Microsoft Azure · Public course · v1.1.0
AZ-140: Azure Virtual Desktop
Study Azure Virtual Desktop across architecture, networking, storage, deployment, identity, security, profiles, clients, applications, monitoring and recovery. Practise with 258 flashcards and 180 original questions, alongside Microsoft Learn and hands-on labs.
258 flashcards · 180 practice questions
Choose topics, then use Flashcards, Learn, Write, Match, Practice Questions or Mock Exam when the course has suitable content.
Unofficial study aid, not affiliated with or endorsed by Microsoft. Original educational practice questions, not official exam questions or a prediction of an exam result. Use Microsoft Learn and hands-on labs alongside this course.
Topics in this course
NetworkingSecurityStorage & FSLogixArchitecture & planningProfile storageDeployment & imagesIdentity & accessClients & user experienceApplications & deliveryMonitoring & autoscaleUpdates & recoveryFlashcards
Azure Virtual Desktop reverse connect
Networking
The session host initiates an outbound HTTPS connection to the service. The base remote session does not require an internet-facing inbound RDP listener on the session host.
RDP Shortpath transport
Networking
RDP Shortpath uses UDP for the data transport after the initial reverse-connect connection. The available path depends on the network and client configuration.
Shortpath fallback when UDP is blocked
Networking
If a usable UDP path cannot be established, the session can use the TCP-based reverse-connect transport, provided its required connectivity is available.
ExpressRoute
Networking
A private connection from an on-premises network to Microsoft cloud services through a connectivity provider. ExpressRoute connections do not travel over the public internet.
Azure Virtual Desktop Private Link
Networking
Private endpoints provide private routes to selected Azure Virtual Desktop workflows. Remote users need network access to the virtual network, such as a VPN or ExpressRoute.
Azure Virtual Desktop Agent URL Tool
Networking
Checks whether a session host can reach the required Azure Virtual Desktop FQDNs and endpoints. Use it when investigating outbound firewall or proxy restrictions.
Shared security responsibility in Azure Virtual Desktop
Security
Microsoft secures the virtualization control plane and physical infrastructure. The customer or partner secures identities, devices, apps, session-host operating systems and deployment network controls.
Multifactor authentication for Azure Virtual Desktop
Security
Require additional authentication evidence beyond a password for users and administrators. Microsoft recommends MFA to improve deployment security.
Conditional Access
Security
Evaluate access conditions such as the user, sign-in and device before granting access to an Azure Virtual Desktop environment.
Local administrator rights on pooled session hosts
Security
Avoid granting standard users local administrator rights on shared multi-session hosts. If users need those privileges, Microsoft recommends a personal host pool with a session host assigned to each user.
Session-host patching responsibility
Security
Patch the running operating system, installed applications and deployment images. A managed control plane does not remove the need to patch customer-managed session hosts.
RemoteApp and application security
Security
Publishing a RemoteApp is not an application-execution security boundary. Use application-control features when you must restrict which software can run on a session host.
FSLogix profile container
Storage & FSLogix
A virtual disk holding a user's Windows profile. At sign-in it is attached so the roaming profile appears local, which supports users moving between pooled session hosts.
FSLogix profile disk formats
Storage & FSLogix
FSLogix containers use VHD or VHDX virtual disk files. These files hold the profile data rather than an entire session-host operating system image.
FSLogix ODFC container
Storage & FSLogix
An Office Data and Files Container focuses on Microsoft Office-related profile data. A default profile container already includes that data, so a separate ODFC container is not normally needed alongside it.
FSLogix Cloud Cache
Storage & FSLogix
An optional configuration for profile and ODFC containers, not a third container type. It uses a local cache and configured remote storage providers.
FSLogix SMB storage
Storage & FSLogix
SMB file shares are supported storage for FSLogix containers. Network reachability, authentication and share/file permissions must all support access to each user's profile.
Protecting FSLogix user profiles
Storage & FSLogix · Security
Restrict who can access profile container files and how they reach the storage. Profile disks may contain sensitive user data and should not be broadly readable by other users.
Which user count drives the initial RDP link-capacity estimate?
Networking
Peak concurrent sessions, with their actual workloads and displays. Total licensed users can exceed concurrency substantially; application traffic, optimized media and network overhead still need separate allowance.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Why can adding bandwidth fail to improve a geographically distant AVD session?
Networking
Bandwidth does not remove propagation delay. If the path has enough capacity but high round-trip time, locating session hosts closer to the users addresses the distance component of latency.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
What is jitter, and why does it matter to a remote desktop?
Networking
Jitter is variation in packet-arrival delay. An adequate average bandwidth figure can coexist with uneven delivery, causing audio or visual glitches; inspect delay variation and congestion rather than capacity alone.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Implement Quality of Service (QoS) for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-quality-of-service-qos
Under what packet-loss condition do Microsoft's starting RDP bandwidth recommendations apply?
Networking
They apply to networks with less than 0.1% packet loss. Treat 1.5, 3, 5 and 15 Mbps workload figures as planning recommendations, then load-test representative sessions.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Should workload and display bandwidth tables be added together for the same session?
Networking
No. They describe overlapping influences on one RDP stream. Resolution, frame rate and changing content affect consumption together; validate the chosen estimate with representative application and display testing.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
What extra network-capacity dimension should be assessed when supported RDP Multipath is used?
Networking
Firewall/NAT transport capacity as well as Mbps. A session can maintain up to three UDP and two TCP paths; actual SNAT consumption also depends on the NAT implementation, destinations and reuse.
Objectives: Assess network capacity and speed requirements for Azure Virtual Desktop Sources: Use RDP Multipath to improve connection reliability to Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-multipath
What region constraint applies to the session-host VNet?
Networking
The VNet must be in the same Azure region as the session hosts. Plan the host subnet for maximum intended scale and supporting network resources before deploying hosts.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Why is VNet peering alone insufficient for an AD DS-backed session-host design?
Networking
Peering does not automatically supply domain DNS resolution or every required route. Hosts must resolve the AD domain and reach its domain controllers for domain join and authentication.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Which connection pattern allows ordinary AVD sessions without public inbound RDP on the host?
Networking
The client and host initiate outbound connections to the AVD service, which authenticates and brokers the session over TCP 443. Public inbound TCP 3389 is not required for that user workflow.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
What is the difference between an NSG rule and a user-defined route?
Networking
An NSG permits or denies an IP/port/protocol flow. A route chooses its next hop. A permitted flow can still fail if a UDR sends it to an unreachable appliance or creates an invalid return path.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Why does the WindowsVirtualDesktop firewall FQDN tag not complete an AVD allowlist?
Networking
It simplifies AVD service access, but does not cover every dependency. Application backends, identity services, Microsoft 365, updates and specified certificate endpoints need their own documented connectivity.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
How should AVD traffic to Azure platform addresses 169.254.169.254 and 168.63.129.16 be handled?
Networking
Preserve their required platform communication and avoid proxying, intercepting or redirecting them. Blocking IMDS or platform communication/DNS can disrupt provisioning and host health reporting.
Objectives: Design network configuration for session hosts to meet requirements for Azure Virtual Desktop Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
What must happen before Shortpath can carry an AVD session over UDP?
Networking
The user must first authenticate and the session must be brokered through the AVD reverse-connection process. A successful supported UDP path then carries session traffic; unsolicited UDP does not establish a session.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath
When is TURN needed rather than a direct STUN-discovered Shortpath path?
Networking
TURN relays UDP when NAT/firewall behavior prevents a viable direct path. STUN discovers address mappings but does not relay the complete session; symmetric NAT can make TURN necessary.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath
Which port is the default managed-network Shortpath listener?
Networking
UDP 3390. Enable the listener on the hosts and allow the configured port from authorized private client networks through Windows Firewall, NSGs and intermediate devices; a custom listener uses its selected port.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: Configure RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-rdp-shortpath
What happens when the configured unmanaged Shortpath dynamic-port pool is exhausted?
Networking
The host falls back to its usual ephemeral range. The configured default pool is 38300–39299; custom pools must fit within 1024–49151. This pool is separate from the fixed managed-network listener.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: Configure RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-rdp-shortpath
What does RDP Multipath preserve when the active transport degrades?
Networking
Alternative supported transport paths to the same session. It can switch to a viable path, but does not distribute one desktop across hosts or keep a session connected when every network path disappears.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: Use RDP Multipath to improve connection reliability to Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-multipath
What must accompany DSCP 46 marking for effective AVD managed-network QoS?
Networking
Matching managed Shortpath traffic and consistent classification/queue priority across the controlled network path. Host marking alone does not prove routers honor it; the documented method does not apply to TCP reverse connect.
Objectives: Plan and implement Remote Desktop Protocol (RDP) Shortpath, RDP Multipath, and quality of service (QoS) policies Sources: Implement Quality of Service (QoS) for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-quality-of-service-qos
Which AVD Private Link subresource handles initial feed discovery?
Networking
The workspace global subresource. One shared global endpoint uses privatelink-global.wvd.microsoft.com; Microsoft recommends a dedicated workspace with no registered application groups for this endpoint.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
Which private DNS zone is used by both workspace feed and host-pool connection endpoints?
Networking
privatelink.wvd.microsoft.com. Feed and connection endpoints serve different workflows even though they share this zone; link and resolve the appropriate private records from the relevant networks.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview; Set up Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-setup
Which endpoints are needed for public discovery but private workspace feeds and sessions?
Networking
Workspace feed endpoints and host-pool connection endpoints. The global discovery endpoint is unnecessary for that requirement because initial discovery is intentionally public.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
What public-access exception applies to the workspace used for global discovery?
Networking
Its private-only public-access setting is ignored for initial discovery. Do not use that setting as evidence that every public discovery request is prevented; feed and host-pool access have their own controls.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
What host action follows relevant host-pool Private Link or network configuration changes?
Networking
Restart RDAgentBootLoader on the session hosts, or restart the hosts. Then test feed retrieval and actual sessions separately, with DNS, routes and public/private settings matching the intended design.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
What host-pool setting enables supported direct UDP in an AVD Private Link design?
Networking
Opt in to Allow Direct UDP network path over Private Link and disable public-network STUN/TURN. Direct managed Shortpath still requires client-to-host reachability; the private endpoint does not relay that direct UDP path.
Objectives: Plan and implement an Azure Private Link solution for Azure Virtual Desktop Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview; Set up Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-setup
What does WVDAgentUrlTool.exe validate on a session host?
Networking
Reachability of required AVD endpoints using the installed agent's matching configuration. It tests specific regional names, so one successful host test does not prove every wildcard dependency or other subnet is correct.
Objectives: Monitor and troubleshoot network connectivity Sources: Check access to required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/check-access-validate-required-fqdn-endpoint
What is avdnettest.exe used to investigate?
Networking
Client-side STUN/TURN reachability and NAT behavior for Shortpath. It helps diagnose UDP-path establishment; a successful TCP desktop does not by itself prove Shortpath works.
Objectives: Monitor and troubleshoot network connectivity Sources: Configure RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-rdp-shortpath
Which diagnostic identifier links events from one AVD connection attempt?
Networking
The connection Correlation ID. Combine it with the affected user, host and UTC timestamp so network and connection records relate to the same attempt rather than an unrelated incident.
Objectives: Monitor and troubleshoot network connectivity Sources: Analyze connection quality in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/connection-latency
What units and sampling cadence should be remembered for AVD connection-network data?
Networking
Estimated bandwidth is in kilobytes per second and estimated RTT is in milliseconds. Network data points are generated about every two minutes during an active session; compare units and time windows carefully.
Objectives: Monitor and troubleshoot network connectivity Sources: Analyze connection quality in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/connection-latency
Why can an allowed effective NSG rule coexist with a failed connection?
Networking
Effective NSG rules do not include Windows Firewall, and do not prove correct DNS, routing, return paths or application behavior. Inspect the relevant host firewall and packet path as well.
Objectives: Monitor and troubleshoot network connectivity Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Why should ConnectionGraphicsData not be treated as a continuous healthy-session baseline?
Networking
It records graphics degradation rather than regular samples of every healthy session. Use connection-network data and host/application performance evidence alongside it to distinguish graphics, network and workload problems.
Objectives: Monitor and troubleshoot network connectivity Sources: Analyze connection quality in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/connection-latency
Which population determines retained FSLogix storage capacity?
Profile storage
All retained profiles, including users who are currently disconnected or inactive. Concurrent sessions drive performance demand; sizing capacity only for today's active users can omit substantial persisted data.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads
Why must profile-storage IOPS and throughput be assessed separately from capacity?
Profile storage
Stored GiB do not measure the rate or size of I/O requests. Sign-in storms can create high IOPS on a modest dataset, while larger operations can demand throughput; measure both peak and steady workloads.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
An SSD v2 share has 30,000 provisioned IOPS and a 90,000-IOPS burst limit. How long does a full 216-million-credit bucket last at that limit?
Profile storage
One hour: the excess is 90,000 − 30,000 = 60,000 IOPS, so 216,000,000 ÷ 60,000 = 3,600 seconds. This assumes a full bucket and constant demand at the stated limit.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Why might distributing profiles across two shares in one classic account fail to remove a performance bottleneck?
Profile storage
The shares still share the storage account's aggregate limits. Check the account, share, host NIC and network constraints; another share is not automatically another independent account-level performance budget.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Which Azure Files media is recommended for FSLogix Cloud Cache?
Profile storage
SSD shares, because lower latency and higher IOPS help avoid provider-storage bottlenecks. Also size the local cache and provider capacity; Cloud Cache does not remove storage-performance requirements.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads
What does asynchronous geographic storage replication imply for an unplanned regional failover?
Profile storage
Recent writes might not yet exist in the secondary region, so data loss is possible. Choose a tolerable RPO, plan the supported failover and test recovery rather than assuming replication guarantees zero loss.
Objectives: Plan storage for Azure Virtual Desktop user data Sources: Azure Files data redundancy — https://learn.microsoft.com/en-us/azure/storage/files/files-redundancy
What storage protocol does an ordinary FSLogix VHDLocations path require?
Profile storage
A supported SMB share reached through a UNC path. NFS support in a storage service does not make its NFS export a substitute for ordinary SMB Profile or ODFC container storage.
Objectives: Implement storage for FSLogix components Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions; Store FSLogix profile containers on Azure NetApp Files — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-netapp
Which location setting is used by FSLogix Cloud Cache instead of ordinary VHDLocations?
Profile storage
CCDLocations identifies Cloud Cache providers. Use the configuration appropriate to Cloud Cache rather than treating a provider endpoint as an ordinary SMB VHDLocations path.
Objectives: Implement storage for FSLogix components Sources: Configure profile containers with Cloud Cache — https://learn.microsoft.com/fslogix/tutorial-cloud-cache-containers
What does CloudKerberosTicketRetrievalEnabled enable on an eligible Entra-joined or hybrid-joined host?
Profile storage
It enables cloud Kerberos ticket retrieval for the documented Azure Files Entra Kerberos flow. Storage integration, admin consent, share authorization and ACLs are still separate prerequisites.
Objectives: Implement storage for FSLogix components Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Why is LoadCredKeyFromProfile configured for the documented Entra Kerberos FSLogix flow?
Profile storage
It loads roaming credential keys from the current profile. Configure it alongside the documented host and storage prerequisites; it is not a replacement for permissions or the cloud Kerberos ticket policy.
Objectives: Implement storage for FSLogix components Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid
What extra Entra application tag enables cloud-only group SIDs in the Azure Files Kerberos flow?
Profile storage
kdc_enable_cloud_group_sids. It is mandatory for the documented cloud-only identity scenario; use supported updated Windows hosts and cloud-aware ACL administration as well.
Objectives: Implement storage for FSLogix components Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Does normal hybrid-user Entra Kerberos profile access require session-host line of sight to AD DS domain controllers?
Profile storage
Not for the documented Entra-joined or hybrid-joined profile-access flow. AD connectivity remains required when configuring hybrid-user file ACLs, and the hybrid users/groups must satisfy the synchronization prerequisites.
Objectives: Implement storage for FSLogix components Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Which classic account kind is used by HDD provisioned v2 Azure Files?
Profile storage
FileStorage with a StandardV2 SKU. The older rule that standard/HDD always means GPv2 does not describe this model; v2 provisions capacity, IOPS and throughput independently.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Which classic Azure Files model uses StorageV2/GPv2 and charges for used storage plus transactions?
Profile storage
HDD pay-as-you-go. Its transaction-optimized, hot and cool tiers differ from provisioned models; evaluate transaction patterns and other applicable charges as well as stored capacity.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
How many user identity sources can be enabled for SMB on one classic Azure Files account?
Profile storage
One: AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos. It applies across the account's shares; sharing an account cannot provide independently enabled identity sources for different shares.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Overview of Azure Files identity-based authentication for SMB access — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview; Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Can a top-level Microsoft.FileShares resource hold ordinary FSLogix SMB profiles under current guidance?
Profile storage
No. That model currently supports SSD NFS shares only. Use a classic Microsoft.Storage SMB share for ordinary FSLogix VHDLocations and choose its supported media, billing and redundancy.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Does selecting RA-GRS or RA-GZRS expose a readable Azure Files secondary share?
Profile storage
No. Azure Files requires a supported failover to use the secondary share. Read-access behavior for other storage services does not create active-active SMB profile access.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Azure Files data redundancy — https://learn.microsoft.com/en-us/azure/storage/files/files-redundancy
What naming constraint applies to a classic Azure storage account?
Profile storage
A globally unique name of 3–24 lowercase alphanumeric characters. Select the correct account kind, SKU, region and redundancy separately; a valid name does not establish SMB identity integration.
Objectives: Implement storage accounts for Azure Virtual Desktop Sources: Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share
Which hostname should remain in an Azure Files UNC path after adding a file private endpoint?
Profile storage
Use the normal <account>.file.core.windows.net hostname. DNS through privatelink.file.core.windows.net resolves it to the private endpoint; the session host still needs routing and TCP 445 access.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share
Which two authorization layers govern ordinary identity-based Azure Files SMB access?
Profile storage
Share-level authorization and file/directory ACLs. Passing one does not pass the other; AVD entitlement and Azure management permissions are also separate from these SMB data-access checks.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions; Overview of Azure Files identity-based authentication for SMB access — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview
How is the profile-users group's root Modify permission scoped in the recommended isolation layout?
Profile storage
This folder only. Users can create their own profile directory at the share root; the group does not receive recursive Modify access to every user's profile contents.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
What does CREATOR OWNER accomplish in the profile-share ACL layout?
Profile storage
Modify rights scoped to subfolders and files give the creating user's identity access within its new profile directory. CREATOR OWNER does not grant every profile user access to all other containers.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
Which Azure Files SMB data role supports administrators changing file ACLs?
Profile storage
Storage File Data SMB Share Elevated Contributor. Ordinary Storage File Data SMB Share Contributor supplies data read/write/delete rights but does not itself authorize modifying ACLs.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions; Overview of Azure Files identity-based authentication for SMB access — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview
What extra Entra application configuration accompanies Azure Files Entra Kerberos over a private endpoint?
Profile storage
Add matching private-link FQDN entries to the storage application's identifierUris while retaining public entries. Missing registration can prevent Kerberos ticket acquisition and cause unsupported NTLM fallback or error 1326.
Objectives: Implement file shares for Azure Virtual Desktop Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable; Azure Files SMB authentication troubleshooting — https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication
Which subnet delegation is used by conventional regular ANF volumes?
Profile storage
Microsoft.NetApp/volumes on a dedicated subnet. Use only one ANF-delegated subnet for volume creation per VNet and plan its size in advance; a /28 provides only 11 usable Azure addresses.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Delegate a subnet to Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-delegate-subnet
What determines whether a regular ANF capacity pool has a 1-TiB or 4-TiB minimum?
Profile storage
The network features of its volumes. The minimum is 1 TiB when every volume uses Standard network features; any Basic-feature volume requires a 4-TiB minimum.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Create a capacity pool for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-set-up-capacity-pool; Resource limits for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-resource-limits
What is the current minimum size of a regular ANF volume?
Profile storage
50 GiB. Distinguish the volume minimum from the larger capacity-pool minimum and from requirements for specialized volume/storage types.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Resource limits for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-resource-limits
How does traditional ANF auto QoS allocate volume throughput?
Profile storage
From volume quota and service level: Standard 16, Premium 64 and Ultra 128 MiB/s per TiB. Manual QoS allocates throughput within the pool budget; Flexible requires manual QoS and separates throughput from capacity.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Create a capacity pool for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-set-up-capacity-pool; Understand Azure NetApp Files cost model — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-cost-model
Which SMB ANF setting is recommended for FSLogix service-interruption tolerance?
Profile storage
SMB Continuous Availability on the FSLogix volume. It improves tolerance of supported service interruptions, but does not replace backups, directory connectivity, capacity planning or a regional recovery procedure.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Store FSLogix profile containers on Azure NetApp Files — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-netapp
Where does native ANF backup restore a protected volume?
Profile storage
To a new ANF volume within the same region. Create a backup vault first; native backups are stored independently of local volume snapshots and are separate from replication/failover.
Objectives: Implement Azure NetApp Files for Azure Virtual Desktop Sources: Understand Azure NetApp Files backup — https://learn.microsoft.com/en-us/azure/azure-netapp-files/backup-introduction
What should determine how AVD resources are grouped into resource groups?
Architecture & planning
Group resources by ownership, lifecycle and operational boundaries. Separating replaceable session hosts from durable shared dependencies can simplify access and cleanup. Resource groups are management containers; placing resources together does not itself provide network connectivity or desktop access.
Objectives: Recommend resource groups, subscriptions, and management groups for Azure Virtual Desktop resources Sources: Azure resource management fundamentals — https://learn.microsoft.com/en-us/entra/architecture/secure-resource-management
When does a separate subscription help an AVD design?
Architecture & planning
Use it when billing, delegated administration, policy or quota boundaries require isolation. Plan resource permissions and quotas in each subscription. A subscription boundary does not remove the need for routing, DNS, image access or user assignments across the resulting design.
Objectives: Recommend resource groups, subscriptions, and management groups for Azure Virtual Desktop resources Sources: Azure resource management fundamentals — https://learn.microsoft.com/en-us/entra/architecture/secure-resource-management
What is the purpose of management groups in a multi-subscription AVD environment?
Architecture & planning
They organize subscriptions so governance such as inherited Azure Policy and RBAC can be applied consistently. They do not contain session hosts directly, allocate user sessions or replace resource groups within subscriptions.
Objectives: Recommend resource groups, subscriptions, and management groups for Azure Virtual Desktop resources Sources: Azure resource management fundamentals — https://learn.microsoft.com/en-us/entra/architecture/secure-resource-management
Why choose Windows Enterprise multi-session for a compatible shared desktop workload?
Architecture & planning
It provides the Windows client application experience while allowing multiple users on one session host. Verify that the OS release, application, identity and management requirements are supported. Size hosts for measured concurrent demand rather than assuming the edition guarantees performance.
Objectives: Recommend an operating system (OS) for Azure Virtual Desktop session hosts Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
What must be considered before choosing Windows Server for AVD session hosts?
Architecture & planning
Check application and OS support, the Remote Desktop Session Host role and eligible RDS CALs with Software Assurance or qualifying subscription rights. Windows client user entitlements alone do not satisfy the Windows Server RDS licensing requirement.
Objectives: Recommend an operating system (OS) for Azure Virtual Desktop session hosts Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
How should a move from a single-session OS to a multi-session image be planned?
Architecture & planning
Deploy new hosts from a supported multi-session image and validate apps, identity, profiles and management. Do not assume an in-place edition conversion is supported. External user state and a controlled migration reduce the risk of losing machine-local data.
Objectives: Recommend an operating system (OS) for Azure Virtual Desktop session hosts Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
What two cost layers remain when internal users have eligible Windows client AVD licenses?
Architecture & planning
Eligible user licensing can cover Windows client AVD access, but Azure infrastructure still costs money. Compute, disks, profile storage, networking, monitoring and backup are separate. Verify the specific user entitlement; an Azure subscription alone does not license Windows client access.
Objectives: Recommend an appropriate licensing model for Azure Virtual Desktop based on requirements Sources: Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
When is AVD per-user access pricing relevant?
Architecture & planning
It is an access-licensing option for qualifying external commercial use, such as providing an application to customers. It is not a substitute for eligible internal-user licensing and does not include Azure infrastructure or separately required application licenses.
Objectives: Recommend an appropriate licensing model for Azure Virtual Desktop based on requirements Sources: Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Does an eligible Microsoft 365 Windows client entitlement automatically license a Windows Server session host?
Architecture & planning
No. Windows Server session hosts require the applicable RDS CALs with active Software Assurance or eligible RDS subscription rights. Select licensing based on both the user scenario and the host OS; client and server access rights are different.
Objectives: Recommend an appropriate licensing model for Azure Virtual Desktop based on requirements Sources: Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
What makes a pooled host pool suitable for users who do not need a dedicated VM?
Architecture & planning
Users are allocated to available hosts in a shared pool. External profiles and consistent apps allow users to work on different hosts across sessions. Pooling improves capacity sharing but requires compatible apps, session limits and enough failure headroom.
Objectives: Plan a host pool architecture Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology
When should a personal host pool be considered?
Architecture & planning
Use it when a user needs a dedicated assigned VM, persistent machine state or workload isolation. The personal assignment model determines which user gets which VM. Preserve and protect unique machine-local data; it cannot be treated like disposable pooled compute.
Objectives: Plan a host pool architecture Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology
How do a host pool, application group and AVD workspace relate?
Architecture & planning
A host pool supplies session hosts. An application group publishes desktops or RemoteApps from that pool. Registering the application group with an AVD workspace exposes it in the user feed, while user assignment controls entitlement. These are separate configuration steps.
Objectives: Plan a host pool architecture Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology; Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
What should a sizing pilot measure before selecting production session-host capacity?
Architecture & planning
Measure representative concurrent workloads, CPU, memory, disk latency, application response and sign-in behavior. Include busy periods and real client locations. Use the resulting acceptable sessions per host to choose VM size and limits; generic users-per-vCPU tables are starting estimates.
Objectives: Design an Azure Virtual Desktop configuration for performance requirements Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
Why can adding vCPUs fail to fix slow desktop sign-ins?
Architecture & planning
The limiting component may be profile storage latency, authentication, application initialization or network delay rather than CPU. Correlate sign-in stages and host/storage telemetry, then fix the measured bottleneck. More compute does not automatically improve a slow external dependency.
Objectives: Design an Azure Virtual Desktop configuration for performance requirements Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines; Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
What additional validation is needed for a graphics-heavy AVD workload?
Architecture & planning
Validate a supported GPU-capable VM, OS and graphics driver alongside application behavior, client support and transport conditions. Test the actual visualization workload. A larger general-purpose VM does not automatically provide the hardware acceleration the app needs.
Objectives: Design an Azure Virtual Desktop configuration for performance requirements Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
How many hosts are needed for 210 concurrent users at a measured limit of 30 per host, with one-host failure tolerance?
Architecture & planning
Eight. Seven hosts serve 210 users at 30 each; one additional host allows the remaining seven to serve the full load after one failure. This assumes equal host capacity and no other capacity constraints. Use concurrent users rather than total assigned users.
Objectives: Design an Azure Virtual Desktop configuration for Azure Virtual Machines capacity requirements Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
How does host failure tolerance change pooled capacity planning?
Architecture & planning
The surviving available hosts must still carry the required concurrent workload within tested limits. Add spare capacity or use smaller failure domains, and account for maintenance too. Counting only the capacity of every healthy host leaves no margin when a host fails.
Objectives: Design an Azure Virtual Desktop configuration for Azure Virtual Machines capacity requirements Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines; Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
Why does approved regional vCPU quota not guarantee a successful recovery deployment?
Architecture & planning
Quota authorizes consumption up to a limit; it does not reserve physical VM-family capacity. Confirm supported sizes and actual regional availability, and test deployment. Plan alternatives or capacity-reservation options where requirements justify them; keep recovery quotas ready before an outage.
Objectives: Design an Azure Virtual Desktop configuration for Azure Virtual Machines capacity requirements Sources: Azure Virtual Desktop limits — https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-limits; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
What must be ready before adding session hosts through the portal?
Deployment & images
Prepare the subscription/provider registration, permissions, supported image and VM size, subnet, DNS, required connectivity and identity-join method. The VM and its VNet must be in the same region. Valid portal selections do not compensate for broken join or endpoint access.
Objectives: Create host pools and session hosts by using the Azure portal Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
What end-to-end test proves that a newly deployed AVD desktop is usable?
Deployment & images
Use an assigned pilot user to discover the resource, launch it, authenticate, attach the intended profile and run required apps. Check host health and telemetry. A completed ARM deployment or an available host alone does not prove user entitlement and workload readiness.
Objectives: Create host pools and session hosts by using the Azure portal Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
Can an existing standard host pool be switched in place to session host configuration?
Deployment & images
No. The management approach is chosen at host-pool creation. Session host configuration uses a persistent host configuration and management policy for pooled host creation and replacement. Plan a new pool and controlled migration when a different management approach is required.
Objectives: Create host pools and session hosts by using the Azure portal Sources: Host pool management approaches — https://learn.microsoft.com/en-us/azure/virtual-desktop/host-pool-management-approaches
What does declaring a host-pool resource in Bicep create, and what remains to be deployed?
Deployment & images
It creates the host-pool service resource with its specified settings. A complete desktop deployment also needs actual VMs, networking, join and agent registration, application groups, workspace registration and user assignments. A host-pool declaration alone does not provision usable session hosts.
Objectives: Automate creation of Azure Virtual Desktop hosts and host pools by using PowerShell, Azure CLI, Azure Resource Manager templates (ARM templates), and Bicep files Sources: Host pool ARM and Bicep reference — https://learn.microsoft.com/en-us/azure/templates/microsoft.desktopvirtualization/2024-04-03/hostpools
What registers an independently provisioned standard session host with a pool?
Deployment & images
After the supported join and connectivity prerequisites are met, install the AVD Agent and Agent Boot Loader using a valid registration token from the target pool. VM creation and a session-host child-resource declaration are not substitutes for the agent registration workflow.
Objectives: Automate creation of Azure Virtual Desktop hosts and host pools by using PowerShell, Azure CLI, Azure Resource Manager templates (ARM templates), and Bicep files Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
What does a host-pool registration token authorize?
Deployment & images
It authorizes a session host to register with that host pool during the token validity period. It does not assign users to an application group or grant desktop access. Treat it as a secret and avoid exposing it in deployment logs or source control.
Objectives: Automate creation of Azure Virtual Desktop hosts and host pools by using PowerShell, Azure CLI, Azure Resource Manager templates (ARM templates), and Bicep files Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
What is breadth-first load balancing intended to do?
Deployment & images
Spread new sessions across available pooled hosts to preserve performance headroom. Existing sessions reconnect to their current host. It does not migrate running sessions or replace measured capacity limits; autoscale can control the algorithm during scheduled phases.
Objectives: Configure host pool and session host settings Sources: Host pool load balancing — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing
Why can depth-first allocation help reduce pooled compute costs?
Deployment & images
It consolidates new sessions onto occupied available hosts up to their configured session limit, leaving other hosts empty for a scaler to deallocate. The load-balancing setting itself does not stop VMs. Use a tested limit so consolidation does not harm performance.
Objectives: Configure host pool and session host settings Sources: Host pool load balancing — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing
What does drain mode allow and prevent?
Deployment & images
It prevents allocation of users who have no existing session on that host. Users with existing active or disconnected sessions can reconnect. It does not log users off, shut down the VM or install updates; those require separate maintenance actions.
Objectives: Configure host pool and session host settings Sources: Drain mode — https://learn.microsoft.com/en-us/azure/virtual-desktop/drain-mode
Does lowering MaxSessionLimit terminate sessions already above the new limit?
Deployment & images
No. It influences new-session allocation; existing sessions remain. Plan capacity and user handling separately when changing the limit. It is not an enforced CPU limit, and concurrent connection activity can briefly exceed the configured session count.
Objectives: Configure host pool and session host settings Sources: Host pool load balancing — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing
Does setting a Windows client VM license type to Windows_Client purchase user licenses?
Deployment & images
No. It records the eligible Windows client licensing configuration for the VM; it does not acquire or assign qualifying user entitlements. Confirm both the VM configuration and every user’s eligible access rights before production use.
Objectives: Configure licensing for session hosts, including user eligibility for Windows client access and RDS Client Access License (CAL) requirements for Windows Server Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
What distinguishes Windows Server session-host licensing configuration from Windows client AVD?
