Cloud Workplace Foundation
Azure Virtual Desktop and Windows 365 in one architecture, one configuration and one operation. You decide which desktop fits each user group; we build the platform underneath as code and run it. The second user group is no longer a project — it's a use case.
Every one of these desktops was the right call
The first virtual desktop is usually a host pool for the call center, cleanly built, and users are happy. Then the engineers show up with their own machines, colleagues working from home need Windows 365, and the shift workers at the site need Frontline. Every one of those decisions made sense at the time, and every one of them dragged along its own chain of obligations that nobody signed up for.
- New desktop typeAnother project and another team that has to know it
- Custom imageOne more Golden Image that someone maintains by hand
- Manual patchingPatch weekends and sessions someone has to sign off on
- Duplicate app packagingThe same application built and tested twice
- DriftAfter a year, no environment looks like any other
- Cost and riskMore hands in operations and more surface area for errors
- With Cloud Workplace Foundation
- One framework
- One image process
- One packaging
- No drift
Without a framework, every desktop is a special case
This isn't a reflection on the teams that built the environments; it's because each one was created as its own product. Three consequences show up almost everywhere.
- CostEvery desktop type has its own hosts, its own images and its own institutional knowledge. That means capacity can only be planned per environment, not per user group, and you end up paying for reserve capacity that rarely gets used.
- RiskSecurity baselines maintained by hand drift apart over time. What applies on one host pool is missing on another, and the question of which state is currently in production ultimately gets answered by an audit.
- SpeedA new team gets a new project: design, image, policies, packaging, sign-off. Weeks pass before the first secure desktop is ready, even though every building block has long existed somewhere in the organization.
Four desktop types, one framework
Each user group gets the desktop that fits the way they work, and all four run on the same platform. Applications and client configuration are consistent everywhere; only the infrastructure underneath differs. For Azure Virtual Desktop, we build and operate it as code; for Windows 365, Microsoft operates it and we provide the Azure Network Connection and the configuration on top. Choosing a type is therefore a question of workload, not architecture.
Azure Virtual DesktopAVD PooledMultiple users share a session host. The most cost-effective option when many people work in similar ways. | Azure Virtual DesktopAVD PersonalEach user gets their own virtual machine, with their own state and full performance. | Windows 365Windows 365 EnterpriseA personal Cloud PC per user, infrastructure at Microsoft. The desktop for everyone who works from anywhere. | Windows 365Windows 365 FrontlineDedicated Cloud PCs for employees who work in shifts and only need their desktop during their shift. | |
|---|---|---|---|---|
| Individual desktop per user | not included | included | included | included |
| Shared session hosts with scaling plans | included | not included | not included | not included |
| New image from the Image Factory every month | included | not included | not included | not included |
| License follows the shift, not the headcount | not included | not included | not included | included |
| Infrastructure as code, operated by glueckkanja | included | included | not included | not included |
| Infrastructure operated by Microsoft, Azure Network Connection by glueckkanja | not included | not included | included | included |
| Intune Policy Blueprints and Defender for Endpoint | included | included | included | included |
| RealmJoin with more than 2,500 applications | included | included | included | included |
| Typically for | Call centers, external users, seasonal workers | Engineers, Power User | Remote Knowledge Worker | Frontline, shift workers |
- Individual desktop per user
- Shared session hosts with scaling plans
- New image from the Image Factory every month
- License follows the shift, not the headcount
- Infrastructure as code, operated by glueckkanja
- Infrastructure operated by Microsoft, Azure Network Connection by glueckkanja
- Intune Policy Blueprints and Defender for Endpoint
- RealmJoin with more than 2,500 applications
Typically for: Call centers, external users, seasonal workers
- Individual desktop per user
- Shared session hosts with scaling plans
- New image from the Image Factory every month
- License follows the shift, not the headcount
- Infrastructure as code, operated by glueckkanja
- Infrastructure operated by Microsoft, Azure Network Connection by glueckkanja
- Intune Policy Blueprints and Defender for Endpoint
- RealmJoin with more than 2,500 applications
Typically for: Engineers, Power User
- Individual desktop per user
- Shared session hosts with scaling plans
- New image from the Image Factory every month
- License follows the shift, not the headcount
- Infrastructure as code, operated by glueckkanja
- Infrastructure operated by Microsoft, Azure Network Connection by glueckkanja
- Intune Policy Blueprints and Defender for Endpoint
- RealmJoin with more than 2,500 applications
Typically for: Remote Knowledge Worker
- Individual desktop per user
- Shared session hosts with scaling plans
- New image from the Image Factory every month
- License follows the shift, not the headcount
- Infrastructure as code, operated by glueckkanja
- Infrastructure operated by Microsoft, Azure Network Connection by glueckkanja
- Intune Policy Blueprints and Defender for Endpoint
- RealmJoin with more than 2,500 applications
Typically for: Frontline, shift workers
Updates without interruption
We don't patch pooled hosts in place; we rebuild them every month from a new image. The Image Factory produces it, you review it in staging, then it rolls out as a Green/Blue Deployment: new hosts enter the pool, users switch over at their next login, and the old hosts stay up until nobody needs them anymore. Rolling back is always an option, and patch weekends are gone for good.
