AZ-140 — frequently asked questions

Access groups grant permission but do not provide the necessary license for authentication and billing under per-user pricing.

No, Microsoft 365 F3 licenses allow guest users to access AVD resources without needing Azure AD Premium P1 or P2.

The feed sub-resource privately connects an Azure Virtual Desktop workspace so clients can reach the feed privately. For a host pool such as Pool1, the connection sub-resource is the one that carries session traffic.

Yes. The subscription must have the Microsoft.DesktopVirtualization resource provider registered so the private endpoint and its DNS/approval flow can be created for the host pool.

Option B applies to Azure Arc-enabled servers or Azure Local session hosts. A standard Windows Server VM added to an AVD host pool needs the AVD agent and a host pool registration token.

New-AzWvdHostPool creates a new host pool, but Pool1 already exists. Adding Server2 requires registering it as a session host, not provisioning another host pool.

Storage4 is a StorageV2 account in West US, while Pool1 is in East US. FSLogix Profile and Office Containers are latency-sensitive and should use Azure Files in the same region as the session hosts.

No. BlobBlockStorage supports only blob storage, not SMB file shares, and FSLogix Profile/Office Containers require an SMB Azure Files share.

That role manages host pools and scaling plans, but lacks Microsoft.Authorization/roleAssignments/write, which the autoscale flow needs to grant the AVD service principal rights over the session host VMs.

Yes. User Access Administrator includes roleAssignments/write at subscription scope, so it can perform the role assignment that assigning Scaling1 to Pool1 requires, just like Owner.

User Access Administrator only manages role assignments; assigning a scaling plan is a Microsoft.DesktopVirtualization operation allowed by Desktop Virtualization Contributor, already held by Admin1.

Yes. Desktop Virtualization Contributor at subscription scope includes Microsoft.DesktopVirtualization actions, so Admin1 can already assign Scaling1 to Pool1.

FSLogix profiles are VHDX files mounted over SMB, and page blobs and block blobs do not expose an SMB file share, so they cannot host profile containers.

Yes. Microsoft lists standard file shares as valid for light workloads, while premium file shares are recommended for medium, heavy and power workloads.

FSLogix applies per-user settings through a SID-keyed registry subkey on the session host; a pre-Windows 2000 or UPN logon name can change and is not the mapping key.

Yes. Because the SID stays constant even when the UPN or SAM logon name is edited, FSLogix continues to match the per-user settings to the same account.

"Set time limit for disconnected sessions" ends the session once the limit expires, which signs the user out. Adding "End session when time limits are reached" ensures termination instead of a lingering disconnected session.

It works and meets the goal, but local policy must be applied to each session host and is lost on reimage. Domain GPO or Intune is preferable for fleets, though that does not change the answer here.

Conditional Access only evaluates sign-in conditions such as MFA and device compliance; it does not provide the RDP/SSH channel to session hosts that portal-based administration requires.

No. Bastion connects over private IPs through the Azure portal, so session hosts can stay private with no public IPs and no inbound RDP/SSH ports open.

Rule sets match on traditional Active Directory SIDs. A cloud-only member exists only in Microsoft Entra ID, so it has no on-premises AD SID for App Masking to evaluate, even though it is a valid member account.

No. A guest identity is represented by its home-tenant object rather than a local on-premises AD SID, so application rule sets cannot resolve it on your Entra joined session hosts.

While some legacy tools may allow it, Azure primarily supports Generation 2 VMs for upload. However, this specific exam question focuses on disk conversion actions (A and C) as the primary solution.

VHDX is supported by Azure, but the question options force a choice between VHD and other formats. Converting to VHD is a valid path, whereas keeping it as VHDX might require additional steps not listed.

The service principal requires permissions to manage the power state and resources of session host VMs, which the Owner role provides at the subscription level.

Admin1 has this role, but the question focuses on enabling the service principal's capabilities for autoscaling, which requires additional permissions.

The Windows 10 multi-session image already includes the FSLogix agent; the administrator still must configure the profile container path and settings.

No. FSLogix uses SMB with contoso.com authentication plus share and NTFS permissions, so a SAS key or shared-key change is unrelated.

Azure’s upload path accepts VHD, not VHDX; a VHDX must be converted to a fixed-size VHD first, so it is not the best disk to select.

Fixed-size VHDs give predictable performance and match Azure’s supported image format, avoiding conversion and resizing work before deployment.

SourceVM1 is not generalized, so it still contains machine-specific identity and user-specific data; Sysprep /generalize must remove those before it can be used as an AVD image source.

No. Deallocation only stops compute billing; it does not run Sysprep, so the operating system remains specialized and cannot be used as an AVD session host image source.

It is SSD-backed and supported, but it requires managing NetApp accounts, capacity pools and volumes and costs more, failing the minimize-cost and minimize-effort requirements.

No. FSLogix profile containers require an SMB share such as Azure Files or Azure NetApp Files; blob storage is not a supported profile container target, even in a premium SSD tier.

Because App1 is a RemoteApp running on session hosts, the managed identity belongs to the Azure VM/session host that runs the app, not to the AVD application group or workspace.

In the host pool's RDP properties under device redirection settings; all session hosts in Pool1 inherit that configuration.

Clipboard redirection controls copy/paste data flow only; it does not block a user from capturing the session screen with screenshot tools.

Yes; an Intune policy ultimately configures a local Group Policy object on the session host, so the setting still lands on Host1 and Host2.

FSLogix profile access depends on an AD DS-backed identity or supported Entra Kerberos hybrid identity; a cloud-only Entra account lacks the AD DS SID that profile share permissions require.

No. With supported Azure Files Entra Kerberos and a hybrid synced identity such as User1, FSLogix profile access can work on an Entra-joined session host.