Skip to content
Schoolyear AVD

Exam Orchestrator

The picture below shows a general overview of the lifecycle of an exam in Schoolyear AVD. Schoolyear AVD will call Azure-provided APIs in your Azure tenant to perform these orchestration actions in your Azure Tenant.

Architecture Overview

Start deployment

A configurable number of minutes before the start of an exam that requires AVD, the deployment starts. This preparation time can be configured per exam environment and is called the “Deployment Duration”. Once the deployment has started, the exam configuration cannot be edited anymore. New exams must be scheduled further into the future than it takes to deploy the exam. For example, if the configured Deployment Duration is 2 hours, an exam must be scheduled at least 2 hours in advance.

The following actions are performed during deployment:

  1. A new Entra Security Group is created
  2. A new Resource Group is created in the configured Azure Subscription and location
  3. A deployment is started within that Resource Group using a configurable Template Spec hosted in your Azure Tenant
  4. Check that enough Sessionhosts are available in the newly deployed Hostpool

These actions may be performed multiple times in case a deployment job is restarted. The actions must therefore be idempotent. The creation of security groups in Entra and the creation of the Resource Group are idempotent by default. However, you must take extra care in development of the Template Spec.

If any of the actions fail or time out, the deployment job is retried 2 times, after which it is considered failed (3 tries in total).

Entra Security Group

A new Security Group is created in your Entra directory. This group will be named syexam-<<examID>>, where examID is the ID in Schoolyear’s system. No members are added to this group during deployment.

Resource Group & Deployment

A new Resource Group is created in the Subscription that you configure. This Resource Group will be named syexam-<<examID>>, where examID is the ID in Schoolyear’s system.

Within this Resource Group, a deployment is started using a Template Spec that is hosted in your Azure Tenant. The parameters that are provided to this Template Spec are described in the Template API section of this Chapter.

Check Sessionhost availability

After the deployment of the Template Spec finishes, Schoolyear AVD will monitor the amount of Sessionhosts that are marked as “Available” in the newly deployed Hostpool.

A configurable minimum of Sessionhosts must be registered Available within 30 minutes of the deployment succeeding. If not, the deployment is considered failed.

Once the minimum number of available Sessionhosts is reached, the deployment succeeds and the monitoring of available Sessionhosts stops.

This minimum is configured by an output of the Template Spec which is described in the Template API section of this Chapter.

Student begins exam

Up to 30 minutes before the start time of an exam, students may start Schoolyear Safe Exam Workspace (SEW) to prepare for their exam.

In the loading screen of SEW, they will be presented with a prompt to log into their Microsoft account. After logging in, their Entra account is added as a member to the Entra Security Group created during deployment.

To provide Entra some time to propagate this new member, the student needs to wait a few seconds before they can continue their onboarding process.

Once the exam start time passes, the student is show a fullscreen view of the AVD Web Client.

Deletion

At the exam end timestamp, the deletion job will start.

It will execute the following delete steps:

  • Delete “Extra Resources” outputted by the Template Spec during deployment
  • Delete Resource Group: thereby deleting all resources in it
  • Delete the Entra Security Group

These steps may fail individually, but do not prevent the other steps from being executed. However, if any of these steps fail, the deletion is considered a failure.

Deletion jobs are retried 2 times for a total of 3 attempts.

Deleting Extra Resources

The Template Spec may output a list of Resource URIs during deployment of resources outside the exam’s Resource Group that need to be deleted at the end of the exam.

These resources are deleted by calling the DELETE HTTP method on their Resource URI. This HTTP request is retried once for a total of two attempts.

The HTTP request is performed using the same authentication as for all other requests made by the Exam Orchestrator.

Deleting the Resource Group

The Resource Group is delete by name with the following types configured to be force-deleted:

  • Microsoft.Compute/virtualMachines
  • Microsoft.Compute/virtualMachineScaleSets

Deleting the Entra Security Group

The Entra Security Group is deleted by name. If the group no longer exists, it is not considered a failure. If multiple groups exist with the same name, none of them are deleted and the deletion is considered a failure.