- 1Build imageMonthly from code, with the latest updates and your application base
- 2Provision stagingThe new image is made available in a staging environment
- 3Validate imageYou test it with your applications and provide feedback within two business days
- 4Swap hostsNew hosts built from the image enter the pool, users switch at their next login
- 5Keep fallbackThe previous hosts remain until everyone has switched; rollback is available at any time
- 2,500+pre-packaged applications in RealmJoin
- 100 %Infrastructure as Code, from the landing zone to the policy
Certified operationsCloud-native, as code
What makes the difference
Cloud Workplace Foundation is 100% Infrastructure as Code: OpenTofu, TerraProvider, Packer and GitHub, operated under ISO 27001. Every environment can be reproduced from it, every change has a plan and a history, and the documentation isn't written by hand — it's generated from code every night. That makes it the only documentation that is guaranteed to reflect the current state.
All hosts are Entra ID joined. There are no domain controllers in the VDI environment, and older applications that need Kerberos get it through Entra Kerberos and Cloud Kerberos Trust. New Microsoft features flow continuously into the blueprints without anyone having to rebuild the environment. The platform doesn't age; it gets maintained.
- Entra ID nativeAll hosts Entra ID joined, no domain controllers in the VDI, Entra Kerberos and Cloud Kerberos Trust for legacy applications
- EvergreenNew Microsoft features flow continuously into the blueprints without requiring a rebuild of the environment
- Documentation AppDocumentation of your environment is regenerated from code every night
- 100 Percent Infrastructure as CodeOpenTofu, TerraProvider, Packer, GitHub. Optionally Azure Confidential VMs for regulated data
What changes for your organization
One platform instead of multiple products delivers improvements in four areas simultaneously, for every user group you have today and every one that comes later.
SpeedA new user group is a use case on the existing platform, not a project with a steering committee. Define, parameterize, deploy, validate, go live.
CostCapacity is planned per user group and scales with actual demand. You pay for what you need, not for what was budgeted two years ago.
SecurityThe same security baseline on every desktop, whether Pooled, Personal or Cloud PC, validated as code and kept current with Microsoft every month. An audit becomes a question that the code answers.
ContinuityMonthly image lifecycle, evergreen updates, monitoring and service reviews are all part of the managed service. Your team keeps the decisions and hands off routine operations.
Every new user group starts on the same platform
A use case for us is a user group with its desktop type, its applications and its rules. It moves through five steps, either in parallel with the foundation setup or afterward, with multiple use cases running at once if needed, and every additional group takes the same path. Once you've been through it, you know it the second time around, and by the third time the pipeline knows it too.
Four typical use cases
- AVD PooledCall centerMany identical workstations, capacity follows the time of day
- AVD PersonalEngineersOwn tools and full performance on a dedicated VM
- Windows 365 EnterpriseRemote Knowledge WorkerThe same personal desktop, regardless of location
- Windows 365 FrontlineShift operationsOne Cloud PC per shift, not per person
The path every group follows
- 1DefineUser group, desktop type, applications, network and security requirements
- 2ParameterizeThe blueprint becomes your use case: parameters in code, not in the portal
- 3DeployThe pipeline deploys infrastructure, policies and applications
- 4ValidateYou test with pilot users and your line-of-business applications
- 5Go liveThe user group switches over and the managed service takes it from there
You decide where each workload runs; we operate the platform
What stays with you is what only you can know: which line-of-business applications your people need and whether a new image works with them. Everything below that we operate as a managed service, down to the landing zone, which we take over with the Azure Foundation if you don't have one yet. The boundary is clearly drawn where knowledge of your applications is required, not knowledge of Azure.
- Your users and applicationsLine-of-business applications, end-user support, approval of the new image in stagingYou or your partner*
- Use cases per user groupDefine, Parameterize, Deploy, Validate, Go live, for every additional group on the same platformglueckkanjaCloud Workplace FoundationInfrastructure as code, monthly image lifecycle, Intune Policies and Defender, RealmJoin, monitoring and alerting in your tenant, monthly service reviewCloud PCs: Microsoftglueckkanja
- Landing ZoneSubscriptions and management groups, hub network, governance as code. Operated by you or your partner; with the Azure Foundation, we take over this layer too.Azure Foundation
Without the Azure Foundation, the landing zone stays with you; we operate everything above it up to your line-of-business applications.
