AZ-140 Azure Virtual Desktop (AVD)

A tenant represents your organization and houses subscriptions, which provision resources like virtual machines and Office 365 apps in Azure, and you can change the subscription's directory.

Explore Azure resource hierarchy by examining resources, resource groups, subscriptions, and management groups, and learn how policies, access control, governance propagate and precedence rules apply.

Create and manage Azure management groups from the root tenant, move subscriptions to production or nonprofit groups, and configure access controls, policies, and ownership roles.

Azure virtual network provides a cloud-based representation of your network with private and public ip addresses, an address space, and subnets to segment resources and enable internet or on-prem connectivity.

Discover how Azure VM service provides on-demand, scalable compute with usage-based pricing and flexible VM series choices for your workloads, including availability sets and zones for uptime.

Learn to create and configure Azure virtual machines, choose region and image, set up availability sets or availability zones, adjust size, networking, and security settings, and manage virtual machine lifecycle.

Understand Azure disk types, including managed vs unmanaged disks, OS and data disks, and temporary disks, and learn how standard, premium, and ultra SSDs affect Azure Virtual Desktop performance.

Learn to create and manage Azure disks, attach data disks, and resize the operating system disk on an Azure VM, choosing premium or standard options.

Create a network security group in the Azure portal, bind it to a production subnet, and review inbound and outbound rules. Configure default allow within the virtual network, add deny all rules at priority 3000, and create specific allow rules for necessary traffic.

Establish vnet peering to connect virtual networks across subscriptions and regions, with traffic routed over Azure backbone for low latency. Ensure ip ranges do not overlap to enable seamless connectivity.

Explain Azure virtual network routing, including default system routes, user-defined routes, and BGP, and show how to route traffic via firewall, VPN gateways, peering, and service endpoints.

Learn how Azure Active Directory provides cloud-based authentication and identity and access management for services like Office 365 and Azure Virtual Desktop, including cloud, on-premises, and hybrid scenarios.

Learn how to add and verify a custom domain in Azure AD so you can create user names like user@yourdomain.com, not user@tenant.onmicrosoft.com, and sync on-premises users with Azure AD Connect.

Learn to buy a domain and register it in Azure Active Directory, configure DNS for verification, and add the custom domain to enable single identity across on-premises and Azure services.

Learn how Azure AD Connect links on-premises identity to Azure, enabling a unified single identity for access to cloud and on-premises apps, via password hash synchronization, pass-through authentication, or federation.

Configure Azure AD Connect to sync on-prem objects to Azure cloud using pass-through authentication or password hash synchronization, enabling hybrid identity, single sign-on, and on-prem authentication.

Explore how Azure DNS provides default name resolution with internal.cloudapp.net and configure custom DNS to use your own DNS servers for VM name resolution and domain joining.

Explore Azure public dns zone for hosting public dns records. Create a zone, add an a record to the public IP, and delegate to Azure name servers.

Discover how encryption protects data at rest, in transit, and in use in Azure, and how Azure Key Vault stores secrets to support customer managed keys for disks and storage.

Learn to encrypt Azure storage accounts and VM disks with customer managed keys from a Key Vault, create and apply disk encryption sets, and grant Key Vault permissions.

Discover how Azure Firewall premium enables traffic inspection and decryption, intrusion detection and prevention, and URL filtering with web category rules to secure Azure Virtual Desktop deployments.

Learn how Azure VPN gateway enables encrypted traffic between an Azure virtual network and on-premises (and other clouds) using site-to-site, point-to-site, and ExpressRoute for dedicated, high-security connectivity.

Configure a site-to-site VPN between Azure and on-premise by provisioning a VPN gateway and local network gateway, installing routing and remote access on Windows Server, and validating connectivity with ping.

Explore how Azure Bastion service provides secure remote access to virtual machines over SSL without public IPs, including prerequisites, subnet setup, and network rules.

Explore how Azure NAT gateway provides outbound internet access for private VMs without public IPs, enabling scalable access via a single NAT IP.

