Add Azure user roaming and reproducible Laboratorio wallpaper policy

README.md

@@ -60,6 +60,8 @@ Operational documentation:
 - [Linux client enrollment with realmd and SSSD](docs/linux-client-enrollment.md)
 - [Self-hosted RustDesk server and managed Windows remote access](docs/rustdesk-operations.md)
 - [Domain monitoring, usage reports, and six-month retention](docs/monitoring.md)
+- [Laboratorio desktop wallpaper protection](docs/laboratorio-wallpaper-policy.md)
+- [Azure user roaming by role with Azure Files and FSLogix](docs/user-roaming.md)
 - [Decision: do not persist password verifiers in Redis](docs/decisions/0001-no-password-cache.md)
 
 | Prefix | Role | Default OU | Security group in the same OU |
@@ -107,7 +109,9 @@ Follow [docs/lab-runbook.md](docs/lab-runbook.md). Review
 For a public Azure VM, use
 [docs/azure-vpn-deployment.md](docs/azure-vpn-deployment.md). It supports an
 optional Azure P2S gateway or direct enrollment restricted to explicit public
-source CIDRs.
+source CIDRs. P2S deployments also provision private Azure Files storage for
+role-based roaming: `AL` redirects only Documents/Desktop, while `AD` and `DO`
+can mount an FSLogix VHDX profile after the post-domain setup step.
 
 Never disable the built-in Microsoft password Credential Provider. It is the
 supported recovery path if a third-party provider fails to load.