A spoke's default 0.0.0.0/0 route sends all egress through Azure Firewall. AVD endpoint rules are allowed, but brokered sessions drop during firewall scale-in. Which route change matches current AVD firewall guidance while keeping other egress controlled?

✓ Correct answer

• Add a more specific WindowsVirtualDesktop service-tag route with next hop Internet.

The recommended service-tag route sends broker/gateway traffic directly and avoids the documented scale-in disconnection path. The default route can continue to send remaining egress through the firewall. Option explanations: A. Add an NSG allow without changing the current traffic path.: An allow rule does not change the route causing the scale-in dependency. B. Expose public TCP 3389 on every session host.: Public administrative RDP is not the fix for broker/gateway egress disruption. C. Enable TLS interception for AVD service traffic.: AVD service traffic must not be TLS-inspected or terminated. D. Add a more specific WindowsVirtualDesktop service-tag route with next hop Internet.: The more specific route implements the documented direct broker/gateway path. Sources: Use Azure Firewall to protect Azure Virtual Desktop deployments — https://learn.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop

Read the source reference