Default all users to local Windows profiles

scripts/Deploy-SguAzureInfrastructure.ps1

@@ -18,7 +18,8 @@ param(
     [string]$VpnClientAddressPoolPrefix = '172.30.0.0/24',
     [string[]]$PublicEnrollmentSourceAddressPrefixes = @(),
     [string]$AdministratorSourceAddressPrefix = '',
-    [bool]$DeployUserRoaming = $true,
+    [bool]$DeployUserRoaming = $false,
+    [switch]$AcknowledgeUserRoamingRisks,
     [ValidatePattern('^$|^[a-z0-9]{3,24}$')]
     [string]$UserRoamingStorageAccountName = '',
     [ValidatePattern('^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$')]
@@ -47,6 +48,9 @@ if (-not $AdministratorPassword) {
 if ($DeployUserRoaming -and -not $DeployVpnGateway) {
     throw 'Azure user roaming requires the P2S gateway deployed by this template so clients can reach the private Azure Files endpoint. Use -DeployUserRoaming $false with direct public enrollment.'
 }
+if ($DeployUserRoaming -and -not $AcknowledgeUserRoamingRisks) {
+    throw 'User roaming is disabled by default. To provision it, also pass -AcknowledgeUserRoamingRisks after reviewing the sign-in, sign-out, storage-availability, stale-cache, and recovery risks in docs/user-roaming.md.'
+}
 foreach ($shareName in @($FsLogixProfilesShareName, $RedirectedFoldersShareName)) {
     if ($shareName.Contains('--')) {
         throw "Azure Files share names cannot contain consecutive hyphens: $shareName"