One engineer must install and test privileged drivers as part of the job. Other users share pooled multi-session hosts and must remain protected from that engineer's administrative changes. Which host design best fits?

✓ Correct answer

• Give the engineer a dedicated VM in a personal host pool.

A dedicated personal VM isolates the engineer's administrative control from other users' Windows sessions. Shared profile folders and directory join choices do not neutralize local administrator power on a shared instance. Option explanations: A. Grant the engineer local administrator rights on the shared host and rely on separate profile folders.: A local administrator can affect other users despite ordinary profile-folder permissions. B. Grant Virtual Machine Administrator Login across every pooled VM and leave all users on the same hosts.: This broadens administrative access while retaining the shared-host risk. C. Move all users to Entra Domain Services so local administrative actions cannot affect other sessions.: Managed-domain join does not prevent local administrators from affecting other sessions on the same VM. D. Give the engineer a dedicated VM in a personal host pool.: A dedicated personal VM provides the recommended separation for a user who needs administrator rights. Sources: Security recommendations for Azure Virtual Desktop — https://learn.microsoft.com/en-us/azure/virtual-desktop/security-recommendations

Read the source reference