Understand Azure fundamentals for Citrix workloads
Why this domain matters
This domain tests whether you can map Citrix Virtual Apps and Desktops workload requirements onto Azure primitives. A subscription is the billing, quota, and policy boundary. Resource groups organize resources for lifecycle and delegated administration. Regions determine latency and service availability, while availability zones and availability sets provide different resilience models. Azure Resource Manager, Bicep, and ARM templates give repeatable deployments. Azure RBAC controls who can change resources, and Azure Policy enforces constraints such as allowed regions or disk SKUs.
Core rules and concepts
- Compute: general-purpose D-series and memory-optimized E-series are common for VDAs. CVAD does not require nested virtualization on Azure. Size by session density, memory per session, and peak concurrency, not by the template VM size.
- Storage: use managed disks. Premium SSD is appropriate for master images and write-heavy workloads; standard SSD can suit lighter task-worker pools. Keep the master image in a dedicated resource group and control image versions.
- Networking: plan VNet address space, subnets, NSG rules, user-defined routes, and DNS before deployment. Cloud Connectors need outbound access, not inbound public endpoints.
- Identity: Cloud Connectors and domain-joined VDAs depend on AD DS; Entra ID provides user authentication and Azure RBAC.
- Cost: Windows Azure Hybrid Benefit, reserved instances, autoscale deallocation, and egress awareness materially change the bill.
Worked example
A pool must support 300 users at 25 percent concurrency, or 75 concurrent sessions. The workload is estimated at six sessions per vCPU and 2.5 GB RAM per session. vCPU demand is 75 / 6 = 13 vCPUs; memory demand is 75 x 2.5 = 188 GB. A D8s_v5 has 8 vCPUs and 32 GB. Six hosts provide 48 vCPUs and 192 GB, so memory is satisfied and vCPU is overprovisioned. Add one host for maintenance and failure headroom, for seven hosts. The reasoning shows why memory, not vCPU, sized this catalog.
Traps that cost marks
Do not confuse an availability set with an availability zone: zones protect against datacenter failure, sets protect against host maintenance within a datacenter. Not every VM size exists in every region or zone. Assuming Citrix Cloud requires inbound firewall openings is wrong for Cloud Connectors. Assigning a service principal at subscription scope when resource-group scope is sufficient is an over-permission trap.
Key points
- Subscription, resource group, region, and zone are separate design decisions.
- CVAD on Azure uses ordinary Azure VMs; nested virtualization is not a requirement.
- Size catalogs from concurrency, sessions per vCPU, and memory per session.
- Cloud Connectors are outbound-only to Citrix Cloud; VDAs do not need public IPs.
- Azure Hybrid Benefit and deallocation are major cost levers.