session after 5pm does not need a ticket to the cloud team.
- Privileged Azure stays with the cloud team.