* You also retain functional testing of your line-of-business applications, Microsoft licenses, Azure consumption and RealmJoin licenses.
From ramp-up to your first users
- Define the scopeDefine the scopeThe ramp-up project: design, rules, permissions and processes. Together we establish what the platform looks like in your tenant and who can do what.
- Build the foundationBuild the foundationThe foundation setup: infrastructure, IaC pipelines, Intune baselines, networking including Azure Network Connection, security and tooling, all as code.
- Roll out user groupsRoll out user groupsThe use case deployments: Define, Parameterize, Deploy, Validate, Go live for each user group. In parallel with the foundation setup or afterward, multiple at the same time if needed.
- Operate the platformOperate the platformManaged Operations: monitoring, image lifecycle, evergreen, monthly service review. From here on, every new user group is a use case, not a project.
What comes before and after
No slides, just your architecture
The briefing with the Azure team 60 minutes
In 60 minutes we walk through your desktop landscape: which user groups you have, which desktop type fits each one, and what Cloud Workplace Foundation takes off your plate. No slides — your architecture on the table, and by the end a clear picture of what your platform would look like. You'll get a meeting proposal, not a sales call.
User groupsCurrent stateWhich groups are on which desktops today and what's coming next
Desktop typesMappingPooled, Personal, Enterprise or Frontline per user group, with reasoning- Operating modelResponsibilitiesWhat glueckkanja takes over, what stays with you, and what your landing zone needs for that
Next stepRamp-upWhether a ramp-up project is the right entry point and what it takes on your end
Questions we hear in the first conversation
Answered briefly. If your question isn't here, ask us below.
Isn't Windows 365 managed by Microsoft?
Yes, the infrastructure. Compute, storage and the provisioning of Cloud PCs are Microsoft's responsibility, which is exactly why no Image Factory is needed for that part. Network, policies, security baselines and applications, however, remain with you, and that's where Cloud Workplace Foundation comes in: with the Azure Network Connection, Intune Blueprints, Defender for Endpoint and RealmJoin, on the Cloud PC just as on the session host.
We already have Azure Virtual Desktop or another VDI.
That works fine. Cloud Workplace Foundation is a platform, not a big-bang migration. User groups move over as use cases one at a time, the existing environment keeps running in the meantime, and in the end you're operating one world instead of two.
Our apps require Active Directory.
In most cases they need Kerberos, not the domain controller. All hosts are Entra ID joined, and legacy applications and file shares still get their Kerberos tickets via Entra Kerberos and Cloud Kerberos Trust. A classic AD domain join for session hosts is deliberately not supported by the platform.
We want to filter session host traffic through a firewall or proxy.
With us, Zero Trust ends at the endpoint, not the firewall. Defender for Endpoint handles web and network protection on every host, which eliminates the central bottleneck in the path. Designs that incorporate a firewall or proxy are possible, but they fall outside the blueprint and require additional effort.
Do we need other managed services from glueckkanja for this?
No. Cloud Workplace Foundation uses Entra ID, Intune, Defender and RealmJoin as building blocks, but does not depend on any other managed service. If you already have Managed Intune or Managed Entra, your virtual desktops join the same blueprint. If not, you still get the full platform.
What licenses do we need?
Microsoft 365 E3 with E5 Security and Intune Plan 1 as the base. For Windows 365, Enterprise or Frontline licenses are added per user group; for RealmJoin, the RealmJoin license applies. Licenses stay with you; license advisory is not part of the service.
How long does it take to get to the first desktop?
It depends on the landing zone, networking and the first user group, so we don't quote a blanket number we'd have to walk back later. The foundation setup and the first use case run in parallel, and in the briefing we'll tell you what to expect for your specific landscape.
We operate in a regulated environment and have specific data processing requirements.
For that, Azure Confidential VMs are available as an optional choice for session hosts, keeping data encrypted even during processing. The platform itself is operated under ISO 27001, and both monitoring and Log Analytics run in your own tenant.
What's not included?
The landing zone, which you either already have or can get through the Azure Foundation; end-user support; functional testing of your line-of-business applications; Windows Server or other operating systems as session hosts; and Microsoft licenses, Azure consumption and RealmJoin licenses. Physical device management and MDM for iOS and Android are not part of the platform, though both are available as an extension with Managed Intune.