Explore Azure virtual desktop as a cloud platform as a service that lets you access apps and data from anywhere on any device, with secure multi-session Windows 10/11 and pay-as-you-go.

Highlight Azure Virtual Desktop advantages over other VDI solutions: Office 365 licenses include AVD at no extra cost, Microsoft-managed services, and Windows 10/11 multi-session for scalable, cost-effective access in Azure.

Explain Azure Virtual Desktop architecture, contrasting customer-managed resources (networks, Active Directory, domain services, session hosts, workspace) with Microsoft-managed services (web access, gateway, connection broker, diagnostics) in a PaaS model.

Explain Azure Virtual Desktop licensing entitlements, including eligible Windows, Microsoft 365 licenses, and Windows Server CALs, and outline external user pricing and Azure infrastructure costs for VMs, storage, and networking.

Meet the prerequisites for Azure virtual desktop: an active subscription, identity providers, domain join via domain services, suitable images, a license, plus proper network, DNS, and remote desktop access.

Learn to plan and design an Azure virtual desktop, covering identity and access management, network and connectivity, compute sizing, storage options, and backup and disaster recovery best practices.

Measure latency and roundtrip to the nearest Azure region for a better Azure Virtual Desktop experience, using sites like the latency estimator and Azure speed dot com.

Learn to use the Azure pricing calculator to estimate monthly costs for Azure Virtual Desktop, including single-session 100 desktops, DVfi hardware, storage, and pay-as-you-go versus reserved options.

Explore Azure Virtual Desktop resources, including published desktops and applications, application groups, workspaces, host pools, and session hosts, and how they deliver environments to users over the network.

Learn how Azure Shared Image Gallery centralizes and replicates VM images across regions, using image sources, definitions, and versions to enable rapid disaster recovery for Azure Virtual Desktop.

Explore maximum session limit and how it controls user logins to Azure Virtual Desktop host pools. Compare load balancing methods, breadth-first and depth-first, to evenly distribute connections across multiple VMs.

Assign hybrid, on-premises-synced users to the application group by clicking add, selecting FS Test1 and FS Test2, and then logging in to access the Azure virtual desktop.

Learn to manually add a virtual machine as a session host to an Azure Virtual Desktop host pool using a registration key and deployment agent installation.

Explore Azure Virtual Desktop host pool, application group, and workspace settings, including properties, session behavior, device redirection, access control, diagnostics, and scaling options.

Create an Azure Virtual Desktop with Azure AD join, deploying Azure AD joined virtual machines managed via Intune, and assign access to groups for cloud-only users without on-premise domain controllers.

Explore Azure Virtual Desktop patching and application lifecycle management, featuring SXM patch delivery and re imaging master images to keep VMs up to date.

Explore storage accounts for FSLogix profile containers in Azure Virtual Desktop, comparing Azure Premium File and NetApp file options, and understanding LRS and ZRS data redundancy.

Set up an azure premium file storage account and profile share for FSLogix and MSA X packages, enable soft delete, and join it to active directory for VDI access.

Explore how service endpoints secure access to Azure storage over the backbone network from your VNet, reducing internet exposure, and how private endpoints assign a private IP for low-latency connectivity.

Configure a storage account by enabling a service endpoint for a selected virtual network subnet to restrict access, then explore private endpoints for access via private IP.

Learners configure a storage private endpoint to force traffic through a private IP on a storage account, block public internet access, and set up private DNS for secure access.

Learn to configure FSLogix profile management in Azure Virtual Desktop by creating a GPO, enabling profile containers, and mapping storage for user and office data, including Outlook and SharePoint caches.

Explore FSLogix cloud cache, a disaster recovery solution that caches user profiles locally to enable fast reads and writes during outages across multiple storage locations.

Learn to implement FSLogix Cloud Cache in Azure Virtual Desktop by configuring a GPO with primary and disaster recovery storage, enabling local cache, and validating seamless profile replication.

Learn how First Logic's application masking shows or hides apps by user group, IP address, or network, reducing the need for multiple master images.

Configure Azure backup for a fslogix profile on Azure premium file with a recovery services vault, daily backups, 30-day retention, separate shares, and restore capabilities.

