Azure AZ-140 study plan
Azure AZ-140 · Give each week a clear focus.
8 weeks · About 7 hours per week
Plan and implement an Azure Virtual Desktop infrastructure
Compare pooled versus personal host pools and depth-first versus breadth-first load balancing, then write a one-paragraph justification for each deployment scenario you sketch
Deploy a pooled host pool with two session hosts from a custom image and register both hosts to a workspace and desktop application group
Diagram how host pool, application group, workspace, and session host objects relate, labeling which object carries which configuration
Configure an FSLogix profile container on Azure Files and verify a test user's profile persists across two different session hosts
Your checkpoint
A working host pool with at least two registered session hosts, a named workspace and desktop application group, and a one-page object-relationship diagram; profile roaming proven by a written two-host test result.
Plan and implement an Azure Virtual Desktop infrastructure
Create a scaling plan with ramp-up, peak, and off-peak schedules and assign it to the host pool
Set RDP properties on the host pool (device redirection, clipboard, drive mapping) to a defined security posture and record each choice
Design the network layout for the deployment, deciding between public and private endpoints and whether RDP Shortpath applies
Apply a new custom image to the host pool through a versioned image and confirm existing session hosts rebuild cleanly
Your checkpoint
A documented scaling plan with the schedule table it enforces, a table of every RDP property you set and why, a network diagram with subnet and endpoint choices marked, and proof of one successful image update cycle.
Plan and implement user environments and apps
Select a user profile strategy (FSLogix container, cloud cache, or user profile disks) for three stated scenarios and justify each pick
Package a line-of-business app as an MSIX or App Attach package and attach it to a host pool
Publish a RemoteApp through a new application group and assign access to a test security group
Configure Microsoft Teams optimization and Outlook caching mode settings on a session host and verify the resulting behavior
Your checkpoint
An attached app package and a published RemoteApp both launching successfully for a non-admin test user, plus a written profile-strategy decision table covering all three scenarios.
Plan and implement user environments and apps & Plan and implement identity and security
Configure OneDrive Known Folder Move and FSLogix container sizing so profile storage does not grow unbounded
Set up Universal Print or printer redirection for a session host and confirm the queue is reachable from a session
Map each AVD administrative task to the least-privilege built-in role that permits it
Take a timed, full-length practice assessment and log every missed objective by domain
Your checkpoint
A working OneDrive plus FSLogix configuration for a test user, a role-to-task mapping table covering at least eight tasks, and a scored practice assessment with a remediation list sorted by domain.
Plan and implement identity and security
Choose between AD DS, Microsoft Entra Domain Services, and Microsoft Entra join for two given scenarios and document the identity flow end to end
Deploy session hosts using Microsoft Entra join and enable single sign-on for the client
Write Conditional Access policies that require multifactor authentication and block legacy authentication for the AVD app
Configure Azure role assignments and scoped RBAC so a helpdesk group can drain hosts but not modify the host pool
Your checkpoint
A signed-in Entra-joined session host where SSO works without a second credential prompt, plus exported Conditional Access policy definitions and an RBAC assignment table with scope for each group.
Plan and implement identity and security & Monitor and maintain an Azure Virtual Desktop infrastructure
Harden session host connectivity with NSG rules and Azure Firewall policy that permit only required AVD endpoints
Enforce device compliance through Intune and require compliant or hybrid-joined devices for AVD access
Enable Azure Monitor for AVD and confirm session host inventory and connection diagnostics land in the Log Analytics workspace
Build one alert rule on a session host performance counter and trigger it deliberately
Your checkpoint
A policy and network hardening sheet listing every required endpoint and rule, evidence of the AVD insights workbook showing both session hosts, and one alert that fired in a controlled test.
Monitor and maintain an Azure Virtual Desktop infrastructure
Query connection and host performance data with Kusto so you can answer which users disconnected unexpectedly last week
Configure a host pool update strategy and script a staged image rollout with a rollback point
Design backup and recovery for FSLogix profile containers and test restoring one user's profile
Automate routine maintenance (host drain, start-on-connect checks, disk cleanup) with an Azure Automation runbook
Your checkpoint
Three saved Kusto queries with their output, a written update and rollback runbook, and a restored profile container verified by a successful sign-in.
Monitor and maintain an Azure Virtual Desktop infrastructure & Plan and implement an Azure Virtual Desktop infrastructure & Plan and implement identity and security & Plan and implement user environments and apps
Re-review every objective flagged in your week-four remediation list and close each gap with a hands-on check
Rebuild a minimal end-to-end environment from scratch in under two hours without notes
Take two timed full-length practice assessments and compare domain-level scores for improvement
Write a one-page cheat sheet of the ten configuration values you most often mix up
Your checkpoint
Two practice assessment scores at or above 80 percent with the second equal to or higher than the first, a completed remediation list showing every item closed, and a finished one-page cheat sheet.
Milestones
Week 2: Host pool deploys, scales on schedule, and survives one full image update without orphaned session hosts.
Week 4: A published RemoteApp and an attached app package both work for a test user, and your first full practice assessment is scored and broken down by domain.
Week 6: Entra-joined SSO, Conditional Access, scoped RBAC, and AVD insights are all verified live, with no unresolved identity gaps.
Week 8: Two practice assessments at or above 80 percent, a closed remediation list, and one clean end-to-end rebuild completed without notes.