Deployment & images
Windows Server requires the RDS Session Host role and appropriate RDS licensing configuration backed by eligible CALs or subscription rights. Windows client Enterprise multi-session uses qualifying Windows client access entitlements. The Windows_Client VM setting cannot replace server RDS licensing.
Objectives: Configure licensing for session hosts, including user eligibility for Windows client access and RDS Client Access License (CAL) requirements for Windows Server Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Why should the golden-image build VM stay outside the AVD host pool?
Deployment & images
The current preparation guidance says not to join the build VM to a pool or install the AVD Agent. Keep machine-specific registration, live user profiles and secrets out of the image. Deployment installs and registers the agents separately on each new session host.
Objectives: Create an image manually Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image
What is the purpose of generalizing and shutting down a Windows build VM before image capture?
Deployment & images
Sysprep removes machine-specific Windows state so the image can create distinct VMs. Capture the generalized source after shutdown. Do not resume ordinary customization on that generalized source; use a new build VM or the documented image workflow for later changes.
Objectives: Create an image manually Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image
What are the three main stages of an Azure VM Image Builder template?
Deployment & images
Source selects the base image; customize applies scripts, apps and updates; distribute publishes the built image, often as a Compute Gallery version. A successful build produces a deployable image. A separate host rollout is needed to change existing desktops.
Objectives: Create an image by using Azure VM Image Builder Sources: Custom image templates — https://learn.microsoft.com/en-us/azure/virtual-desktop/custom-image-templates
What access does Image Builder’s user-assigned managed identity need?
Deployment & images
Grant the permissions required to read the chosen source and customization artifacts and write the image to its destination. Scope access to the resources used. The builder also needs required network/package endpoints; identity permissions do not fix blocked downloads.
Objectives: Create an image by using Azure VM Image Builder Sources: Custom image templates — https://learn.microsoft.com/en-us/azure/virtual-desktop/custom-image-templates
How should a published generalized image be modified for a new application version?
Deployment & images
Create a fresh build VM or repeatable pipeline from the approved source, apply and test the change, generalize it and publish a new version. Avoid editing production hosts and treating that as an updated image. Record source, app versions and configuration for repeatability.
Objectives: Modify an image Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image; Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
What should an image lifecycle retain until a rollout is proven?
Deployment & images
Retain the known-good image version, its build artifacts and deployment configuration. Validate the new version on pilot hosts before broader replacement. A compute rollback can redeploy the previous image, but it does not automatically reverse profile or application-data schema changes.
Objectives: Plan and implement lifecycle management for images Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery; Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
Why pin an explicit Compute Gallery image version in production deployments?
Deployment & images
It makes deployments reproduce the approved build and avoids unintentionally adopting an untested latest version. Promote versions through validation, then update deployment parameters deliberately. Publishing a newer gallery version does not update existing VMs.
Objectives: Plan and implement lifecycle management for images Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
What should be tested after adding OS and application updates to a session-host image?
Deployment & images
Deploy a pilot host and test sign-in, profile attachment, required apps, licensing/activation and relevant client experiences. Include app interactions with the OS update. Successful package installation on the build VM is insufficient evidence that the deployed shared desktop works.
Objectives: Apply OS and application updates to an image Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image; Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
What compatibility checks matter when creating a host from a custom gallery image?
Deployment & images
Match the image’s OS state, Hyper-V generation and security capabilities with the chosen VM configuration. Ensure the version is available in the target region and the deployment identity can read it. Then complete join, registration and user-access validation.
Objectives: Create a session host by using a custom image Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop; Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
What is the difference between a gallery image definition and an image version?
Deployment & images
A definition describes the image family and compatibility, such as OS, generation and security features. A version is an actual deployable build identified by numeric major.minor.patch. Configure regional replication and replica count on versions to support distribution and deployment demand.
Objectives: Plan and implement image storage, including Azure Compute Gallery Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
Why is standalone AD DS insufficient for Azure Virtual Desktop cloud-service sign-in?
Identity & access
The AVD service authenticates through Microsoft Entra ID. AD DS can authenticate Windows and legacy resources, but an AD-only account cannot access the AVD service. A third-party identity provider must federate with Entra ID rather than replace it.
Objectives: Select an identity scenario for Azure Virtual Desktop, including Active Directory Domain Services (AD DS), Microsoft Entra ID, and Microsoft Entra Domain Services Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
When does an AD DS-backed identity scenario fit better than a cloud-only session-host design?
Identity & access
Choose AD DS or hybrid join when hosts need existing domain Group Policy and AD-dependent applications. Hybrid join retains AD DS management while enabling modern Entra SSO. Microsoft Entra Domain Services instead supplies a managed legacy domain without customer-managed domain controllers.
Objectives: Select an identity scenario for Azure Virtual Desktop, including Active Directory Domain Services (AD DS), Microsoft Entra ID, and Microsoft Entra Domain Services Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Management concepts for Microsoft Entra Domain Services — https://learn.microsoft.com/en-us/entra/identity/domain-services/administration-concepts
What host identity design is required for an invited external user to use AVD?
Identity & access
Use Microsoft Entra-joined session hosts and enable host-pool Entra SSO, with the documented supported OS and update levels. The identity must be invited into the resource tenant. External users cannot use Kerberos or NTLM to reach on-premises resources.
Objectives: Select an identity scenario for Azure Virtual Desktop, including Active Directory Domain Services (AD DS), Microsoft Entra ID, and Microsoft Entra Domain Services Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
What identity matching condition supports the same synchronized user at the AVD service and AD DS host?
Identity & access
Either the UPN or SID must match. For SID matching, AD ObjectSID corresponds to Entra OnPremisesSecurityIdentifier. Different internal and public UPN suffixes can work when SID alignment is correct; signing in to Windows as a different account is unsupported.
Objectives: Specify requirements to configure the Azure Virtual Desktop session host for an identity scenario Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
What network configuration does an AD DS domain-joined session host need before domain join and sign-in?
Identity & access
Configure DNS that can locate the domain controllers and routed connectivity to them. Use an appropriately delegated domain-join account and the intended OU when specified. A reachable internet endpoint alone does not establish domain-controller discovery or AD authentication.
Objectives: Specify requirements to configure the Azure Virtual Desktop session host for an identity scenario Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Why can an existing cloud user authenticate to the AVD feed but fail on an Entra Domain Services-joined host?
Identity & access
The managed domain may lack compatible Kerberos and NTLM password hashes. Existing cloud users must change or reset their passwords after the managed-domain setup so those hashes become available. Successful Entra cloud authentication does not prove managed-domain Windows authentication will succeed.
Objectives: Specify requirements to configure the Azure Virtual Desktop session host for an identity scenario Sources: Management concepts for Microsoft Entra Domain Services — https://learn.microsoft.com/en-us/entra/identity/domain-services/administration-concepts; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Which Azure role grants use of an AVD application group's published resources, and where is it assigned?
Identity & access
Assign Desktop Virtualization User to the user's Entra security group at application-group scope. Ensure the application group is registered with a workspace. This role grants resource entitlement; it does not grant AVD administration or automatically satisfy every Windows sign-in requirement.
Objectives: Plan and implement Azure role-based access control (Azure RBAC) for Azure Virtual Desktop Sources: Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac; Microsoft Entra joined session hosts in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-ad-joined-session-hosts
What duties are outside the Desktop Virtualization Contributor role?
Identity & access
It manages AVD objects but does not itself grant Azure VM compute management or permission to assign user/group roles. Add only the relevant compute role or role-assignment permission when those duties are required; Azure RBAC is separate from Windows administrator sign-in.
Objectives: Plan and implement Azure role-based access control (Azure RBAC) for Azure Virtual Desktop Sources: Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac
Which principal, role, and scope can authorize Start VM on Connect?
Identity & access
Grant Desktop Virtualization Power On Contributor to a managed identity assigned to the host pool or the tenant's AVD service principal. A lower scope is supported when it contains the target session-host VMs; subscription scope simplifies larger deployments but is not mandatory.
Objectives: Plan and implement Azure role-based access control (Azure RBAC) for Azure Virtual Desktop Sources: Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles; Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect
How do power-management autoscale authorization requirements differ from Start VM on Connect?
Identity & access
Power-management autoscale uses Desktop Virtualization Power On Off Contributor and currently requires subscription scope. Assign it to the host-pool managed identity or tenant AVD service principal supported by the workflow. A resource-group assignment is insufficient despite being acceptable for a suitable Start VM on Connect deployment.
Objectives: Plan and implement Azure role-based access control (Azure RBAC) for Azure Virtual Desktop Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles
What does the dedicated dynamic-scaling role-assignment workflow specify?
Identity & access
It specifies the tenant AVD service principal with both Desktop Virtualization Power On Off Contributor and Desktop Virtualization Virtual Machine Contributor at subscription scope. Follow that dedicated workflow; do not assume that every dynamic-scaling path uses the same identity alternative as power-management autoscale.
Objectives: Plan and implement Azure role-based access control (Azure RBAC) for Azure Virtual Desktop Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles
Which two authentication resources need aligned Conditional Access policies when AVD uses Entra SSO?
Identity & access
Azure Virtual Desktop covers feed, gateway, and service authentication; Windows Cloud Login covers token-based Windows session-host authentication. Use separate scoped policies with compatible grant and session controls. The Azure Virtual Desktop Azure Resource Manager Provider is not the documented MFA target.
Objectives: Plan and implement Microsoft Entra Conditional Access policies for connections to Azure Virtual Desktop Sources: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa
How should a new AVD Conditional Access policy be validated before enforcement?
Identity & access
Start with a pilot group in Report-only. Test resource subscription, launch, reconnection, and the supported browser and installed-client paths. Review the Conditional Access results in Entra sign-in logs for both the AVD service and Windows Cloud Login when SSO is enabled.
Objectives: Plan and implement Microsoft Entra Conditional Access policies for connections to Azure Virtual Desktop Sources: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa
What legacy MFA setting should be checked when Entra-joined host sign-in reports that the sign-in method is not allowed?
Identity & access
Check for legacy per-user MFA. The documented Entra-joined AVD path requires Conditional Access rather than per-user MFA. Disable the incompatible legacy setting and apply suitable Conditional Access controls after testing instead of removing MFA protection from the deployment.
Objectives: Plan and implement Microsoft Entra Conditional Access policies for connections to Azure Virtual Desktop Sources: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa
What enables a supported passwordless cloud authentication method to authenticate the Windows AVD session?
Identity & access
Modern Microsoft Entra SSO authenticates Windows with an Entra token. Without that host-pool SSO path, successful passkey or Windows Hello authentication to the cloud service does not guarantee the same method can satisfy a legacy Windows credential prompt.
Objectives: Plan and implement authentication options in Azure Virtual Desktop, including passwordless, smart card, and multifactor authentication Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
What domain connectivity does traditional smart-card sign-in to an AD-backed session host require?
Identity & access
Smart-card host sign-in uses Kerberos. The client must obtain tickets from a domain-controller KDC through direct connectivity, a VPN, or a KDC proxy. NTLM cannot substitute for that Kerberos path; also verify certificates, trust configuration, and client support.
Objectives: Plan and implement authentication options in Azure Virtual Desktop, including passwordless, smart card, and multifactor authentication Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
What does redirectwebauthn:i:1 enable inside an AVD session?
Identity & access
It enables supported WebAuthn redirection, forwarding an in-session app or browser authentication challenge to the local device for Windows Hello or a locally attached FIDO authenticator. It is distinct from enablerdsaadauth:i:1, which enables host-pool Entra SSO.
Objectives: Plan and implement authentication options in Azure Virtual Desktop, including passwordless, smart card, and multifactor authentication Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
When is a separate Virtual Machine User Login role required for users of Entra-joined AVD hosts?
Identity & access
For host pools without a session host configuration, grant standard users Virtual Machine User Login on the target VMs or a containing scope, alongside application-group entitlement. Current documentation exempts pools using a session host configuration from this additional VM login-role assignment.
Objectives: Manage roles, groups, and rights assignments on Azure Virtual Desktop session hosts Sources: Microsoft Entra joined session hosts in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-ad-joined-session-hosts
Which Windows Remote Desktop user right wins if both an allow and an applicable deny are configured?
Identity & access
Deny log on through Remote Desktop Services overrides an allow. Check effective domain/device policy and group membership, using gpresult and sign-in failure logs where appropriate. A local allow or an Azure role assignment cannot override the Windows deny right.
Objectives: Manage roles, groups, and rights assignments on Azure Virtual Desktop session hosts Sources: Troubleshoot access denied and user not authorized issues in Remote Desktop Services — https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshooting-access-denied-and-user-not-authorized-rds-issues; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
What AVD host design is preferred when a user genuinely requires local administrator rights?
Identity & access
Prefer a personal host pool with a dedicated VM. Local administrators on a pooled multi-session host can affect other users and defeat ordinary permission boundaries. Keep shared multi-session users standard users and use separately controlled administrative accounts for management.
Objectives: Manage roles, groups, and rights assignments on Azure Virtual Desktop session hosts Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Which session-host join types support modern Microsoft Entra token-based SSO?
Identity & access
Microsoft Entra join and Microsoft Entra hybrid join support it, subject to the documented OS, update, client, and identity requirements. AD DS-only and Entra Domain Services-only joins do not qualify; changing an RDP property alone cannot fix an unsupported join design.
Objectives: Configure Microsoft Entra single sign-on Sources: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Which tenant setting enables RDP authentication through Windows Cloud Login?
Identity & access
Enable remoteDesktopSecurityConfiguration.isRemoteDesktopProtocolEnabled on the Windows Cloud Login service principal. Tenant configuration requires Application Administrator, Cloud Application Administrator, or equivalent permissions. The host pool must also enable Entra SSO; tenant configuration alone does not activate it for every pool.
Objectives: Configure Microsoft Entra single sign-on Sources: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
When does Entra SSO need a Microsoft Entra Kerberos server object?
Identity & access
Create it for hybrid-joined hosts to complete authentication to a domain controller, or when Entra-joined hosts need AD-backed on-premises resources. If users and hybrid hosts reside in different AD domains, provide the required two-way trust as well.
Objectives: Configure Microsoft Entra single sign-on Sources: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
What does an improved Defender for Cloud Secure Score demonstrate?
Security
It reflects remediation of applicable security recommendations and improved measured posture. It does not prove the absence of malware or active threats. Verify the affected resources' health and endpoint telemetry, while continuing threat investigation and the remaining security controls.
Objectives: Plan, implement, and manage security for Azure Virtual Desktop session hosts by using Microsoft Defender for Cloud Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations; Defender for Endpoint / Vulnerability Management integration with Defender for Cloud — https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Why should Defender for Servers coverage not be assumed to license every Windows AVD host?
Security
Defender for Servers can integrate with and deploy Defender for Endpoint for supported server operating systems. Windows client AVD hosts need appropriate Defender for Endpoint coverage; a server subscription plan is not a universal substitute for the required client/user endpoint licensing.
Objectives: Plan, implement, and manage security for Azure Virtual Desktop session hosts by using Microsoft Defender for Cloud Sources: Defender for Endpoint / Vulnerability Management integration with Defender for Cloud — https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Does a VM listed as Can be onboarded in Defender inventory already have functioning endpoint protection telemetry?
Security
No. Resource discovery and endpoint onboarding are separate. Confirm the Defender for Endpoint sensor or relevant extension, reporting health, required connectivity, and device telemetry. Azure Monitor Agent installation does not replace the Defender for Endpoint sensor.
Objectives: Plan, implement, and manage security for Azure Virtual Desktop session hosts by using Microsoft Defender for Cloud Sources: Defender for Endpoint / Vulnerability Management integration with Defender for Cloud — https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
What scheduled antivirus scan pattern usually fits a dense pooled AVD deployment?
Security
Use scheduled quick scans with real-time and cloud-delivered protection, and randomize starts across hosts. Full scans can create substantial CPU and storage load and should serve a justified incident or compliance need. Align schedules and catch-up behavior with actual usage and autoscale.
Objectives: Configure session host protection by using Microsoft Defender Antivirus Sources: Configure Microsoft Defender Antivirus in RDS or VDI environments — https://learn.microsoft.com/en-us/defender-endpoint/deployment-vdi-microsoft-defender-antivirus; Microsoft Defender Antivirus full scan considerations and best practices — https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices
What safeguards make a shared Defender security-intelligence location a sound VDI optimization?
Security
Keep its content current, protect it from unauthorized modification, and grant hosts the required read access. The shared location reduces repeated per-VM unpackaging; it does not replace Defender Antivirus, ongoing updates, or active protection on each session host.
Objectives: Configure session host protection by using Microsoft Defender Antivirus Sources: Configure Microsoft Defender Antivirus in RDS or VDI environments — https://learn.microsoft.com/en-us/defender-endpoint/deployment-vdi-microsoft-defender-antivirus
Which Defender task should run on the VDI main image before sealing it?
Security
Run the Windows Defender Cache Maintenance scheduled task and let it finish before sealing the main image. Skipping this preparation can cause higher CPU use when every deployed VM performs cache maintenance. Continue normal updates and active protection on the live hosts.
Objectives: Configure session host protection by using Microsoft Defender Antivirus Sources: Configure Microsoft Defender Antivirus in RDS or VDI environments — https://learn.microsoft.com/en-us/defender-endpoint/deployment-vdi-microsoft-defender-antivirus; Microsoft Defender Antivirus full scan considerations and best practices — https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices
Why must a non-persistent VDI golden image not blindly retain a live Defender for Endpoint onboarding identity?
Security
Cloned sensor registration, including duplicated senseGuid values, can merge or obscure device records. Keep the primary image unonboarded. If maintenance onboarded it, follow Microsoft's offboarding and local-registration cleanup process before capturing and distributing the image.
Objectives: Configure session host protection by using Microsoft Defender for Endpoint, including onboarding and scanning options Sources: Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi
How does single-entry non-persistent VDI onboarding derive a stable record per final device name?
Security
Run Onboard-NonPersistentMachine.ps1 after the final hostname assignment and final provisioning restart. It invokes the CMD onboarding script. For separate records per provisioned instance, use the documented CMD-script model instead; do not independently schedule both scripts for the single-entry model.
Objectives: Configure session host protection by using Microsoft Defender for Endpoint, including onboarding and scanning options Sources: Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi
What operational impact must be considered before isolating a compromised pooled host through Defender for Endpoint?
Security
Isolation affects the shared host, so all its users can lose network connectivity. Coordinate incident containment and user impact, drain and replace the compromised pooled host from a trusted image when appropriate, and investigate any affected image or credentials before trusting replacements.
Objectives: Configure session host protection by using Microsoft Defender for Endpoint, including onboarding and scanning options Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations; Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi
How do an NSG, a UDR, and Azure Firewall play different roles in a host network?
Security
An NSG permits or denies IP, port, and protocol traffic; a UDR selects the next hop; Azure Firewall centrally filters and logs traffic, including supported FQDN application rules. A valid route does not grant access, and an NSG allow does not create reachability.
Objectives: Implement and manage network security for connections to Azure Virtual Desktop, including user defined routes (UDRs), network security groups (NSGs), and Azure Firewall Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop; Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
What TLS-inspection condition applies to AVD service traffic through a security appliance?
Security
Do not TLS-inspect or terminate AVD service traffic. Preserve its native TLS connection and certificate validation while allowing the current documented service and supporting endpoints. A general inspection policy must have the appropriate exception rather than replacing native AVD trust.
Objectives: Implement and manage network security for connections to Azure Virtual Desktop, including user defined routes (UDRs), network security groups (NSGs), and Azure Firewall Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop; Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
What route does current Azure Firewall guidance recommend for direct AVD broker and gateway connectivity?
Security
With default egress routed to Azure Firewall, add a more specific WindowsVirtualDesktop service-tag route with next hop Internet. This keeps broker/gateway traffic direct and avoids firewall scale-in disconnections, while other controlled egress follows the intended firewall path.
Objectives: Implement and manage network security for connections to Azure Virtual Desktop, including user defined routes (UDRs), network security groups (NSGs), and Azure Firewall Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop
What does Azure Bastion provide to a session host that has no public IP?
Security
It provides managed administrative RDP or SSH transport to the VM's private IP, with the client reaching Bastion over TLS 443. Private reachability and target rules must permit the connection. Administrators still need valid guest credentials or supported Entra login rights.
Objectives: Configure Azure Bastion or just-in-time (JIT) VM access for administrative access to session hosts Sources: What is Azure Bastion? — https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
What does JIT VM access change, and which Defender plan does it require?
Security
With Defender for Servers Plan 2 and a supported topology, JIT temporarily changes managed NSG or Azure Firewall rules for an approved source, port, and duration. An authorized access request opens the window; managed rules close after it expires.
Objectives: Configure Azure Bastion or just-in-time (JIT) VM access for administrative access to session hosts Sources: Enable just-in-time VM access — https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage
Why can an approved JIT request still leave an administrator unable to sign in?
Security
JIT grants a temporary network-rule opening, not a VPN route or Windows administrator privileges. The source must still reach the VM, and valid guest credentials or supported sign-in rights are required. Diagnose routing and OS authorization separately from the JIT request.
Objectives: Configure Azure Bastion or just-in-time (JIT) VM access for administrative access to session hosts Sources: Enable just-in-time VM access — https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage
How should App Control for Business be introduced on pooled session hosts?
Security
Deploy device-scoped code-trust policy to a test ring in audit mode, review legitimate app and driver events, and add narrowly justified rules before progressive enforcement. Test AVD, FSLogix, scripts, and updates. The policy affects all sessions on the host.
Objectives: Plan and implement Windows threat protection features on Azure Virtual Desktop session hosts, including App Control for Business and Controlled Folder Access Sources: Deploying App Control for Business policies — https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Which Defender Antivirus operating conditions are required for Controlled Folder Access?
Security
Defender Antivirus must be in active mode with real-time protection. Controlled Folder Access does not function in passive mode, including EDR block mode. Begin with audit, examine legitimate writes, then enable enforcement with specific allowed applications and protected paths.
Objectives: Plan and implement Windows threat protection features on Azure Virtual Desktop session hosts, including App Control for Business and Controlled Folder Access Sources: Controlled folder access overview and requirements — https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview
What should be done when CFA blocks a known business application's legitimate protected-folder writes?
Security
Verify that the blocked application is trustworthy, review the actual writer and path, and allow that specific application when justified. Test the workflow before enforcement. Microsoft automatically trusts many reputable applications; broad folder or application exceptions undermine the intended protection.
Objectives: Plan and implement Windows threat protection features on Azure Virtual Desktop session hosts, including App Control for Business and Controlled Folder Access Sources: Controlled folder access overview and requirements — https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview
How do Secure Boot, vTPM, and boot attestation contribute to Trusted Launch?
Security
On supported Generation 2 VMs, Secure Boot validates trusted boot code, vTPM protects keys and measured-boot data, and attestation checks boot integrity against expected state. These complement each other; boot protection does not replace antivirus, patching, or application controls.
Objectives: Plan for and implement Azure confidential VMs and Trusted Launch security features for Azure Virtual Desktop session hosts Sources: Trusted Launch for Azure virtual machines — https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Which VM capability protects memory in use from the hypervisor and host management stack?
Security
An Azure confidential VM on supported AMD SEV-SNP or Intel TDX hardware provides this isolation. Disk encryption alone protects data at rest. Verify AVD OS/image support, confidential-capable VM family, region, and feature compatibility when choosing the deployment.
Objectives: Plan for and implement Azure confidential VMs and Trusted Launch security features for Azure Virtual Desktop session hosts Sources: About Azure confidential VMs — https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
When must confidential OS disk encryption be selected for a confidential VM?
Security
Choose the confidential OS disk encryption configuration when creating the VM. It cannot be changed afterward. Decide the supported platform- or customer-managed key arrangement during planning, and verify the selected VM image and other required features are compatible.
Objectives: Plan for and implement Azure confidential VMs and Trusted Launch security features for Azure Virtual Desktop session hosts Sources: About Azure confidential VMs — https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview
How does an FSLogix Profile Container make a roaming profile appear local to applications?
Storage & FSLogix
At sign-in, FSLogix attaches the user’s VHD or VHDX and redirects profile access into it. Applications continue to use the normal Windows profile path. The disk detaches at sign-out so another host can attach the persistent profile.
Objectives: Recommend FSLogix configuration Sources: FSLogix types of containers — https://learn.microsoft.com/fslogix/concepts-container-types; Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers
Which container design is the normal recommendation for a new AVD deployment needing the whole profile and Microsoft 365 data?
Storage & FSLogix
Use one Profile Container. It already includes the benefits of ODFC, so adding a separate ODFC normally adds complexity without meeting a new requirement. ODFC alone is useful when another profile product handles the rest of the Windows profile.
Objectives: Recommend FSLogix configuration Sources: FSLogix types of containers — https://learn.microsoft.com/fslogix/concepts-container-types; Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers
Does Windows Enterprise multi-session mean one user can freely write the same FSLogix disk from several sessions?
Storage & FSLogix
No. Multi-session allows different users to share a host. Same-user concurrent connections on one AVD session host are unsupported. Multiple connections across hosts require a specifically supported differencing-disk design, and OneDrive cannot use the same container simultaneously.
Objectives: Recommend FSLogix configuration Sources: Concurrent or multiple connections to a single container — https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections
Which registry location configures FSLogix Profile Containers?
Storage & FSLogix
Use HKLM\SOFTWARE\FSLogix\Profiles on every intended session host. This is different from the ODFC policy key. Apply settings consistently through managed policy or registry deployment; installing FSLogix alone does not enable Profile Containers.
Objectives: Configure FSLogix Profile Containers Sources: Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
What kind of path belongs in VHDLocations for ordinary FSLogix containers?
Storage & FSLogix
An accessible SMB share UNC path, rather than a particular user’s disk filename. FSLogix searches configured locations for an existing disk and creates a new disk in the first location if none is found. User authorization and file permissions must also work.
Objectives: Configure FSLogix Profile Containers Sources: Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
What does Enabled=1 under the FSLogix Profiles key do?
Storage & FSLogix
It enables Profile Containers for eligible users on that host. The service, include/exclude groups, share access and the remaining configuration still have to be valid. A successful software installation is not evidence that a user’s profile is being redirected.
Objectives: Configure FSLogix Profile Containers Sources: Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
How does IsDynamic=1 affect the physical size of a new FSLogix container?
Storage & FSLogix
The physical disk file grows as data is written instead of immediately consuming the configured logical maximum. Capacity planning still needs growth and headroom. Deleting files inside the disk does not guarantee an immediate reduction of the physical file on storage.
Objectives: Configure FSLogix Profile Containers Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
What test demonstrates that an ordinary Profile Container actually roams between hosts?
Storage & FSLogix
Create a setting or test file as a standard user, sign out completely, then sign in to a different session host. Verify that the same state returns and inspect attachment logs. Merely reconnecting to the existing session does not test cross-host persistence.
Objectives: Configure FSLogix Profile Containers Sources: Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers
Which registry location configures an ODFC Container?
Storage & FSLogix
Use HKLM\SOFTWARE\Policies\FSLogix\ODFC. Enable it, specify the supported container location and select the required workload settings. Applying those values under the Profiles key would target Profile Containers instead of the intended Office-data configuration.
Objectives: Configure FSLogix ODFC containers Sources: Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
What does the ODFC IncludeOfficeActivation setting persist?
Storage & FSLogix
It includes supported Office activation data in the ODFC Container. This preserves user state; it does not supply a Microsoft 365 license or enable shared computer activation by itself. Each user still needs the applicable license and activation configuration.
Objectives: Configure FSLogix ODFC containers Sources: Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation
Why exclude ODFC-managed folders from another roaming-profile product?
Storage & FSLogix
Both products otherwise try to capture the same files, which can cause inconsistent state or sign-in problems. Let ODFC persist its selected Office data and let the other profile product handle the remaining profile, then test Office workloads across hosts.
Objectives: Configure FSLogix ODFC containers Sources: Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers
Which location setting selects Cloud Cache rather than ordinary remote-container storage?
Storage & FSLogix
Configure CCDLocations for the relevant container. It describes the Cloud Cache providers and replaces VHDLocations for that configuration; the two should not coexist. Cloud Cache supports SMB and Azure page-blob providers, with supported credential protection for connection secrets.
Objectives: Configure FSLogix Cloud Cache Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; Configure profile containers with Cloud Cache — https://learn.microsoft.com/fslogix/tutorial-cloud-cache-containers
How do Cloud Cache hydration reads differ from its remote writes?
Storage & FSLogix
Missing data is hydrated from one healthy provider, initially following configured provider order. Writes are queued and asynchronously sent to all configured providers. Each provider stores a full copy, so local cache, remote capacity and extra I/O need planning.
Objectives: Configure FSLogix Cloud Cache Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; FSLogix Cloud Cache overview — https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache
What must accompany a nonzero HealthyProvidersRequiredForRegister value to provide the intended fail-closed profile experience?
Storage & FSLogix
Use PreventLoginWithFailure and/or PreventLoginWithTempProfile for the failure cases you intend to block. The healthy-provider count governs FSLogix registration; the companion policies load FRXShell after an attach failure or temporary-profile condition, leaving sign-out as the user’s option.
Objectives: Configure FSLogix Cloud Cache Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
What happens when CcdUnregisterTimeout=0 and the required healthy-provider count is unmet at sign-out?
Storage & FSLogix
Sign-out can wait indefinitely for the required provider availability. The default required unregister count is one. Investigate provider health and synchronization before forcing unregister or destroying the host, because unsynchronized writes may exist only in its local cache.
Objectives: Configure FSLogix Cloud Cache Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; FSLogix Cloud Cache overview — https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache
What does Applies=Yes mean for an FSLogix application-hiding rule?
Storage & FSLogix
The hiding rule applies to that matching assignment, so the selected resources are hidden. Applies=No is an exception. Assignments run from top to bottom, and a later matching assignment can override an earlier result; test both intended populations.
Objectives: Implement FSLogix application masking Sources: Create and implement Rule Sets (application masking) — https://learn.microsoft.com/fslogix/tutorial-application-rule-sets; FSLogix Apps RuleEditor and Rule Sets — https://learn.microsoft.com/fslogix/concepts-fslogix-apps-rule-editor-rule-sets
Which two FSLogix Rule Set files should be deployed together?
Storage & FSLogix
Deploy the .fxr rule file and its .fxa assignment file to C:\Program Files\FSLogix\Apps\Rules on every target host. The rules describe the resources and the assignments describe who receives them. Validate the result as an intended and excluded user.
Objectives: Implement FSLogix application masking Sources: Create and implement Rule Sets (application masking) — https://learn.microsoft.com/fslogix/tutorial-application-rule-sets
What identity condition restricts FSLogix Rule Set assignments for cloud-only users?
Storage & FSLogix
Rule Set assignments require AD-synchronized users or groups and domain-controller line of sight for SID resolution. Cloud-only Entra accounts are unsupported for this assignment feature. Support for a cloud-only profile-storage scenario does not automatically extend to application masking assignments.
Objectives: Implement FSLogix application masking Sources: Create and implement Rule Sets (application masking) — https://learn.microsoft.com/fslogix/tutorial-application-rule-sets; FSLogix Apps RuleEditor and Rule Sets — https://learn.microsoft.com/fslogix/concepts-fslogix-apps-rule-editor-rule-sets
What should drive selection between installed Windows App and browser access?
Clients & user experience
Choose by the required platform capabilities, including device redirection, authentication, monitors and media optimization. Compare the feature matrix for the actual service and endpoint platform. A browser can suit lightweight access but cannot be assumed equivalent to the installed Windows client.
Objectives: Choose an Azure Virtual Desktop client Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Compare Windows App features across platforms — https://learn.microsoft.com/windows-app/compare-platforms-features?pivots=azure-virtual-desktop
Can Windows App browser access provide the dedicated Teams VDI media optimization path?
Clients & user experience
No. Current Teams VDI guidance excludes web browsers from Teams optimization. Use a supported installed client and the compatible host/endpoint components when optimized calls are required; successfully opening Teams in a browser-launched desktop does not demonstrate optimized media.
Objectives: Choose an Azure Virtual Desktop client Sources: Install Teams for VDI — https://learn.microsoft.com/microsoftteams/teams-client-vdi-requirements-deploy; Compare Windows App features across platforms — https://learn.microsoft.com/windows-app/compare-platforms-features?pivots=azure-virtual-desktop
What must accompany Windows App’s standalone MSIX for a Store-disabled offline installation?
