An AD-backed host denies a user's RDS logon. The user belongs to Remote Desktop Users, and a local allow right is present. An effective domain GPO assigns the user's security group Deny log on through Remote Desktop Services. What is the correct remediation?

✓ Correct answer

• Correct the applicable domain deny-right policy for the approved users, then verify effective policy.

An applicable Windows deny right wins over an allow and is not overridden by Azure RBAC. Correct the authoritative domain policy deliberately and confirm the resulting effective rights. Option explanations: A. Disable MFA for all AVD users.: The failure is caused by a Windows user right, not the stated MFA configuration. B. Add Desktop Virtualization Contributor to override the Windows deny.: Azure resource management permissions cannot override a Windows logon deny right. C. Correct the applicable domain deny-right policy for the approved users, then verify effective policy.: Changing the applicable deny assignment addresses the cause while preserving controlled Windows rights. D. Repeat the local allow-right edit after each restart.: The effective domain deny remains authoritative, so repeated local allows do not solve the cause. Sources: Troubleshoot access denied and user not authorized issues in Remote Desktop Services — https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshooting-access-denied-and-user-not-authorized-rds-issues; Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations

Read the source reference