Microsoft Certified: Azure Virtual Desktop Specialty (AZ-140)

A is correct.

Explanation: The Azure Virtual Desktop app applies when the user subscribes to Azure Virtual Desktop and authenticates to the Gateway. Selecting both Browser and Mobile apps and desktop clients ensures the policy applies to the web client and all other clients.

B is incorrect: The Windows Cloud Login app applies when the user authenticates to the session host when single sign-on is enabled, not when subscribing to the service.

C is incorrect: Selecting only Browser applies the policy to the web client, but misses the desktop clients.

D is incorrect: You should deselect values for legacy authentication clients when configuring this policy.

D is correct.

Explanation: The Desktop Virtualization User Session Operator role allows sending messages, disconnecting sessions, and using the logoff function to sign users out of a session host, but doesn't allow host pool or session host management.

A is incorrect: The Desktop Virtualization Contributor role allows managing all Azure Virtual Desktop resources.

B is incorrect: The Desktop Virtualization Session Host Operator role allows viewing and removing session hosts, and changing drain mode.

C is incorrect: The Desktop Virtualization User role allows users to use an application on a session host as a non-administrative user.

C is correct.

Explanation: If a user needs local administrator privileges to install apps, you should give them a personal desktop instead of a shared session host to respect security boundaries.

A is incorrect: A pooled host pool with Windows Enterprise multi-session is recommended for users from one organization with standard privileges.

B is incorrect: Granting local administrator privileges in multi-session pooled scenarios is not recommended because users can cross security boundaries for sessions or NTFS data permissions.

D is incorrect: A separate Azure tenant and subscription is recommended when users from different organizations are connecting.

B is correct.

Explanation: Microsoft recommends adding the Microsoft Defender for Endpoint onboarding script to the AVD golden image as a startup script at first boot. This ensures the script runs immediately and prevents multiple objects for the same machine from being created.

A is incorrect: It is not recommended to onboard the actual AVD golden image itself.

C is incorrect: Onboarding with multiple entries for each virtual desktop can lead to confusion when investigating incidents.

D is incorrect: The script should run as early in the startup/provisioning process as possible, not manually after a user signs in.

A is correct.

Explanation: To use a smart card to authenticate to Microsoft Entra ID, you must first configure AD FS for user certificate authentication or configure Microsoft Entra certificate-based authentication.

B is incorrect: Enabling SSO using AD FS skips the session host credential prompt, but does not configure the initial Microsoft Entra ID smart card authentication.

C is incorrect: Installing smart card drivers on the session host is required for in-session smart card authentication, not for authenticating to Microsoft Entra ID.

D is incorrect: Enabling the FIDO2 Security Key is used for passwordless authentication, not for smart card authentication.

A is correct.

Explanation: To configure configuration policies for Windows 10 or Windows 11 Enterprise multi-session VMs, you must use the Settings catalog in the Microsoft Intune admin center.

B is incorrect: The Settings catalog is the supported method for configuring policies for Enterprise multi-session VMs.

C is incorrect: While ADMX-backed policies are supported via the Settings catalog, the existing device configuration profile templates (like Administrative templates) are generally not supported directly for multi-session VMs.

D is incorrect: Existing device configuration profile templates, such as Device restrictions, are not supported for Windows 10 or Windows 11 Enterprise multi-session VMs.

B is correct.

Explanation: Users must be discoverable through Microsoft Entra ID to access Azure Virtual Desktop. You can manage user identities in AD DS and sync them to Microsoft Entra ID using Microsoft Entra Connect.

A is incorrect: User identities that exist only in AD DS aren't supported, including standalone Active Directory deployments with AD FS.

C is incorrect: Azure Virtual Desktop currently doesn't support external identities.

D is incorrect: Azure Virtual Desktop doesn't support signing in to Microsoft Entra ID with one user account and signing in to Windows with a separate user account.

A is correct.

Explanation: Azure Firewall or a network virtual appliance (NVA) firewall can be used to control and restrict outbound traffic from Azure Virtual Desktop session hosts.

B is incorrect: Azure Front Door is a global load balancer and web security service, not used for restricting outbound traffic from session hosts.

C is incorrect: Azure Application Gateway is a web traffic load balancer, not a firewall for restricting outbound session host traffic.

D is incorrect: Azure Bastion provides secure and seamless RDP/SSH connectivity to VMs, but does not control or restrict outbound traffic from the session hosts.

B and D are correct.

Explanation: Features that require you to assign a role to an Azure Virtual Desktop service principal include Autoscale, Start VM on Connect, and App attach (when using Azure Files and your session hosts joined to Microsoft Entra ID).

A is incorrect: Windows Desktop client update notifications are configured via registry settings on the client device, not by assigning an RBAC role to a service principal.

C is incorrect: Web client sign-in relies on Microsoft Entra ID authentication and Conditional Access, not an RBAC role assigned to the Azure Virtual Desktop service principal.

A is correct.

Explanation: You run the New-AzRoleAssignment cmdlet to add a Microsoft Entra user group to an app group and assign the Desktop Virtualization User role.

B is incorrect: Add-AzRoleAssignment is not a valid Azure PowerShell cmdlet for assigning roles.

C is incorrect: Set-AzRoleAssignment is used to modify an existing role assignment, not to create a new one.

D is incorrect: Register-AzRoleAssignment is not a valid Azure PowerShell cmdlet.