Clients & user experience
Acquire the architecture-matched framework dependencies required by that release, install them first, and then install the application package. Offline installation does not provide offline AVD connectivity; launching remote resources still requires access to the service’s required endpoints.
Objectives: Choose a deployment method for the client Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic
How can an organization centrally deploy the Windows App Store package to managed Windows endpoints?
Clients & user experience
Use the Microsoft Store app deployment path in Intune, with appropriate assignment and monitoring. Pilot the supported endpoint OS, architecture and required capabilities, and keep the client updated. Client deployment grants no AVD application-group entitlement by itself.
Objectives: Choose a deployment method for the client Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Using Intune, install Windows App on physical devices — https://learn.microsoft.com/en-us/windows-365/enterprise/install-windows-365-app-intune
How does an empty Windows App feed differ from a published app that fails to launch?
Clients & user experience
An empty feed suggests checking the signed-in organizational account, assignments, workspace registration and refresh. A visible resource that fails later points toward connection, host authentication or application launch. Identify the failing stage before changing unrelated configuration.
Objectives: Deploy and troubleshoot Azure Virtual Desktop clients Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic; Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Why compare a failing Windows App connection with another supported client on the same endpoint?
Clients & user experience
The comparison helps isolate client-specific configuration from a broader service, network or authorization problem. Keep the account and target resource the same, note the exact failure stage, and collect client diagnostics before making tenant-wide or host-pool-wide changes.
Objectives: Deploy and troubleshoot Azure Virtual Desktop clients Sources: Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic
Which RDP property permits a local microphone to provide input to the remote session?
Clients & user experience
Use audiocapturemode:i:1, subject to compatible client support, host policy and endpoint microphone privacy permission. audiomode governs audio playback and does not replace the capture setting. Microphone redirection alone does not establish Teams optimization.
Objectives: Configure device redirection Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties; Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd
Which RDP property requests redirection of supported local cameras?
Clients & user experience
Use camerastoredirect:s:*. The client must support the camera path, the device must work locally, and endpoint privacy and session-host policy must permit use. A permissive host-pool property cannot overcome a restricting policy or unsupported client.
Objectives: Configure device redirection Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties
Where is video fetched when browser MMR playback redirection is active?
Clients & user experience
The browser in the remote session fetches the video. It forwards the encoded bitstream to the local endpoint for decoding and rendering. The browser page remains in the remote session; the source download is not simply moved to the endpoint.
Objectives: Configure multimedia redirection Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
Where does media connectivity originate for supported MMR WebRTC call redirection?
Clients & user experience
The local endpoint connects to the telephony service for the offloaded WebRTC call. Plan endpoint network access as well as host access. This differs from playback redirection, where the remote browser downloads video and forwards its bitstream for local processing.
Objectives: Configure multimedia redirection Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
How does a traditional printer join Universal Print when it has no built-in Universal Print support?
Clients & user experience
Use a Universal Print connector on a machine that can reach the printer, register the printer and share it with authorized users. Applicable licenses and printer installation/provisioning are still needed. This path does not depend on redirecting an endpoint’s locally installed printer.
Objectives: Configure printing and Universal Print Sources: Set up Universal Print — https://learn.microsoft.com/universal-print/set-up-universal-print; Printing on AVD using Universal Print — https://learn.microsoft.com/universal-print/fundamentals/universal-print-avd
Which Universal Print settings roam with supported Windows 11 multi-session profiles?
Clients & user experience
User printer installations and printing preferences can roam with the profile on the documented Windows 11 multi-session 22H2-and-later path. Machine-specific printer properties, such as drivers and ports, do not roam. Treat those as separate host configuration.
Objectives: Configure printing and Universal Print Sources: Printing on AVD using Universal Print — https://learn.microsoft.com/universal-print/fundamentals/universal-print-avd
How should Intune policy scope and assignment target align on Windows Enterprise multi-session hosts?
Clients & user experience
Assign device-scope configuration to device groups and supported user-scope configuration to user groups. A scope/target mismatch can report Error or Not applicable. Verify that the selected setting supports multi-session and inspect assignment status rather than assuming successful application.
Objectives: Configure user settings through Microsoft Intune policies or Group Policy Sources: Intune: Windows Enterprise multi-session remote desktops — https://learn.microsoft.com/en-us/mem/intune-service/fundamentals/azure-virtual-desktop-multi-session
Which Group Policy loopback mode makes user settings follow the session host instead of the user’s normal OU policy?
Clients & user experience
Use Replace when host-linked user policies must substitute for the user’s normal policy list. Merge combines the normal user policies with host-linked user policies. Pilot the intended outcome and inspect resultant policy on the actual session host.
Objectives: Configure user settings through Microsoft Intune policies or Group Policy Sources: Group Policy processing and loopback — https://learn.microsoft.com/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing
Where do you configure custom RDP properties that apply when users launch resources from an AVD host pool?
Clients & user experience
Use the host pool’s RDP Properties settings and save the intended configuration. Launches from that pool receive the corresponding RDP data. Test after reconnecting, and check client capabilities and session-host policies because host-pool permission alone is insufficient.
Objectives: Configure Remote Desktop Protocol (RDP) properties on a host pool Sources: Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties; Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol
What does drivestoredirect:s:* request, and what design risk does it introduce?
Clients & user experience
It requests redirection of all supported local drives. The session can access permitted endpoint drive content, so use restricted selections or disable redirection when the requirement limits data movement. Client support and policy still control the effective behavior.
Objectives: Configure Remote Desktop Protocol (RDP) properties on a host pool Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties
Which time-limit policy releases a session after it has been disconnected for a defined period?
Clients & user experience
Set time limit for disconnected sessions. It signs the user out after the configured disconnected retention period, freeing application resources and profile locks. An idle-session limit acts before disconnection and is a different timer; closing the client alone is not sign-out.
Objectives: Configure session timeout properties Sources: Create a scaling plan: configure a time limit policy — https://learn.microsoft.com/azure/virtual-desktop/autoscale-create-assign-scaling-plan#configure-a-time-limit-policy; Policy CSP: Terminal Server session time limits — https://learn.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver
What changes the default disconnect action when an applicable active or idle session time limit expires?
Clients & user experience
Enable End session when time limits are reached to sign out instead of retaining a disconnected session. Apply it with the intended active or idle limit and validate the effective policy. Forced sign-out can discard unsaved application work.
Objectives: Configure session timeout properties Sources: Policy CSP: Terminal Server session time limits — https://learn.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver; Create a scaling plan: configure a time limit policy — https://learn.microsoft.com/azure/virtual-desktop/autoscale-create-assign-scaling-plan#configure-a-time-limit-policy
Which role lets the documented Start VM on Connect automation identity power on target VMs?
Clients & user experience
Desktop Virtualization Power On Contributor. Assign it to the supported host-pool managed identity or AVD service principal at a scope containing the target VMs. The end user’s application-group entitlement does not give the automation service VM start authorization.
Objectives: Implement the Start VM on Connect feature Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles
What does Start VM on Connect create or start when an authorized user requests access?
Clients & user experience
It starts existing eligible session-host VMs. It does not create new VMs or provide shutdown scheduling. Startup can delay the first connection, so use an appropriate scaling plan when the requirement includes scheduled capacity management rather than only user-triggered start.
Objectives: Implement the Start VM on Connect feature Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect
When does an automatically assigned personal desktop receive its initial user mapping?
Clients & user experience
On the user’s first connection, an available host is allocated to that user. The user still needs access to the Desktop application group. Automatic assignment is different from direct assignment, where an administrator must establish the user-to-host mapping.
Objectives: Assign and unassign personal desktops to users Sources: Configure personal desktop assignment — https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type
What restriction applies after enabling multiple personal desktops per user on a direct-assignment pool?
Clients & user experience
The multiple-desktops setting cannot be disabled afterward. Assign or unassign the individual host mappings to manage which desktops a user receives. This remains a dedicated personal-desktop model; it does not turn the pool into shared-session allocation.
Objectives: Assign and unassign personal desktops to users Sources: Configure personal desktop assignment — https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type; AVD documentation changes — https://learn.microsoft.com/en-us/azure/virtual-desktop/whats-new-documentation
When is installing an application in the base image a good deployment choice?
Applications & delivery
For common, relatively stable applications used by most users. It gives a consistent runtime environment across hosts, but changing the app requires the corresponding image or host rollout. Flexible per-user delivery of compatible packaged apps can instead favor App Attach.
Objectives: Choose a method for deploying an app to Azure Virtual Desktop Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview
What installation context and assignment intents are supported for Intune apps on Windows Enterprise multi-session?
Applications & delivery
Install in system/device context, target devices, and use Required or Uninstall intent. Available and user-context app deployments are unsupported for this scenario. Dependencies and supersedence must also use system context; support for user-context scripts does not remove these app restrictions.
Objectives: Choose a method for deploying an app to Azure Virtual Desktop Sources: Intune: Windows Enterprise multi-session remote desktops — https://learn.microsoft.com/en-us/mem/intune-service/fundamentals/azure-virtual-desktop-multi-session
Can a personal host pool expose selected applications through a RemoteApp application group?
Applications & delivery
No. RemoteApp application groups are supported with pooled host pools. Desktop application groups support pooled or personal pools. Choose the host-pool and application-group model that meets the required presentation; adding an executable does not change a Desktop group into RemoteApp.
Objectives: Create and configure an application group Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Preferred application group type behavior — https://learn.microsoft.com/azure/virtual-desktop/preferred-application-group-type
Which AVD role represents a user’s entitlement to an application group?
Applications & delivery
Desktop Virtualization User, assigned to the user or an appropriate Entra security group at the application group. That grants access to its published resources. It is distinct from roles for managing hosts, operating sessions or signing in to a Windows VM where separately required.
Objectives: Assign users to application groups Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac
What resources does a user see when assigned to several RemoteApp groups from the same pooled host pool?
Applications & delivery
The user sees the combined authorized RemoteApps from those groups. Membership of a standard application group controls its published application set; it does not establish a separate per-executable assignment. Preferred application-group type becomes relevant when that user also has Desktop access from the same pool.
Objectives: Assign users to application groups Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Preferred application group type behavior — https://learn.microsoft.com/azure/virtual-desktop/preferred-application-group-type
Why use a documented shell:appsFolder package-family entry when publishing a supported MSIX-installed app?
Applications & delivery
It identifies the installed package’s application without hard-coding a versioned WindowsApps installation directory. A version-specific executable path can become invalid after an update. Use the documented package-family and application ID for that app, and verify launch after updating.
Objectives: Publish an application as a RemoteApp Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd
Does adding a standard executable to a RemoteApp group install it on eligible session hosts?
Applications & delivery
No. Publication exposes an application entry; deployment must make the executable and its dependencies available on every eligible host. Test the installed path, working directory and data permissions as a standard user, including after allocation to another host.
Objectives: Publish an application as a RemoteApp Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Which Office Deployment Tool property enables shared computer activation?
Applications & delivery
Set <Property Name="SharedComputerLicensing" Value="1" /> in the reviewed installation configuration. This chooses the activation mode; it does not grant entitlement. Every user must hold a qualifying Microsoft 365 license and sign in with their own account.
Objectives: Implement and manage Microsoft 365 Apps on Azure Virtual Desktop session hosts Sources: Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation; Install Microsoft 365 Apps on a custom image — https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image
Which Microsoft 365 business plan supplies shared computer activation for Apps for business?
Applications & delivery
Microsoft 365 Business Premium. Business Standard includes Apps for business but lacks its shared computer activation entitlement. Qualifying Apps for enterprise plans also support SCA. A registry or installation switch cannot compensate for a user’s nonqualifying subscription.
Objectives: Implement and manage Microsoft 365 Apps on Azure Virtual Desktop session hosts Sources: Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation
How does shared computer activation affect the user’s normal limited-PC activation allowance?
Applications & delivery
Use of Microsoft 365 Apps with shared computer activation enabled does not count against the normal limited-PC allowance. This applies to the shared-activation mode; every user still needs their own qualifying license.
Objectives: Implement and manage Microsoft 365 Apps on Azure Virtual Desktop session hosts Sources: Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation
What does OneDriveSetup.exe /allusers change on non-persistent AVD hosts?
Applications & delivery
It installs the OneDrive sync application per machine so users share the executable installation. Their sync state and files remain per user. Use supported profile persistence and policies; per-machine binaries do not turn all users’ OneDrive data into one shared sync state.
Objectives: Implement and manage OneDrive, including multisession environments Sources: Install Microsoft 365 Apps on a custom image — https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image; Use the OneDrive sync app on virtual desktops — https://learn.microsoft.com/en-us/onedrive/sync-vdi-support
What OneDrive limitation matters when one user might launch desktop and app sessions simultaneously?
Applications & delivery
OneDrive with FSLogix does not support simultaneous instances using the same container. Design assignments and session behavior to avoid that state. Separate session hosts or successful FSLogix mounting do not make the same-container concurrent sync scenario supported.
Objectives: Implement and manage OneDrive, including multisession environments Sources: Concurrent or multiple connections to a single container — https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections; Use the OneDrive sync app on virtual desktops — https://learn.microsoft.com/en-us/onedrive/sync-vdi-support
Which host registry value identifies the AVD media environment to Teams?
Applications & delivery
HKLM\SOFTWARE\Microsoft\Teams\IsWVDEnvironment, a DWORD set to 1. This is one prerequisite for the supported optimization path, not proof that media is optimized. Compatible Teams/client releases and host/endpoint components must still load successfully.
Objectives: Implement and manage Microsoft Teams, including the Remote Desktop WebRTC Redirector Service Sources: Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd; Install Teams for VDI — https://learn.microsoft.com/microsoftteams/teams-client-vdi-requirements-deploy
Why retain the Remote Desktop WebRTC Redirector Service when deploying new Teams with SlimCore?
Applications & delivery
It supplies the recommended fallback when a user connects from an endpoint that cannot use SlimCore. New Teams supports both architectures on their supported paths. Verify the active optimization status; a launched application or redirected microphone is not sufficient evidence.
Objectives: Implement and manage Microsoft Teams, including the Remote Desktop WebRTC Redirector Service Sources: Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd; New Teams VDI optimization and endpoint requirements — https://learn.microsoft.com/en-us/microsoftteams/vdi-2
Which macOS Windows App distribution is required for the Teams SlimCore path?
Applications & delivery
Use the supported non-Store Microsoft AutoUpdate, or MAU, distribution. It bundles the required plugin. The App Store distribution remains on WebRTC optimization. Use current supported releases and platform prerequisites rather than assuming that both distribution channels provide identical optimization.
Objectives: Implement and manage Microsoft Teams, including the Remote Desktop WebRTC Redirector Service Sources: Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd; New Teams VDI optimization and endpoint requirements — https://learn.microsoft.com/en-us/microsoftteams/vdi-2
How can administrators prevent users from disabling the required browser MMR extension?
Applications & delivery
Manage or force-install the extension using supported enterprise browser policies through Intune, Group Policy or the Edge management service. Target the intended hosts or users and check applied policy and extension status. Installing extension files once does not enforce ongoing browser behavior.
Objectives: Implement and manage browsers for Azure Virtual Desktop sessions Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
Which host pools can receive an App Attach package created with Regional deployment scope?
Applications & delivery
Only Regional host pools in the same Azure region. The package inherits scope from its original pool and its scope cannot be changed after creation. A geographical pool in the same region is still incompatible with that Regional package.
Objectives: Configure dynamic application delivery by using App attach Sources: Add and manage App Attach applications — https://learn.microsoft.com/azure/virtual-desktop/app-attach-setup
What Azure Files share-level setting supports App Attach reads by AD DS session-host computer accounts?
Applications & delivery
Set the default share-level permission to Storage File Data SMB Share Reader, then grant NTFS read access to the session-host computer objects. App images are mounted in the host context, so copying user-profile permissions is not a complete app-storage configuration.
Objectives: Configure dynamic application delivery by using App attach Sources: App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview
Which files must be retained when distributing a CIM image for App Attach?
Applications & delivery
Retain the .cim metadata and its accompanying objectid_ and region_ files as one complete image set. Copying only the .cim file omits package data and leaves an incomplete application image.
Objectives: Create an application package for App attach Sources: Create an MSIX image for App Attach — https://learn.microsoft.com/azure/virtual-desktop/app-attach-create-msix-image; App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview
What certificate prerequisite must session hosts satisfy for a signed MSIX or Appx package?
Applications & delivery
They must trust the valid code-signing certificate and its chain. Review package identity, dependencies, architecture and app compatibility as well. A package file being readable on SMB does not establish signature trust or prove that every captured application is suitable.
Objectives: Create an application package for App attach Sources: App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview; Add and manage App Attach applications — https://learn.microsoft.com/azure/virtual-desktop/app-attach-setup
How are AVD service events sent to Log Analytics?
Monitoring & autoscale
Configure diagnostic settings on the relevant AVD resources and select the required categories and destination workspace. These settings collect service events such as connections and errors. They do not collect the guest OS CPU and memory counters supplied through AMA and DCRs.
Objectives: Configure log collection and analysis for Azure Virtual Desktop session hosts Sources: AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics; Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
What collects Windows performance counters inside session hosts for Insights?
Monitoring & autoscale
Azure Monitor Agent with suitable data collection rules and associations to the session-host VMs. Confirm installation, identity, destination and connectivity. Installing AMA alone without the required collection configuration does not populate all the needed guest telemetry.
Objectives: Configure log collection and analysis for Azure Virtual Desktop session hosts Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
What is the purpose of associating a DCR with a session-host VM?
Monitoring & autoscale
The association applies the rule’s guest-data collection configuration to that VM, including selected counters/events and destinations. A DCR merely existing in Azure does not make every host use it. Verify associations when new hosts join the pool.
Objectives: Configure log collection and analysis for Azure Virtual Desktop session hosts Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
What turns a monitoring condition into an operational notification?
Monitoring & autoscale
An Azure Monitor alert rule evaluates the chosen metric or log condition, and an action group routes the notification or response. Choose a meaningful threshold, window and severity. Displaying a workbook chart alone does not alert an operator.
Objectives: Monitor Azure Virtual Desktop by using Azure Monitor Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics; Azure Monitor action groups — https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups
Why correlate connection errors with checkpoints and connection identifiers?
Monitoring & autoscale
Correlation links events from the same connection attempt and helps locate the failing stage. Combine service evidence with client, host, identity and profile logs as needed. A failure before reaching the AVD service might leave no AVD connection record.
Objectives: Monitor Azure Virtual Desktop by using Azure Monitor Sources: AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics
Which Azure log helps investigate who changed a session-host VM’s power state?
Monitoring & autoscale
The Azure Activity Log records management-plane operations such as VM start and deallocate actions. Compare its actor and timestamps with scaling and session telemetry. Guest event logs and AVD connection logs answer different questions about the same incident.
Objectives: Monitor Azure Virtual Desktop by using Azure Monitor Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics; Virtual machines monitoring data reference: Activity log — https://learn.microsoft.com/en-us/azure/virtual-machines/monitor-vm-reference#activity-log
What is AVD Insights built on, and how can a team adapt it?
Monitoring & autoscale
Insights uses Azure Monitor Workbooks to query monitoring data. Save a customizable workbook copy and adapt parameters, queries and visualizations to the team’s needs. The workbook consumes collected data; changing its layout does not enable missing diagnostics or guest counters.
Objectives: Customize Azure Monitor workbooks for Azure Virtual Desktop Insights Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
What should be checked when an Insights workbook shows empty host-performance charts?
Monitoring & autoscale
Check the selected pool, workspace and time range, then verify AMA, DCR contents/associations and data arrival for those hosts. Also check reader access. Rebuilding the workbook cannot repair a missing telemetry pipeline.
Objectives: Customize Azure Monitor workbooks for Azure Virtual Desktop Insights Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Why can an operator open an Insights workbook but see no query results?
Monitoring & autoscale
Permission to view the workbook does not necessarily grant permission to query the underlying Log Analytics data. Verify the relevant resource/workspace access model and scopes, along with correct parameters. Grant only the read permissions needed for the operator’s role.
Objectives: Customize Azure Monitor workbooks for Azure Virtual Desktop Insights Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
How should capacity be optimized when users report slowness but CPU is low?
Monitoring & autoscale
Inspect memory, disk latency, profile storage, application response and connection quality. Correlate the complaint with telemetry from the same period. Resize or tune the component that is actually constrained; low CPU alone does not prove sufficient overall capacity.
Objectives: Optimize session host capacity and performance Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
How should maintenance batch size be chosen for a pooled host rollout?
Monitoring & autoscale
The hosts left available must support current demand within tested session limits, including required failure headroom. Reduce batch size or add validated replacement hosts first if necessary. Draining a large batch without capacity planning can overload the remaining hosts.
Objectives: Optimize session host capacity and performance Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
Why should a capacity pilot include a simultaneous morning sign-in burst?
Monitoring & autoscale
Sign-ins create transient load from profiles, authentication, applications and storage that differs from steady-state sessions. Measure sign-in response and dependency saturation during the burst. A pool that handles established sessions may still fail its morning responsiveness requirement.
Objectives: Optimize session host capacity and performance Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
How do power-management autoscale and dynamic autoscale differ?
Monitoring & autoscale
Power-management autoscale starts and deallocates existing hosts. Dynamic autoscale creates and deletes hosts through the supported session host configuration workflow. Select the method that matches the pool’s management approach and prerequisites; avoid independent competing scalers controlling the same pool.
Objectives: Implement autoscaling in host pools Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
Is a pooled autoscale capacity threshold a CPU utilization threshold?
Monitoring & autoscale
No. It concerns session utilization relative to available host capacity derived from session limits. CPU measurements still matter for choosing those limits. A 75% capacity threshold does not mean the scaler waits for guest CPU to reach 75%.
Objectives: Implement autoscaling in host pools Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
How many hosts does a 10% minimum require in a seven-host pool?
Monitoring & autoscale
One, because the fractional host requirement rounds up. The minimum host percentage and session-capacity threshold are separate constraints. Required session demand may cause more hosts to be started than the minimum alone.
Objectives: Implement autoscaling in host pools Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
What does an autoscale exclusion tag do during maintenance?
Monitoring & autoscale
It prevents autoscale from starting, stopping or changing drain mode on the tagged host. The host still counts in the minimum-percentage calculation. Coordinate exclusions and remaining capacity; excluding a VM is not the same as removing it from the pool.
Objectives: Implement autoscaling in host pools Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
Why is the scaling plan’s time zone important?
Monitoring & autoscale
Schedule phases run in the configured time zone, which must match the intended business hours and seasonal clock behavior. A correctly defined ramp-up can still occur at the wrong local time if the plan uses the wrong zone. Test observed behavior and scaling logs.
Objectives: Implement autoscaling in host pools Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
What is the operational difference between disconnecting and signing out an AVD session?
Monitoring & autoscale
Disconnection leaves the session and its processes on the host so the user can reconnect. Sign-out ends the session and closes its applications. Disconnected sessions can still consume resources and affect shutdown eligibility; warn users before any forced sign-out.
Objectives: Monitor and manage active sessions and application groups Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology; Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
What should be checked when a healthy pool’s desktop is missing from a user’s feed?
Monitoring & autoscale
Check the intended application group, its registration with the AVD workspace and the user’s assignment. Then refresh the supported client feed and confirm the account/tenant. Host CPU and load-balancing changes do not create a missing publication or entitlement.
Objectives: Monitor and manage active sessions and application groups Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology; Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
What must be checked before shutting down a drained host for maintenance?
Monitoring & autoscale
Check both active and disconnected sessions and apply the agreed user notification/sign-out process. Drain mode alone does not empty the host. Also coordinate autoscale exclusions and sufficient remaining capacity before stopping the VM.
Objectives: Monitor and manage active sessions and application groups Sources: Drain mode — https://learn.microsoft.com/en-us/azure/virtual-desktop/drain-mode
How does persistence influence the session-host update strategy?
Updates & recovery
Replaceable pooled hosts often use image servicing and staged replacement with external profiles. Personal desktops with unique machine state often need supported in-place servicing and backups. Select the approach for the OS and state requirements, then validate it in a pilot ring.
Objectives: Recommend an update strategy for session hosts Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
What does Scheduled Agent Updates service?
Updates & recovery
It schedules the AVD Agent, side-by-side stack and Geneva Monitoring agent. It does not schedule Windows OS or line-of-business app patches. Keep hosts available during the window; critical updates and initial installation can occur outside normal noncritical windows.
Objectives: Recommend an update strategy for session hosts Sources: Scheduled agent updates — https://learn.microsoft.com/en-us/azure/virtual-desktop/scheduled-agent-updates
Why test OS and application updates together in a pilot ring?
Updates & recovery
An update can change app compatibility, profile behavior, activation or client features even if installation succeeds. Test representative users and workloads before expansion, keep a rollback path and preserve capacity while replacing or servicing hosts.
Objectives: Recommend an update strategy for session hosts Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
Is Azure Update Manager the current supported choice for Windows Enterprise multi-session OS patching?
Updates & recovery
No. The current AVD update methodology matrix does not support Azure Update Manager for Windows client Enterprise or multi-session. Use an OS-appropriate supported method, such as image servicing for pooled multi-session hosts. Recheck the support matrix when platform guidance changes.
Objectives: Recommend an update strategy for session hosts Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
What does a 15-minute RPO mean?
Updates & recovery
The recovery design must limit acceptable data loss to the last 15 minutes. Backup/replication frequency, lag and recoverability determine whether this is achievable. It does not mean service must be restored within 15 minutes; that requirement is the RTO.
Objectives: Plan and implement a disaster recovery plan for Azure Virtual Desktop Sources: Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
What must a two-hour RTO cover for an AVD business workload?
Updates & recovery
Restore a usable service within two hours, including dependencies such as identity, profiles, applications, networking and capacity. A VM boot time alone does not demonstrate the RTO. Time representative end-to-end recovery drills and resolve any gaps.
Objectives: Plan and implement a disaster recovery plan for Azure Virtual Desktop Sources: Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
What makes a recovery runbook more than a list of replicated resources?
Updates & recovery
It defines owners, decision criteria, dependency order, failover and failback steps, data-write coordination and user validation. Tests record actual RPO/RTO and capacity. Replicated components still need an executable procedure to restore working desktops.
Objectives: Plan and implement a disaster recovery plan for Azure Virtual Desktop Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr; Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
What is the main AVD trade-off between active-passive and active-active regions?
Updates & recovery
Active-passive can reduce standing costs but may need more time to deploy or start recovery capacity. Active-active serves users in both regions and needs capacity/operations to absorb a failure. Neither design automatically supplies profile consistency or surviving app back ends.
Objectives: Plan for multi-region implementation Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
What must accompany a gallery replica in an AVD recovery region?
Updates & recovery
Working identity and DNS, network paths and endpoints, profile/data recovery, available VM capacity, app dependencies and user publication/assignment. The image is only one dependency. Validate a real user performing work in the recovery region.
Objectives: Plan for multi-region implementation Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Why should regional failover prevent simultaneous uncontrolled writes to one FSLogix profile?
Updates & recovery
Concurrent writes to competing copies can cause conflicts or corruption. Coordinate sign-out or fence old writers, select the authoritative recovery state and control failback. Asynchronous replication can lose unflushed changes and does not replace recoverable historical backups.
Objectives: Plan for multi-region implementation Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Does backing up a personal session-host VM protect its remote FSLogix share?
Updates & recovery
No. A remote profile share is a separate storage asset and needs its own supported protection. The same is true of external application databases and user files. Design backup coverage by asset rather than assuming one VM backup includes all desktop dependencies.
Objectives: Design and implement a backup strategy for Azure Virtual Desktop Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview; Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
Why is storage redundancy insufficient protection against an overwritten profile?
Updates & recovery
Redundancy maintains copies of the current storage state and can propagate the overwrite. Historical recovery points with appropriate retention let you restore an earlier healthy container. Combine availability protection with tested backups; they solve different failure modes.
Objectives: Design and implement a backup strategy for Azure Virtual Desktop Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview
How does application-consistent recovery differ from crash-consistent recovery?
Updates & recovery
Application-consistent recovery coordinates supported applications, typically through functioning VSS writers on Windows. Crash-consistent recovery resembles an abrupt power loss and may require app recovery. Confirm the workload’s support and test restored data; a completed job alone does not prove application readiness.
Objectives: Design and implement a backup strategy for Azure Virtual Desktop Sources: Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts; An overview of Azure VM backup — https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction
What are the essential safeguards before replacing a user’s FSLogix container from backup?
Updates & recovery
Fully sign the user out and verify the container is detached everywhere. Preserve the current copy, choose a healthy recovery point and verify ownership, ACLs and the configured path. Then test fresh sign-in and expected data. Never overwrite a mounted container.
Objectives: Configure backup and restore for FSLogix user profiles, personal desktops, and images Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
What should be validated after restoring a personal desktop VM?
Updates & recovery
Validate networking, DNS, identity join, agent health/registration and the correct personal assignment, then test apps and data. A restored disk does not automatically restore every AVD relationship. Avoid duplicate active machines with conflicting machine or agent state.
Objectives: Configure backup and restore for FSLogix user profiles, personal desktops, and images Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr; Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts; An overview of Azure VM backup — https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction
What should be protected in addition to regional image replicas?
Updates & recovery
Retain approved image versions, build scripts, configuration, app packages and infrastructure definitions. Gallery replication distributes deployable images but is not a complete backup of the build system. These artifacts support reconstructing hosts, publication and deployment after a loss.
Objectives: Configure backup and restore for FSLogix user profiles, personal desktops, and images Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Practice questions
These are original study questions. Multiple-response practice uses exact-set scoring in the app, with no partial credit.
1. A team is configuring the base reverse-connect transport for Azure Virtual Desktop. Which direction does the session host use to establish its connection to the service?
Networking
✓ Correct answer
- An outbound HTTPS connection
The session host initiates outbound HTTPS connectivity to Azure Virtual Desktop. Reverse connect avoids requiring an internet-facing inbound RDP listener for the base session transport.
Open this question’s page →2. Which transport does RDP Shortpath use for its remote-session data path?
Networking
✓ Correct answer
- UDP
RDP Shortpath uses a UDP-based data transport. The initial connection still begins with the TCP-based reverse-connect transport before a suitable Shortpath path is established.
Open this question’s page →3. A client cannot establish any usable Shortpath UDP connection. Required reverse-connect connectivity remains available. What transport can carry the session?
Networking
✓ Correct answer
- The TCP-based reverse-connect transport
If UDP connectivity cannot be established, Azure Virtual Desktop can fall back to TCP-based reverse connect. This depends on the required TCP/service connectivity being available.
Open this question’s page →4. An organization wants a private connection from its on-premises network to Microsoft cloud services through a connectivity provider. Which service fits that requirement?
Networking
✓ Correct answer
- Azure ExpressRoute
ExpressRoute provides private connectivity through a connectivity provider. Azure DNS resolves names, Azure Monitor observes resources, and App Configuration stores application configuration; those services do not provide this private circuit.
Open this question’s page →5. Select the two statements that describe Azure Virtual Desktop reverse connect and Shortpath correctly.
Networking
✓ Correct answers
- The initial session connection uses TCP-based reverse connect
- Shortpath can move the session data transport to a usable UDP path
A connection starts with the secure TCP-based reverse-connect transport. When a suitable Shortpath connection is established, session data moves to UDP. This does not require disabling TLS or exposing a public inbound TCP 3389 listener.
Open this question’s page →6. A remote employee must access an Azure Virtual Desktop workflow that uses only a private endpoint in a virtual network. What must the design provide for that employee?
Networking
✓ Correct answer
- Network access to the virtual network, such as through a VPN or ExpressRoute
The client needs a route to the virtual network for private-endpoint connectivity. Private Link does not by itself connect a remote device to that network; a VPN or ExpressRoute can provide access.
Open this question’s page →7. After tightening outbound firewall rules, a session host cannot connect to Azure Virtual Desktop. Which tool directly checks its access to the required service FQDNs and endpoints?
Networking
✓ Correct answer
- The Azure Virtual Desktop Agent URL Tool
The Agent URL Tool validates whether the session host can reach the documented FQDNs and endpoints. Profile-size and display settings do not test outbound service connectivity.
Open this question’s page →8. Which two Azure Virtual Desktop workflows have their own private-endpoint target sub-resources?
Networking
✓ Correct answers
- Downloading the workspace feed
- Connecting to a host pool
The workspace feed workflow uses the feed sub-resource, and host-pool connections use the connection sub-resource. Initial feed discovery is a third supported workflow using global; local wallpaper, windows and documents are not these endpoint workflows.
