What Simform’s Azure Virtual Desktop Specialization Means for Modernizing Legacy VDI on Azure

Simform has earned the Microsoft Azure Virtual Desktop (AVD) specialization, its tenth advanced specialization from Microsoft, by passing a third-party audit and meeting Microsoft’s rigorous performance and skilling requirements.

This milestone adds AVD to a Microsoft-validated Azure portfolio spanning cloud migration, enterprise applications, networking, security, and other specialized workloads.

That breadth allows Simform to approach AVD as part of the wider Azure estate rather than as a separate desktop project, with the applications, infrastructure, identity, controls, and operations around it addressed as part of the same program.

The Microsoft Azure Virtual Desktop specialization validates that a partner has deployed, optimized, and secured virtual desktop infrastructure on Azure for real customers, to a standard an independent auditor has checked. An aligned Solutions Partner designation is a prerequisite, with the AVD specialization adding workload-specific performance, skilling, and audit requirements.

Microsoft sets four requirements for the specialization, listed in Partner Center.

• An aligned designation. The partner holds an active Solutions Partner designation in the Infrastructure solution area.
• Customer consumption. Azure Virtual Desktop usage comes from at least three customers over the previous three months.
• Certified engineers. At least three people hold the Azure Virtual Desktop Specialty certification, alongside certified Azure architects, administrators, and security engineers.
• A third-party audit. An independent auditor reviews the partner’s delivery evidence including documented design decisions, migration controls, testing, governance, and production operations, before Microsoft grants the specialization.

For enterprises, the audit provides an additional level of assurance that Simform has worked through the architecture and operating decisions that determine whether AVD remains secure, performant, resilient, and manageable after deployment. It validates the engineering around the desktop as much as the desktop layer itself.

Simform addresses AVD alongside the Azure infrastructure, applications, identity, networking, security, and operations it depends on.

It gives teams a stronger basis to:

• Reduce migration rework by resolving application, identity, networking, and security dependencies earlier.
• Shorten the path to production with architecture, recovery, and operational requirements defined before rollout.
• Improve security and resilience by building controls into the target environment rather than adding them later.
• Keep performance and cost visible through workload-aware sizing, scaling, and ongoing consumption monitoring.
• Create clearer ownership across migration, production operations, and future changes to the environment.

Because Simform’s Microsoft-validated capabilities span infrastructure, applications, security, and cloud operations, AVD can be planned as part of the wider Azure transformation, with fewer handoffs and an environment designed for production from the start.

Our approach is to resolve the operating decisions around AVD before users move. Seven areas matter most:

1. Azure foundation is designed before the desktop layer

AVD inherits the strengths and weaknesses of the Azure environment around it. Landing zones, network topology, segmentation, private connectivity, DNS, and access to dependent applications all shape how secure, responsive, and scalable the desktop environment will be.

Designing that foundation first reduces late-stage migration issues and avoids reworking core networking after users are already in production. Application dependencies are mapped at the same stage so connectivity, identity, and compatibility issues surface before migration.

2. Scale is decided by host pool design

Host pools are designed around workload profile, application demand, isolation needs, and cost targets. Segmenting users by actual demand helps protect performance without overprovisioning lighter workloads.

Validating those assumptions before wider rollout gives enterprises a more predictable balance between user experience, capacity, and compute cost as demand changes.

3. Security reaches the user session

AVD security has to extend beyond the Azure perimeter. Identity, access, endpoint controls, and data protection need to follow the user into the virtual workspace.

Entra ID, Conditional Access, MFA, Defender, and Intune help govern who can access the environment and what happens within the session. This reduces exposure while allowing legacy application dependencies to be modernized gradually rather than forcing every system to change at once.

4. Performance starts with profiles and application delivery

Profile storage and application delivery directly affect sign-in times and responsiveness. FSLogix, RemoteApp, and full-desktop delivery should be selected around workload, consistency, and maintenance requirements rather than as default choices.

Getting those decisions right gives users a more consistent experience while making session hosts easier to patch, rebuild, and maintain as workloads change.

5. Cost is designed in before autoscale optimizes it

Host size, user density, storage, region strategy, and resilience requirements establish the cost baseline before users ever sign in. Those architectural choices have a much larger impact on spend than optimization measures added after go-live.

Autoscale can then reduce idle compute as demand changes. SimOps, our cloud management platform, provides visibility into Azure consumption and cost so teams can track when actual usage starts moving away from the assumptions the environment was designed around.

6. Operations are engineered during the build

Infrastructure as code, centralized monitoring, governed image management, and tested recovery should be designed into the environment before go-live. These controls make changes easier to review, reproduce, and audit as the environment evolves.

For managed environments, Simform’s 24×7 services cover monitoring, incidents, changes, recovery, and ongoing optimization, with SimDesk supporting service operations.

7. Migration is treated as a controlled transition

Users, applications, and dependencies move through pilot groups and migration waves, with rollback and stabilization built into the plan. This gives teams time to validate application behavior, access, profiles, and performance under real usage.

Legacy infrastructure is decommissioned only after the target environment has proved stable, reducing business-continuity risk and avoiding an irreversible cutover before the new environment is ready.

The audit reinforced an important point: Microsoft validates delivery rigor, not a single reference architecture. The two customer environments reviewed started from very different constraints, and the designs reflected them.

What stayed consistent was the delivery discipline: define the operating requirements, make the architecture decisions explicit, validate them, and move users only after the target environment is ready.

Replacing legacy Citrix with a resilient Azure foundation

For a financial services client, the starting point was a hosted Citrix XenApp environment supporting a business-critical recordkeeping platform. The goal was not to reproduce that setup in Azure, but to remove the legacy hosting dependency and rebuild the environment around stronger security, resilience, and operational control.

Simform designed a CAF-aligned, hub-and-spoke Azure foundation with AVD isolated in its own network segment. Users were split across light, medium, and heavy workload profiles so capacity could be matched to application demand. Identity and access controls were strengthened through Entra ID, Conditional Access, and MFA, while security monitoring was centralized and cross-region disaster recovery was built into the target architecture. The Azure infrastructure was provisioned entirely through Terraform, and the old environment remained available through a two-week stabilization window before decommissioning.

The client retired both Citrix and the legacy hosting dependency, while gaining centralized security monitoring, fully repeatable infrastructure deployment through Terraform, and a tested cross-region recovery model.

Building a cloud-only workspace that keeps sensitive data off endpoints

A legal-services client had a different requirement. Roughly 150 users needed a consistent Windows workspace that could be accessed from managed or personal devices without sensitive client data being stored on those endpoints. Instead of modernizing an existing VDI estate, Simform designed a cloud-only AVD environment from the ground up.

Session hosts were joined directly to Entra ID, with Conditional Access and MFA governing sign-in. FSLogix profiles were stored on Azure Files, while Intune, Defender for Endpoint, Purview, and network isolation extended security controls into the session itself. Applications and client data remained inside the managed Azure workspace, giving users access from approved devices without moving sensitive information onto the endpoint.

A successful AVD program is one that remains secure, responsive, cost-efficient, and manageable after migration. Getting there means resolving application, infrastructure, identity, security, recovery, and operational decisions before they become production issues.

Simform’s Azure Virtual Desktop specialization provides independent validation of that delivery experience and builds on its broader Microsoft relationship, continued investment in Azure engineering, certified talent, and production delivery.

For teams moving from legacy VDI or expanding an existing AVD estate, the priority should be to define the target operating environment first and sequence the migration around it.