Azure AZ-140 cheat sheet

Pooled host pools use breadth-first (even spread) or depth-first (fill to the max session limit) load balancing; personal host pools use automatic or direct assignment instead.

Session host count = ceil(concurrent users / max session limit) plus spare capacity for maintenance windows and host failures.

Depth-first balancing requires a Max session limit value to decide when a host is full; breadth-first also respects that limit once a host reaches it.

Session hosts connect outbound over TCP 443 to the AVD service (reverse connect); no inbound ports or public IP addresses are required for user sessions.

RDP Shortpath for managed networks uses direct UDP 3390; RDP Shortpath for public networks relays TURN over UDP 3478 and needs a public IP or NAT on the session host.

The registration key is entered during agent installation and can be regenerated at any time; regeneration only affects new registrations, existing hosts stay registered.

Flagging a host pool as a validation environment delivers AVD service and agent updates to that pool first, ahead of production pools.

Autoscale scaling plans are composed of ramp-up, peak, ramp-down, and off-peak phases, each with a capacity threshold and a minimum percentage of running hosts.

Spread session hosts across availability zones or an availability set, and avoid burstable B-series sizes for production multi-session workloads.

Join options are AD DS domain join, Microsoft Entra Domain Services domain join, or Microsoft Entra ID join; Entra ID join is supported for pooled host pools.

Single sign-on requires Microsoft Entra ID authentication plus hosts joined to Entra ID, Entra Domain Services, or AD DS with hybrid identity synchronized.

Conditional Access for AVD targets the Azure Virtual Desktop cloud application; MFA, compliant-device, and sign-in risk policies only take effect with Entra ID authentication.

Assign users the Desktop Virtualization User role on the application group or workspace; that role grants session access only, never local administrator rights.

MFA is configured in Conditional Access or satisfied by AD FS claims; it is not a host pool setting.

Screen capture protection and watermarking are enabled through host pool RDP properties and require supported Windows client and host versions.

Azure Files backing FSLogix authenticates with AD DS Kerberos or Microsoft Entra ID Kerberos; disable SMB guest access and scope share permissions to required identities.

Harden session hosts with Trusted launch (Secure Boot plus vTPM), encryption at host, and Defender for Endpoint; keep RDP closed to the internet and rely on reverse connect.

FSLogix profile container captures the entire user profile in a per-user VHDX; the ODFC container captures only Office data (Outlook OST, Teams, OneDrive, SharePoint) and can be combined with it.

FSLogix requires an SMB 3.0 share; Azure Files Premium or Azure NetApp Files is recommended for IOPS, configured through the VHDLocations registry value or GPO.

The default FSLogix VHDX size is 30,000 MB and the file expands dynamically but does not shrink automatically, so size for profile growth up front.

Microsoft 365 Apps on multi-session hosts require Shared Computer Activation (SharedComputerLicensing=1); user-based or device-based activation alone fails.

Teams media optimization requires the Teams WebRTC Redirector service on the host and a per-machine Teams install; otherwise media falls back to server-side processing.

A user can be assigned to only one Desktop application group per host pool but can be assigned to multiple RemoteApp application groups in that same pool.

MSIX App Attach lifecycle is stage, register per user, unregister at sign-out, then destage; images may be stored on an SMB share.

Host pool RDP properties control redirection: drivestoredirect, redirectclipboard, redirectprinters, audiocapturemode, usbdevicestoredirect, and multimonitor settings.

Universal Print removes the need for a print server, while classic printer redirection remains available through the redirectprinters RDP property.

Diagnostic settings on the host pool, workspace, and application group route data to Log Analytics; key tables are WVDConnections, WVDErrors, WVDCheckpoints, WVDAgentHealthStatus, and WVDHostRegistrations.

AVD Insights uses Azure Monitor Agent with a data collection rule for performance counters in addition to the WVD diagnostic tables.

Drain mode blocks new sessions on a host while existing sessions continue; enable it before patching, reimaging, or decommissioning.

Grant the AVD service principal Desktop Virtualization Power On Off Contributor for autoscale and Desktop Virtualization Power On Contributor for Start VM on Connect.

Hosts stuck in Unavailable usually appear in WVDAgentHealthStatus and are fixed by reinstalling the agent with a freshly generated registration key.

Alert on WVDErrors for connection failures and on session host availability, attaching an Azure Monitor action group for notification.

Use Azure Update Manager for guest OS patching; image-level changes require patching the Azure Compute Gallery image and redeploying or reimaging hosts.

A scaling plan capacity threshold (for example 60 percent) is the utilization level at which autoscale starts additional hosts; below it hosts are drained and stopped.

Personal host pools depend on Start VM on Connect so users can power on deallocated hosts themselves.