Build a Virtual Desktop Infrastructure Solution — System Design Interview Practice

Interview prompt

Design a secure virtual-desktop platform with pooled and personal desktops, profile persistence, identity integration, elastic capacity, application delivery, and predictable user logon behavior.

• Define desktop assignment, host-pool capacity, user/profile identity, session lifecycle, application entitlement, and disconnect/reconnect semantics.
• Separate control-plane provisioning from session brokering and profile storage; scale hosts on demand while protecting logon capacity.
• Explain multi-session isolation, image/version rollout, profile locking, host failure, regional recovery, and idle-session cost controls.
• Cover privileged access, endpoint security, auditability, monitoring, and a degraded mode when identity or profile services fail.

Requirements and scale assumptions

• Provision host pools and images, authenticate users, assign sessions, mount profiles, deliver applications, and reconnect users after interruption.
• Support pooled/personal desktops, autoscaling schedules, drain/maintenance, profile backup/restore, device posture, and admin audit.
• Handle host and profile-store failure, revoke access, roll back images, and preserve user work during control-plane or network degradation.
• Meet p95 logon time under 30 seconds and reconnect a healthy session within 10 seconds.
• Scale to 50k concurrent sessions with bursty morning logons without a single hot key or unbounded synchronous work.
• Do not lose committed state; make retries and duplicate events safe.
• Degrade safely when downstream workers, caches, or external dependencies fail.
• 50k sessions, 5k hosts, and 10x morning logon burst
• Partition by the primary tenant, user, item, or geographic key and isolate hot partitions.
• Keep serving state bounded; retain raw events or durable records for replay and auditing.

• Peak scale: 50k sessions; 5k hosts; 10x burst — Capacity assumption that drives partitioning and backpressure.
• Latency target: logon p95 < 30s; reconnect < 10s — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — Directory, assignment, image, and profile records are authoritative; host health and session views are derived.
• Async boundary: At-least-once workers — Keep Azure Virtual Desktop for VDI, FSLogix for profile management, Azure AD for authentication off the synchronous path.

Key entities

• ResourceSpecresourceId, tenantId, desiredState, version, policyVersion, updatedAt

  Versioned desired state for a virtual desktop infrastructure solution managed resource.

• OperationoperationId, resourceId, requestHash, step, attempt, status

  Durable virtual desktop infrastructure solution reconciliation operation with per-step progress.

• PolicyVersionpolicyId, scope, version, rules, effectiveAt, status

  Auditable virtual desktop infrastructure solution policy evaluated before provisioning or mutation.

• ReconciliationCheckpointresourceId, provider, observedVersion, cursor, lastError, updatedAt

  Provider-specific virtual desktop infrastructure solution observation and recovery cursor.

Data flow

1. 1. Accept a desired-state commandThe virtual desktop infrastructure solution control plane authenticates the tenant, validates policy and quotas, checks the expected version, and records the desired state.
2. 2. Plan a safe operationA planner turns virtual desktop infrastructure solution desired state into ordered, bounded steps with dependency checks, blast-radius limits, and rollback metadata.
3. 3. Reconcile providers asynchronouslyWorkers apply virtual desktop infrastructure solution operations through provider adapters, persist checkpoints, rate-limit calls, and treat unknown outcomes as observable state.
4. 4. Publish observed healthThe serving projection joins desired and observed virtual desktop infrastructure solution state with operation status, policy version, freshness, and actionable errors.
5. 5. Recover and auditRetries, dead letters, drift detection, and operator approvals repair virtual desktop infrastructure solution resources without losing the original command or provider evidence.

Deep dives and trade-offs

• Desired versus observed stateKeep virtual desktop infrastructure solution desired state separate from provider-observed state and show both to operators. Make every reconciliation step conditional and resumable so a worker crash does not restart unsafe effects. Version policy and resource state so old operations cannot overwrite newer intent.
• Provider failures and unknown outcomesUse provider-specific idempotency tokens and query-after-timeout behavior for virtual desktop infrastructure solution operations. Bound retries with exponential backoff, circuit breakers, and per-provider quotas. Route irreconcilable drift to an approval or quarantine path instead of retrying forever.
• Blast radius and operationsPartition virtual desktop infrastructure solution work by tenant, region, cluster, or resource class and cap concurrent mutations. Audit who changed desired state, which policy allowed it, and what provider evidence was observed. Alert on drift age, operation backlog, failed steps, policy denials, and stale observations.
• Push versus pull reconciliationUse event triggers for fast response and periodic scans for missed events, drift, and recovery. A push-only virtual desktop infrastructure solution controller silently misses changes when a provider event is lost.
• Central control plane versus provider-native controllersKeep policy, intent, and audit centralized while isolating provider-specific application logic behind adapters. A monolithic controller becomes hard to scale and couples unrelated provider failure domains.
• Automatic repair versus approvalAutomate low-risk, reversible virtual desktop infrastructure solution changes and require approval for destructive or high-blast-radius operations. Full automation without policy or blast-radius controls can turn a transient signal into a widespread outage.