Home / cloud-computing / Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) / Cheat Sheet
Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140)

AZ-140 Cheat Sheet

AZ-140 Tests Azure Virtual Desktop Design Trade-offs — Not Generic VM Administration

For administrators running Azure Virtual Desktop in production. Infrastructure planning is 40–45% of the exam, so think in users, sessions, cost targets and sign-in storms rather than single virtual machines.

Check Your Readiness →
Among the harder certs
Avg: Not published by Microsoft
Pass: 750 / 1000
Most candidates understand Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) concepts — and still fail. This exam tests how you apply knowledge under pressure.

AZ-140 Domain Map (skills measured as of 20 July 2026)

Questions open with a business scenario: user count, workload profile, network rule or cost target. Several options work technically, and the right one satisfies every stated constraint. Expect configuration detail such as registry values, RDP properties and exact role names. 100 minutes; question count not published.

  1. 01
    Plan and implement an AVD infrastructure (40–45%) — networking, FSLogix storage, host pool type and load balancing, session host images
  2. 02
    Plan and implement identity and security (15–20%) — join type, Desktop Virtualization roles, Conditional Access, Defender and host hardening
  3. 03
    Plan and implement user environments and apps (20–25%) — FSLogix containers, RDP properties, Windows App, App attach and RemoteApp groups
  4. 04
    Monitor and maintain an AVD infrastructure (10–15%) — Insights, scaling plans, image-based patching, backup and disaster recovery

Wrong instinct vs correct approach

Session hosts in two regions must use Trusted Launch, with a freshly patched image built every month
✕ Wrong instinct

Capture a managed image from a reference VM each month

✓ Correct approach

Use Azure VM Image Builder, through custom image templates, to build on a schedule and publish versions to an Azure Compute Gallery replicated to both regions. Trusted Launch needs a gallery image definition; managed images do not support it.

Help desk staff must message users and sign them out without changing host pools or VMs
✕ Wrong instinct

Grant Desktop Virtualization Contributor on the host pool

✓ Correct approach

Assign Desktop Virtualization User Session Operator. It allows sending messages, disconnecting and signing out sessions with no rights over host pool settings or session host VMs, which is the least-privilege fit being tested.

Profiles live on one Azure Files share, and users must keep signing in if that share fails
✕ Wrong instinct

Enable Azure Backup on the share and restore after an outage

✓ Correct approach

Configure FSLogix Cloud Cache with CCDLocations listing both shares, one in another region. Writes go to every location, so sign-in continues from the surviving share. Backup recovers data afterwards but does not keep sessions working during the outage.

The Insights workbook shows connection data but no CPU or memory counters from session hosts
✕ Wrong instinct

Reinstall the Azure Virtual Desktop agent on every host

✓ Correct approach

Diagnostic settings on host pools and workspaces only feed service data. Host counters need the Azure Monitor Agent plus a data collection rule associated with the session hosts, using the counter set Azure Virtual Desktop Insights expects.

Users on pooled hosts complain only about Teams call quality
✕ Wrong instinct

Move the session hosts to GPU-enabled VM sizes

✓ Correct approach

Teams media optimisation offloads audio and video to the client device through the WebRTC Redirector Service on the host. Multimedia redirection is the separate fix for browser video sites; GPU sizes do not change the calling path.

Know these cold

  • ▸ Reverse connect — osts need outbound service URLs only; never open inbound 3389
  • ▸ Host pool type, pooled or personal, is fixed at creation and cannot be changed
  • ▸ Registration token validity runs one hour to 27 days; expired token means generate a new one
  • ▸ Drain mode blocks new sessions; existing sessions continue until users sign out
  • ▸ Private Link sub-resources — lobal for discovery, feed for the workspace feed, connection for sessions
  • ▸ FSLogix storage — iles Standard cheapest, Files Premium for production, NetApp Files needs a delegated subnet
  • ▸ Profile Container roams the whole profile; ODFC holds Office data only; masking hides, never blocks
  • ▸ Per-user access pricing covers external commercial users only, never your own employees
  • ▸ Conditional Access must target both Azure Virtual Desktop and Windows Cloud Login when SSO is on
  • ▸ Pooled hosts — rotect images and FSLogix storage; Site Recovery suits personal desktops

Can you answer these without checking your notes?

In this scenario: "Session hosts in two regions must use Trusted Launch, with a freshly patched image built every month" — what should you do first?
Use Azure VM Image Builder, through custom image templates, to build on a schedule and publish versions to an Azure Compute Gallery replicated to both regions. Trusted Launch needs a gallery image definition; managed images do not support it.
In this scenario: "Help desk staff must message users and sign them out without changing host pools or VMs" — what should you do first?
Assign Desktop Virtualization User Session Operator. It allows sending messages, disconnecting and signing out sessions with no rights over host pool settings or session host VMs, which is the least-privilege fit being tested.
In this scenario: "Profiles live on one Azure Files share, and users must keep signing in if that share fails" — what should you do first?
Configure FSLogix Cloud Cache with CCDLocations listing both shares, one in another region. Writes go to every location, so sign-in continues from the surviving share. Backup recovers data afterwards but does not keep sessions working during the outage.

Common Exam Mistakes — What candidates get wrong

Opening inbound RDP to fix session host connectivity

Azure Virtual Desktop uses reverse connect: session hosts open outbound connections to the service, so inbound 3389 is never required. Connection failures point to blocked outbound URLs; build NSG and firewall rules with the WindowsVirtualDesktop service tag rather than hard-coded IP lists.

Picking breadth-first load balancing when the scenario says minimise cost

Breadth-first spreads users across every running host for best per-user performance. Depth-first fills one host to its max session limit before using the next, so fewer VMs run and a scaling plan can deallocate the rest. Pooled or personal cannot be changed after creation.

Forgetting Virtual Machine User Login on Microsoft Entra joined hosts

Desktop Virtualization User on the application group puts the desktop in the user's feed, but Entra joined session hosts also check a VM sign-in role. Without Virtual Machine User Login, sign-in fails however many application group assignments you add.

Moving FSLogix to Cloud Cache while leaving VHDLocations configured

Cloud Cache reads its storage providers from CCDLocations, writes to every listed location and keeps a local cache, so it adds resilience across shares or regions. It increases local disk use rather than saving storage, and VHDLocations should not stay set alongside it.

Enabling Start VM on Connect or scaling plans without the service principal role

The Azure Virtual Desktop service principal, not the users, needs Desktop Virtualization Power On Contributor for Start VM on Connect and Power On Off Contributor for scaling plans, at subscription or resource group scope. Without it, hosts never start or stop.

Resources to help you pass Azure Virtual Desktop AZ-140 on your first attempt

Check whether your host pool, FSLogix and scaling decisions hold up against AZ-140 scenarios.