How to Enable AVD Screen Capture Protection

AZ-140 Last updated

Plan and implement security

Short answer

B Configure a local Group Policy setting on each session host to enable screen capture protection.

Question

You have an Azure Virtual Desktop deployment that contains a host pool named Pool1. Pool1 contains 10 session hosts. You need to enable screen capture protection on all the session hosts in Pool1. The solution must minimize administrative effort. What should you do?

  1. From RDP Properties for Pool1, configure the Session behavior settings.
  2. On each session host, configure a local Group Policy setting. Correct Answer
  3. To each session host, add an extension.
  4. From RDP Properties for Pool1, configure the Display settings.

Key Takeaways

Screen capture protection is an OS-level feature that must be enabled via Group Policy or Intune, testing the knowledge that it cannot be configured via host pool RDP properties.

Enabling screen capture protection in Azure Virtual Desktop requires configuring an OS-level Group Policy or Intune setting, not an RDP property. This page confirms that configuring the Group Policy setting on the session hosts is the correct approach.

Common mistake: Choosing RDP Properties (Options A or D) because many other AVD features are configured at the host pool level, but screen capture protection is enforced on the session host OS.

Expert Analysis

Why the Answer Is Correct

Screen capture protection prevents unauthorized screenshot captures of an AVD session, but it is enforced at the operating system level of the session host, not at the connection broker level. According to Microsoft documentation, this feature must be enabled using Group Policy (local or domain) or Microsoft Intune. Option B correctly identifies Group Policy as the mechanism to apply this configuration to the session hosts.

Why the Other Options Are Wrong

Options A and D suggest configuring RDP Properties for the host pool, but screen capture protection is not an RDP property and cannot be managed from the host pool configuration. Option C suggests adding a virtual machine extension, but Microsoft does not provide a VM extension for enabling screen capture protection. Therefore, these options do not apply the required security feature.

Community Comment Notes

Commenters correctly pointed out that Microsoft's official documentation explicitly requires Group Policy or Intune for this feature. As hwoccurrence noted, "this feature is not configured at the host pool level or via RDP properties" and must be enabled "on the OS itself". Another user provided the direct Microsoft Learn link confirming the Group Policy method.

Official Reference

https://learn.microsoft.com/en-us/azure/virtual-desktop/screen-capture-protection

Exam Strategy

Remember that AVD security features like screen capture protection and watermarking are enforced on the session host OS via Group Policy or Intune, not through host pool RDP properties. If an OS-level policy is required, eliminate any RDP property or extension options.

Community Votes

B
75%
C
25%

75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 6

  1. Korro 👍 3 Answered B
    I think answer B is correct as the microsoft learn article states to use either Microsoft Intune or Group Policy. Nothing mentioned from extentions there. https://learn.microsoft.com/en-us/azure/virtual-desktop/screen-capture-protection?tabs=group-policy
  2. jeff1988 👍 2 Answered C
    To enable screen capture protection on all the session hosts in Pool1 while minimizing administrative effort, you should: C. To each session host, add an extension. Adding the appropriate Azure VM extension to each session host is the most efficient way to enable screen capture protection across all hosts. This method ensures that the protection is applied consistently and automatically without the need for manual configuration on each host.
  3. hwoccurrence 👍 1 Answered B
    According to Microsoft’s Screen Capture Protection documentation for Azure Virtual Desktop, this feature is not configured at the host pool level or via RDP properties. Instead, you must enable it on the OS itself—either via Group Policy (local or domain) or by using Intune policy if your session hosts are Azure AD‐joined. There is also no official “extension” for enabling screen capture protection.
  4. Moot2 👍 1 Answered B
    B Intune or group policy setting https://learn.microsoft.com/en-us/azure/virtual-desktop/screen-capture-protection?tabs=intune
  5. lusis987 👍 1 Answered D
    Minimize effort: D. From RDP Properties for Pool1, configure the Display settings.
Show 1 more comment
  1. sKostas 👍 1 Answered B
    It is a group policy setting and it doesn't require an extension

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Storage Accounts Can Host FSLogix Profile Containers?

S-Grade

First Step for AVD Reauthentication in New Subscription

S-Grade

Does the Owner Role Let Admin1 Assign Scaling1 to Pool1?

S-Grade

Practice All AZ-140 Questions

Access 64 questions with complete answers and detailed explanations.

View Full AZ-140 Practice Test →

← Back to AZ-140 Study Guide