Skip to content

Security model#

Your sign-in, in your browser#

The page runs entirely in your browser and makes every change with your own delegated sign-in to Azure Resource Manager and Microsoft Graph. Microsoft tokens stay in the tab. Andy Kemp Consulting's platform only records that your organisation is approved, and each step's progress; it never receives Microsoft tokens, passwords or tenant data.

The app's permissions are delegated, so it can do only what your own roles allow, and it asks for the wider ones only at the step that needs them.

The local administrator password#

  • Generated in the page (24 characters) or typed by you. A generated one is never shown.
  • Sent once to Azure as a secure parameter, straight into your Key Vault, and only when that secret doesn't exist yet. A typed password is held in memory only, never saved in the page.
  • Session hosts read it from Key Vault through an ARM Key Vault reference, so it never passes through the page again.

The Key Vault allows template deployment so the reference works. Anyone with Contributor on the workload resource group can deploy a template that reads it: keep that role to the people who run the estate.

Registration#

The host pool registration token is created just before the session hosts are deployed, expires after two hours, and is revoked as soon as the step ends, whether it worked or not.

Storage#

FSLogix storage is reached through a private endpoint. Folder permissions are set from a session host inside your network with a temporary role, removed afterwards. The storage firewall is never opened.

Tenant-wide changes#

Every tenant-wide change shows before and after and waits for a typed APPLY. Existing Conditional Access policies only ever get the storage app added to their excluded apps, and only those that require MFA or an authentication strength for all resources.

Pinned releases#

Each version's templates and scripts are published once, at deploy.andykemp.com/releases/avd/<version>/, and never edited. A manifest holds each file's SHA-256, and the page checks every file against it before using it.