A method for provisioning a virtualized resource includes directing, by a provisioning machine, a server-executed hypervisor to provision a virtual machine. The provisioning machine directs generation of an organizational unit within a first organizational unit within a multi-tenant directory service separated from a second organizational unit in the multi-tenant directory service by a firewall. The provisioning machine associates the virtual machine with the first organizational unit. The provisioning machine establishes at least one firewall rule on the virtual machine restricting communications to the virtual machine to communications from explicitly authorized machines, which including at least one other machine within the organizational unit. The provisioning machine receives a request to provision a virtualized resource for at least one user. The provisioning machine updates data associated with the organizational unit to include an identification of the at least one user. The provisioning machine directs the virtual machine to host the virtualized resource.