IT playbook · AI Employee: Ivy

AVD Assignment

AVD ready on next login

Install this playbookBack to marketplace
The problem

Azure Virtual Desktop (or VMware Horizon, Citrix, AWS WorkSpaces) assignment is manual + inconsistent. New employee needs a virtual desktop; IT ops manually assigns from the correct pool, configures apps, joins to session host, sets up profile. Contractor + external users need scoped access with time limits. Reassignment on role change means retiring old VD + provisioning new. Manual = slow + error-prone; scale increases both.

At a glance
Trigger
Chat + form
Approvals
Manager approval
What it does
Writes to your systems
Systems
Azure Virtual Desktop · Intune
How it feels in production

An hour-by-hour walkthrough.

New contractor Kiran starts 2026-11-01, needs AVD access for the specific SaaS the customer requires him to work in. Ivy picks up the HRIS event 5 days before start: - Contractor engagement, end date 2027-05-01 (6 months) - Role: Contract Engineer, cost center CC-CUSTOMER-XYZ - AVD requirement: pool 'contractor-secure' (locked-down, scoped access) - App requirements: specific customer SaaS + Office suite + browser - Session limits: 8 hours/day, disconnected auto-log-off after 15 min idle Ivy provisions: - Assigns Kiran to contractor-secure AVD host pool - Configures profile with FSLogix container in restricted storage account - Assigns required apps via MSIX app-attach - Sets session policies (time limits, USB restrictions, clipboard controls) - Configures Conditional Access requiring MFA + compliant device - Sets engagement-end auto-deprovision for 2027-05-01 Kiran gets AVD access on day 1. On engagement end, Ivy auto-deprovisions: revokes assignment, deletes user profile per retention policy, releases the license back to the pool.
How it works

Step by step.

  1. 01

    Detect assignment need + resolve requirements

    HRIS event or manager request. Role-based AVD pool + app requirements resolved from catalog.

    HRIS · AVD catalog · Role registry
  2. 02

    Provision to correct host pool

    Assign to appropriate pool (employee-standard, contractor-secure, developer-elevated). Session capacity + policies applied.

    Azure AVD · VMware Horizon · Citrix · AWS WorkSpaces
  3. 03

    Configure profile + apps + policies

    FSLogix profile in appropriate storage. Apps via MSIX app-attach or vendor packaging. Session policies per pool.

    FSLogix · MSIX · App-attach · Session policies
  4. 04

    Apply access controls

    Conditional Access, MFA requirement, device compliance requirement, network restrictions per pool.

    Azure AD Conditional Access · MFA · Compliance policies
  5. 05

    Schedule deprovision on end date

    Contractor engagement end triggers auto-deprovision. Profile retention per policy; license released.

    Scheduler · AVD deprovisioning · License pool
Systems and wiring

What you connect to make this run.

Azure AVD · VMware Horizon · Citrix · AWS WorkSpaces

read+write

Primary virtual desktop platform. Assignment, session control, deprovisioning.

FSLogix · Profile management

read+write

User profile containers. Storage account per pool sensitivity.

Azure AD · Conditional Access

read+write

Access control policies + MFA + device compliance for VD access.

HRIS · License pool

read

Employment status + engagement dates drive provisioning + deprovisioning lifecycle.

What changes

Before and after, honestly.

Time from employee start to AVD access
Before
1-5 business days
After
Same-day (day 1)
IT hours per AVD provisioning
Before
45-90 minutes
After
5-15 minutes
Contractor VD deprovisioning on engagement end
Before
30-70% timely
After
99%+ (auto-triggered)
License utilization efficiency
Before
60-75% (deprovisions delayed)
After
90%+
Related

Playbooks that pair with this one.

IT

New Hire Provisioning

AVD is one component of full new-hire provisioning.

IT

Contractor Access Expiration

Contractor VD deprovisioning coordinated with broader access expiration.

IT

License Reclamation

Deprovisioned VDs release licenses back to pool.

Frequently asked

Answers about this playbook.

What about BYOD accessing corporate VDs?

BYOD access supported with compliance requirements: MFA required, no local file save allowed, session recording per policy.

How does it handle GPU-intensive workloads (design, ML)?

GPU-enabled pools for specialized workloads. Provisioning routes based on role + workload requirements.

What about multi-region users needing low-latency access?

Regional pool selection per user location. AVD deployed in multiple Azure regions; user assigned to nearest.

How does it handle temporary access spikes (contractor surge, event)?

Auto-scaling host pools accommodate surge. Idle scale-down after event reduces cost.

Can users have persistent vs. non-persistent desktops?

Both supported per pool config. Persistent (dedicated) for developers; non-persistent (pooled) for contractors + kiosk-style users.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore IT playbooks