Open this question’s page →9. Which control adds authentication evidence beyond a user's password and is recommended for Azure Virtual Desktop users and administrators?
Security
✓ Correct answer
- Multifactor authentication
MFA strengthens authentication by requiring additional evidence. Increasing capacity or exposing RDP does not add authentication evidence, and disabling logs reduces visibility.
Open this question’s page →10. A security team wants access decisions to consider the user, sign-in and device before granting access to Azure Virtual Desktop. Which feature addresses that requirement?
Security
✓ Correct answer
- Microsoft Entra Conditional Access
Conditional Access evaluates access conditions before granting access. Storage optimization, balancing and display names serve other purposes and do not provide these identity access decisions.
Open this question’s page →11. Under Azure Virtual Desktop's shared security responsibilities, which two components are customer- or partner-managed?
Security
✓ Correct answers
- The session-host operating system
- The deployment's network controls
The customer or partner manages session-host OS security and deployment network controls. Microsoft manages the virtualization control plane and physical datacenter. A managed service still requires customer security work.
Open this question’s page →12. A user has a justified requirement for local administrator privileges in their virtual desktop. Which design does Microsoft recommend instead of granting those rights on a shared multi-session host?
Security
✓ Correct answer
- Use a personal host pool and assign the user their own session host
Microsoft recommends personal host pools with a session host per user when local administrator privileges are needed. Administrators on a shared host can affect other users' sessions and data; a bigger profile disk does not address that risk.
Open this question’s page →13. A vulnerability affects the session-host OS and an installed application. Which three locations belong in the customer-managed patch plan?
Security
✓ Correct answers
- Running session-host operating systems
- The affected applications on those hosts
- Base images used for new session hosts
Patching must cover running operating systems, affected applications and base images so newly created hosts do not reintroduce the vulnerability. Workspace names and profile disk sizes are not patches.
Open this question’s page →14. A team publishes one application as RemoteApp and assumes users cannot launch any other software on the session host. Which review finding is correct?
Security
✓ Correct answer
- RemoteApp alone is not an application-execution security boundary; use application control when restriction is required
Microsoft explicitly notes that RemoteApp is not a security feature that prevents other applications from launching. Application-control features such as App Control or AppLocker can enforce allowed software.
Open this question’s page →15. A team needs evidence of Azure Virtual Desktop user and administrator activity. What should it enable?
Security
✓ Correct answer
- Collection of relevant audit logs
Audit logs provide activity evidence. Microsoft recommends collecting relevant logs such as Azure Activity, Microsoft Entra and session-host logs; display, size and name changes do not provide that evidence.
Open this question’s page →16. An administrator is reviewing access to local and remote file systems from session hosts. Which approach follows Microsoft's least-privilege recommendation?
Security
✓ Correct answer
- Grant only the file-system permissions users need for their work
Least privilege limits permissions to the resources and operations a user needs. Broad full control, removing ACLs or sharing an administrator account increases access and weakens accountability.
Open this question’s page →17. A pooled Azure Virtual Desktop user may sign in to different session hosts and needs their Windows profile settings to follow them. Which FSLogix feature addresses this?
Storage & FSLogix
✓ Correct answer
- A profile container
FSLogix profile containers store the user's profile in a virtual disk that is attached at sign-in. This allows personalization to follow the user across session hosts; naming, firewall and registration settings do not roam profiles.
Open this question’s page →18. Which two virtual disk formats are used for FSLogix containers?
Storage & FSLogix
✓ Correct answers
- VHD
- VHDX
FSLogix containers are VHD or VHDX files. ISO is an optical-disc image format and WIM is a Windows imaging format; neither is the FSLogix container disk format here.
Open this question’s page →19. A default FSLogix profile container is already configured. Must a separate ODFC container always be added to include Office-related profile data?
Storage & FSLogix
✓ Correct answer
- No, the default profile container already includes profile and ODFC content
The default profile container holds both general profile and ODFC content in the same disk, which is the recommended configuration. Separate ODFC containers serve particular scenarios, rather than being universally required.
Open this question’s page →20. How should FSLogix Cloud Cache be classified?
Storage & FSLogix
✓ Correct answer
- An optional configuration for profile and ODFC containers
Cloud Cache is an optional configuration that can be used with profile or ODFC containers. It is not a distinct third container type, an identity replacement or an application publishing tool.
Open this question’s page →21. A branch has ample spare bandwidth and negligible loss, but sessions to a distant Azure region show a stable 210-ms RTT. Business requirements permit another host region. Which change best addresses the measured network constraint?
Networking
✓ Correct answer
- Deploy the workload in a suitable region closer to the branch
The measured constraint is latency rather than capacity. A closer suitable host region can reduce propagation delay; remeasure representative sessions afterward. Option explanations: A. Deploy the workload in a suitable region closer to the branch: Shortening the geographical path addresses the propagation component of RTT. B. Double the internet link's advertised bandwidth: More capacity does not remove distance-related delay when the existing link is not congested. C. Raise the host-pool session limit: Higher density does not correct network latency and could add host contention. D. Increase the profile-container maximum size: Profile capacity does not shorten the endpoint-to-host path. Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Open this question’s page →22. A planner reserves 18 Mbps for each medium-workload session by adding 3 Mbps from the workload table to 15 Mbps for a 4K display at 30 fps. Which review comment is most accurate?
Networking
✓ Correct answer
- The tables describe overlapping influences; validate a representative workload/display estimate
Use the tables as planning guidance and test the actual combination. Neither an automatic sum nor one workload figure guarantees the required capacity. Option explanations: A. 3 Mbps is sufficient regardless of the display or activity: The workload starting figure does not override a demanding display pattern. B. The tables describe overlapping influences; validate a representative workload/display estimate: Workload and display recommendations concern the same stream, so simple addition is not a documented sizing method. C. The display has no effect because the workload is medium: Resolution and frame rate can materially increase bandwidth needs. D. 18 Mbps is a guaranteed maximum for every such session: The guidance is not a fixed ceiling; content, frame rate and redirection can change consumption. Sources: Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Open this question’s page →23. A pilot has 0.5% packet loss. Its owner claims that meeting the published minimum Mbps per workload is enough to approve the branch network. What should the reviewer conclude?
Networking
✓ Correct answer
- The stated loss exceeds the guidance's conditions, so investigate loss and retest the experience
The pilot falls outside the network conditions attached to the recommendations. Correct or characterize packet loss and test realistic sessions before approval. Option explanations: A. Only the total number of licensed users needs recalculation: Concurrency matters, but recalculating licenses does not address measured loss. B. The Mbps table guarantees smooth sessions at any loss rate: The table has a stated packet-loss condition and cannot guarantee this pilot's result. C. The stated loss exceeds the guidance's conditions, so investigate loss and retest the experience: The recommendations assume less than 0.1% packet loss; meeting Mbps alone does not validate this path. D. A larger profile disk will compensate for packet retransmissions: Storage capacity does not repair packet loss. Sources: Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Open this question’s page →24. A network team is approving a 1-Gbps AVD branch design. It has checked average Mbps but has not tested peak demand or the firewall's connection capacity. Which two measurements directly close those gaps?
Networking
✓ Correct answers
- Measure representative traffic at peak concurrent session load
- Measure transport-path/NAT capacity with the supported Multipath workload
Approval needs both traffic demand and transport-resource evidence. Concurrent workload tests and firewall/NAT path measurements assess different constraints. Option explanations: A. Measure representative traffic at peak concurrent session load: Peak concurrent activity can exceed the average and reveals demand bursts. B. Measure transport-path/NAT capacity with the supported Multipath workload: Several paths per session can pressure connection/NAT resources even with spare Mbps. C. Record the maximum configured VHDX size as the only network-capacity metric: Container size is a storage-capacity setting, not a measurement of the branch transport. D. Use the total purchased license count as the sole performance measurement: Licenses do not measure concurrency, traffic or NAT behavior. Sources: Use RDP Multipath to improve connection reliability to Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-multipath; Network guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/network-guidance
Open this question’s page →25. AD DS domain controllers are reachable by IP from a peered session-host VNet, but new hosts cannot resolve the domain during join. The host VNet still uses DNS that cannot resolve AD records. Which change addresses the stated defect?
Networking
✓ Correct answer
- Configure reachable DNS servers or forwarding that resolves the AD domain
Peering supplies connectivity, not automatic AD DNS configuration. Set a supported resolver path and verify domain records from the host network. Option explanations: A. Add a public IP to each host: A public IP does not make AD DNS records resolvable. B. Open the managed Shortpath listener: The UDP display-transport listener does not supply directory DNS. C. Increase the storage-account quota: Profile capacity does not affect AD DNS resolution. D. Configure reachable DNS servers or forwarding that resolves the AD domain: Domain join requires domain-name resolution as well as IP reachability. Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Open this question’s page →26. Hosts can reach the AVD service over HTTPS, but Windows activation fails. Firewall logs show blocked traffic to azkms.core.windows.net. Which documented dependency should be allowed?
Networking
✓ Correct answer
- TCP 1688 to the specified Azure KMS endpoint
AVD HTTPS access does not cover every host dependency. Permit the documented activation endpoint and port using the current endpoint requirements. Option explanations: A. TCP 1688 to the specified Azure KMS endpoint: This is the documented Windows activation dependency in the host endpoint list. B. UDP 3390 to the KMS endpoint: UDP 3390 is the default managed Shortpath listener, not the activation transport. C. UDP 3478 to the profile share: STUN/TURN relay traffic does not activate Windows. D. TCP 445 to the workspace feed endpoint: SMB to a workspace feed is unrelated to Windows activation. Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Open this question’s page →27. An individual remote employee needs private reachability from a laptop to Azure VNets used by the AVD design. There is no branch gateway and no requirement for a provider circuit. Which connectivity option fits this endpoint requirement?
Networking
✓ Correct answer
- Point-to-site VPN
Point-to-site provides the requested individual-device connection. The AVD endpoint and profile services still need their own DNS, routes and permissions. Option explanations: A. An Azure Files share-level role: A data role does not create private network reachability. B. Point-to-site VPN: Point-to-site connects an individual device to an Azure VNet. C. ExpressRoute private peering solely to this laptop: ExpressRoute is an organizational/provider connectivity design rather than this individual-device VPN requirement. D. Site-to-site VPN: Site-to-site connects networks through gateways; the scenario supplies no branch gateway. Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; About Point-to-Site VPN — https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about
Open this question’s page →28. A host-side proxy/security baseline attempts to intercept every destination. The team must preserve required Azure platform communication. Which two platform IP destinations need the documented exception from interception or redirection?
Networking
✓ Correct answers
- 168.63.129.16
- 169.254.169.254
IMDS and Azure platform communication must retain their required paths. A host-side interception policy must exempt these destinations; ordinary Azure NSGs and UDRs do not redirect the protected platform paths by default. Option explanations: A. 168.63.129.16: This platform communication/DNS address must retain its required path without interception or redirection. B. 51.5.0.0/16: This is the public-cloud Shortpath relay range, not one of the two special Azure platform addresses identified here. C. 169.254.169.254: This is IMDS and must retain its required platform path without proxying or redirection. D. azkms.core.windows.net: This is a documented activation destination, but not one of the two special platform IP paths identified here. Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Open this question’s page →29. Public-cloud clients and hosts can establish TCP sessions and reach STUN, but symmetric NAT prevents a viable direct UDP path. UDP relay use is permitted by policy. Which Shortpath method addresses this condition?
Networking
✓ Correct answer
- TURN-relayed UDP using the documented relay endpoint
TURN is the supported relay mechanism for this NAT condition. In Azure public cloud, allow the current documented relay range and UDP 3478 as required. Option explanations: A. Public inbound administrative TCP 3389: Opening administrative RDP is not the Shortpath UDP relay solution. B. Unauthenticated UDP sent before AVD brokering: Shortpath does not bypass the initial authentication and reverse-connection process. C. TURN-relayed UDP using the documented relay endpoint: TURN carries UDP through a relay when direct NAT traversal cannot form a viable path. D. STUN as a relay for the full desktop stream: STUN discovers mappings; it does not relay the complete session. Sources: RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath; Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Open this question’s page →30. A supported Multipath session has several established paths. The user's device then loses every network interface. What outcome should the operations team expect?
Networking
✓ Correct answer
- Reconnection requires restored network connectivity
Multipath protects against failure or degradation of an individual path, not total loss of endpoint connectivity. Reconnection still depends on restoring a usable network. Option explanations: A. Multipath keeps the desktop connected without any network: Alternative paths help only when at least one viable network path exists. B. The existing TURN path remains usable without restoring any network interface: TURN is a network relay path; it cannot remain usable from a device that has lost every network interface. C. The session moves automatically to a different host to restore the device's network: Multipath does not change host assignment or repair endpoint connectivity. D. Reconnection requires restored network connectivity: No available path remains, so Multipath cannot maintain connectivity during the complete outage. Sources: Use RDP Multipath to improve connection reliability to Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-multipath
Open this question’s page →31. Managed Shortpath works on a custom UDP listener port 3400. A QoS GPO matches svchost.exe and UDP, but its source-port filter is still 3390. No matching traffic is marked. Which focused adjustment is needed?
Networking
✓ Correct answer
- Change the source-port match to the actual listener port 3400
The policy targets the right application and protocol but the wrong port. Match the configured listener before evaluating DSCP marking and downstream queues. Option explanations: A. Change the source-port match to the actual listener port 3400: The policy must match the traffic's configured listener/source port. B. Change the policy protocol to TCP: The working managed Shortpath path in this scenario uses UDP. C. Apply outbound throttling instead of correcting the source-port match: Throttling is not a substitute for matching the actual traffic and can further degrade the stream. D. Match the destination profile-share port 445: The policy should match RDP session traffic, not SMB profile traffic. Sources: Implement Quality of Service (QoS) for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-quality-of-service-qos
Open this question’s page →32. Managed Shortpath packets leave hosts marked DSCP 46. A WAN router ignores markings and uses one FIFO queue. The host policy also applies an unnecessarily low outbound throttle. Which two changes address these findings?
Networking
✓ Correct answers
- Remove the unnecessary outbound throttle from the prioritization policy
- Configure the router to honor the intended traffic classification and priority queue
Correct marking is only one part of QoS. Honor it throughout the controlled path and avoid imposing a throttle that contradicts the desired experience. Option explanations: A. Remove the unnecessary outbound throttle from the prioritization policy: The documented prioritization-only policy leaves throttling unset; a low cap can degrade the stream. B. Increase the configured profile maximum to alter the router's queue: Profile capacity cannot change packet queuing. C. Treat TCP reverse connect as the transport supported by this managed Shortpath QoS method: The documented managed Shortpath QoS policy applies to its UDP path, not TCP reverse-connect transport. D. Configure the router to honor the intended traffic classification and priority queue: End-to-end managed QoS requires the network devices to apply consistent priorities. Sources: Implement Quality of Service (QoS) for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-quality-of-service-qos
Open this question’s page →33. An empty workspace hosts the deployment's shared global private endpoint. An administrator wants to delete it because it has no application groups. What is the appropriate review decision?
Networking
✓ Correct answer
- Preserve its discovery role until a planned replacement is working
The workspace can be operationally important without application groups. Account for the shared global discovery endpoint before removing it. Option explanations: A. Replace it with an Azure Files private endpoint: The file endpoint serves storage, not AVD initial discovery. B. Preserve its discovery role until a planned replacement is working: An empty dedicated workspace is recommended for the global endpoint; deleting it can break initial discovery. C. Rely only on host-pool connection endpoints to replace global discovery: Host-pool connection endpoints serve sessions and do not replace the initial global discovery workflow. D. Delete it because only workspaces with desktops can matter: Global discovery is a separate workflow and does not require registered application groups there. Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
Open this question’s page →34. A host pool has a working connection private endpoint. Hosts must use private AVD connectivity, but users are intentionally allowed to connect through the public service. The current host-pool access mode requires both sides private. Which mode matches the requirement?
Networking
✓ Correct answer
- Allow public user access while requiring private access for session hosts
Choose the host-pool access mode for the intended paths of both participants. Creating an endpoint alone does not select the correct public/private policy. Option explanations: A. Allow public access for both sides without a host restriction: It does not enforce the private-host requirement. B. Configure the storage account's public access instead of the host pool: Storage access settings do not control the AVD host-pool connection workflow. C. Allow public user access while requiring private access for session hosts: This documented mode matches public users and private hosts. D. Require both users and hosts to use private routes: That mode conflicts with the stated public-user requirement. Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
Open this question’s page →35. Private AVD records resolve correctly in Azure, but an on-premises VPN client still gets public AVD addresses from its corporate resolver. Private routing is available. What should be fixed first?
Networking
✓ Correct answer
- Corporate DNS resolution/forwarding to the appropriate linked private zones
The failure is in the client's name-resolution path. Configure forwarding/resolution for the private AVD zones and retest from that network. Option explanations: A. Grant a user broader file-share ACLs: File ACLs cannot change AVD service DNS resolution. B. Increase the session-host VM size: VM compute capacity does not correct DNS answers. C. Remove all private endpoints: Removing the private design does not meet the private-access requirement. D. Corporate DNS resolution/forwarding to the appropriate linked private zones: The client must resolve the relevant AVD names to the private addresses for the intended workflow. Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview; Set up Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-setup
Open this question’s page →36. A design deliberately keeps initial discovery public, while workspace feed downloads and host-pool sessions must use private routes. Which two AVD private endpoint subresources are needed?
Networking
✓ Correct answers
- Host pool connection
- Workspace feed
Private feed and session requirements are served by their respective endpoints. The discovery and storage workflows have separate purposes. Option explanations: A. Workspace global: It privatizes initial discovery, which the scenario deliberately leaves public. B. Host pool connection: This subresource provides private session-host connection workflows. C. Workspace feed: This subresource provides the required private workspace-feed workflow. D. Storage account file: It can privatize profile storage but does not implement either stated AVD service workflow. Sources: Azure Private Link with Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/private-link-overview
Open this question’s page →37. A connection-network record shows 1,000 kilobytes per second. Using decimal units of 1,000 bytes per kilobyte and 1,000,000 bits per megabit, what bandwidth is that?
Networking
✓ Correct answer
- 8 Mbps
Connection-network bandwidth is reported in kilobytes per second. Convert units before comparing it with link capacity or Mbps planning guidance. Option explanations: A. 8 Mbps: 1,000 × 1,000 bytes/s × 8 bits/byte ÷ 1,000,000 gives 8 Mbps. B. 1 Mbps: This treats bytes as bits and misses the factor of eight. C. 8,000 Mbps: This misses the kilo-to-mega conversion after converting bytes to bits. D. 1,000 Mbps: This treats the recorded kilobyte value as megabits. Sources: Analyze connection quality in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/connection-latency
Open this question’s page →38. A healthy test session has periodic connection-network records but no ConnectionGraphicsData records. The analyst wants a regular baseline of healthy sessions. Which approach is appropriate?
Networking
✓ Correct answer
- Use periodic network records and relevant host metrics rather than assuming graphics logging is broken
The tables have different collection behavior. A healthy baseline needs regularly collected network and workload evidence, not mandatory graphics rows. Option explanations: A. Artificially reduce bandwidth so every baseline session becomes unhealthy: Introducing a fault does not produce a representative healthy baseline. B. Use periodic network records and relevant host metrics rather than assuming graphics logging is broken: Graphics data is degradation-oriented and is not a continuous baseline of healthy sessions. C. Use only profile-file sizes as graphical latency measurements: Stored size is not a measurement of encoding, transport, decoding or rendering delay. D. Treat missing graphics rows as proof the user never connected: The connection-network records already establish an active monitored connection. Sources: Analyze connection quality in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/connection-latency
Open this question’s page →39. WVDAgentUrlTool succeeds on one host, but new hosts in another subnet cannot contact the AVD service. What is the most useful next validation?
Networking
✓ Correct answer
- Run the tool on an affected host with its matching agent configuration and inspect that subnet's path
Validate from the failing source. Use the affected host's installed agent tool/configuration and trace its actual DNS, route and filtering path. Option explanations: A. Test only a user's local profile directory: That does not exercise the affected host's required service endpoints. B. Accept the first host's result as proof for the entire deployment: A successful test does not establish access from another subnet. C. Run the tool on an affected host with its matching agent configuration and inspect that subnet's path: Endpoint access is source-specific; the affected subnet can have different DNS, routes or firewall rules. D. Increase every user's FSLogix quota: Profile capacity does not fix host outbound endpoint access. Sources: Check access to required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/check-access-validate-required-fqdn-endpoint
Open this question’s page →40. Effective NSG rules permit a host's intended flow, but the connection fails. The team has not checked the destination's DNS answer or Windows Firewall. Which two investigations are directly relevant?
Networking
✓ Correct answers
- Resolve the destination from the affected host
- Inspect the host's Windows Firewall rules and logs
Check the actual destination and the host's local filtering. Effective NSG results do not include every layer that can prevent a connection. Option explanations: A. Increase the total license count: Licenses do not diagnose DNS or packet filtering. B. Resolve the destination from the affected host: An incorrect or unreachable DNS result can break a flow despite an allowed NSG rule. C. Declare success because an NSG allow rule proves end-to-end application access: NSG permission is only one layer and does not prove resolution or host filtering. D. Inspect the host's Windows Firewall rules and logs: Windows Firewall is a separate enforcement layer not represented by effective NSG rules. Sources: Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint
Open this question’s page →41. Client-to-host RTT is low, but each host reads its FSLogix share across regions and profile operations are slow. Measured storage-path latency is high. Which storage-design adjustment addresses this evidence?
Profile storage
✓ Correct answer
- Place suitable profile storage close to the active session hosts
AVD has distinct endpoint-to-host and host-to-storage paths. Optimize the path identified by the measurement while preserving roaming profile storage. Option explanations: A. Store profiles only on disposable pooled-host OS disks: That compromises reliable persisted profiles when hosts are replaced or selected differently. B. Disable profile isolation so every user shares one container: Permissions and isolation must not be sacrificed to mask a latency defect. C. Buy more client internet bandwidth without changing the storage path: The slow path is between the host and profile storage, not the client link. D. Place suitable profile storage close to the active session hosts: Reducing the host-to-profile path latency addresses the measured storage-access constraint. Sources: Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads
Open this question’s page →42. A company retains 800 user profiles, usually has 150 concurrent sessions, and expects 30 GiB per retained profile. Which base capacity should the planner reserve before growth and other data?
Profile storage
✓ Correct answer
- 24,000 GiB for all retained profiles
Capacity must hold the retained population. Concurrent load informs IOPS and throughput; it does not make inactive profiles disappear. Option explanations: A. 24,000 GiB for all retained profiles: 800 × 30 GiB accounts for the entire retained dataset. B. 800 GiB because one profile always consumes one GiB: The scenario states an average of 30 GiB per profile. C. 4,500 GiB because only concurrent users retain data: 150 × 30 omits profiles of users who are not currently connected. D. 150 GiB because capacity and concurrency are identical: Session count is not stored capacity. Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads
Open this question’s page →43. A provisioned v2 share has enough capacity and throughput, but measured random I/O demand exceeds its sustainable provisioned IOPS every morning for several hours. Which sizing change best addresses that constraint?
Profile storage
✓ Correct answer
- Provision IOPS for the measured sustained demand
Sustained I/O peaks need a sustainable performance budget. Provisioned v2 separates IOPS from capacity and throughput, so adjust the measured constraint. Option explanations: A. Add unused capacity solely to force v2 IOPS to rise: Provisioned v2 selects capacity and IOPS independently; size the constrained performance component directly. B. Provision IOPS for the measured sustained demand: Long demand above the provisioned level cannot be assumed to remain within burst credits indefinitely. C. Use bandwidth guidance per user as a storage IOPS guarantee: RDP network guidance does not establish profile I/O demand. D. Rely indefinitely on a full burst-credit bucket: Credits decline when demand exceeds provisioned IOPS and can be exhausted. Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Open this question’s page →44. Profiles are split across two shares in one classic account. Each share is below its own limit, yet their combined workload reaches an account limit. What does the second share change?
Profile storage
✓ Correct answer
- It partitions the data, but the account aggregate limit still applies
Share partitioning can help some limits, but it does not remove a shared account bottleneck. Evaluate the aggregate budget before expecting improvement. Option explanations: A. It creates a wholly independent account-level IOPS budget: A second share is not a second storage account. B. It guarantees no more sign-in latency without measurement: Account, host and network constraints still need assessment. C. It partitions the data, but the account aggregate limit still applies: Classic shares in one account share the account's aggregate resources and limits. D. It removes the host NIC's limit automatically: Data partitioning does not change the host NIC's throughput. Sources: Azure Files guidance for virtual desktop workloads — https://learn.microsoft.com/en-us/azure/storage/files/virtual-desktop-workloads; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Open this question’s page →45. An administrator sees familiar settings after testing FSLogix on a host that already had a local profile. No container attachment has been verified. What is the most useful validation before approving roaming?
Profile storage
✓ Correct answer
- Use a suitable fresh test user and verify FSLogix logs/container attachment across hosts
Verify the actual profile path and attachment with controlled testing. A familiar desktop on one preexisting local profile does not establish roaming. Option explanations: A. Immediately enable destructive local-profile deletion for every production user: Migration and protection must be planned before using a setting that permanently deletes local profiles. B. Treat a successful public feed download as proof of SMB access: Resource discovery and profile-share access are separate workflows. C. Approve the design from the familiar desktop alone: Existing local profile content can create a misleading result. D. Use a suitable fresh test user and verify FSLogix logs/container attachment across hosts: This exposes whether shared container persistence is actually functioning instead of being masked by local state. Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Store FSLogix profile containers on Azure NetApp Files — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-netapp
Open this question’s page →46. Hybrid users can mount Azure Files profiles using Microsoft Entra Kerberos from eligible Entra-joined hosts without host-to-DC access. A remote administrator now needs to configure those users' NTFS ACLs but lacks AD connectivity. Which dependency remains relevant?
Profile storage
✓ Correct answer
- AD connectivity for the documented hybrid-user ACL administration
The normal Entra Kerberos access path can avoid DC line of sight while hybrid ACL administration still needs it. Provide the administrator's required directory path. Option explanations: A. AD connectivity for the documented hybrid-user ACL administration: Normal cloud Kerberos profile access and hybrid ACL administration have different directory dependencies. B. Replacing all user ACLs with anonymous full access: Removing authorization is not a supported solution to missing directory connectivity. C. Disabling the storage account's identity source permanently: That would disrupt identity-based access rather than enable the intended administration. D. Public inbound RDP to every session host: Exposing administrative RDP does not establish the missing directory access. Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Open this question’s page →47. A supported, updated public-cloud host uses Azure Files Entra Kerberos for cloud-only users. Cloud-only group membership is needed for ACLs, but the storage application has not enabled cloud group SIDs. Which manifest tag is required?
Profile storage
✓ Correct answer
- kdc_enable_cloud_group_sids
Apply the documented cloud-group tag in the storage Entra application. Updated host prerequisites, admin consent and permissions must also be satisfied. Option explanations: A. WindowsVirtualDesktop: The firewall FQDN tag is unrelated to Kerberos application group SIDs. B. kdc_enable_cloud_group_sids: This tag enables the documented cloud-only group SID behavior and is mandatory for that scenario. C. DeleteLocalProfileWhenVHDShouldApply: This FSLogix setting concerns local profile removal, not Entra application SIDs. D. SharedComputerLicensing: This Office activation property does not configure Azure Files tickets. Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Open this question’s page →48. A hardening baseline disabled two Windows services on otherwise eligible Entra Kerberos FSLogix hosts. DNS, share roles and ACLs pass their checks. Which two services must be running for the documented ticket flow?
Profile storage
✓ Correct answers
- WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)
- IP Helper (iphlpsvc)
Restore the documented services. Their names should not be confused with optional administrative or printing services; WPAD hardening can be handled separately. Option explanations: A. Print Spooler: It is not one of these documented Entra Kerberos ticket-flow prerequisites. B. Remote Registry: It is not one of the two required services identified for this flow. C. WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc): It performs functions including KDC Proxy requests; disabling WPAD separately does not justify disabling this service. D. IP Helper (iphlpsvc): The Entra Kerberos prerequisites explicitly require IP Helper in the running state. Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Open this question’s page →49. A team wants a classic HDD SMB share with independently provisioned capacity, IOPS and throughput. Which account/model combination meets that requirement?
Profile storage
✓ Correct answer
- FileStorage with StandardV2 for HDD provisioned v2
Use the current HDD provisioned v2 model. Legacy shorthand that every HDD share must use GPv2 is insufficient. Option explanations: A. FileStorage with SSD provisioned v1: The media and billing version do not meet the stated requirement. B. StorageV2 with HDD pay-as-you-go: HDD pay-as-you-go is a different billing/performance model. C. FileStorage with StandardV2 for HDD provisioned v2: Current classic HDD v2 uses FileStorage and independently selected performance components. D. A Blob-only account for SMB VHDLocations: Blob-only storage does not provide the requested classic SMB file share. Sources: Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share; Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Open this question’s page →50. Two applications require different Azure Files user identity sources: one AD DS and one Entra Kerberos. The team plans two shares inside a single classic account with both sources enabled simultaneously. What should change?
Profile storage
✓ Correct answer
- Use separate storage accounts for the independently enabled identity sources
Separate the accounts when simultaneously enabled identity sources must differ. Permissions within a share are distinct from enabling its account's identity method. Option explanations: A. Enable AD DS on one share and Entra Kerberos on the other within that account: Identity-source enablement is at account level, not an independent per-share setting. B. Rename the shares to select their authentication source: Share names do not determine account identity integration. C. Assign two Azure management Owner roles to enable both: Management roles do not change the one-identity-source restriction. D. Use separate storage accounts for the independently enabled identity sources: Only one SMB user identity source can be enabled per classic account and applies across its shares. Sources: Overview of Azure Files identity-based authentication for SMB access — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview; Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable
Open this question’s page →51. An SSD Azure Files profile account meets local performance needs, but the design also needs recovery from regional loss. A reviewer proposes simply selecting GRS on that SSD account. What is the accurate response?
Profile storage
✓ Correct answer
- SSD Azure Files supports LRS/ZRS; plan a separate supported regional recovery design
Keep media and recovery requirements explicit. SSD's local/zone redundancy choices do not supply a native geo-redundant SSD share. Option explanations: A. SSD Azure Files supports LRS/ZRS; plan a separate supported regional recovery design: Geo-redundant Azure Files choices are HDD options, so the SSD requirement needs another recovery approach. B. GRS is available for every SSD profile account: That contradicts the supported Azure Files media/redundancy combinations. C. ZRS alone guarantees recovery after loss of the whole region: Zone replication does not independently provide regional-outage recovery. D. A readable RA-GZRS secondary SMB share automatically solves it: SSD does not support this geo option, and Azure Files does not expose RA secondary-share reads. Sources: Azure Files data redundancy — https://learn.microsoft.com/en-us/azure/storage/files/files-redundancy
Open this question’s page →52. A deployment script creates a top-level Microsoft.FileShares SSD NFS resource. The owner wants to use it as the ordinary SMB VHDLocations store for FSLogix without changing the resource. What is the correct assessment?
Profile storage
✓ Correct answer
- Use a classic Microsoft.Storage SMB share instead
The resource model's current protocol restriction matters. Create a supported classic SMB share rather than treating roles or path syntax as protocol conversion. Option explanations: A. Assign SMB Share Contributor and the NFS resource becomes an SMB share: Authorization roles do not change its supported protocol. B. Use a classic Microsoft.Storage SMB share instead: The top-level model currently supports SSD NFS, not the ordinary SMB share required here. C. Change the NFS path to UNC syntax and it becomes supported: Textual path syntax cannot add an unsupported SMB service. D. Use the workspace global private endpoint to convert the storage protocol: An AVD discovery endpoint does not convert Azure Files protocols. Sources: Understand Azure Files billing — https://learn.microsoft.com/en-us/azure/storage/files/understanding-billing
Open this question’s page →53. A storage administrator mounts a profile share with the account key successfully. A new user's Kerberos ticket and intended NTFS ACLs are correct, but the user has no SMB share role and no default share permission applies. What is missing?
