Three “ghost sessions” had spawned from the production gold image. Each session had a valid user ID, a compliant IP address, and a perfect conditional access token. By all traditional metrics, they were legitimate employees logging in to their Cloud PC. But Marta knew those three users were currently asleep in Seattle. She had just seen them at the company offsite.
Marta smiled. “The cloud isn’t a castle. It’s a river. You can’t build walls. You have to control the flow of trust. Secure the identity. Lock the control plane. And never, ever let the ghost sleep in the gold image.”
The CISO went pale. “So they can just… reassign a computer to themselves?”
This was the nuclear option. She rebuilt the Azure Compute Gallery. Instead of persistent Cloud PCs that lived for months, she deployed multi-session AVD pools with Ephemeral OS disks . Every time a user signed out, their entire Cloud PC was destroyed and rebuilt from a fresh, immutable gold image.
Marta pulled up a diagram. The AVD architecture was a Rube Goldberg machine of trust.