Azure AZ-140 key terms

A collection of one or more Azure Virtual Desktop session hosts that users connect to. It defines the type (pooled or personal), the load-balancing method, the maximum session limit, and the application groups that reference it.

A virtual machine running a supported Windows client or server operating system, joined to a host pool, that runs user sessions. It runs the AVD agent and the agent boot loader to accept brokered connections.

A logical grouping of RemoteApp programs or a single full desktop that users can access. Every application group belongs to exactly one host pool and is published to users through a workspace.

The user-facing container that groups one or more application groups so end users see a single set of desktops and apps in the web client, Windows App, or Remote Desktop client.

A time-limited shared secret that authorizes a session host to join a host pool. You supply it during the AVD agent installation or when generating a deployment token for the pool.

A host pool where multiple users share the same session hosts. It supports breadth-first or depth-first load balancing and can run Windows multi-session editions to reduce cost.

A host pool in which each user is permanently assigned to a dedicated session host, preserving their session and desktop state across reconnects. Automatic assignment can hand out hosts on first connection.

Custom RDP settings such as drive redirection, clipboard, and multi-monitor that are stored on the host pool and pushed to clients at connection time by the brokering service rather than through Group Policy.

A feature that establishes a direct UDP transport between the client and session host, bypassing the AVD gateways. It cuts latency and improves throughput, and can use public or private networks.

An autoscale configuration that starts and stops session hosts using a ramp-up, peak, ramp-down, and off-peak schedule plus per-host-pool capacity thresholds, reducing compute cost during idle hours.

A host pool setting that lets the service power on a stopped, deallocated session host when a user connects, so personal desktops can stay off while nobody is using them.

A repository for storing and versioning custom virtual machine images, including hardened golden images with the AVD agent preinstalled, that can be shared across subscriptions and used to deploy session hosts.

Registering session hosts directly with Microsoft Entra ID without an on-premises domain. Users sign in with Entra ID credentials, and FSLogix can use Entra Kerberos authentication to reach Azure Files.

Joining session hosts to both on-premises Active Directory and Microsoft Entra ID, which enables Entra-based Conditional Access and Intune management while keeping traditional domain authentication and Group Policy.

A managed domain service that provides domain join, LDAP, and Kerberos without you deploying domain controllers, commonly used to domain-join AVD session hosts in cloud-only deployments.

The traditional on-premises or IaaS-hosted directory used to domain-join session hosts and authenticate users. It is required when Group Policy and Kerberos-integrated legacy applications must be supported.

A Microsoft Entra ID policy engine that grants or blocks access to AVD based on user, device, location, and risk signals, and enforces requirements such as MFA or compliant devices.

Requiring two or more verification factors at sign-in. For AVD it is enforced through Conditional Access, and the host pool can be configured to re-prompt for MFA inside an active session.

Purpose-built Azure RBAC roles such as Desktop Virtualization Contributor, Host Pool Contributor, Application Group Contributor, Workspace Contributor, and Session Host Configuration Operator, used to scope who can manage AVD objects.

Connecting a host pool or workspace to your virtual network through a private endpoint so user connections and feed discovery travel over the Microsoft backbone instead of the public internet.

Endpoint detection and response software that can be onboarded to session hosts to detect malware and attacks; AVD supports automated onboarding and on-demand quick or full antivirus scans.

A set of virtual machine security features-Secure Boot, virtual TPM, and boot integrity monitoring-that help protect session hosts from bootkits and rootkits and can be enabled on generation-2 VMs.

A host pool RDP property that blocks screen capture tools from capturing content in the remote session, helping prevent sensitive data leaking through screenshots or screen sharing.

A per-user virtual hard disk that stores the whole user profile and is attached at sign-in, giving pooled and multi-session users a consistent profile across session hosts without roaming profile limitations.

An FSLogix feature that writes profile data to multiple target locations at once so users keep working if one storage location fails, at the cost of extra write traffic.

Delivering MSIX-packaged applications to session hosts by attaching a virtual disk at sign-in, so apps are not installed in the base image and can be assigned per user or group.

An application published from a host pool so it appears in the user's local Start menu or client as if installed locally, while actually running inside the remote session.

SMB or Kerberos-authenticated cloud file shares often used to host FSLogix profile containers; they need Microsoft Entra Kerberos or AD DS authentication plus correct share and NTFS permissions.

A high-performance, low-latency Azure file service that supports SMB volumes for FSLogix profiles, often chosen for large user counts or input/output-heavy profile workloads.

A Windows 10 or Windows 11 Enterprise multi-session edition that lets many users share one session host, the most cost-efficient option for pooled task-worker scenarios.

The Azure data store where AVD diagnostic logs, performance counters, and connection events are collected and queried; it underpins insights workbooks, custom reports, and log-based alerts.

Per-host-pool or per-workspace configuration that sends AVD logs and metrics-such as checkpoints, errors, connections, and host registration events-to a Log Analytics workspace, storage account, or event hub.

A workbook-based monitoring solution built on Azure Monitor that surfaces connection reliability, host performance, and utilization trends for host pools without writing your own queries.

Kusto Query Language, used in Log Analytics and Azure Monitor to filter, summarize, and join AVD tables such as WVDConnections and WVDCheckpoints when building custom reports and alert queries.

An Azure Monitor rule that evaluates a log query, metric, or activity log event against a threshold and fires an action group, for example notifying admins when a session host heartbeat stops.

The periodic signal a session host sends to the AVD service to show it is healthy and available; a missing heartbeat means the host cannot accept connections and is a key troubleshooting signal.

A session host setting that stops new sessions from being created on that host while letting existing users finish their work, typically enabled before patching or maintenance.

A service for assessing and deploying operating system updates to session hosts on a schedule using maintenance configurations, so images and hosts stay patched without manual effort.