Profile storage
✓ Correct answer
- Appropriate share-level SMB data authorization for the user or group
Test the actual entitled user path. Grant the intended share data permission while retaining the correct ACLs; an account-key mount is not proof of user authorization. Option explanations: A. Azure management Contributor alone: Resource management access does not automatically grant ordinary SMB data access. B. A larger dynamically expanding VHDX: Container size does not grant missing share authorization. C. Appropriate share-level SMB data authorization for the user or group: Both share authorization and file ACLs must pass; the administrator's key bypasses the normal user test. D. Public inbound RDP on the storage endpoint: SMB authorization is not supplied by administrative RDP connectivity. Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions; Overview of Azure Files identity-based authentication for SMB access — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview
Open this question’s page →54. Azure Files resolves to its private IP and TCP 445 succeeds. Eligible Entra Kerberos clients nevertheless receive error 1326 after the private endpoint was introduced. The private-link name is absent from the storage application's identifierUris. What should be corrected?
Profile storage
✓ Correct answer
- Add corresponding private-link FQDN identifierUris while retaining the existing public entries
Working DNS and SMB transport are necessary but insufficient here. Register the private-link FQDN forms so Kerberos can request the proper storage ticket. Option explanations: A. Change all profile ACLs to Full Control for Everyone: The identified failure is ticket acquisition; broad ACLs neither register the name nor preserve isolation. B. Remove the cloud Kerberos ticket policy from the hosts: Removing a required policy does not correct the missing application registration. C. Enable NTLM for domain credentials on Azure Files: Azure Files does not support that NTLM fallback for domain credentials. D. Add corresponding private-link FQDN identifierUris while retaining the existing public entries: The documented ticket flow needs private-link name registration in the Entra application. Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable; Azure Files SMB authentication troubleshooting — https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication
Open this question’s page →55. A profile-share requirement explicitly says the file service must have a private IP reachable from host VNets. A service endpoint has been enabled, but the hostname still reaches the public file service. What meets the private-IP requirement?
Profile storage
✓ Correct answer
- Create a private endpoint for the file subresource and configure its private DNS resolution
Use the storage account's file private endpoint for this requirement. Continue using the normal UNC hostname with DNS resolving to the private address. Option explanations: A. Create a private endpoint for the file subresource and configure its private DNS resolution: A file private endpoint provides a private IP and needs the corresponding name-resolution path. B. Create only the AVD host-pool connection endpoint: That endpoint serves AVD sessions and does not also privatize Azure Files. C. Assign Storage File Data SMB Share Elevated Contributor to every user: A data role does not implement private network addressing. D. Keep only the service endpoint because it assigns a private IP: A service endpoint restricts access to a public service endpoint; it does not assign a private file-service IP. Sources: Store FSLogix profile containers on Azure Files using Microsoft Entra ID — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-entra-id-hybrid; Create an Azure classic file share — https://learn.microsoft.com/en-us/azure/storage/files/create-classic-file-share
Open this question’s page →56. The ProfileUsers group already has root Modify scoped to This folder only. The intended layout must give creators access to their own children and retain administrator recovery access. Which two ACL entries fit that layout?
Profile storage
✓ Correct answers
- Designated storage administrators: Full Control on this folder, subfolders and files
- CREATOR OWNER: Modify on subfolders and files only
Keep root creation rights distinct from child access. Creator-specific child permissions and designated administrative control satisfy the stated roles without broad recursive user access. Option explanations: A. Designated storage administrators: Full Control on this folder, subfolders and files: This retains intended operational access across the profile tree. B. CREATOR OWNER: Modify on subfolders and files only: The creator-specific inherited rights support access inside each new user's directory. C. ProfileUsers: Modify on all users' folders recursively: That would grant the whole group cross-profile access and defeat isolation. D. Everyone: Full Control on every container: It exposes profiles to unintended principals and defeats the stated isolation. Sources: Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
Open this question’s page →57. A regular ANF capacity pool contains one Basic-network-feature volume. The team wants to shrink the pool to 1 TiB based on newer minimum guidance. Which constraint controls this pool?
Profile storage
✓ Correct answer
- A 4-TiB pool minimum applies while any volume uses Basic network features
Apply the minimum to the actual network-feature mix. The newer regular-volume and pool figures are not interchangeable unconditional limits. Option explanations: A. The pool can always shrink to 1 TiB regardless of volume features: That omits the documented Basic-feature condition. B. A 4-TiB pool minimum applies while any volume uses Basic network features: The 1-TiB minimum requires every volume in the pool to use Standard network features. C. A 50-GiB volume minimum is also the capacity-pool minimum: Volume quota and pool size are separate constraints. D. Assigning an Azure Files data role lowers the ANF pool minimum: An unrelated SMB data role does not change ANF capacity constraints. Sources: Create a capacity pool for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-set-up-capacity-pool; Resource limits for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-resource-limits
Open this question’s page →58. Before creating regular ANF volumes, a planner expects more than 11 usable addresses for future storage endpoints. They propose a dedicated /28 delegated subnet. Which planning adjustment is appropriate?
Profile storage
✓ Correct answer
- Choose a larger suitable dedicated delegated subnet, such as /26, before deployment
Plan sufficient delegated address space in advance. The raw subnet size is not the Azure-usable count, and multiple delegated subnets are not a workaround within one VNet. Option explanations: A. Use the session-host subnet without ANF delegation: Regular ANF volumes require their dedicated Microsoft.NetApp/volumes delegation. B. Count all 16 addresses in /28 as usable Azure addresses: Azure reserves addresses, leaving 11 usable in a /28 subnet. C. Choose a larger suitable dedicated delegated subnet, such as /26, before deployment: A /28 offers 11 usable Azure addresses, while /26 offers 59 and more growth room. D. Plan several ANF-delegated subnets in the same VNet for ordinary volume creation: Only one delegated subnet can be used for ANF volume creation per VNet. Sources: Delegate a subnet to Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-delegate-subnet
Open this question’s page →59. Two traditional ANF volumes need equal capacity but very different throughput. The pool has enough total throughput budget. The team wants to assign throughput explicitly instead of tying each allocation to quota. Which QoS approach fits?
Profile storage
✓ Correct answer
- Manual QoS with explicit per-volume throughput within the pool budget
Use manual QoS for explicit per-volume allocation. Capacity and aggregate pool performance still constrain what can be assigned. Option explanations: A. Azure Files share-level RBAC as the ANF QoS control: SMB authorization roles do not assign ANF throughput. B. Auto QoS while claiming quota and service level have no effect: Traditional auto QoS derives throughput from volume quota and service level. C. Windows DSCP marking as the ANF throughput allocation mechanism: DSCP prioritizes network traffic; it does not allocate ANF pool throughput. D. Manual QoS with explicit per-volume throughput within the pool budget: Manual QoS lets volume throughput differ independently of quota within the pool's allocation budget. Sources: Create a capacity pool for Azure NetApp Files — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-set-up-capacity-pool; Understand Azure NetApp Files cost model — https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-cost-model
Open this question’s page →60. A conventional AD-backed ANF FSLogix design expects 4,800 concurrently active profiles and should tolerate supported SMB service interruptions. Which two design actions align with Microsoft's FSLogix volume guidance?
Profile storage
✓ Correct answers
- Enable SMB Continuous Availability on the FSLogix volumes
- Distribute active profiles across regular volumes rather than putting all 4,800 on one
Spread the active workload according to the regular-volume guidance and enable recommended SMB interruption tolerance. These do not replace ACLs, directory reachability or recovery testing. Option explanations: A. Enable SMB Continuous Availability on the FSLogix volumes: This is recommended to improve tolerance of supported service interruptions. B. Replace SMB containers with NFS paths without another profile solution: Ordinary FSLogix VHDLocations requires supported SMB storage. C. Distribute active profiles across regular volumes rather than putting all 4,800 on one: Microsoft recommends limiting active concurrent FSLogix profiles to 3,000 per regular volume for predictable performance. D. Assign Azure Files SMB Share Contributor to ANF as its data-access gate: Conventional ANF SMB uses directory authentication and Windows ACLs rather than the Azure Files share RBAC gate. Sources: Store FSLogix profile containers on Azure NetApp Files — https://learn.microsoft.com/en-us/fslogix/how-to-configure-profile-container-netapp; Configure SMB Storage Permissions — https://learn.microsoft.com/en-us/fslogix/how-to-configure-storage-permissions
Open this question’s page →61. A team redeploys pooled session hosts monthly. Its profile storage and shared network have a much longer lifecycle. The team wants to reduce accidental deletion during host cleanup. Which grouping best supports this requirement?
Architecture & planning
✓ Correct answer
- Place replaceable hosts and durable shared dependencies in separate resource groups.
Resource groups should reflect shared lifecycle and ownership. Durable profiles and networking need protection beyond the replaceable session-host lifecycle. Option explanations: A. Place replaceable hosts and durable shared dependencies in separate resource groups.: Separating lifecycle boundaries lets host resources be cleaned up without deleting the durable dependencies with them. B. Place all resources in one resource group so deleting the pool also deletes its profiles.: A single deletion boundary increases the precise risk the team wants to reduce. C. Create a management group for each VM and put the VM directly inside it.: Management groups organize subscriptions; VMs are Azure resources inside resource groups. D. Put every resource in the same region and rely on the region to prevent deletion.: Region placement does not define resource deletion boundaries. Sources: Azure resource management fundamentals — https://learn.microsoft.com/en-us/entra/architecture/secure-resource-management
Open this question’s page →62. Four AVD subscriptions in the same tenant must inherit a centrally controlled allowed-regions policy. Which scope is designed to apply the policy across the subscriptions?
Architecture & planning
✓ Correct answer
- A management group containing the four subscriptions.
Management groups provide governance above subscriptions. The hierarchy and policy scope should match the required centralized control. Option explanations: A. The AVD workspace used for the desktop feed.: An AVD workspace is a publication resource, not the Azure governance parent of subscriptions. B. A management group containing the four subscriptions.: Governance conditions at this scope cascade to descendant subscriptions and resources. C. A host-pool registration token shared by all hosts.: The token authorizes host registration and has no policy-inheritance function. D. One resource group in the first subscription.: A resource-group policy does not govern separate subscriptions. Sources: Azure resource management fundamentals — https://learn.microsoft.com/en-us/entra/architecture/secure-resource-management
Open this question’s page →63. A finance application is certified for a Windows client OS and supports multiple users on one host. The team wants shared AVD compute rather than a dedicated VM per user. Which OS choice best fits?
Architecture & planning
✓ Correct answer
- A supported Windows Enterprise multi-session image.
Select a supported client multi-session image when both the workload and sharing model permit it. Validate the application on the chosen release. Option explanations: A. An unsupported Windows client release to preserve the old application installer.: Unsupported OS selection does not meet the supported deployment requirement. B. A Windows client single-session image, with MaxSessionLimit increased to 40.: An allocation setting does not change the OS into a supported multi-session edition. C. A supported Windows Enterprise multi-session image.: It provides a Windows client environment with multiple simultaneous user sessions on a host. D. Windows Server solely because its kernel supports multiple sessions.: The stated certification requires a Windows client OS; Server also has separate licensing requirements. Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Open this question’s page →64. A branch requires session-host compute to run on its supported Azure Local infrastructure while using the AVD managed service. What should the architect validate before selecting the host OS and deployment method?
Architecture & planning
✓ Correct answer
- The current Azure Local AVD prerequisites, supported OS list and join requirements for the chosen deployment workflow.
AVD on Azure Local is a supported architecture with its own documented prerequisites. Validate the actual OS and deployment/join path rather than assuming Azure VM rules apply unchanged. Option explanations: A. Only the Azure-region VM quota because local infrastructure has no host prerequisites.: Azure quota is not a substitute for local infrastructure, OS and workflow support. B. That any OS image booting locally is automatically an AVD-supported session host.: Bootability alone does not establish service support. C. That the AVD managed control plane must be moved onto a local VM.: Azure Local hosts customer compute while the AVD managed service remains managed by Azure. D. The current Azure Local AVD prerequisites, supported OS list and join requirements for the chosen deployment workflow.: Azure Local has specific supported configurations; method-specific requirements must be checked. Sources: Azure Virtual Desktop on Azure Local — https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-local-overview; Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Open this question’s page →65. An organization plans Windows client AVD desktops for its employees. The employees already have qualifying Microsoft 365 licenses. What should the cost estimate include?
Architecture & planning
✓ Correct answer
- Azure infrastructure and separately required application costs in addition to the existing qualifying user licenses.
Windows client user access licensing and Azure infrastructure are separate cost layers. Budget compute, storage, networking, monitoring and any additional application rights. Option explanations: A. Azure infrastructure and separately required application costs in addition to the existing qualifying user licenses.: Qualifying access rights do not include the Azure resources or every application used by the desktop. B. RDS CALs for every Windows client user solely because the pool is shared.: RDS CAL requirements described here apply to Windows Server session hosts, not this eligible client scenario. C. No Azure infrastructure costs because the user entitlement includes session-host VMs.: Compute and associated resources remain billable. D. External commercial per-user access pricing as the replacement for employee licensing.: That licensing option is for qualifying external commercial scenarios, not replacing internal-user entitlement. Sources: Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Open this question’s page →66. A software provider offers an AVD-hosted Windows client application to its external customers as a commercial service. It is evaluating qualifying AVD per-user access pricing. Which costs must remain in the design?
Architecture & planning
✓ Correct answers
- Azure compute, storage and other infrastructure consumed by the service.
- Any separately required application licensing.
External commercial access pricing is a licensing layer. Infrastructure and application rights still need separate budgeting and validation. Option explanations: A. Azure compute, storage and other infrastructure consumed by the service.: Per-user access pricing covers access rights, not the Azure resources. B. A requirement to reclassify all internal employees as external customers.: Internal and external licensing scenarios must reflect actual use. C. An assumption that the access charge includes all VM backup and log retention.: Those infrastructure services retain separate charges and configuration. D. Any separately required application licensing.: Access pricing does not grant every third-party or Microsoft application entitlement. Sources: Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Open this question’s page →67. Engineers install user-specific tools that must remain on the same VM. Security also requires one dedicated VM per engineer. Which host-pool architecture matches?
Architecture & planning
✓ Correct answer
- A personal host pool with controlled user-to-host assignments.
Choose personal hosts for dedicated VM assignment and persistent machine state, then protect that state and control assignment. Option explanations: A. A RemoteApp application group without any session hosts.: An application group publishes apps from hosts; it cannot run workloads without compute. B. A personal host pool with controlled user-to-host assignments.: Personal hosts provide dedicated assigned VMs and support the stated persistence model. C. A pooled host pool with depth-first allocation.: Consolidating sessions conflicts with dedicated compute and does not establish persistent assignment. D. A pooled host pool with breadth-first allocation.: Breadth-first shares allocation across hosts and does not give each engineer a dedicated VM. Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology
Open this question’s page →68. Call-center users and GPU-intensive designers have different OS/app baselines, capacity limits and maintenance windows. The company wants predictable scaling and controlled image updates. Which design is most suitable?
Architecture & planning
✓ Correct answer
- Separate workload-specific host pools with tested images, limits and scaling policies.
Workload-specific pools provide clear image, capacity and maintenance boundaries when requirements differ materially. Option explanations: A. One pool with a single maximum session limit chosen for the lightest workload.: A limit for light users is unsafe for the heavier workload and does not separate lifecycle. B. One personal host shared simultaneously by all users.: A personal assigned host does not establish this shared multi-workload pool design. C. Separate workload-specific host pools with tested images, limits and scaling policies.: Separate pools let each workload use compatible capacity and an independent lifecycle. D. One image definition whose description lists both applications, without deploying them.: Description metadata does not provide the required apps or workload separation. Sources: Azure Virtual Desktop terminology — https://learn.microsoft.com/en-us/azure/virtual-desktop/terminology; Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
Open this question’s page →69. A pilot has low host CPU and ample free memory. Morning sign-ins are slow, and the delay aligns with high profile-share latency. Which change should be investigated first?
Architecture & planning
✓ Correct answer
- Improve or tune the profile-storage path and its performance capacity.
Use correlated evidence to fix the constrained component. Additional vCPUs are not a justified first response to a storage-limited sign-in path. Option explanations: A. Double the vCPU count on every session host without further measurements.: The evidence does not identify host CPU as the constraint. B. Increase MaxSessionLimit to let more sign-ins use each host.: Higher concurrent load can worsen the constrained dependency and does not repair it. C. Change the preferred application group type to RemoteApp.: Publication preference does not remove profile-storage latency. D. Improve or tune the profile-storage path and its performance capacity.: The measured bottleneck is the external profile path during sign-in. Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines; Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Open this question’s page →70. An architect must validate a shared desktop response-time target before choosing a VM size. Which pilot activities provide useful evidence?
Architecture & planning
✓ Correct answers
- Measure sign-in bursts and profile/storage latency as well as steady-state host performance.
- Run representative applications with the expected peak concurrent user mix.
Measure the actual workload, concurrency and user experience across steady-state and burst periods. Use those results to set capacity and limits. Option explanations: A. Test one idle session and multiply its CPU usage by the total licensed user count.: An idle sample and assigned-user count do not represent concurrent demand or contention. B. Measure sign-in bursts and profile/storage latency as well as steady-state host performance.: Transient sign-in and external dependencies can dominate the user experience. C. Run representative applications with the expected peak concurrent user mix.: Realistic concurrent workload exposes CPU, memory and application demand. D. Use only the largest available VM size as evidence that all response targets will be met.: Size alone does not prove application, storage and connection performance. Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines; Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Open this question’s page →71. A pilot supports 30 concurrent users on each 8-vCPU host. A new pool needs 120 concurrent users plus one-host failure tolerance. Other VMs already consume 16 vCPUs from the same relevant regional VM-family quota. What minimum family quota accommodates the design?
Architecture & planning
✓ Correct answer
- 56 vCPUs.
Four hosts serve the peak; a fifth provides the failure margin. The new fleet needs 5 × 8 = 40 vCPUs, so the quota must accommodate 40 + 16 = 56. Quota still does not reserve physical capacity. Option explanations: A. 56 vCPUs.: Five hosts need 40 vCPUs, and the existing consumption adds 16. B. 48 vCPUs.: Four new hosts plus existing usage fit 48, but four lack the required one-host failure margin. C. 40 vCPUs.: This covers the new pool but omits the existing 16-vCPU consumption. D. 64 vCPUs.: This provides extra quota but is not the minimum for the stated design. Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines; Azure Virtual Desktop limits — https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-limits
Open this question’s page →72. The recovery region has approved vCPU quota, but a drill cannot deploy the chosen VM size due to regional capacity. What should the recovery plan change?
Architecture & planning
✓ Correct answer
- Validate physical VM-family availability and supported alternatives, and consider suitable capacity-reservation arrangements for the recovery requirement.
Prepare quotas and actual deployment capacity before an outage. Drills should verify the chosen sizes or tested alternatives can be deployed. Option explanations: A. Treat quota approval as guaranteed capacity and omit further deployment drills.: The failed drill demonstrates that quota does not guarantee physical supply. B. Validate physical VM-family availability and supported alternatives, and consider suitable capacity-reservation arrangements for the recovery requirement.: Quota is a consumption limit, so availability and a viable deployment path need separate planning. C. Increase the host-pool session limit to make undeployed VMs available.: An allocation setting cannot create unavailable compute capacity. D. Remove all image replicas so the regional deployment uses less quota.: Image replicas are not the source of vCPU capacity shortages. Sources: Azure Virtual Desktop limits — https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-limits; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →73. A deployment administrator with Contributor on the target resource group creates the pool, VMs and application group successfully. The portal’s user-assignment step fails with an authorization error. What permission is missing for that step?
Deployment & images
✓ Correct answer
- Microsoft.Authorization/roleAssignments/write at the appropriate application-group scope or a containing scope.
Contributor does not grant permission to assign Azure RBAC roles. Add only the appropriately scoped role-assignment authorization needed for the portal assignment step. Option explanations: A. The user’s own Virtual Machine User Login role on a deployment VM.: End-user guest login rights do not grant the administrator role-assignment permission. B. Microsoft.Compute/virtualMachines/write on the same resource group.: The successful VM deployment already demonstrates compute-write permission; it does not grant role assignment. C. Microsoft.Authorization/roleAssignments/write at the appropriate application-group scope or a containing scope.: Creating a user assignment requires permission to write the Azure role assignment. D. Microsoft.DesktopVirtualization/hostPools/write on the created host pool.: Pool configuration permissions do not imply authorization to assign RBAC roles. Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
Open this question’s page →74. A production pool uses standard management. The team wants the persistent session host configuration workflow for future automated host replacement. Can the existing pool be converted in place?
Deployment & images
✓ Correct answer
- No; create a pool with the desired management approach and plan a controlled migration.
Treat the management approach as a creation-time architectural choice. Migrate through validated hosts, publication and user access rather than assuming an in-place conversion. Option explanations: A. Yes; adding an AMA extension converts the pool.: AMA configures monitoring, not host lifecycle management. B. Yes; publishing a new image version changes the pool’s management approach.: Image publication does not alter the pool management model. C. Yes; toggling drain mode changes standard management to session host configuration.: Drain mode only affects new-session allocation. D. No; create a pool with the desired management approach and plan a controlled migration.: The management approach is selected at pool creation and cannot be changed in place. Sources: Host pool management approaches — https://learn.microsoft.com/en-us/azure/virtual-desktop/host-pool-management-approaches
Open this question’s page →75. A Bicep deployment creates only Microsoft.DesktopVirtualization/hostPools with the desired properties. No VMs, extensions or application groups are included. What is the expected result?
Deployment & images
✓ Correct answer
- A host-pool service resource exists, but additional deployment and registration work is required before users can launch desktops.
Infrastructure as code must cover the complete desired deployment. Provisioning a host-pool object is one component, not a functioning desktop service. Option explanations: A. A host-pool service resource exists, but additional deployment and registration work is required before users can launch desktops.: The resource declaration establishes pool settings, not the complete session-host and publication workflow. B. The template installs and registers an AVD Agent on every VM in the subscription.: The template does not contain that VM/extension deployment logic. C. AVD automatically creates ten hosts because the pool is pooled.: A pooled host-pool declaration does not imply a VM count or independent provisioning. D. All licensed tenant users automatically receive a desktop assignment.: Licensing does not automatically create application-group assignments. Sources: Host pool ARM and Bicep reference — https://learn.microsoft.com/en-us/azure/templates/microsoft.desktopvirtualization/2024-04-03/hostpools; Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
Open this question’s page →76. A Windows VM created by an independent standard-pool script is domain joined and can reach required endpoints, but it never appears in the target host pool. The registration token used by the script expired yesterday. What should be corrected?
Deployment & images
✓ Correct answer
- Use a valid token from the target pool and complete the AVD Agent and Agent Boot Loader registration workflow.
For independently provisioned standard hosts, use the correct unexpired pool token with the AVD registration components, then verify host health. Option explanations: A. Install only AMA and wait for the VM to become an AVD host.: AMA collects guest telemetry and is not the AVD registration agent. B. Use a valid token from the target pool and complete the AVD Agent and Agent Boot Loader registration workflow.: An expired token cannot authorize the host registration; the agent workflow must succeed. C. Raise the maximum session limit before registering the host.: Capacity settings do not repair token validity or agent registration. D. Give the registration token to the end user to subscribe to the workspace.: The token is for hosts, not user feed subscription, and must remain secret. Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop
Open this question’s page →77. A host already has 15 user sessions when an administrator lowers MaxSessionLimit to 10. The administrator expects five sessions to end immediately. What behavior should be expected?
Deployment & images
✓ Correct answer
- Existing sessions remain; the lower limit affects new-session allocation rather than terminating five sessions.
MaxSessionLimit controls allocation. Plan notifications and supported session operations separately if existing sessions must be reduced. Option explanations: A. The host deallocates immediately because its session count exceeds the limit.: A session-limit change does not perform VM power management. B. Five running sessions are migrated automatically to other hosts with their process memory.: Load balancing does not migrate established Windows sessions. C. Existing sessions remain; the lower limit affects new-session allocation rather than terminating five sessions.: Changing the allocation limit is not a sign-out operation. D. The five newest sessions are logged off automatically when the property is saved.: The setting does not select or terminate existing sessions. Sources: Host pool load balancing — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing
Open this question’s page →78. An operator manually changes a pooled host pool to breadth-first. At the next scaling phase, it returns to depth-first. The pool is assigned to an enabled scaling plan. Where should the intended phase behavior be configured?
Deployment & images
✓ Correct answer
- In the allocation algorithm settings of the applicable scaling-plan schedule phases.
When autoscale manages phase-specific allocation, set the intended behavior in the schedule and validate it rather than repeatedly editing the pool manually. Option explanations: A. In the gallery image version number used by the session hosts.: Image version metadata does not control load-balancing algorithms. B. In a user’s individual FSLogix profile container.: Profile persistence does not define the pool’s scheduled allocation algorithm. C. In the friendly name of the desktop application group.: The display name does not control the plan’s allocation decisions. D. In the allocation algorithm settings of the applicable scaling-plan schedule phases.: The enabled plan can apply its configured phase algorithm and override the manual pool selection. Sources: Host pool load balancing — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-host-pool-load-balancing; Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
Open this question’s page →79. A team sets licenseType to Windows_Client on Windows Enterprise multi-session VMs. It has not checked employee user licenses. Which statement is correct?
Deployment & images
✓ Correct answer
- The VM setting does not purchase user access rights; qualifying user entitlements must also be verified.
Validate the actual Windows client entitlement for each internal user as well as the VM license configuration. Option explanations: A. The VM setting does not purchase user access rights; qualifying user entitlements must also be verified.: The VM licensing metadata and user access entitlement are separate requirements. B. The setting purchases and assigns a qualifying license to every employee.: A VM property cannot buy or assign Microsoft 365 or Windows user entitlements. C. The setting converts the hosts to Windows Server and provides RDS CALs.: It neither changes the OS edition nor supplies RDS access licenses. D. An Azure subscription removes all Windows client user-license requirements.: Infrastructure billing does not replace the access-licensing requirements. Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Open this question’s page →80. A legacy workload must run on supported Windows Server AVD session hosts. Employees have Microsoft 365 licenses that qualify for Windows client AVD. What additional licensing configuration must be planned for the Server hosts?
Deployment & images
✓ Correct answer
- The RDS Session Host role and appropriate RDS licensing backed by eligible CALs with Software Assurance or qualifying subscription rights.
Select the access licensing for the actual host OS. Verify the Server role, licensing configuration and eligible RDS rights independently of Windows client user entitlement. Option explanations: A. No RDS licensing because all users belong to one application group.: Application-group entitlement does not establish Windows Server licensing rights. B. The RDS Session Host role and appropriate RDS licensing backed by eligible CALs with Software Assurance or qualifying subscription rights.: Windows Server AVD has its own RDS role and licensing requirements. C. An image version named licensed, without configuring RDS licensing.: An image label neither configures licensing nor acquires access rights. D. Only Windows_Client VM metadata because client access entitlement automatically supplies Server RDS CALs.: Client entitlement and VM metadata do not replace the Server RDS access requirement. Sources: Azure Virtual Desktop prerequisites — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites; Azure Virtual Desktop licensing — https://learn.microsoft.com/en-us/azure/virtual-desktop/licensing
Open this question’s page →81. A build engineer proposes capturing a currently registered production session host with cached user profiles as the next generalized golden image. Which changes align with the current golden-image guidance?
Deployment & images
✓ Correct answers
- Remove live user data and machine-specific state before generalization and capture.
- Use a separate build VM outside the host pool without installing the AVD Agent.
Use a controlled build source, keep user data out, and perform agent registration separately on new hosts. Generalize and shut down before capture. Option explanations: A. Embed the production registration token in the image for indefinite reuse.: Tokens expire and are secrets; host registration is a deployment operation. B. Remove live user data and machine-specific state before generalization and capture.: A reusable image should not distribute cached user data, credentials or production registration state. C. Capture the source while it remains in active use by production users.: Active production use is unsafe for building a clean generalized image and can capture user state. D. Use a separate build VM outside the host pool without installing the AVD Agent.: The guidance keeps build VMs out of the pool and installs/registers agents during host deployment. Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image
Open this question’s page →82. An Image Builder run can read its base image but fails when publishing to a Compute Gallery. The destination is reachable. Which configuration should be checked first?
Deployment & images
✓ Correct answer
- The template’s user-assigned managed identity has the required permission to write the destination image.
Image Builder needs destination permissions for its managed identity, independently of its source-read permissions and network access. Option explanations: A. The desktop users are members of the desktop application group.: End-user desktop entitlement does not authorize Image Builder to publish images. B. The source VM has an AVD Agent registration token embedded.: Image Builder publication does not need a registered AVD build VM or embedded token. C. The template’s user-assigned managed identity has the required permission to write the destination image.: Reading the source does not imply permission to publish into a different destination scope. D. The pool uses depth-first allocation.: Allocation controls session placement and is unrelated to publishing gallery versions. Sources: Custom image templates — https://learn.microsoft.com/en-us/azure/virtual-desktop/custom-image-templates
Open this question’s page →83. A published generalized image contains version 5 of a line-of-business app. Version 6 must be prepared repeatably without changing running hosts yet. What should the team do?
Deployment & images
✓ Correct answer
- Build and test a new image from the approved source, then publish a new gallery version.
Use a controlled build to create a new tested image version. Image creation and host deployment are separate stages. Option explanations: A. Change the gallery version label and keep the existing image content.: Renaming metadata does not install or test the app. B. Install version 6 on one production host and assume the gallery version changes automatically.: Changes to a running VM do not update its source image. C. Restart the already generalized capture source and use it as the normal production session host.: The generalized source is for image capture, not resuming normal production customization. D. Build and test a new image from the approved source, then publish a new gallery version.: A new version records the app change while preserving the old build and separating rollout from image creation. Sources: Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image; Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
Open this question’s page →84. Production deployments use the gallery’s latest image, so an untested build has appeared on newly added hosts. Which change best prevents recurrence?
Deployment & images
✓ Correct answer
- Pin the approved explicit image version in production deployment parameters and promote versions after testing.
Control image promotion and version selection. Keep known-good versions until dependent deployments and rollback requirements are resolved. Option explanations: A. Pin the approved explicit image version in production deployment parameters and promote versions after testing.: Explicit pinning makes new deployments use the intended reviewed build. B. Delete all older versions before the next build.: That removes rollback choices and does not prevent adoption of an untested latest version. C. Change pool load balancing so latest selects fewer users.: Load balancing does not decide which gallery version provisioning uses. D. Publish every build to production with the same untracked app configuration.: Untracked configuration undermines repeatability and validation. Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery; Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts
Open this question’s page →85. A pooled image rollout starts during a normal business day. What two preparations best support safe replacement and recovery if the new app build fails?
Deployment & images
✓ Correct answers
- Ensure the remaining or replacement hosts can carry demand before draining each batch.
- Retain the known-good image version and deployment settings for redeployment.
A safe staged rollout needs tested capacity and a retained known-good image. Protect and assess external data separately from compute rollback. Option explanations: A. Delete the old image as soon as the new build completes.: Build completion is not rollout validation and early deletion removes the rollback source. B. Assume reverting the image will reverse every profile and database migration.: Compute rollback does not automatically undo changes to external data. C. Ensure the remaining or replacement hosts can carry demand before draining each batch.: Capacity headroom prevents the rollout from overloading the hosts still serving users. D. Retain the known-good image version and deployment settings for redeployment.: These provide a concrete compute rollback path. Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts; Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
Open this question’s page →86. A build pipeline installs a cumulative OS update and an application update successfully. The image is used by shared desktops with FSLogix. What validation is needed before broad rollout?
Deployment & images
✓ Correct answer
- Deploy pilot hosts from the new image and test real sign-in, profile attachment and representative application workflows.
Image validation must test the resulting desktop and user state, including OS/app compatibility and profile behavior. Option explanations: A. Raise the session limit before the first pilot sign-in.: A capacity setting is not compatibility validation and can add load. B. Deploy pilot hosts from the new image and test real sign-in, profile attachment and representative application workflows.: The deployed shared desktop can expose interactions that a successful installer on the build VM does not test. C. Use the package-install exit codes as the only release gate.: They prove installer execution, not desktop usability. D. Copy current user profiles into the generalized image for convenience.: Live user profiles should stay outside the reusable image. Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts; Prepare a golden image — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image
Open this question’s page →87. A custom gallery version is available only in West Europe. The team needs new hosts in North Europe and has already confirmed compatible OS, generation and VM size. Which action directly prepares that image for the deployment?
Deployment & images
✓ Correct answer
- Replicate the approved image version to North Europe and verify the deployment identity can read it.
