Appearance
DDE Infrastructure Overview
Purpose
This document describes the Azure infrastructure for the DDE (Azure Virtual Desktop) environment. DDE is a customer-facing environment that provides hosted application access via Azure Virtual Desktop (AVD). It runs in a completely separate Azure tenant from the primary production environment.
Key Characteristics
| Attribute | Value |
|---|---|
| Azure Tenant | ciriusdde.com (Tenant ID: ff1c5d68-4536-4407-a62a-acae3d485251) |
| Region | US West 2 |
| Repository | azure-dde-infra |
| Connectivity to primary | None — fully isolated |
| Purpose | Customer-facing hosted application via AVD |
Tenant Isolation
DDE runs in its own dedicated Azure tenant. This means:
- Separate Entra ID — no shared identity plane with the primary tenant. Users, service principals, and OIDC credentials are managed independently.
- Separate subscriptions — no resource sharing or cross-tenant access.
- No network connectivity — there is no VPN, VNet peering, or private link between the DDE tenant and the primary Azure tenant.
- Separate OIDC configuration — GitHub Actions authenticates to the DDE tenant via its own federated identity credentials, independent of the primary tenant's app registration.
This isolation is intentional and provides a strong security boundary between customer-facing workloads and internal production infrastructure.
Subscription Structure
The DDE tenant uses 4 subscriptions:
| Subscription | Purpose | Key Resources |
|---|---|---|
| Logging | Centralized monitoring | Log Analytics, archive storage, Defender |
| Main | IAM and state | OIDC federation, Key Vault, Terraform state storage |
| Billings | Customer workloads | AVD host pool, session hosts, customer VNet |
| Firewall | Network and identity | Palo Alto firewall, Panorama, AD DCs (ACTDIRAZC01, ACTDIRAZC02), Entra Connect (ENTRACAZC01) |
Active Directory and Entra Connect
The firewall subscription hosts two Active Directory domain controllers and an Entra Connect server for hybrid identity synchronization. These are colocated with the Palo Alto firewall in the firewall VNet rather than in a dedicated identity VNet (see DDE Network Topology for rationale).
Panorama
DDE Panorama was rebuilt in March 2026 (PAN-OS 12.1.2 Marketplace AMI) with the following improvements over the original deployment:
- Separate log disk with aggressive local retention settings
- 80% disk space alert configured
- Encryption at host enabled on the DDE subscription
- Log forwarding to S3/Azure Storage archive configured
Outstanding: The DDE firewall is not yet reconnected to this Panorama instance — a firewall reboot is required to restore the Panorama management connection. Scheduled for the next available maintenance window.
Termination protection gap: Termination protection for the DDE Panorama VM is not yet set in Terraform — verify and enable in the Azure portal, and add to Terraform. See Known Operational Issues in the Palo Alto overview.
Backup Coverage
Both DDE subscriptions have Recovery Services Vaults deployed with full coverage.
DDE Firewall Vault — 7 VMs protected (ACTDIRAZC01, ACTDIRAZC02, ENTRACAZC01, Palo Alto firewall, Panorama, Syslog VM, VLC). Soft delete and immutability (Unlocked) enabled.
DDE Billings Vault — 7 AVD session host backup protections, 30-day daily retention, soft delete and immutability (Unlocked) enabled.
See Backup Architecture for full vault details.
Core Components
Azure Virtual Desktop (AVD)
AVD is the primary service delivered from the DDE environment. Customers connect to hosted applications through AVD session hosts rather than accessing infrastructure directly. This provides:
- Centralized application delivery without exposing internal systems
- Session-based access that can be monitored and audited
- Controlled access to resources within the DDE tenant only
Virtual Machines
Session host VMs run the applications delivered to customers via AVD. VMs are:
- Deployed and managed via Terraform (
azure-dde-infra) - Placed in appropriate subnets based on workload classification
- Base images built in the dev environment before deployment
Networking
DDE uses a separate VNet within the isolated tenant. Traffic is inspected by the Palo Alto firewall using the same three-zone model as the primary environment.
Palo Alto Firewall Zones
| Zone | Purpose |
|---|---|
untrust | External / customer-facing traffic |
trust | Internal DDE workloads and session hosts |
mgmt | Firewall and infrastructure management |
Because DDE is customer-facing, the untrust zone handles inbound customer connections to AVD. Security policies strictly control what trust zone resources are reachable from untrust.
Storage Accounts
Storage accounts support application data and operational needs within the DDE tenant. No data is shared with or replicated to the primary Azure tenant.
Key Vault
Secrets, keys, and certificates used by DDE workloads are stored in a dedicated Key Vault within the DDE tenant. This is separate from the Key Vault in the primary tenant.
Security Tooling
| Tool | Status | Notes |
|---|---|---|
| Arctic Wolf MDR | ✅ Active | VLC confirmed showing active ingestion |
| Cortex XDR | ✅ Active | Deployed on all DDE Windows VMs and session hosts |
| MDE (Microsoft Defender for Endpoint) | ✅ Passive Mode | Passive Mode enforced alongside Cortex XDR (Active Mode causes CPU saturation) |
| Maester M365 audit | ✅ Active | Running in DDE tenant weekly via kobe-audit app registration (Graph API read-only) |
| Azure Policy (HIPAA/HITRUST + ISO 27001) | ✅ Active | Assigned to all DDE subscriptions |
CI/CD Pipeline
The azure-dde-infra repository uses the same GitHub Actions pipeline structure as the primary environment — Terraform fmt/validate, Checkov HIPAA scanning, Trivy, plan, and apply — but authenticates to the DDE tenant using its own OIDC federated credentials.
See CI/CD Pipeline Overview for pipeline details.
Compliance Posture
The DDE environment is in scope for SOC2, HIPAA, and HITRUST compliance. As a customer-facing environment handling ePHI access, key controls include:
- Tenant isolation providing a hard security boundary from internal systems
- Palo Alto firewall enforcing zone-based access control
- AVD providing session-based access without direct system exposure
- Checkov scanning on all PRs to enforce compliant infrastructure configuration
- Key Vault for secrets management within the tenant
- HIPAA/HITRUST and ISO 27001 policy assignments on all subscriptions
- Full backup coverage across all critical VMs and session hosts
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Added Panorama termination protection gap note; added Cortex XDR to security tooling; added kobe-audit app registration name to Maester entry | Kobe |
| March 2026 | Removed backup gap warning — DDE firewall vault (7 VMs) and billings vault (7 AVD session hosts) now deployed; added Panorama rebuild status (PAN-OS 12.1.2, reconnection pending); added security tooling table; updated tenant ID | Rory |
| March 2026 | Added subscription structure, AD/Entra Connect description, and backup gap warning | Rory |
| February 2026 | Initial draft | Rory |