Configure a FSLogix profile disk alert with group policy and a logon script to notify users at 70% usage, using registry to set a 30-second message duration with loopback processing.

Identify common FSlogix user profile issues in Azure Virtual Desktop, review best practices to avoid them, and learn how to configure and resolve FSlogix profiles.

Diagnose FSLogix profile issues on Azure Virtual Desktop by checking event logs, verifying profile mounting via metadata, and clearing file handles, then reboot the VDA to ensure detachment.

Create and enforce Azure conditional access policies to require multi-factor authentication for Azure Virtual Desktop, using conditions like location, device platform, risk, and app scope, with block and test scenarios.

Configure conditional access policies in azure active directory to block access from unmanaged personal devices while allowing hybrid joined corporate devices to access azure virtual desktop and citrix desktops.

Apply azure policy to enforce location-based deployment, achieve organization-wide resource governance, and centrally track compliance and noncompliance by defining rules with scope at subscription, resource group, or management group.

Configure a group policy to enforce session time limits on Azure Virtual Desktop, including idle and disconnected timeouts, and enable timezone redirection to reflect client time.

Learn to configure and test AppLocker in Azure Virtual Desktop by whitelisting and blacklisting applications and scripts on Windows 10.

Onboard Azure virtual desktop session hosts or Citrix VMs to Microsoft Defender for Endpoint using a startup script, and use vulnerability management and attack surface detection to secure the infrastructure.

Explore Defender features to secure Azure Virtual Desktop environments by configuring web content filtering, custom network indicator, tamper protection, and email notification for vulnerability management.

Explore Azure Virtual Desktop monitoring with Insight to view host pool health, sessions, utilization, and connection diagnostics, and troubleshoot round-trip time, Log Analytics, and performance metrics.

Configure Azure virtual desktop alerts by creating action groups and alert rules for virtual machines, storage, and disks, then set memory, cpu, and storage thresholds and test notifications.

Explore the microsoft endpoint management (Intune) portal to manage devices across Windows, Android, iOS, and Mac, covering Windows enrollment, compliance policies, configuration profiles, and PowerShell script deployment.

Enroll Azure virtual desktop multi session VMs into Intune by enabling automatic MDM enrollment and configuring a group policy, then verify enrollment in Azure AD and Intune.

Deploy Office 365 apps to an Azure Virtual Desktop via Intune. Publish Word and Teams, configure 64-bit, current channel, and shared activation for multi-session.

Package and deploy a Win32 app to Azure Virtual Desktop using the Intune content preparation tool and Intune portal, with 64-bit deployment and a manual detection rule.

Create a security dynamic device group in Intune by using a dynamic query that includes devices whose display name starts with a prefix, enabling automatic inclusion for applying compliance policies.

Configure and apply an Intune device configuration profile for Windows multi-session Azure Virtual Desktop to customize the start menu and power options, then verify the profile succeeds.

Explore how Azure Site Recovery protects Azure Virtual Desktop personal host pools by replicating disks to a secondary region, using crash and application consistency snapshots, and performing failover.

Attach MSI apps to Azure Virtual Desktop session hosts using MSIX app attach; decouple apps from the OS and deliver them from a network share, reducing login time.

Create a staging VM, package an application with the MSIX packaging tool, convert to a VHD, and publish it via MSIX app attach in Azure Virtual Desktop.

Configure FSLogix profile for Azure AD joined session hosts with Azure Kerberos, including creating an Azure premium file share and enabling Kerberos ticket access for hybrid users.

Enable watermarking in Azure Virtual Desktop to prevent data capture, display a QR code for session tracking, and use Log Analytics or Azure Virtual Desktop Insight to identify sessions.

Azure virtual desktop custom image templates automate master image customization, installing language packs and apps during image creation and publishing as a managed image or compute gallery.

Demonstrates configuring Azure files with Microsoft Entra ID authentication to support FSLogix profile containers without on-premises domain controllers, using Microsoft Entra Kerberos for seamless VDI access.