Prepare the gallery version in the target deployment region, with compatible metadata and access, then deploy and register the new hosts. Option explanations: A. Change the scaling plan time zone to North Europe.: A schedule time zone does not distribute image versions. B. Enable drain mode on the existing West Europe hosts.: Drain mode does not replicate an image. C. Replicate the approved image version to North Europe and verify the deployment identity can read it.: Regional availability and read access are needed to deploy from that gallery version. D. Register the application group with a second AVD workspace without changing the gallery.: Feed publication does not make image content available for regional VM provisioning. Sources: Deploy Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/deploy-azure-virtual-desktop; Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
Open this question’s page →88. An image family must support three release builds and high parallel host deployment in two regions. Which Gallery configuration meets the storage and distribution requirement?
Deployment & images
✓ Correct answers
- Configure target-region replication and suitable replica counts for those versions.
- Create separate numeric image versions under the compatible image definition.
Gallery definitions describe a family; versions hold actual builds. Regional replicas distribute those builds and must suit the deployment demand. Option explanations: A. Configure target-region replication and suitable replica counts for those versions.: Replication supplies regional image availability and replicas support deployment demand. B. Create separate numeric image versions under the compatible image definition.: Versions represent distinct deployable builds in the image family. C. Store all builds only as text in the image definition description.: Definition metadata does not contain the deployable disks for each build. D. Use user application-group assignments as image read permissions.: User launch entitlement is not gallery image access for deployment. Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery
Open this question’s page →89. A company must keep its existing AD DS Group Policy and Kerberos-dependent applications, while enabling modern Entra token-based SSO to Windows. Its users are synchronized to the AVD tenant. Which session-host identity design best meets these requirements?
Identity & access
✓ Correct answer
- Join the hosts to AD DS and configure Microsoft Entra hybrid join.
Hybrid join preserves AD DS domain management and Kerberos dependencies while satisfying the host-join requirement for modern Entra SSO. Complete the documented SSO and Kerberos prerequisites. Option explanations: A. Use standalone AD DS hosts and authenticate the AVD service with AD FS alone.: AD DS-only hosts do not qualify for modern Entra SSO, and the AVD cloud service still requires Entra identity. B. Join the hosts only to Microsoft Entra Domain Services.: Managed-domain-only join does not support the modern Entra token-based SSO path required here. C. Use local Windows accounts for the hosts and Entra accounts for the AVD feed.: AVD does not support different identities for cloud-service authentication and Windows session sign-in. D. Join the hosts to AD DS and configure Microsoft Entra hybrid join.: Hybrid-joined hosts retain AD DS and also meet the supported modern Entra SSO join condition. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Open this question’s page →90. An organization invites external Entra users into its resource tenant. The users need cloud applications only. New hosts use the documented supported OS and updates, but the proposed pool is AD DS-only and uses legacy host authentication. Which architectural changes are required for the external-user design?
Identity & access
✓ Correct answers
- Enable Microsoft Entra SSO on the host pool.
- Use Microsoft Entra-joined session hosts.
Invited external identities require Entra-joined hosts and host-pool Entra SSO. The scenario already provides the OS/update and tenant-invitation prerequisites and avoids unsupported legacy-resource access. Option explanations: A. Enable Microsoft Entra SSO on the host pool.: Host-pool Entra SSO provides the required Windows authentication path for these external identities. B. Enable NTLM host authentication for the external users.: External identities cannot use Kerberos or NTLM for on-premises resource access, and NTLM does not supply the required SSO path. C. Use Microsoft Entra-joined session hosts.: Entra join is the required session-host identity scenario for invited external users. D. Create matching local administrator accounts for the external users.: Local administrator accounts neither meet the supported identity design nor supply application entitlement. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
Open this question’s page →91. An existing cloud-only user can authenticate to the AVD feed. On a newly deployed Entra Domain Services-joined host, Windows rejects the password. Managed-domain DNS and connectivity are healthy, and the user has access rights. The user has never changed the password since the managed domain was enabled. What should be checked next?
Identity & access
✓ Correct answer
- Whether the user has changed or reset the password to generate managed-domain-compatible hashes.
Existing cloud users need the password change/reset process that supplies compatible Kerberos and NTLM hashes to the managed domain. Working Entra feed authentication does not demonstrate that those hashes exist. Option explanations: A. Whether the user has changed or reset the password to generate managed-domain-compatible hashes.: The missing password-hash preparation is a documented cause of this difference between cloud and managed-domain sign-in. B. Whether a local Windows account can replace the user's cloud account.: Replacing the user with a local account violates the same-identity requirement and does not repair synchronization. C. Whether the user has Desktop Virtualization Contributor on the subscription.: A management role does not provide the managed domain's password hashes or Windows authentication. D. Whether the host is configured to use a public internet DNS resolver.: Public DNS would not fix managed-domain authentication and could break domain-controller discovery. Sources: Management concepts for Microsoft Entra Domain Services — https://learn.microsoft.com/en-us/entra/identity/domain-services/administration-concepts; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Open this question’s page →92. A migration will introduce Entra-joined hosts alongside an existing AD DS-joined pool. An administrator proposes registering both join types in that same pool and letting the broker select either. What should the migration design do?
Identity & access
✓ Correct answer
- Create a separate host pool for the Entra-joined hosts.
Keep a homogeneous join type within a host pool. A separate pool lets the migration apply the appropriate identity, SSO, and Windows sign-in prerequisites without mixing supported join scenarios. Option explanations: A. Mix the join types after making their hostnames follow the same naming pattern.: Naming conventions do not change the host's join type or authentication requirements. B. Create a separate host pool for the Entra-joined hosts.: A separate pool preserves the required consistent join type and supports deliberate migration. C. Mix the join types after granting every user local administrator rights.: Local administrator membership does not make a mixed-join host pool a supported design. D. Register the new hosts in the existing pool and rely on workspace registration to normalize authentication.: Workspace registration publishes resources; it does not normalize the underlying join types. Sources: Microsoft Entra joined session hosts in Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-ad-joined-session-hosts; Prerequisites for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/prerequisites
Open this question’s page →93. Start VM on Connect is enabled on a pool whose host-pool managed identity will execute the feature. All target VMs are in one dedicated resource group. Security requires the least-privilege suitable built-in role and a scope containing only that group. Which assignment meets the requirement?
Identity & access
✓ Correct answer
- Desktop Virtualization Power On Contributor on the target resource group.
Start VM on Connect supports a host-pool managed identity and a lower scope that contains the target VMs. Power On Contributor supplies the needed role without the extra stop privileges of Power On Off Contributor. Option explanations: A. Desktop Virtualization Power On Contributor on the host-pool resource alone.: The host-pool resource is not a containing Azure scope for the VM resources, so that assignment does not cover them. B. Desktop Virtualization Power On Off Contributor on the target resource group.: The extra stop/deallocate permissions are unnecessary for this least-privilege Start VM on Connect assignment. C. Desktop Virtualization Power On Contributor on the target resource group.: The selected role is suitable for Start VM on Connect, and the resource group contains all target VMs. D. Desktop Virtualization Power On Contributor on the subscription.: Subscription scope can work, but it exceeds the stated resource-group scope requirement. Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles; Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac
Open this question’s page →94. A pooled host pool with a session host configuration will use dynamic scaling. The administrator is following the dedicated dynamic-scaling role-assignment instructions and has selected the tenant's AVD service principal. Which subscription-scope role assignments does that workflow specify?
Identity & access
✓ Correct answers
- Desktop Virtualization Virtual Machine Contributor.
- Desktop Virtualization Power On Off Contributor.
The dedicated dynamic-scaling instructions specify both Power On Off Contributor and Desktop Virtualization Virtual Machine Contributor on the AVD service principal at subscription scope. Do not substitute the power-management-only role set. Option explanations: A. Desktop Virtualization Virtual Machine Contributor.: Desktop Virtualization Virtual Machine Contributor is the additional specified role for creating, deleting, and updating hosts. B. Desktop Virtualization User.: Desktop Virtualization User grants application-group resource use, not automated host lifecycle operations. C. User Access Administrator.: Role-assignment administration is not the service's required VM lifecycle role and would grant unrelated privileges. D. Desktop Virtualization Power On Off Contributor.: Power On Off Contributor is one of the two specified roles for the dynamic workflow. Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles; Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac
Open this question’s page →95. A security team is introducing MFA policies for both AVD resource discovery and Windows session-host authentication. The pool uses Entra SSO, and the team will use separate compatible policies. Which authentication resources should those policies target?
Identity & access
✓ Correct answers
- Azure Virtual Desktop.
- Windows Cloud Login.
Azure Virtual Desktop governs service authentication such as feed and gateway activity. Windows Cloud Login governs the Windows token-authentication stage used by Entra SSO. Protect both stages with compatible policies. Option explanations: A. Windows 365 as a replacement for both AVD authentication targets.: Windows App can have a Windows 365 authentication dependency, but that application does not replace the two stated AVD authentication targets. B. Azure Virtual Desktop.: This is the documented target for AVD service MFA. C. Windows Cloud Login.: This is the documented SSO Windows-authentication resource. D. Azure Virtual Desktop Azure Resource Manager Provider.: The ARM Provider application is not the documented AVD MFA target. Sources: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa
Open this question’s page →96. An administrator configures a time-based sign-in-frequency policy for AVD SSO. A user keeps an established desktop session open beyond the interval and expects Windows to sign out immediately. What behavior should the administrator explain?
Identity & access
✓ Correct answer
- Expiry does not interrupt the established session; reauthentication is evaluated when a new token is needed.
Sign-in frequency controls reauthentication at a relevant token request, not an automatic logoff timer for an already established desktop. Separate Windows session time-limit policies control disconnect/logoff behavior. Option explanations: A. The interval automatically logs off every established Windows session.: Sign-in frequency is not a Windows session logoff policy. B. The AVD service must interrupt the session on its next diagnostic request.: A service diagnostic request is not the stated automatic termination mechanism. C. The existing session's cached token permanently exempts future launches from Conditional Access.: Cached state does not permanently override future sign-in-frequency and Conditional Access evaluation. D. Expiry does not interrupt the established session; reauthentication is evaluated when a new token is needed.: This matches the documented distinction between session continuity and token reauthentication. Sources: Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access — https://learn.microsoft.com/en-us/azure/virtual-desktop/set-up-mfa
Open this question’s page →97. A user successfully reaches the AVD cloud service from home. Traditional smart-card sign-in to an AD-backed host fails. The smart-card certificate is valid, but the client cannot reach a domain-controller KDC and no VPN is available. Which design can supply the required ticket path?
Identity & access
✓ Correct answer
- Provide a correctly configured KDC proxy accessible to the client.
Traditional smart-card host authentication requires Kerberos tickets from a KDC. A supported KDC proxy can provide that path when direct or VPN connectivity is unavailable. Option explanations: A. Provide a correctly configured KDC proxy accessible to the client.: A KDC proxy is a documented method for client access to the required KDC. B. Grant the user Desktop Virtualization Workspace Contributor.: Workspace management permissions do not provide Kerberos tickets or Windows authentication. C. Enable Controlled Folder Access on the session host.: File-write protection does not establish the required authentication network path. D. Enable NTLM as a replacement for smart-card Kerberos authentication.: Traditional smart-card host sign-in uses Kerberos; NTLM is not a substitute for its ticket acquisition. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
Open this question’s page →98. A user already signs in to an AVD desktop through Entra SSO. A web application inside the session must authenticate using the user's locally attached FIDO device. The client, host OS, and application support WebAuthn redirection. Which host-pool RDP property enables that in-session path?
Identity & access
✓ Correct answer
- redirectwebauthn:i:1
WebAuthn redirection forwards the in-session authentication challenge to the local device. Host SSO, smart-card redirection, and drive redirection serve different purposes. Option explanations: A. drivestoredirect:s:*: Drive redirection exposes local storage rather than forwarding authenticator challenges. B. redirectwebauthn:i:1: This property enables supported in-session WebAuthn redirection. C. enablerdsaadauth:i:1: This enables Entra SSO to Windows, which is already functioning and is a different authentication stage. D. redirectsmartcards:i:1: Smart-card redirection is not the WebAuthn redirection setting for a local FIDO challenge. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
Open this question’s page →99. An AD-backed host denies a user's RDS logon. The user belongs to Remote Desktop Users, and a local allow right is present. An effective domain GPO assigns the user's security group Deny log on through Remote Desktop Services. What is the correct remediation?
Identity & access
✓ Correct answer
- Correct the applicable domain deny-right policy for the approved users, then verify effective policy.
An applicable Windows deny right wins over an allow and is not overridden by Azure RBAC. Correct the authoritative domain policy deliberately and confirm the resulting effective rights. Option explanations: A. Disable MFA for all AVD users.: The failure is caused by a Windows user right, not the stated MFA configuration. B. Add Desktop Virtualization Contributor to override the Windows deny.: Azure resource management permissions cannot override a Windows logon deny right. C. Correct the applicable domain deny-right policy for the approved users, then verify effective policy.: Changing the applicable deny assignment addresses the cause while preserving controlled Windows rights. D. Repeat the local allow-right edit after each restart.: The effective domain deny remains authoritative, so repeated local allows do not solve the cause. Sources: Troubleshoot access denied and user not authorized issues in Remote Desktop Services — https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshooting-access-denied-and-user-not-authorized-rds-issues; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Open this question’s page →100. One engineer must install and test privileged drivers as part of the job. Other users share pooled multi-session hosts and must remain protected from that engineer's administrative changes. Which host design best fits?
Identity & access
✓ Correct answer
- Give the engineer a dedicated VM in a personal host pool.
A dedicated personal VM isolates the engineer's administrative control from other users' Windows sessions. Shared profile folders and directory join choices do not neutralize local administrator power on a shared instance. Option explanations: A. Grant the engineer local administrator rights on the shared host and rely on separate profile folders.: A local administrator can affect other users despite ordinary profile-folder permissions. B. Grant Virtual Machine Administrator Login across every pooled VM and leave all users on the same hosts.: This broadens administrative access while retaining the shared-host risk. C. Move all users to Entra Domain Services so local administrative actions cannot affect other sessions.: Managed-domain join does not prevent local administrators from affecting other sessions on the same VM. D. Give the engineer a dedicated VM in a personal host pool.: A dedicated personal VM provides the recommended separation for a user who needs administrator rights. Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Open this question’s page →101. Entra-joined hosts, supported clients, OS updates, user entitlement, and applicable VM login rights are healthy. Windows Cloud Login has RDP authentication enabled in the tenant. One host pool still lacks the host-pool SSO setting. Which RDP property should be added to enable it?
Identity & access
✓ Correct answer
- enablerdsaadauth:i:1
Tenant Windows Cloud Login configuration and host-pool Entra SSO are separate requirements. enablerdsaadauth:i:1 activates the host-pool Entra SSO path. Option explanations: A. enablerdsaadauth:i:1: This is the documented RDP property for enabling Entra SSO on the host pool. B. redirectwebauthn:i:1: This enables in-session WebAuthn redirection rather than Windows SSO. C. drivestoredirect:s:*: This controls local drive redirection, not host authentication. D. redirectsmartcards:i:1: This controls smart-card redirection and does not activate Entra SSO. Sources: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Open this question’s page →102. A pilot Entra SSO user locks the remote desktop. The client disconnects. On reconnection, an application with unsaved work is still running. No separate logoff policy has expired. How should this behavior be interpreted?
Identity & access
✓ Correct answer
- The default SSO lock behavior disconnected the client while the Windows session remained running.
The default Entra SSO lock behavior disconnects rather than displaying the remote lock screen. Disconnect is not logoff; a separate policy controls when the session ends, and reconnection can reevaluate authentication. Option explanations: A. Controlled Folder Access shut down Windows and restored the application.: Controlled Folder Access restricts file modification; it does not perform this session lifecycle action. B. The default SSO lock behavior disconnected the client while the Windows session remained running.: This matches the default SSO lock behavior and the observed continuing Windows session. C. Autoscale deleted the VM and recreated the application's memory.: Deleting and recreating a VM does not preserve the running application's unsaved memory state. D. Windows logged off the user and FSLogix restored the unsaved running process.: FSLogix persists supported profile data, not a logged-off process's unsaved memory. Sources: Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Open this question’s page →103. A team remediates several Defender for Cloud recommendations and the subscription Secure Score increases. A Defender endpoint alert on one host remains unresolved. What should the team do?
Security
✓ Correct answer
- Verify the remediated resource states and continue investigating the active endpoint alert.
Secure Score measures applicable posture recommendations; it is not proof that active threats are absent. Verify remediation and continue endpoint investigation using functioning sensor telemetry. Option explanations: A. Close the endpoint alert because improved Secure Score proves that no threat remains.: Posture improvement does not resolve or disprove an active endpoint detection. B. Disable the sensor so the resource's recommendation status is easier to maintain.: Disabling telemetry weakens verification and investigation instead of resolving the issue. C. Verify the remediated resource states and continue investigating the active endpoint alert.: This preserves the distinction between configuration posture and threat detection. D. Replace endpoint investigation with the AVD application-group assignment report.: Application entitlement reports do not provide endpoint threat investigation. Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations; Defender for Endpoint / Vulnerability Management integration with Defender for Cloud — https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Open this question’s page →104. A session-host VM appears in Defender inventory as Can be onboarded. Azure Monitor Agent is installed, but the Defender portal has no sensor telemetry from it after the expected reporting window. What should be verified?
Security
✓ Correct answer
- Whether Defender for Endpoint onboarding, sensor health, and required outbound connectivity are functioning.
Cloud inventory discovery and Azure Monitor Agent do not establish Defender for Endpoint onboarding. Verify the actual Defender sensor/extension and its reporting path. Option explanations: A. Whether Desktop Virtualization User is assigned at subscription scope.: AVD application entitlement is separate from endpoint sensor onboarding. B. Whether Azure Monitor diagnostic settings alone can be used as the Defender sensor.: Monitor diagnostics do not replace the Defender for Endpoint sensor. C. Whether an additional local administrator account removes the onboarding requirement.: Local administrative accounts neither eliminate onboarding nor demonstrate protection telemetry. D. Whether Defender for Endpoint onboarding, sensor health, and required outbound connectivity are functioning.: These checks address the missing endpoint reporting despite resource discovery. Sources: Defender for Endpoint / Vulnerability Management integration with Defender for Cloud — https://learn.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Open this question’s page →105. One hundred pooled hosts start a full antivirus scan simultaneously at the morning sign-in peak, causing CPU and storage contention. Real-time protection is currently enabled. Which changes best reduce contention while preserving the documented routine protection approach?
Security
✓ Correct answers
- Schedule quick scans and randomize their start times across hosts.
- Retain real-time and cloud-delivered protection on live hosts.
Routine scheduled quick scans and randomized timing reduce synchronized workload. Keep real-time and cloud-delivered protection; image scanning and broad exclusions do not replace it. Option explanations: A. Disable live-host real-time protection and rely only on the base-image scan.: An image scan cannot protect later live-host activity and user downloads. B. Schedule quick scans and randomize their start times across hosts.: Quick scans and randomized starts follow the recommended VDI scheduling approach. C. Exclude every user's Downloads folder from protection.: A blanket Downloads exclusion creates a broad unprotected area and does not address scan scheduling correctly. D. Retain real-time and cloud-delivered protection on live hosts.: These protections should remain enabled while scan scheduling is optimized. Sources: Configure Microsoft Defender Antivirus in RDS or VDI environments — https://learn.microsoft.com/en-us/defender-endpoint/deployment-vdi-microsoft-defender-antivirus; Microsoft Defender Antivirus full scan considerations and best practices — https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices
Open this question’s page →106. An analyst wants to scan one suspicious download directory on a live session host. There is no current need to scan the entire host or restart it, and the investigation should limit I/O scope. Which scan type best fits?
Security
✓ Correct answer
- A custom scan of the specified directory.
A custom scan targets the specified file or directory and matches the limited investigation scope. Full and offline scans add unnecessary scope or disruption here. Option explanations: A. A custom scan of the specified directory.: A custom scan directly targets the suspicious directory. B. The next scheduled quick scan, with a guarantee that it exhaustively scans that directory.: A quick scan focuses on common malware locations; it does not supply the stated exhaustive directory-specific guarantee. C. A full scan of the entire system and attached storage.: A full scan has broader scope and potentially larger I/O cost than the requirement. D. An offline scan requiring a restart.: Offline scanning introduces a restart that the stated investigation does not require. Sources: Microsoft Defender Antivirus full scan considerations and best practices — https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices
Open this question’s page →107. An organization rebuilds non-persistent hosts and wants a distinct Defender device entry for every provisioned instance, even when the final hostname is reused. The golden image is unonboarded and the correct VDI onboarding package is available. Which documented entry model should it use?
Security
✓ Correct answer
- The CMD onboarding-script model for multiple entries per provisioned instance.
The CMD-script model supports multiple entries per provisioned instance. The PowerShell non-persistent script is used for a stable single entry per final device name and invokes the CMD script as part of that different model. Option explanations: A. The PowerShell single-entry-per-final-device-name model.: This targets stable naming-based entries rather than the requested separate-instance model. B. The CMD onboarding-script model for multiple entries per provisioned instance.: This matches the requirement for distinct provisioned-instance records. C. Install Azure Monitor Agent without a Defender onboarding script.: Azure Monitor Agent does not onboard the host to Defender for Endpoint. D. Capture one already-onboarded sensor identity and reuse it in every clone.: Cloning a live sensor identity can merge or obscure device records. Sources: Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi
Open this question’s page →108. Incident responders are authorized to isolate a compromised pooled session host through Defender for Endpoint. Twelve users currently have sessions on that host. Which immediate impact must the responders account for?
Security
✓ Correct answer
- All users on that host can lose network connectivity because isolation applies to the shared device.
Device isolation affects the shared host, not just one user's session or process. Plan containment and subsequent trusted replacement with awareness of every user's connectivity impact. Option explanations: A. Only the detected malicious process loses network access; other host sessions are unaffected.: Device isolation is not limited to the single malicious process. B. Isolation only hides the host in the Defender portal and changes no network behavior.: Isolation is a containment action, not merely an inventory-display change. C. All users on that host can lose network connectivity because isolation applies to the shared device.: This is the relevant pooled-host operational consequence. D. Azure Virtual Desktop automatically migrates all running processes to another host.: AVD does not automatically migrate running session process memory in response to endpoint isolation. Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations; Onboard non-persistent VDI devices to Microsoft Defender for Endpoint — https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi
Open this question’s page →109. A spoke's default 0.0.0.0/0 route sends all egress through Azure Firewall. AVD endpoint rules are allowed, but brokered sessions drop during firewall scale-in. Which route change matches current AVD firewall guidance while keeping other egress controlled?
Security
✓ Correct answer
- Add a more specific WindowsVirtualDesktop service-tag route with next hop Internet.
The recommended service-tag route sends broker/gateway traffic directly and avoids the documented scale-in disconnection path. The default route can continue to send remaining egress through the firewall. Option explanations: A. Add an NSG allow without changing the current traffic path.: An allow rule does not change the route causing the scale-in dependency. B. Expose public TCP 3389 on every session host.: Public administrative RDP is not the fix for broker/gateway egress disruption. C. Enable TLS interception for AVD service traffic.: AVD service traffic must not be TLS-inspected or terminated. D. Add a more specific WindowsVirtualDesktop service-tag route with next hop Internet.: The more specific route implements the documented direct broker/gateway path. Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop
Open this question’s page →110. A design uses standard brokered TCP AVD user connections. The managed-network Shortpath listener is disabled. The hosts have NSGs at both subnet and NIC, and egress crosses a security appliance. Which controls support the normal AVD service connection?
Security
✓ Correct answers
- Exclude AVD service traffic from TLS inspection or termination.
- Permit required outbound TCP 443 traffic through both applicable NSG rule sets.
Normal reverse-connect service traffic uses outbound TCP 443 and requires permitted effective rules. Preserve native TLS and allow the complete documented dependency set; ordinary brokered TCP user access does not require public inbound RDP. Option explanations: A. Expose inbound public TCP 3389 to users on each host.: Public inbound TCP 3389 is not required for normal brokered user connections. B. Allow only the WindowsVirtualDesktop FQDN tag and block every other identity, storage, and update dependency.: The AVD tag does not cover every supporting dependency, so this policy would break required services. C. Exclude AVD service traffic from TLS inspection or termination.: AVD service traffic must preserve its native TLS connection. D. Permit required outbound TCP 443 traffic through both applicable NSG rule sets.: Both applicable NSGs must permit the required connection; an allow at only one layer is insufficient. Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop; Required FQDNs and endpoints for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/required-fqdn-endpoint; RDP Shortpath for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-shortpath
Open this question’s page →111. Administrators need native-client administrative RDP through Azure Bastion to hosts with private IPs only. Private routing, target NSGs, and guest sign-in rights are already correct. Which choice meets the native-client transport requirement?
Security
✓ Correct answer
- A dedicated Standard Bastion deployment with the supported native-client connection.
Standard Bastion supports the required native-client connection and reaches VM private IPs. The scenario already supplies routing and guest authorization, so the missing decision is the transport capability. Option explanations: A. A dedicated Standard Bastion deployment with the supported native-client connection.: Standard includes the native-client capability required by the scenario. B. JIT alone, without a private client path or Bastion deployment.: JIT temporarily changes network rules; it does not provide the missing native-client gateway or private path. C. A dedicated Basic Bastion deployment using only its browser connection.: Basic supplies browser connectivity rather than the stated native-client feature. D. Permanent public-IP TCP 3389 access to every host.: Public direct RDP violates the private-IP-only transport requirement. Sources: What is Azure Bastion? — https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
Open this question’s page →112. A supported VM is covered by Defender for Servers Plan 2. An authorized administrator needs RDP from one approved source IP for one hour, with the network opening closed afterward. Which approach implements the requirement?
Security
✓ Correct answer
- Configure JIT protection for the required port and approved source/time window, then submit an authorized access request.
JIT with the supported Plan 2/topology temporarily opens managed network rules for the approved source, ports, and duration. Guest credentials and network reachability remain separate prerequisites. Option explanations: A. Create a permanent NSG allow for TCP 3389 from all internet addresses.: A permanent internet-wide rule does not restrict the source or expire after the approved hour. B. Configure JIT protection for the required port and approved source/time window, then submit an authorized access request.: JIT configuration and the approved request produce the required temporary managed opening. C. Grant Virtual Machine Contributor and assume it creates a timed RDP opening.: A compute management role does not create the requested JIT network window. D. Use Defender for Servers Plan 1 as a substitute for the stated JIT plan requirement.: The documented JIT feature requires Defender for Servers Plan 2. Sources: Enable just-in-time VM access — https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage
Open this question’s page →113. App Control audit on a test ring identifies a required, validated, signed management driver missing from the policy. The driver must continue working after signed updates. What should be done before enforcement?
Security
✓ Correct answer
- Add a narrowly scoped publisher-based allow rule for the validated driver and retest the host workflows.
App Control governs code trust. A carefully scoped publisher rule can accommodate the validated signed driver's updates better than a brittle file hash; retest the AVD and management workflows before enforcement. Option explanations: A. Disable antivirus cloud protection to prevent App Control from evaluating the driver.: Antivirus cloud-protection settings do not supply the missing App Control allow rule. B. Trust every executable beneath a user-writable profile path.: A broad writable-path trust rule would allow users to introduce unrelated code into a trusted location. C. Add a narrowly scoped publisher-based allow rule for the validated driver and retest the host workflows.: This addresses the legitimate code-trust gap and supports controlled signed updates. D. Add the driver to Controlled Folder Access allowed applications to authorize code execution.: CFA allows protected-folder writes; it does not authorize a driver to load under App Control. Sources: Deploying App Control for Business policies — https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
Open this question’s page →114. Controlled Folder Access is configured as Enabled, but testing shows untrusted applications can still modify the selected protected folder. Defender Antivirus is in passive mode and EDR block mode is enabled. What prerequisite must the administrator correct?
Security
✓ Correct answer
- Use a supported configuration with Defender Antivirus active and real-time protection enabled.
CFA requires Defender Antivirus active mode with real-time protection. Passive mode, including EDR block mode, does not meet this requirement; fix the supported protection configuration and repeat audit/enforcement testing. Option explanations: A. Use EDR block mode as the supported replacement for active antivirus in CFA.: EDR block mode does not make CFA function in passive antivirus mode. B. Allow every application through the CFA allowed-applications list.: A broad allowed-applications list weakens protection and does not fix the antivirus prerequisite. C. Trust the folder path in App Control for Business.: App Control code-trust policy does not activate CFA file-write protection. D. Use a supported configuration with Defender Antivirus active and real-time protection enabled.: These are the operating prerequisites stated for CFA. Sources: Controlled folder access overview and requirements — https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview
Open this question’s page →115. A compatible Generation 2 session-host VM will use Trusted Launch. The requirements are to validate trusted signed boot code and retain protected measured-boot data. Which features should be enabled for those respective protections?
Security
✓ Correct answers
- Secure Boot.
- vTPM.
Secure Boot validates trusted boot components, while vTPM protects keys and boot measurements. Remote attestation can then use measured-boot information to assess integrity; these are distinct from cloud sign-in and disk encryption. Option explanations: A. Secure Boot.: Secure Boot supplies the trusted boot-code validation requirement. B. vTPM.: vTPM supplies the protected keys and boot-measurement capability. C. Disk encryption at rest as a replacement for boot validation.: Encryption at rest does not replace boot-chain validation or protected measured-boot storage. D. Windows Cloud Login.: Windows Cloud Login authenticates Windows sessions and does not validate the boot chain. Sources: Trusted Launch for Azure virtual machines — https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations
Open this question’s page →116. A confidential session-host VM was created without the confidential OS disk encryption arrangement now required by a customer. The customer asks to change that confidential encryption setting on the existing VM. What should the deployment plan do?
Security
✓ Correct answer
- Plan a replacement confidential VM created with the required supported encryption configuration and controlled data migration.
Confidential OS disk encryption must be chosen at VM creation and cannot be changed afterward. A replacement plan should select a supported key/image arrangement and handle application and data migration deliberately. Option explanations: A. Plan a replacement confidential VM created with the required supported encryption configuration and controlled data migration.: Creating a compatible replacement with the correct setting addresses the creation-time requirement. B. Enable Controlled Folder Access so the existing OS disk becomes confidentially encrypted.: CFA restricts untrusted file modifications; it does not encrypt the VM's OS disk. C. Enable Secure Boot on the existing VM and treat it as confidential disk encryption.: Secure Boot protects boot integrity and does not change the existing confidential disk encryption arrangement. D. Change an AVD host-pool RDP property to enable the requested disk encryption.: RDP properties configure connection behavior, not the immutable confidential OS disk encryption setting. Sources: About Azure confidential VMs — https://learn.microsoft.com/en-us/azure/confidential-computing/confidential-vm-overview
Open this question’s page →117. An organization keeps its existing supported roaming-profile product for Windows personalization, but Outlook cache performance is poor. It wants FSLogix to persist selected Microsoft 365 data without replacing that product. Which design best fits?
Storage & FSLogix
✓ Correct answer
- Add an ODFC Container and exclude its managed data from the existing profile product.
ODFC captures the selected Office data while the existing product handles the rest of the profile. Avoid overlapping capture of the same folders. Option explanations: A. Replace the profile product with two full Profile Containers.: Two full-profile containers do not meet the stated selective-data requirement and add competing capture. B. Add an ODFC Container and exclude its managed data from the existing profile product.: ODFC is designed for selected Office data alongside another profile solution; exclusions prevent overlap. C. Publish Outlook as a RemoteApp without changing profile persistence.: RemoteApp changes presentation and does not solve the stated persistence requirement. D. Use application masking to hide Outlook cache folders.: Masking changes resource visibility, not persistence or the supported Office-cache container model. Sources: FSLogix types of containers — https://learn.microsoft.com/fslogix/concepts-container-types; Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers
Open this question’s page →118. FSLogix is installed on every host, intended users pass its group filters, and the SMB profile share is accessible with valid permissions. Containers are currently disabled and no location is configured. Which two Profiles-key settings enable ordinary Profile Containers on that share?
Storage & FSLogix
✓ Correct answers
- Set VHDLocations to the profile share’s UNC path.
- Set Enabled as a DWORD with value 1.
