FSLogix Application Masking for AVD Pooled Host Pools

AZ-140 Last updated

Plan and implement FSLogix

Short answer

A Use FSLogix application masking to hide installed apps from unauthorized groups in a full desktop session.

Question

You have an Azure Virtual Desktop deployment that contains a pooled host pool named Pool1. Pool1 contains five session hosts. You plan to deploy two apps named App1 and App2. The solution must meet the following requirements: • All the session hosts must contain both apps. • All users must connect to a full desktop session. • Only users in the sales department must be able to use App1. • Only users in the research department must be able to use App2. You need to ensure that the users in each department can see only their assigned app when they connect to Pool1. What should you use?

  1. FSLogix application masking Correct Answer
  2. MSIX app attach
  3. RemoteApp application groups
  4. RemoteApp streaming

Key Takeaways

The question tests the ability to restrict application visibility within a full desktop AVD session, where the common trap is choosing RemoteApp which only provides remote apps, not a full desktop.

FSLogix application masking controls application visibility based on user group membership within a full desktop session. This page establishes that FSLogix application masking is the correct solution for hiding specific installed apps from unauthorized users in an Azure Virtual Desktop pooled host pool.

Common mistake: Choosing RemoteApp application groups because it restricts app access, but it violates the requirement for users to connect to a full desktop session.

Expert Analysis

Why the Answer Is Correct

FSLogix application masking dynamically hides or shows installed applications based on the user's Active Directory group membership. In this scenario, both App1 and App2 are installed on all session hosts, but application masking rules ensure that only the sales department sees App1 and only the research department sees App2. This perfectly satisfies the requirement to provide a full desktop session while restricting application visibility.

Why the Other Options Are Wrong

RemoteApp application groups and RemoteApp streaming are incorrect because they publish individual applications rather than a full desktop session, directly violating a stated requirement. MSIX app attach is used to deliver applications dynamically to session hosts without installing them permanently, but it does not provide the granular, group-based visibility restriction needed to hide installed apps within a full desktop.

Community Comment Notes

The community unanimously agrees that FSLogix application masking is required here because the users must connect to a full desktop session. As Bonesurfer noted, "RemoteApp application groups are typically used to publish specific applications directly to users rather than providing a full desktop session." Joelpincol also pointed out that "They are using full desktop - Should be A (FSLogix masking)".

Official Reference

https://learn.microsoft.com/en-us/fslogix/concepts-application-masking

Exam Strategy

When a question specifies users must connect to a full desktop session while having restricted app visibility, eliminate RemoteApp options immediately. Look for FSLogix application masking as the mechanism that filters installed apps by group policy within that desktop.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 6

  1. Bonesurfer 👍 4
    A Using FSLogix application masking allows specific applications to be visible to only authorized users. In this scenario, it enables App1 to be visible only to the sales department and App2 to only the research department. RemoteApp application groups are typically used to publish specific applications directly to users rather than providing a full desktop session. However, the requirements in your scenario specify that all users must connect to a full desktop session while only seeing their department-specific apps
  2. jeff1988 👍 3 Answered A
    A. FSLogix application masking FSLogix application masking allows you to control which applications are visible to users based on group membership. This way, you can install both App1 and App2 on all session hosts, but only users in the sales department will see App1, and only users in the research department will see App2. This approach meets all your requirements and minimizes administrative effort.
  3. 697231c 👍 1 Answered A
    FSLogix Application masking Another discrepancy with the answer that Exam Topics is saying is the correct one. There are a lot of discrepancies on these questions. Is Exam Topics going to correct these errors, or at least provide a justification for why their provided answer is different?
  4. Joelpincol 👍 1 Answered A
    They are using full desktop - Should be A (FSLogix masking), to control which applications are visible to the specific users/groups
  5. dan1111 👍 1 Answered A
    FSLogix Application masking, because they musst use a full desktop session
Show 1 more comment
  1. Moot2 👍 1 Answered A
    Application masking!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Storage Accounts Can Host FSLogix Profile Containers?

S-Grade

First Step for AVD Reauthentication in New Subscription

S-Grade

Does the Owner Role Let Admin1 Assign Scaling1 to Pool1?

S-Grade

Practice All AZ-140 Questions

Access 64 questions with complete answers and detailed explanations.

View Full AZ-140 Practice Test →

← Back to AZ-140 Study Guide