Ordinary Profile Containers require enablement and a VHDLocations storage path. Cloud Cache and ODFC workload settings are different configurations. Option explanations: A. Set VHDLocations to the profile share’s UNC path.: VHDLocations identifies the SMB location searched for each user’s container. B. Set IncludeOfficeActivation under the Profiles key.: IncludeOfficeActivation is an ODFC workload control and does not enable or locate a whole-profile container. C. Set Enabled as a DWORD with value 1.: Enabled=1 turns on Profile Containers for eligible users. D. Set CCDLocations to the share’s UNC path without Cloud Cache provider syntax.: CCDLocations is for a Cloud Cache provider configuration and is not the ordinary VHDLocations setting. Sources: Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
Open this question’s page →119. A new FSLogix deployment creates ordinary containers as VHD because VolumeType has not been explicitly configured. The requirement is to create future containers as VHDX; no existing disk conversion is requested. Which setting addresses that requirement?
Storage & FSLogix
✓ Correct answer
- Set VolumeType to vhdx under the Profiles key.
VolumeType selects the format for new containers. vhdx is recommended, but the reference default is vhd, so the desired format should be configured explicitly. Option explanations: A. Set IsDynamic=1.: Dynamic allocation does not choose between VHD and VHDX. B. Lower SizeInMBs.: Logical maximum size is separate from disk format. C. Set VolumeType to vhdx under the Profiles key.: This selects VHDX for new Profile Containers; it does not imply conversion of existing VHD files. D. Set FlipFlopProfileDirectoryName=1.: The folder naming pattern does not select the container disk format. Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; Configure profile containers using FSLogix — https://learn.microsoft.com/fslogix/tutorial-configure-profile-containers
Open this question’s page →120. A consultant must configure ODFC while leaving the ordinary Profile Container feature disabled. The storage path and access are already prepared. Which registry branch should receive the ODFC enablement and location values?
Storage & FSLogix
✓ Correct answer
- HKLM\SOFTWARE\Policies\FSLogix\ODFC
ODFC has its own policy-key location, separate from the Profiles branch and general FSLogix application settings. Option explanations: A. HKLM\SOFTWARE\FSLogix\Apps: The Apps branch includes general FSLogix settings; it is not the ODFC container configuration branch. B. HKLM\SOFTWARE\FSLogix\Profiles: The Profiles branch configures Profile Containers and would target the wrong feature. C. HKLM\SOFTWARE\Microsoft\Teams: The Teams branch holds Teams environment settings, not ODFC storage configuration. D. HKLM\SOFTWARE\Policies\FSLogix\ODFC: This is the documented ODFC branch for its enablement and container settings. Sources: Configure ODFC containers — https://learn.microsoft.com/fslogix/tutorial-configure-odfc-containers; FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
Open this question’s page →121. A Cloud Cache design already sets HealthyProvidersRequiredForRegister=1. Administrators want users who encounter either a container attach failure or a temporary profile to receive FRXShell and sign out rather than continue with a fallback desktop. Which two companion settings should be enabled?
Storage & FSLogix
✓ Correct answers
- PreventLoginWithTempProfile
- PreventLoginWithFailure
The provider count controls FSLogix registration. The documented failure and temporary-profile policies produce the required restricted fallback experience. Option explanations: A. PreventLoginWithTempProfile: This policy loads FRXShell when FSLogix detects a temporary profile. B. IsDynamic: IsDynamic controls disk allocation behavior, not the fallback desktop experience. C. FlipFlopProfileDirectoryName: The folder-naming pattern does not enforce failure handling. D. PreventLoginWithFailure: This policy loads FRXShell when attachment or use of an existing container fails. Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings
Open this question’s page →122. A Cloud Cache host has unsynchronized local writes. All providers are unavailable, HealthyProvidersRequiredForUnregister=1 and CcdUnregisterTimeout=0. Sign-out is waiting. Which first action best preserves the user’s data?
Storage & FSLogix
✓ Correct answer
- Restore provider availability and inspect synchronization before forcing unregister or deleting the host.
With no healthy required provider and no timeout, sign-out can wait indefinitely. Unsynchronized writes may exist only locally, so restore and verify provider synchronization before destructive recovery. Option explanations: A. Restore provider availability and inspect synchronization before forcing unregister or deleting the host.: This addresses the unmet healthy-provider requirement while preserving the only possible copy of recent writes. B. Enable ClearCacheOnForcedUnregister and force sign-out to discard the cache.: Discarding the unsynchronized cache conflicts with the data-preservation requirement. C. Clear the local cache immediately because the provider replicas must already contain every write.: Asynchronous replication means the remote copies may not contain the unsynchronized data. D. Delete and recreate the VM to release the waiting session.: Destroying the host can lose writes that exist only in its cache. Sources: FSLogix configuration setting reference — https://learn.microsoft.com/fslogix/reference-configuration-settings; FSLogix Cloud Cache overview — https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache
Open this question’s page →123. An organization must retain cloud-only Entra user accounts. Its supported profile-storage design works, and it now plans FSLogix Rule Set assignments to Entra-only user groups for application hiding. Which documented limitation must the administrator raise?
Storage & FSLogix
✓ Correct answer
- FSLogix Rule Set assignments do not support cloud-only Entra accounts; this plan needs a different supported entitlement method.
FSLogix Rule Set assignments require the documented AD-synchronized identities and domain-controller line of sight. A supported cloud-only profile-storage scenario does not remove the separate application-masking assignment limitation. Option explanations: A. Installing an ODFC Container makes Entra-only groups valid Rule Set assignment targets.: ODFC changes selected Office-data persistence; it does not expand the supported Rule Set identity model. B. FSLogix Rule Set assignments do not support cloud-only Entra accounts; this plan needs a different supported entitlement method.: This identifies the assignment-feature limitation while respecting the requirement to retain cloud-only accounts. C. Profile Containers cannot persist Office data for any user who uses application masking.: The issue is assignment identity support, not a general incompatibility between profile persistence and application masking. D. Enabling Cloud Cache automatically supplies domain-controller SID resolution for Entra-only groups.: Cloud Cache controls container storage behavior and does not create AD identity synchronization or domain-controller access. Sources: FSLogix Apps RuleEditor and Rule Sets — https://learn.microsoft.com/fslogix/concepts-fslogix-apps-rule-editor-rule-sets
Open this question’s page →124. A tested FSLogix Rule Set hides the intended resources correctly on the authoring VM. Deployment copied only its .fxr file to the target hosts; the intended group-specific assignments are missing. Which deployment artifact should be included?
Storage & FSLogix
✓ Correct answer
- The matching .fxa assignment file in the FSLogix Rules folder.
The rule and assignment files must be distributed together to the target Rules directory. The assignment file carries the user/group application logic. Option explanations: A. A new host-pool registration token.: Host registration is not the file-based masking deployment mechanism. B. A renamed version of the application executable.: Renaming the executable does not recreate the intended rule assignments. C. The matching .fxa assignment file in the FSLogix Rules folder.: The .fxa supplies the missing assignments alongside the .fxr resource rules. D. A separate ODFC container for every target host.: An ODFC container persists selected Office data and does not supply masking assignments. Sources: Create and implement Rule Sets (application masking) — https://learn.microsoft.com/fslogix/tutorial-application-rule-sets
Open this question’s page →125. Managed Windows endpoints must support the dedicated Teams VDI optimization path during AVD calls. No client is deployed yet. Which client choice best meets the requirement when the host and endpoint prerequisites are also configured?
Clients & user experience
✓ Correct answer
- A current supported installed Windows App for Windows.
A supported installed Windows App can provide the required Teams optimization components. Browser access does not support the dedicated Teams optimization path. Option explanations: A. Windows App browser access in a supported Chrome browser.: Changing browser vendor does not add the required Teams endpoint optimization components. B. Windows App browser access in a supported Edge browser.: A supported browser can launch AVD resources but does not provide Teams VDI optimization. C. The retired Remote Desktop Store app retained from an old image.: The retired Store application is not a supported new rollout choice. D. A current supported installed Windows App for Windows.: This is the current installed client path; compatible media prerequisites must still be met. Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Remote Desktop client overview and retirement notices — https://learn.microsoft.com/previous-versions/remote-desktop-client/overview; Install Teams for VDI — https://learn.microsoft.com/microsoftteams/teams-client-vdi-requirements-deploy
Open this question’s page →126. A company blocks the Microsoft Store. Its endpoint deployment team has obtained an official Windows App MSIX for an offline installation, but a pilot reports missing framework packages. What should the team do?
Clients & user experience
✓ Correct answer
- Obtain the release’s architecture-matched dependencies and install them before Windows App.
A standalone Windows App package needs the frameworks required by its release and endpoint architecture. Offline package installation still does not eliminate service connectivity requirements. Option explanations: A. Obtain the release’s architecture-matched dependencies and install them before Windows App.: Installing the correct dependencies first addresses the reported local installation failure. B. Change the AVD application group’s display name.: Publication names cannot resolve a local package installation prerequisite. C. Install the same MSIX repeatedly until the framework error disappears.: Repeated installation does not supply missing framework dependencies. D. Deploy a legacy Remote Desktop MSI instead of resolving the Windows App dependencies.: Replacing the current client with a retired path does not satisfy the supported rollout requirement. Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic
Open this question’s page →127. A user has two work accounts. Administrators verify that the intended account is assigned to a published application group registered with a workspace. Windows App is signed in only with the other account and its feed is empty. What should the user do first?
Clients & user experience
✓ Correct answer
- Sign in to Windows App with the intended assigned work account and refresh its resources.
Feed discovery uses the signed-in account’s authorized resources. Correcting the account resolves the mismatch before any infrastructure change is justified. Option explanations: A. Ask for Desktop Virtualization Contributor at subscription scope.: A management role is unnecessary for discovering resources assigned to the intended user identity. B. Sign in to Windows App with the intended assigned work account and refresh its resources.: This makes discovery use the identity whose application-group entitlement was verified. C. Move the published application to a different host pool.: Host-pool relocation does not correct the signed-in identity mismatch. D. Delete the existing profile container.: The failure occurs during account-based discovery, before profile attachment. Sources: Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps; Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic; Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Open this question’s page →128. The same assigned account can launch an AVD desktop in supported browser access on one endpoint, but its current installed Windows App fails before the desktop opens. Other endpoints work. What is the most useful first troubleshooting focus?
Clients & user experience
✓ Correct answer
- Collect Windows App diagnostics and inspect that endpoint’s client configuration, updates and proxy/network behavior.
The comparison narrows the fault toward the endpoint’s installed-client path. Diagnose the local failure before changing healthy shared service configuration. Option explanations: A. Move the workspace to a new Azure region.: Region relocation does not diagnose a client-specific endpoint failure. B. Rebuild every session host from a new image.: A fleet rebuild is not justified when the resource launches through another supported client and other endpoints work. C. Collect Windows App diagnostics and inspect that endpoint’s client configuration, updates and proxy/network behavior.: This gathers evidence about the failing client path while retaining the successful comparison. D. Remove and reassign the user’s application-group permissions without collecting evidence.: The same account’s successful launch already demonstrates its usable resource entitlement. Sources: Basic troubleshooting for Windows App — https://learn.microsoft.com/windows-app/troubleshoot-basic; Get started with Windows App — https://learn.microsoft.com/windows-app/get-started-connect-devices-desktops-apps
Open this question’s page →129. A supported Windows App client must pass a local microphone and supported webcam into a generic remote application. Host policy and endpoint privacy permissions already allow both devices. Which two host-pool RDP properties request these resources?
Clients & user experience
✓ Correct answers
- audiocapturemode:i:1
- camerastoredirect:s:*
Audio capture and camera redirection are separate resource settings. Audio playback and drive access cannot substitute for them. Option explanations: A. drivestoredirect:s:*: This requests local drive redirection, not either stated media-input device. B. audiocapturemode:i:1: This permits local microphone input subject to the already-validated permission layers. C. camerastoredirect:s:*: This requests supported local camera redirection. D. audiomode:i:1: This selects playback on the remote computer; it does not request microphone capture. Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties
Open this question’s page →130. A supported endpoint camera works in local apps. In the AVD session it is absent, even though the host-pool camera RDP property and session-host policy permit redirection. Windows App is denied camera access in the endpoint privacy settings. What should be corrected first?
Clients & user experience
✓ Correct answer
- Allow Windows App to access the camera in the endpoint privacy settings.
Redirection depends on endpoint device access as well as client support, host policy and RDP properties. The identified endpoint privacy denial prevents Windows App from using the camera. Option explanations: A. Reinstall the remote conferencing app on every host.: The failure already has a specific endpoint permission cause; a fleet app reinstall does not grant that permission. B. Enable local drive redirection instead of camera redirection.: Drive redirection does not carry the camera stream or change privacy permission. C. Enable microphone recording while leaving camera access denied.: Microphone recording is a separate device capability and does not grant camera access. D. Allow Windows App to access the camera in the endpoint privacy settings.: This corrects the explicit device-access block after the other camera conditions have been verified. Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Compare Windows App features across platforms — https://learn.microsoft.com/windows-app/compare-platforms-features?pivots=azure-virtual-desktop
Open this question’s page →131. Browser MMR playback is active for a supported training-video website. Network logs still show the session-host browser downloading the video, while endpoint decoding reduces host CPU use. How should the administrator interpret this?
Clients & user experience
✓ Correct answer
- This matches playback redirection: the remote browser fetches video and forwards its bitstream for local decoding.
Playback redirection retains the browser and source fetch in the session while offloading bitstream decoding and rendering to the endpoint. Option explanations: A. This matches playback redirection: the remote browser fetches video and forwards its bitstream for local decoding.: The observed traffic and CPU behavior are consistent with the supported playback path. B. Optimization has failed because the endpoint must download every video directly.: Endpoint download is not the documented MMR playback mechanism. C. Only generic audio playback is active because all browser MMR requires endpoint-to-service calls.: Direct endpoint media connectivity describes call redirection, not all browser playback. D. The whole browser page has moved to the endpoint.: The browser page remains in the remote session. Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
Open this question’s page →132. A supported browser telephony app uses MMR call redirection. The host can reach the telephony service, but the endpoint firewall blocks the service connection and calls fail. Which network change addresses this failure?
Clients & user experience
✓ Correct answer
- Permit the endpoint to reach the required telephony service endpoints.
With MMR call redirection, the media connection is between the local endpoint and the telephony app server. Successful host connectivity alone is insufficient for this path. Option explanations: A. Permit only the host to reach the telephony service and keep the endpoint block.: The host path already works; call redirection still needs the blocked endpoint path. B. Permit the endpoint to reach the required telephony service endpoints.: This provides the connectivity required by the redirected call path. C. Increase the host’s browser video cache while preserving the endpoint block.: Browser playback caching does not open the blocked call-media connection. D. Allow SMB from the endpoint to the profile share.: Profile SMB access is unrelated to the endpoint’s telephony connection. Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
Open this question’s page →133. AVD users must print to a traditional office printer even when their endpoint has no local printer installed. All users already hold qualifying Universal Print licenses. The printer has no built-in Universal Print support. Which two deployment actions are needed?
Clients & user experience
✓ Correct answers
- Register and share the printer with the intended users, then provision it for their sessions.
- Deploy a Universal Print connector on a machine that can reach the printer.
A connector integrates a traditional printer with Universal Print; registration, sharing and provisioning make it available to authorized sessions independently of endpoint printer redirection. Option explanations: A. Install the vendor’s printer driver on the session hosts without registering a cloud printer.: A local driver alone does not create the required Universal Print registration or entitlement. B. Register and share the printer with the intended users, then provision it for their sessions.: This makes the registered printer discoverable and usable by the authorized population. C. Enable redirectprinters on the host pool as the only printer-delivery mechanism.: Redirection exposes endpoint printers, but the scenario deliberately has no installed endpoint printer. D. Deploy a Universal Print connector on a machine that can reach the printer.: The connector provides the required link for a printer that is not Universal Print-ready. Sources: Printing on AVD using Universal Print — https://learn.microsoft.com/universal-print/fundamentals/universal-print-avd; Set up Universal Print — https://learn.microsoft.com/universal-print/set-up-universal-print
Open this question’s page →134. A supported Windows 11 Enterprise multi-session pool uses version 22H2 or later and FSLogix. A user’s Universal Print preferences roam, but machine printer properties such as drivers and ports do not. How should the administrator handle this distinction?
Clients & user experience
✓ Correct answer
- Keep the required machine printer configuration on each host and roam the supported user preferences.
Universal Print user preferences can roam in the supported AVD configuration. Printer properties such as driver and port information are machine settings and do not roam with the user. Option explanations: A. Copy the vendor driver binaries into each user profile as a substitute for host printer configuration.: Copying binaries into profiles is not the documented way to configure host printer properties. B. Assume FSLogix must roam all machine printer properties and replace the whole profile.: The observed distinction is expected; replacing a healthy profile does not turn machine properties into user settings. C. Keep the required machine printer configuration on each host and roam the supported user preferences.: This respects the machine-versus-user boundary while preserving the roaming settings that are supported. D. Disable profile persistence so the printer settings become machine-wide.: Disabling persistence removes useful user state without configuring the required host properties. Sources: Printing on AVD using Universal Print — https://learn.microsoft.com/universal-print/fundamentals/universal-print-avd
Open this question’s page →135. An Intune-enrolled Windows Enterprise multi-session pool uses a supported user-scope Settings catalog policy. The administrator assigned it only to a device group and sees Not applicable. Which correction aligns with the documented targeting model?
Clients & user experience
✓ Correct answer
- Assign the user-scope policy to the intended user group.
Supported user-scope policy must target users. The scope and assignment mismatch explains the reported result. Option explanations: A. Convert the same user-scope setting into a device setting by renaming the policy.: A name change cannot alter the setting’s operating-system scope. B. Clone the enrolled VM so each user receives a copied enrollment identity.: Cloning an enrolled identity can cause enrollment and synchronization failures. C. Use Available app assignment intent to deliver the setting.: Application assignment intent does not correct policy scope and Available is unsupported for multi-session app deployment. D. Assign the user-scope policy to the intended user group.: This aligns the policy’s user scope with its assignment population. Sources: Intune: Windows Enterprise multi-session remote desktops — https://learn.microsoft.com/en-us/mem/intune-service/fundamentals/azure-virtual-desktop-multi-session
Open this question’s page →136. AD DS Group Policy user settings for AVD are linked to the session-host OU. The requirement is for these host-linked user policies to completely replace the user’s normal OU-linked user policies during an AVD sign-in. Which loopback mode should be configured?
Clients & user experience
✓ Correct answer
- Replace, so the computer’s policy path supplies the user-policy list instead.
Loopback Replace uses the computer’s GPO path for user settings and omits the normal user-policy list. Merge processes both lists and gives the computer-linked user settings precedence. Option explanations: A. Replace, so the computer’s policy path supplies the user-policy list instead.: Replace provides the specified computer-location-based user settings without processing the normal user-policy list. B. Background refresh only, without loopback processing.: Refresh timing does not select the required loopback policy list. C. Merge, so normal user-OU policies are processed before the host-linked policies.: Merge retains normal user-policy processing, contrary to the complete-replacement requirement. D. Disabled, so only normal user-OU policies apply.: Normal user-OU processing does not apply the required host-linked replacement list. Sources: Group Policy processing and loopback — https://learn.microsoft.com/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing
Open this question’s page →137. A host pool currently allows clipboard transfer. The security requirement is to disable clipboard copying for every new resource connection from that pool. No host or client restriction conflicts with this change. Which RDP property directly controls the requirement?
Clients & user experience
✓ Correct answer
- redirectclipboard:i:0
redirectclipboard controls clipboard redirection. Saving the pool setting and reconnecting provides a reliable test of the new launch configuration. Option explanations: A. audiocapturemode:i:0: This controls microphone capture, not clipboard transfer. B. redirectclipboard:i:0: This disables clipboard redirection for the launched resources, subject to the effective configuration. C. redirectsmartcards:i:0: This controls smart-card forwarding and does not address copying text. D. drivestoredirect:s:: This controls drive redirection, which is distinct from the clipboard requirement. Sources: Peripheral and resource redirection over RDP — https://learn.microsoft.com/azure/virtual-desktop/redirection-remote-desktop-protocol; Set custom RDP properties on a host pool — https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties
Open this question’s page →138. Users close Windows App without signing out. Administrators want their disconnected sessions to remain available for 15 minutes, then sign out and release memory and profile locks. Which policy best expresses this requirement?
Clients & user experience
✓ Correct answer
- Set time limit for disconnected sessions to 15 minutes.
The disconnected-session timer begins after disconnection and ends the retained session when its limit is reached. Option explanations: A. Set a 15-minute screen saver timeout.: Screen saver timing does not sign out disconnected AVD sessions. B. Set time limit for active Remote Desktop Services sessions to 15 minutes.: An active-session duration cap also affects users who are still working. C. Set time limit for disconnected sessions to 15 minutes.: This provides the required disconnected retention followed by sign-out. D. Set time limit for active but idle Remote Desktop Services sessions to 15 minutes.: Idle time is measured while the session is connected and does not define the stated disconnected retention interval. Sources: Create a scaling plan: configure a time limit policy — https://learn.microsoft.com/azure/virtual-desktop/autoscale-create-assign-scaling-plan#configure-a-time-limit-policy; Policy CSP: Terminal Server session time limits — https://learn.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver
Open this question’s page →139. An RDS policy already sets an idle-session limit of 15 minutes. At expiry, users are disconnected but their applications and profile attachments remain. The requirement is to sign users out when that idle limit is reached. Which additional policy should be enabled?
Clients & user experience
✓ Correct answer
- Enable End session when time limits are reached.
End session when time limits are reached changes the applicable timed-out session behavior from disconnect to end-session. Ending the session signs the user out and closes applications. Option explanations: A. Disable all disconnected-session limits.: Removing disconnected-session limits does not make the existing idle expiry sign the user out. B. Keep the idle limit and change only the client’s window-close behavior.: Client window handling does not change server policy when the idle timer expires. C. Set a longer active-session limit.: An active-session duration limit does not change the specified idle-limit expiry behavior. D. Enable End session when time limits are reached.: This makes reaching the configured time limit end the session instead of merely disconnecting it. Sources: Policy CSP: Terminal Server session time limits — https://learn.microsoft.com/windows/client-management/mdm/policy-csp-admx-terminalserver; Create a scaling plan: configure a time limit policy — https://learn.microsoft.com/azure/virtual-desktop/autoscale-create-assign-scaling-plan#configure-a-time-limit-policy
Open this question’s page →140. Start VM on Connect is enabled on a personal pool. An authorized user’s assigned VM is deallocated, but the configured host-pool managed identity has no power-on permissions. Which role should be assigned at a scope containing that VM?
Clients & user experience
✓ Correct answer
- Desktop Virtualization Power On Contributor
The automation identity needs the documented Power On Contributor role to start existing eligible VMs. User entitlement and session operations are different permission categories. Option explanations: A. Desktop Virtualization Power On Contributor: This is the role specified for the feature’s supported automation identity. B. Virtual Machine User Login: This role concerns Windows VM sign-in where required, not automation power-on. C. Desktop Virtualization Session Host Operator: Session Host Operator supports host-management operations such as drain changes and removal, rather than the documented Start VM on Connect power role. D. Desktop Virtualization User Session Operator: User Session Operator manages sessions and does not supply VM power authorization. Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect; Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac; Assign Azure roles to AVD service principals and managed identities — https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles
Open this question’s page →141. Start VM on Connect is enabled on a pooled host pool and its role assignments are verified. During a connection burst, the first VM starts and reaches its session limit, while additional existing VMs are deallocated. Users temporarily see No resources available. Which documented behavior can explain the delay?
Clients & user experience
✓ Correct answer
- The feature starts at most one additional VM every five minutes after the first host reaches its session limit.
For pooled hosts, Start VM on Connect starts another VM when the first reaches its session limit, with an additional start no more than once every five minutes. A burst can exceed immediately available capacity. Option explanations: A. The feature permanently stops starting VMs after the first host boots.: Further VM starts are supported subject to the documented interval and capacity behavior. B. The feature starts at most one additional VM every five minutes after the first host reaches its session limit.: The documented additional-start interval can temporarily leave a burst of requests without an available session slot. C. The feature creates a new VM for every user and is waiting for those deployments.: Start VM on Connect starts existing VMs; it does not provision one VM per connecting user. D. The feature requires each end user to be Azure subscription Owner.: The verified service permissions, rather than subscription Owner for every user, govern VM start operations. Sources: Configure Start VM on Connect — https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect
Open this question’s page →142. A personal pool uses Automatic assignment. A newly entitled Desktop application-group user has never connected, and an available unassigned host is ready. What should happen on the user’s first successful connection?
Clients & user experience
✓ Correct answer
- An available host is allocated and mapped to that user.
Automatic personal assignment establishes the initial user-to-host mapping on the first connection. The scenario already provides application-group entitlement and an available host. Option explanations: A. Every unassigned host is permanently allocated to that user.: The initial automatic connection allocates one available personal host, not the entire pool. B. The connection converts the pool into pooled multi-session allocation.: Automatic assignment preserves the personal pool model and does not change the host-pool type. C. An available host is allocated and mapped to that user.: This is the documented initial allocation behavior for Automatic personal assignment. D. The user is rejected until an administrator creates a Direct host mapping.: Manual host mapping is required by Direct assignment, not the specified Automatic mode. Sources: Configure personal desktop assignment — https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type; Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Open this question’s page →143. A Direct personal host pool already has multiple-desktop assignment enabled, and one user is mapped to three hosts. After sessions and user data are handled, the administrator wants that user to retain only one VM while preserving Desktop application-group access. What should be done?
Clients & user experience
✓ Correct answer
- Unassign the two extra personal-host mappings and keep the intended mapping.
The multiple-desktop feature cannot be disabled after it is enabled, but individual Direct host mappings can be managed. Removing the extra mappings meets this user-specific requirement. Option explanations: A. Disable the pool’s multiple-desktop assignment flag after it has been enabled.: The enabled pool-level flag cannot be disabled; it is not the supported way to remove individual extra assignments. B. Remove the user’s Desktop application-group entitlement.: This removes resource entitlement and conflicts with the requirement to preserve access. C. Delete the workspace registration for the entire host pool.: Workspace removal affects resource publication and does not selectively preserve one personal-host mapping. D. Unassign the two extra personal-host mappings and keep the intended mapping.: This retains the selected VM and group entitlement while removing the user’s two unwanted VM mappings. Sources: Configure personal desktop assignment — https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type; Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Open this question’s page →144. An Intune app has no dependencies and is already assigned to a device group for an enrolled Windows Enterprise multi-session pool. It uses user installation context and Available intent, and is not deploying. Which two changes make this app configuration compatible with the documented multi-session deployment model?
Applications & delivery
✓ Correct answers
- Set the installation context to System.
- Set the assignment intent to Required.
Multi-session app deployment requires system/device installation context, device targets and Required or Uninstall intent. The device target is already correct in the scenario. Option explanations: A. Retain Available intent and ask each user to install from Company Portal.: Available app deployment is unsupported for this scenario. B. Keep user context and assign it to an additional user group.: Adding user targets does not fix the unsupported context or intent. C. Set the installation context to System.: System context corrects the unsupported user-context installation behavior. D. Set the assignment intent to Required.: Required is a supported deployment intent for the existing device assignment. Sources: Intune: Windows Enterprise multi-session remote desktops — https://learn.microsoft.com/en-us/mem/intune-service/fundamentals/azure-virtual-desktop-multi-session
Open this question’s page →145. A team currently has personal desktops but requests a new AVD resource that exposes only selected application windows through RemoteApp. Which application-group design supports that presentation?
Applications & delivery
✓ Correct answer
- Create a RemoteApp application group associated with an appropriate pooled host pool.
RemoteApp application groups are supported with pooled host pools. A Desktop group’s name or shortcuts do not change its group type or supported pool model. Option explanations: A. Create a RemoteApp application group associated with an appropriate pooled host pool.: This uses the supported pool and group model for selected remote application windows. B. Add application shortcuts to the existing Desktop group and treat it as a RemoteApp group.: Installing shortcuts is not RemoteApp publication through the supported group type. C. Rename the personal pool’s Desktop group to RemoteApp.: Renaming a resource does not change its type or pool compatibility. D. Create a second Desktop application group on the existing personal pool.: A pool has only one Desktop group and the proposed action would still expose a desktop. Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Preferred application group type behavior — https://learn.microsoft.com/azure/virtual-desktop/preferred-application-group-type
Open this question’s page →146. Payroll and recruitment executables are installed on all pooled hosts and published as standard RemoteApps in one application group. Members assigned to that group can discover both. The requirement is separate publication entitlement for the payroll and recruitment populations. What should change?
Applications & delivery
✓ Correct answer
- Place the application sets in separate RemoteApp groups and assign the corresponding populations.
Standard RemoteApp entitlement is assigned at application-group level. Separate groups provide the required assignment boundary between the two application sets. Option explanations: A. Use the host pool’s Preferred application group type to choose an executable per user.: The preference selects Desktop versus RemoteApp presentation for dual-assigned users, not individual executables. B. Place the application sets in separate RemoteApp groups and assign the corresponding populations.: Separate group assignments let each population discover its authorized published application set. C. Create a user assignment directly on each standard executable entry inside the same group.: The standard model does not use an independent per-app user assignment inside one application group. D. Grant the payroll users Desktop Virtualization Contributor.: A management role grants unnecessary privileges and does not implement the intended publication boundary. Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp; Preferred application group type behavior — https://learn.microsoft.com/azure/virtual-desktop/preferred-application-group-type
Open this question’s page →147. A path-based RemoteApp starts from its valid executable on every host but cannot find a configuration file referenced with a relative path. The same user can read the file and the app works when started with its expected local working folder. Which publication setting should be corrected?
Applications & delivery
✓ Correct answer
- The RemoteApp working directory.
The working directory controls where relative file references are resolved. The executable, user access and app behavior in the correct folder are already verified. Option explanations: A. The Windows App organizational account.: The app has already launched as the intended user, so discovery identity is not the reported problem. B. The user’s Azure subscription Owner assignment.: An Azure management role does not supply the missing process working directory. C. The RemoteApp working directory.: Setting the expected working directory addresses the specific relative-path difference. D. The host pool’s preferred application-group type.: Presentation preference does not change relative-path resolution inside a launched application. Sources: Publish applications with RemoteApp — https://learn.microsoft.com/azure/virtual-desktop/publish-applications-stream-remoteapp
Open this question’s page →148. Every user of a shared AVD host already has a qualifying Microsoft 365 license. Administrators will install Microsoft 365 Apps with the Office Deployment Tool. Which two conditions support shared computer activation on the host?
Applications & delivery
✓ Correct answers
- Include SharedComputerLicensing with Value="1" in the deployment configuration.
- Allow reliable outbound connectivity to the Office Licensing Service.
SCA must be configured, and the licensing service must be reachable to obtain and renew each licensed user’s activation token. Option explanations: A. Include SharedComputerLicensing with Value="1" in the deployment configuration.: This property enables shared computer activation during installation. B. Allow reliable outbound connectivity to the Office Licensing Service.: Token acquisition and renewal require licensing-service connectivity. C. Use a single device product key as a replacement for per-user shared activation.: This does not implement the specified per-user shared-computer activation model. D. Activate Office once with the administrator’s account for everyone.: An administrator’s activation does not license other users on the shared host. Sources: Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation; Install Microsoft 365 Apps on a custom image — https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image
Open this question’s page →149. A properly licensed user on a shared AVD host has shared computer activation configured correctly. The host has lost Office Licensing Service connectivity for more than 30 days, the user’s token has expired and Office has entered reduced functionality mode. Which action addresses the activation problem?
Applications & delivery
✓ Correct answer
- Restore licensing-service connectivity so the user can renew the activation token.
Shared computer activation uses a per-user token that is valid for 30 days and must be renewed. Restoring access to the licensing service addresses the stated token-expiry cause. Option explanations: A. Set SharedComputerLicensing to 0 and keep the network block.: Disabling SCA does not renew the user’s expired shared-computer token and abandons the required activation model. B. Reuse the administrator’s activation token for every user.: Tokens are per user; an administrator’s activation is not a shared entitlement for everyone. C. Increase the FSLogix container’s maximum size.: Profile capacity does not restore licensing connectivity or renew the expired token. D. Restore licensing-service connectivity so the user can renew the activation token.: This enables the licensed user’s token to be obtained or renewed through the required service. Sources: Overview of shared computer activation — https://learn.microsoft.com/microsoft-365-apps/licensing-activation/overview-shared-computer-activation
Open this question’s page →150. OneDrive is installed per machine on supported non-persistent AVD hosts with current FSLogix. Users have valid sync configuration and network access, but downloading their entire libraries creates unnecessary profile-storage growth. Which supported feature best reduces local download demand?
Applications & delivery
✓ Correct answer
- Use Files On-Demand so online-only content is hydrated when needed.
Files On-Demand avoids downloading all content immediately while allowing supported files to hydrate when opened. It does not remove the need for correct profile persistence and network access. Option explanations: A. Use Files On-Demand so online-only content is hydrated when needed.: This meets the requirement to reduce unnecessary bulk local content while retaining supported access. B. Move the entire Windows profile into OneDrive instead of using FSLogix.: OneDrive sync is not a substitute for roaming the whole Windows profile. C. Install OneDrive per user in every profile to reduce file hydration.: Changing binary installation scope does not eliminate library downloads and departs from the recommended non-persistent installation model. D. Run an additional OneDrive instance against the same container.: Simultaneous instances against the same FSLogix container are unsupported and do not reduce downloads. Sources: Install Microsoft 365 Apps on a custom image — https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image; Use the OneDrive sync app on virtual desktops — https://learn.microsoft.com/en-us/onedrive/sync-vdi-support; Concurrent or multiple connections to a single container — https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections
Open this question’s page →151. A supported macOS endpoint uses current Windows App from the App Store. New Teams on the AVD host uses WebRTC optimization successfully, but the requirement is to use SlimCore and all other SlimCore prerequisites are met. What should change?
Applications & delivery
✓ Correct answer
- Use the supported non-Store MAU distribution of Windows App.
The non-Store macOS MAU client bundles the plugin required for SlimCore. The App Store distribution remains on the WebRTC path. Option explanations: A. Reinstall the host WebRTC service as the only change.: The fallback service already works and does not change the macOS distribution’s bundled components. B. Use the supported non-Store MAU distribution of Windows App.: This supplies the required client distribution while preserving the supported platform conditions. C. Enable generic microphone redirection again on the host pool.: Microphone permission does not add the client’s missing SlimCore plugin. D. Keep the App Store distribution and increase the VM’s profile-disk size.: Profile capacity does not determine whether the client bundles the SlimCore plugin. Sources: Use Microsoft Teams on Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/teams-on-avd; New Teams VDI optimization and endpoint requirements — https://learn.microsoft.com/en-us/microsoftteams/vdi-2
Open this question’s page →152. A supported browser and the MMR service are installed on AVD hosts. Users can disable the browser MMR extension, and redirected media stops working for those sessions. The organization requires the extension to remain enabled. Which management action fits?
Applications & delivery
✓ Correct answer
- Enforce the extension with supported enterprise browser policy through Intune, GPO or the Edge management service.
Enterprise extension policy controls ongoing installation and enablement. Confirm policy application and the extension’s active status on the relevant browser sessions. Option explanations: A. Change RemoteApp display names to include the extension name.: Publication names cannot enforce settings within the browser. B. Allow unrestricted extension removal and increase host CPU capacity.: More CPU does not meet the requirement to keep the managed extension enabled. C. Enforce the extension with supported enterprise browser policy through Intune, GPO or the Edge management service.: Supported browser policy provides the required administrative control over extension behavior. D. Copy extension files into each user profile once and rely on that copy.: A one-time profile copy does not enforce extension availability or enablement. Sources: Multimedia redirection for video playback and calls — https://learn.microsoft.com/en-us/azure/virtual-desktop/multimedia-redirection
Open this question’s page →153. A team plans App Attach on Entra-joined session hosts with Azure Files. The SMB image share is already in the hosts’ Azure region. Which two additional conditions follow the documented Azure Files procedure for this join model?
Applications & delivery
✓ Correct answers
- Assign Reader and Data Access to both the AVD and AVD ARM Provider service principals on the app storage account.
- Use a storage account in the same subscription as the session-host VMs.
The Entra-joined Azure Files App Attach procedure requires the same VM subscription and the documented access for both AVD service principals. These are not the ordinary user-profile share permissions. Option explanations: A. Assign Reader and Data Access to both the AVD and AVD ARM Provider service principals on the app storage account.: Both service principals require this role under the documented current procedure. B. Use an NFS-only share so the host can bypass SMB image mounting.: App Attach images use an accessible SMB share; an NFS-only share does not meet this requirement. C. Use a storage account in the same subscription as the session-host VMs.: The setup prerequisites explicitly require the storage account and session-host VMs to share a subscription. D. Grant only each end user Storage File Data SMB Share Contributor and treat that as complete app-image access.: User-profile share rights are not a replacement for the documented host/service app-image access path. Sources: App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview; Add and manage App Attach applications — https://learn.microsoft.com/azure/virtual-desktop/app-attach-setup
Open this question’s page →154. An App Attach package was created for a Regional host pool in West Europe. It cannot be assigned to a second West Europe pool whose deployment scope is Geographical. The second pool must remain Geographical. Which change fits the documented scope rules?
Applications & delivery
✓ Correct answer
- Create a separate package for a host pool with the required deployment scope and assign that compatible package.
An App Attach package inherits its host pool’s deployment scope at creation, and that scope cannot be changed. Regional packages cannot be assigned to Geographical pools, even when both pools are in the same Azure region. Option explanations: A. Move the already regional SMB share within West Europe to override the package’s scope.: Share placement does not change the scope stored on an existing package. B. Assign more users to the package to override its deployment scope.: User assignments do not override deployment-scope compatibility. C. Edit the existing package’s deployment scope from Regional to Geographical.: The package’s inherited deployment scope is immutable after creation. D. Create a separate package for a host pool with the required deployment scope and assign that compatible package.: A separately created package with the appropriate inherited scope supplies a compatible assignment resource. Sources: Add and manage App Attach applications — https://learn.microsoft.com/azure/virtual-desktop/app-attach-setup
Open this question’s page →155. An administrator copies only MyApp.cim to the App Attach image share. Package assignment, certificate trust and host SMB access have been verified, but hosts cannot use the image data. What should the administrator do?
Applications & delivery
✓ Correct answer
- Copy the accompanying objectid_ and region_ files with the .cim metadata as a complete image set.
A CIM image includes metadata and accompanying data files. The .cim alone does not contain the complete application image. Option explanations: A. Copy the accompanying objectid_ and region_ files with the .cim metadata as a complete image set.: The accompanying files supply the package data omitted by the copy operation. B. Increase each user’s Profile Container size.: Profile capacity is unrelated to the incomplete application-image distribution. C. Change registration from on-demand to log-on blocking to recreate missing files.: Registration timing cannot manufacture missing image files. D. Rename MyApp.cim to MyApp.vhdx without rebuilding the image.: Renaming a file does not convert its image format or restore missing data. Sources: Create an MSIX image for App Attach — https://learn.microsoft.com/azure/virtual-desktop/app-attach-create-msix-image; App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview
Open this question’s page →156. An administrator is preparing separate App Attach pilots for App-V packages and signed MSIX packages. Which two statements describe valid packaging prerequisites?
Applications & delivery
✓ Correct answers
- Ensure the session hosts trust the valid signing-certificate chain for the MSIX package.
- Store the App-V package itself on a file share accessible to the session hosts; it does not require expansion into a CIM or VHDX image.
App-V packages can use the documented direct-package path on an accessible file share. MSIX packages need the application-image workflow and a signing chain trusted by the session hosts. CIM authoring must respect target Windows compatibility. Option explanations: A. Ensure the session hosts trust the valid signing-certificate chain for the MSIX package.: MSIX packages require valid code signing, and the whole certificate chain must be trusted on the session hosts. Package assignment does not establish certificate trust. B. Every App-V package must first be converted to MSIX with MSIXMGR before it can be attached.: App-V has its own supported App Attach package path. Conversion through MSIXMGR is not a universal prerequisite. C. Always generate a CIM image on a newer Windows version than the target session hosts, regardless of compatibility.: To preserve compatibility, Microsoft says to generate CIM files on a Windows version lower than or equal to the version on which the packages will run. D. Store the App-V package itself on a file share accessible to the session hosts; it does not require expansion into a CIM or VHDX image.: Microsoft permits the App-V package itself on the accessible file share, instead of requiring an expanded MSIX application image. Sources: App Attach in Azure Virtual Desktop — https://learn.microsoft.com/azure/virtual-desktop/app-attach-overview; Create an MSIX image for App Attach — https://learn.microsoft.com/azure/virtual-desktop/app-attach-create-msix-image
Open this question’s page →157. AMA and the associated DCR successfully send guest counters from every host. Investigators cannot query AVD connection/checkpoint events because no AVD resource diagnostics have been configured. What should be added?
Monitoring & autoscale
✓ Correct answer
- Diagnostic settings on the relevant AVD resources with the required categories and Log Analytics destination.
Guest telemetry can be healthy while service diagnostics are absent. Configure the resource diagnostic pipeline and confirm the required service categories arrive. Option explanations: A. Another guest-performance DCR collecting the same CPU counter twice.: Duplicating guest counters does not enable AVD service diagnostics. B. Diagnostic settings on the relevant AVD resources with the required categories and Log Analytics destination.: These settings deliver service events independently of the guest agent pipeline. C. Only an AVD Agent registration token in the Log Analytics workspace.: Registration tokens do not configure diagnostic export destinations. D. Only a Windows event-log subscription inside the build VM.: The build VM is not the source of AVD connection service events. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics
Open this question’s page →158. A replacement batch has AMA installed, but only older hosts send the expected counters. The existing DCR defines the correct counters and destination. What should be checked next?
Monitoring & autoscale
✓ Correct answer
- Whether each new host has an association to the intended DCR.
Replacement automation should apply the guest monitoring configuration to every new VM. The existence of AMA and a DCR is insufficient without the proper association. Option explanations: A. Whether every user has a direct personal-desktop assignment.: User assignment does not control AMA collection on pooled hosts. B. Whether each new host has its own AVD workspace.: AVD workspaces publish application groups and do not apply guest-data rules. C. Whether each new host has an association to the intended DCR.: A rule must be associated with the new VMs to apply its collection configuration. D. Whether the gallery version number contains the word monitoring.: The version label does not configure a DCR association. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Open this question’s page →159. A team has a useful log query showing repeated connection failures. Operators currently notice incidents only when someone opens a workbook. What should be added for automatic notification?
Monitoring & autoscale
✓ Correct answer
- An Azure Monitor log alert with a meaningful condition and an action group.
Use a properly scoped log alert, evaluation window and action group to turn monitored failures into actionable notifications. Option explanations: A. A brighter workbook chart without an alert rule.: A visual formatting change does not notify operators. B. A lower maximum session limit as the notification destination.: An allocation setting is not a notification mechanism. C. A registration token placed in the workbook.: The token is a registration secret and has no alerting purpose. D. An Azure Monitor log alert with a meaningful condition and an action group.: The alert evaluates the query condition and the action group routes the notification. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics; Azure Monitor action groups — https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups
Open this question’s page →160. One user cannot reach the resource feed. Other users connect successfully, and no AVD connection record exists for the failed attempt. What is the best next investigation?
Monitoring & autoscale
✓ Correct answer
- Check the affected client’s account, network/DNS path and identity sign-in evidence before assuming a session-host fault.
Use the failing stage to select evidence. Client reachability and identity logs can reveal failures that never reach AVD service diagnostics. Option explanations: A. Check the affected client’s account, network/DNS path and identity sign-in evidence before assuming a session-host fault.: A failure before reaching the service may produce no AVD connection event; local and identity evidence is needed. B. Conclude that the absence of an AVD log proves the user never attempted access.: Missing service telemetry does not prove that no client attempt occurred. C. Reduce image replica count to improve client feed authentication.: Image replicas support VM deployment and do not diagnose feed connectivity. D. Replace every host because connection records always contain all client-side failures.: Service diagnostics cannot capture every failure that occurs before service reachability. Sources: AVD diagnostics in Log Analytics — https://learn.microsoft.com/en-us/azure/virtual-desktop/diagnostics-log-analytics
Open this question’s page →161. A support team wants a saved Insights view filtered by its host pools and with a custom failure chart. Data already arrives correctly. What should it do?
Monitoring & autoscale
✓ Correct answer
- Save and customize an Azure Monitor Workbook copy, adjusting parameters, queries and visualizations.
Customize the workbook’s presentation and queries when collection is already correct. The view and its telemetry pipelines are separate. Option explanations: A. Edit the image definition publisher field to filter incident charts.: Image metadata does not configure workbook queries or parameters. B. Save and customize an Azure Monitor Workbook copy, adjusting parameters, queries and visualizations.: Insights is workbook based, so customization can adapt the view to operational needs. C. Rebuild all session hosts solely to change chart formatting.: Host replacement is unnecessary when data collection already works and the desired change is in the view. D. Change the AVD workspace friendly name and expect its feed to become a monitoring dashboard.: The AVD workspace is a publication resource, distinct from the monitoring workbook. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Open this question’s page →162. An operator can open a team’s custom Insights workbook. The same parameters return data for an administrator, but the operator’s queries report insufficient access to the underlying logs. What should be corrected?
Monitoring & autoscale
✓ Correct answer
- Grant the appropriate read/query access to the relevant monitoring data scope.
Provide the least-privilege monitoring read access required by the workspace/resource access model. Workbook access and data-query access are distinct. Option explanations: A. Assign the operator as the personal user of every host.: Personal desktop assignment does not authorize monitoring queries. B. Give the operator the pool’s host registration token.: The token does not grant log-query access and should not be distributed for this purpose. C. Grant the appropriate read/query access to the relevant monitoring data scope.: Viewing a workbook alone does not guarantee access to its queried Log Analytics data. D. Delete and recreate the workbook with the same data permissions.: Recreating the view does not fix access to the data it reads. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights
Open this question’s page →163. A pool has increasing memory pressure and paging at 22 users per host. CPU remains moderate. A pilot demonstrated acceptable response at 16 users per host on this VM size. Which capacity response addresses both current overload and future allocation?
Monitoring & autoscale
✓ Correct answer
- Provide ready capacity, use the tested 16-user limit for new allocations, and reduce existing overloaded sessions through agreed user notification and sign-out/relaunch handling.
Protect future allocation with the tested limit, provide available capacity, and coordinate user handling to reduce current overloaded sessions. Existing sessions are not moved or terminated by MaxSessionLimit; use supported session operations with notification. Option explanations: A. Change user feed registration without altering capacity.: Publication does not fix per-host memory pressure. B. Increase MaxSessionLimit to 30 because CPU is below 80%.: CPU alone ignores the observed memory constraint and the measured response limit. C. Disable all monitoring to reduce the number of counters.: Removing evidence does not address memory demand and impairs diagnosis. D. Provide ready capacity, use the tested 16-user limit for new allocations, and reduce existing overloaded sessions through agreed user notification and sign-out/relaunch handling.: Additional capacity and a controlled session-reduction process address current overload; a lower limit alone does not end or migrate the 22 existing sessions. Sources: Azure Virtual Desktop Insights — https://learn.microsoft.com/en-us/azure/virtual-desktop/insights; Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
Open this question’s page →164. Eight identical hosts can each support 20 users. During a rollout, 100 users are concurrent. The team must tolerate one additional failure among hosts still serving users. What is the largest batch that can be taken unavailable at once without adding hosts?
Monitoring & autoscale
✓ Correct answer
- 2 hosts.
The available host count after maintenance and one failure must be at least ceiling(100 ÷ 20) = 5. Therefore 8 − batch − 1 ≥ 5, so batch ≤ 2. Option explanations: A. 2 hosts.: Six remain after maintenance; after one failure, five provide exactly 100 sessions. B. 4 hosts.: Four provide only 80 sessions even before the extra failure. C. 1 host.: It is safe but smaller than the maximum batch allowed by the stated arithmetic. D. 3 hosts.: Five remain, but one failure leaves four and only 80 sessions. Sources: Session host sizing guidelines — https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/session-host-virtual-machine-sizing-guidelines
Open this question’s page →165. A standard pooled environment already has a fixed fleet of provisioned hosts. The requirement is to start and deallocate those existing hosts on a business-hours schedule, without creating or deleting VMs. Which approach matches?
Monitoring & autoscale
✓ Correct answer
- Power-management autoscale with the documented permissions and schedule.
Choose power-management scaling for scheduled power control of an existing fleet. Configure its prerequisites and avoid competing automation. Option explanations: A. Two independent scalers simultaneously controlling the same host states.: Competing controllers can undo each other’s decisions and undermine the requested predictable behavior. B. Power-management autoscale with the documented permissions and schedule.: This method controls the power state of existing hosts. C. Dynamic autoscale solely to power off existing standard hosts.: Dynamic scaling creates/deletes hosts through its supported session host configuration workflow. D. Start VM on Connect alone as a complete shutdown schedule.: Start VM on Connect starts on demand and does not supply the requested scheduled shutdown policy. Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Host pool management approaches — https://learn.microsoft.com/en-us/azure/virtual-desktop/host-pool-management-approaches
Open this question’s page →166. Staff begin signing in at 08:30 local time. Tested hosts need ten minutes from a power-on request to launch readiness. Ramp-up currently begins at 08:30 in the correct time zone. The business requires capacity ready five minutes before sign-ins. When should ramp-up begin at the latest?
Monitoring & autoscale
✓ Correct answer
- 08:15 local time.
Schedule capacity ahead of demand: 08:30 minus five minutes of readiness margin minus ten minutes of measured startup is 08:15. Monitor actual readiness rather than assuming power-on means launch-ready. Option explanations: A. 08:20 local time.: Preparation completes at 08:30, leaving no required five-minute readiness margin. B. 08:25 local time.: Preparation completes at 08:35, after users begin signing in. C. 08:15 local time.: Ten minutes of preparation completes by 08:25, five minutes before the sign-in wave. D. 08:30 local time.: This requests power at the start of demand instead of preparing capacity beforehand. Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan
Open this question’s page →167. An administrator needs one host kept out of autoscale actions during patching, while preserving service for other users. Which actions are appropriate?
Monitoring & autoscale
✓ Correct answers
- Apply the scaling plan’s configured exclusion tag to the maintenance host.
- Check surviving capacity and current sessions, and manage drain/sign-out through the maintenance process.
Coordinate the exclusion with user handling and capacity. The scaler will not manage the tagged host, but the host still affects documented minimum calculations. Option explanations: A. Rely on drain mode alone to delete every disconnected session.: Drain mode does not end existing sessions. B. Apply the scaling plan’s configured exclusion tag to the maintenance host.: The tag prevents autoscale power and drain-mode changes on that host. C. Check surviving capacity and current sessions, and manage drain/sign-out through the maintenance process.: The exclusion does not empty the VM or guarantee capacity for the remaining workload. D. Assume the tagged host is omitted from all minimum-host percentage arithmetic.: Excluded hosts are still considered in the minimum-percentage calculation. Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Drain mode — https://learn.microsoft.com/en-us/azure/virtual-desktop/drain-mode
Open this question’s page →168. During ramp-down, a host has no active users but has disconnected sessions. The policy requires no sessions before deallocation, and forced sign-out is disabled. Why might it stay running?
Monitoring & autoscale
✓ Correct answer
- Disconnected sessions still exist, so the no-sessions condition has not been met.
Read the configured shutdown condition precisely. No active sessions and no sessions are different requirements, and disconnected sessions can keep the latter unmet. Option explanations: A. The host’s image version number dictates deallocation eligibility.: Image version metadata is not the session-state shutdown condition. B. Drain mode automatically forces sign-out but takes exactly one day.: Drain mode does not force sign-out or define such a delay. C. A disconnected session is already signed out and therefore cannot affect shutdown.: Session state persists after disconnect and can affect eligibility. D. Disconnected sessions still exist, so the no-sessions condition has not been met.: Disconnecting does not end a session; the stated policy waits until sessions are gone. Sources: Create a scaling plan — https://learn.microsoft.com/en-us/azure/virtual-desktop/autoscale-create-assign-scaling-plan; Drain mode — https://learn.microsoft.com/en-us/azure/virtual-desktop/drain-mode
Open this question’s page →169. A support operator can message, disconnect and sign out user sessions using Desktop Virtualization User Session Operator. The team now needs the operator to edit RemoteApp publication settings in one existing application group, without assigning users or administering unrelated pools. Which additional built-in role is the best fit at that application-group scope?
Monitoring & autoscale
✓ Correct answer
- Desktop Virtualization Application Group Contributor.
Choose the application-group management role at the required scope. User Session Operator covers session operations; user/group assignment requires separate role-assignment authorization and is outside this scenario. Option explanations: A. Desktop Virtualization Application Group Contributor.: This role manages application-group configuration, including publication, but does not grant user/group role assignment. B. Desktop Virtualization Session Host Operator.: This role manages session-host operations, not the required application-group publication. C. Desktop Virtualization Application Group Reader.: This role can view the group but cannot edit its publication settings. D. Desktop Virtualization User.: This grants use of published resources rather than administrative publication changes. Sources: Built-in Azure RBAC roles for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac
Open this question’s page →170. A standard pooled pool uses external profiles and replaceable hosts. The team wants to deploy a tested monthly image while minimizing disruption. Which actions fit?
Updates & recovery
✓ Correct answers
- Drain old hosts and remove them only after the agreed session handling is complete.
- Create validated replacement hosts from the approved image with sufficient capacity before retiring old hosts.
For replaceable standard pooled hosts, use a controlled image-replacement pipeline with capacity, validation and user handling. Match servicing tools to the OS support matrix. Option explanations: A. Use Azure Update Manager as the supported Windows client multi-session patching method without checking the OS matrix.: The current AVD matrix does not support Azure Update Manager for this client OS. B. Drain old hosts and remove them only after the agreed session handling is complete.: Drain and controlled retirement reduce disruption; drain alone does not end sessions. C. Assume publishing the image silently patches every running host.: Image publication does not update existing VMs. D. Create validated replacement hosts from the approved image with sufficient capacity before retiring old hosts.: This maintains working capacity and tests the new compute before removing the old fleet. Sources: Windows update management methodologies — https://learn.microsoft.com/en-us/azure/virtual-desktop/windows-update-management-methodologies-session-hosts; Host pool management approaches — https://learn.microsoft.com/en-us/azure/virtual-desktop/host-pool-management-approaches
Open this question’s page →171. An administrator configures Scheduled Agent Updates and assumes this also installs the monthly Windows cumulative update and line-of-business app patch. Which statement is correct?
Updates & recovery
✓ Correct answer
- It services AVD infrastructure agents/stack components; OS and app patching need their own supported update process.
Separate AVD component servicing from OS/app servicing and coordinate the schedules with autoscale and host availability. Option explanations: A. It requires all hosts to be deallocated throughout the update window.: Hosts need to be available to receive the updates. B. It services AVD infrastructure agents/stack components; OS and app patching need their own supported update process.: The feature covers the AVD Agent, side-by-side stack and Geneva Monitoring agent. C. It replaces all Windows and application update mechanisms on the VM.: The feature does not provide that scope of servicing. D. It guarantees no critical agent update can happen outside the normal window.: Critical updates and initial installation can occur outside the ordinary noncritical schedule. Sources: Scheduled agent updates — https://learn.microsoft.com/en-us/azure/virtual-desktop/scheduled-agent-updates
Open this question’s page →172. The business permits at most 20 minutes of data loss. A recovery drill restores a usable desktop quickly, but the newest recoverable profile state is 45 minutes old. Which requirement is clearly missed?
Updates & recovery
✓ Correct answer
- The recovery point objective.
RPO concerns recoverable data age. A fast restore cannot compensate for data loss exceeding the RPO. Option explanations: A. The host-pool registration-token lifetime.: Token lifetime is not the business data-loss requirement. B. The recovery time objective solely because the data is 45 minutes old.: RTO measures time to restore service, not the age of recovered data. C. The recovery point objective.: The recoverable state is older than the permitted data-loss window. D. The maximum session limit.: The scenario gives no capacity-allocation failure. Sources: Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
Open this question’s page →173. A recovery drill will use cloned hosts while production users remain active. The proposed test points the cloned hosts to the live read-write profile share. What should be corrected before the drill?
Updates & recovery
✓ Correct answer
- Use an isolated test profile/data copy and controlled test connectivity so the drill cannot write to live user state.
Recovery testing should validate a representative workload against controlled copies and paths. Protect production from conflicting writes while measuring the full recovery procedure. Option explanations: A. Disable test telemetry so no production operator sees the drill.: Monitoring visibility does not prevent live data writes and is needed to assess recovery. B. Use the live profile share and assume a test host cannot modify it.: A host with write permissions can alter live data regardless of its test label. C. Change only the test host names and retain the same live read-write containers.: Different host names do not isolate profile writes. D. Use an isolated test profile/data copy and controlled test connectivity so the drill cannot write to live user state.: Isolation lets the team test restoration without conflicting with production writers. Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr; Disaster recovery concepts — https://learn.microsoft.com/en-us/azure/virtual-desktop/disaster-recovery-concepts
Open this question’s page →174. A company chooses a lower-standing-cost recovery design. The second region does not normally serve users, but tested images, configuration and recoverable data are prepared there. Deployment/startup time is allowed by its RTO. Which architecture is described?
Updates & recovery
✓ Correct answer
- Active-passive with a tested recovery-capacity process.
Active-passive can reduce standing compute cost when startup/deployment and dependency recovery fit the tested RTO. Prepare real capacity, not only image copies. Option explanations: A. Active-passive with a tested recovery-capacity process.: The primary serves users and the recovery region is prepared to take over. B. A local availability-zone design that automatically recovers every regional dependency.: Local failure-domain resilience does not describe the stated second-region process. C. Active-active because an image is replicated in two regions.: Image replication alone does not mean both regions actively serve users. D. No recovery planning is required because the AVD control plane is managed.: Customer hosts, data and dependencies still require recovery design. Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →175. After regional failover, some users are still connected to the original region while others are writing to a recovered profile copy. What should the team do before failback?
Updates & recovery
✓ Correct answer
- Coordinate sign-out or fence old writers, choose/reconcile the authoritative profile state and transfer users under a controlled procedure.
Profile continuity requires coordinated state and writers. A regional host design alone does not guarantee safe profile failover or failback. Option explanations: A. Delete both profile copies to force the users to start fresh.: That discards data rather than reconciling recovery state. B. Coordinate sign-out or fence old writers, choose/reconcile the authoritative profile state and transfer users under a controlled procedure.: Controlled write ownership avoids divergent copies and conflicts during recovery and failback. C. Treat Cloud Cache or replication as a guaranteed historical backup with zero loss.: Asynchronous replication can lose recent changes and is not historical protection. D. Allow both regions to overwrite each other’s profile copies continuously without coordination.: Competing writes can create conflicts or corruption. Sources: Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →176. Personal AVD VMs contain unique machine-local tools. FSLogix profiles are on a remote Azure Files share. The team needs protection for both. Which assets need explicit supported backup coverage?
Updates & recovery
✓ Correct answers
- The personal VMs or their required disks and machine state.
- The remote Azure Files profile share with an appropriate policy and retention.
Inventory protection by asset. Back up persistent machine state and external profiles independently, then test restoration of the complete desktop. Option explanations: A. Only the VM, because its backup automatically captures every connected SMB share.: VM backup does not include the contents of remote file shares merely because they are mounted. B. Only the gallery definition description, because it contains all personal data.: Image metadata does not contain user-specific VM or profile state. C. The personal VMs or their required disks and machine state.: The unique local desktop state needs VM/disk protection appropriate to its supported configuration. D. The remote Azure Files profile share with an appropriate policy and retention.: The remote storage is separate from the VM backup scope. Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview; An overview of Azure VM backup — https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction
Open this question’s page →177. The team can discover silent profile corruption up to 14 days after it occurs. The current backup policy keeps only seven days of healthy recovery points. A recent incident was noticed on day 12. Which policy change addresses the identified gap?
Updates & recovery
✓ Correct answer
- Retain recovery history beyond the possible detection delay with an appropriate safety margin, and test restoring a healthy point.
Set retention for detection and recovery needs as well as backup frequency for RPO. Frequent backups with too-short retention can still leave no healthy historical state. Option explanations: A. Keep seven-day retention but double the current live-share replicas.: Current-state redundancy does not extend historical backup retention. B. Keep seven-day retention but increase the desktop VM session limit.: Session allocation cannot preserve an older healthy profile version. C. Retain recovery history beyond the possible detection delay with an appropriate safety margin, and test restoring a healthy point.: A healthy point must still exist when corruption is detected; retention must cover that delay. D. Take more frequent backups while retaining them all for only seven days.: Higher frequency improves point granularity but does not solve a 12-day detection delay. Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview
Open this question’s page →178. An operator has selected a healthy backup of one user’s FSLogix VHDX. The user has a disconnected session on another host. Which steps should precede replacing the live file?
Updates & recovery
✓ Correct answers
- Preserve the current file and confirm the target user, path and permissions for the restored copy.
- Fully sign out the user and verify that no host still holds the container mounted or open.
Sign-out and detachment are prerequisites. Preserve the current state, restore the right container with its permissions and test a fresh sign-in. Option explanations: A. Preserve the current file and confirm the target user, path and permissions for the restored copy.: A preserved copy and verified identity/path/ACLs protect rollback and correct access. B. Fully sign out the user and verify that no host still holds the container mounted or open.: Disconnection leaves the session alive; replacing a mounted file risks damage or conflicting writes. C. Change every user’s profile path to this user’s restored file.: Each user needs the correct container; sharing one restored personal profile across users is invalid. D. Overwrite the file immediately because disconnected always means detached.: A disconnected FSLogix session may still have its container attached. Sources: Azure Files backup overview — https://learn.microsoft.com/en-us/azure/backup/azure-file-share-backup-overview; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →179. A supported personal desktop VM is restored from backup after corruption. It boots, but the assigned user cannot launch it through AVD. What should be checked next?
Updates & recovery
✓ Correct answer
- Network/DNS and join health, agent registration/health, and the intended personal-host assignment.
Validate the complete restored desktop, including identity, networking, agent state and user assignment. Avoid duplicate active instances with conflicting state. Option explanations: A. Only the gallery publisher string, because it authorizes personal users.: Image metadata does not assign a user to a personal desktop. B. Only the backup job’s completion status, which proves launch readiness.: Completed restoration does not validate user access and service integration. C. Delete remote profiles before checking the restored host.: Destructive profile removal is not a justified response to a launch/integration failure. D. Network/DNS and join health, agent registration/health, and the intended personal-host assignment.: A restored VM must still function in the identity and AVD access/assignment chain. Sources: An overview of Azure VM backup — https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →180. A region loss leaves a retained approved gallery replica available in the recovery region. The team must rebuild the pool and later reproduce the image pipeline. What else should have been protected?
Updates & recovery
✓ Correct answer
- Infrastructure definitions, image build scripts/configuration, app artifacts and publication/assignment configuration.
Gallery replication distributes deployable images. Recovery also needs protected build and infrastructure artifacts plus restored access configuration. Option explanations: A. Infrastructure definitions, image build scripts/configuration, app artifacts and publication/assignment configuration.: These reconstruct the deployment and build process beyond the image disks. B. Only the image definition’s friendly name.: A name cannot recreate VMs, configuration, apps or access relationships. C. A plaintext permanent pool token embedded in every artifact.: Registration tokens expire and are secrets; embedding them is neither durable recovery configuration nor appropriate handling. D. Only a screenshot of the former user feed.: A screenshot is not deployable configuration or reusable build input. Sources: Azure Compute Gallery — https://learn.microsoft.com/en-us/azure/virtual-machines/azure-compute-gallery; Multiregion business continuity — https://learn.microsoft.com/en-us/azure/architecture/example-scenario/azure-virtual-desktop/azure-virtual-desktop-multi-region-bcdr
Open this question’s page →Sources and content
Original owner-authored StudyByteLearn assessment and starter material. Microsoft Learn links are factual references, not a republication of Microsoft documentation. See docs/CONTENT_REVIEW.md for provenance. · Updated 2026-10-19
Includes the maintainer-authored 240-card/160-question assessment pack (revision 1.0.0, review dated 18 October 2026 against the blueprint effective 20 July 2026), imported on 19 October 2026, plus the original 18-card/20-question starter reviewed on 19 October 2026. The maintainer confirmed authorship and the earlier Codex Microsoft Learn review. This import validates structure and preserves source facts; it does not claim a fresh factual review. See docs/CONTENT_REVIEW.md.