AZ-140 · Domain 1 of 4

AZ-140 Domain 1: Plan and implement an Azure Virtual Desktop infrastructure

The heaviest AZ-140 domain: design networking and storage for Azure Virtual Desktop, choose host pool types, operating systems and licensing, deploy session hosts by portal or code, and build and version golden images.

Exam weight
40–45%
Official functional groups
5
Estimated questions estimate
19–23
Suggested study time estimate
30–38 hrs

About 15 min read Reviewed October 2026

Overview

Plan and implement an Azure Virtual Desktop infrastructure has five functional groups. Networking covers capacity and latency planning, session host network design, RDP Shortpath, RDP Multipath, QoS, Private Link and connectivity troubleshooting. Storage covers where FSLogix containers live: storage accounts, Azure Files shares and Azure NetApp Files. Host pool planning covers resource organization, operating system choice, licensing and sizing, while implementation covers portal and scripted deployment plus session host settings. Images cover manual builds, Azure VM Image Builder, updates and Azure Compute Gallery.

At 40–45%, this domain can account for nearly half of your score, so it deserves the largest share of study time. Questions are design-heavy: you are given user counts, workloads, network constraints or compliance requirements and must pick the host pool type, VM size, storage tier or image process that fits. Expect several of the exam's longer case-study items to draw on this material.

How it's tested

Domain 1 questions usually open with a business scenario: a number of users, a workload profile, a network constraint or a cost target. You then choose a design element such as pooled or personal hosts, breadth-first or depth-first balancing, Premium Azure Files or Azure NetApp Files, or an image pipeline. Several answers will work technically; pick the one that satisfies every stated constraint.

  • Size and shape the host pool

    Given user types and concurrency, you choose pool type, load balancing, max session limit and VM series that fit performance and cost.

  • Fix the connection path

    A latency, firewall or private-access requirement is described, and you pick RDP Shortpath, required URL access, QoS or Private Link sub-resources.

  • Choose the image workflow

    An update or compliance need is described, and you select Azure VM Image Builder, Compute Gallery versioning, or a manual Sysprep capture.

Reasoning it through

A company has 400 task workers who sign in at 8 a.m. and needs the lowest compute cost. Personal desktops would waste capacity, so a pooled host pool fits. Breadth-first spreads early users across every running host, while depth-first fills one host before starting the next, letting autoscale keep fewer VMs running. Because cost is the stated priority, depth-first with a sensible max session limit is the stronger answer.

Functional groups 5

Official functional groups from the Microsoft outline, in outline order.

1.1 Plan, implement, and manage networking for Azure Virtual DesktopBandwidth and latency, session host network design, RDP Shortpath and Multipath, QoS, Private Link, troubleshooting.
What it means
This group covers assessing capacity and speed needs, designing the virtual network for session hosts, implementing RDP Shortpath, RDP Multipath and QoS policies, deploying Azure Private Link for Azure Virtual Desktop, and monitoring and troubleshooting connectivity.
What to understand
Session hosts use reverse connect, so they need outbound HTTPS to the service URLs but no inbound ports from the internet. RDP Shortpath adds a UDP transport, either directly on managed networks or through STUN and TURN on public networks; RDP Multipath lets the client keep and switch between several network paths. Private Link uses private endpoints with the global, feed and connection sub-resources. Session hosts also need line of sight to domain controllers and the FSLogix storage endpoint.
How it shows up
Expect to pick the transport, the private endpoint sub-resource, or the missing network rule that explains a failed connection.
Common confusion
Assuming session hosts need inbound RDP 3389 open to users; reverse connect makes that unnecessary and risky.
1.2 Plan and implement storage for Azure Virtual Desktop user dataStorage planning, FSLogix storage, storage accounts, file shares and Azure NetApp Files.
What it means
This group covers planning storage for profile and Office containers, creating storage accounts and file shares, joining Azure Files to an identity source for SMB access, setting share and NTFS permissions, and implementing Azure NetApp Files volumes for larger deployments.
What to understand
Azure Files Premium (SSD) suits most production FSLogix workloads, while Standard is cheaper but slower under sign-in storms. Azure NetApp Files offers very low latency and high throughput at scale, delegated to a dedicated subnet. Azure Files needs identity-based authentication through AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos, plus share-level RBAC roles such as Storage File Data SMB Share Contributor and matching NTFS permissions.
How it shows up
Scenarios give user counts, IOPS or latency needs and identity type, then ask which storage service, tier or permission setup to use.
Common confusion
Granting only the share-level RBAC role and forgetting NTFS permissions, or the reverse, leaves profiles failing to mount.
1.3 Plan host pools and session hostsResource organization, operating system, licensing model, host pool architecture, performance and capacity design.
What it means
This group covers recommending resource groups, subscriptions and management groups, choosing a session host operating system, selecting a licensing model, planning host pool architecture, and designing for performance and VM capacity requirements.
What to understand
Pooled host pools share multi-session hosts and use breadth-first or depth-first load balancing; personal host pools give each user a dedicated VM with automatic or direct assignment. Windows 11 Enterprise multi-session is the usual pooled OS, and Windows Server needs RDS CALs. Sizing starts from workload type, with more users per vCPU for light work and GPU-enabled NV-series VMs for graphics. Eligible Microsoft 365 or Windows Enterprise licenses cover internal users, while per-user access pricing covers external commercial users.
How it shows up
You must match a described workforce and budget to pool type, OS, VM family and licensing option.
Common confusion
Thinking per-user access pricing covers employees; it is for external users, while internal staff use eligible Microsoft 365 or Windows licenses.
1.4 Implement host pools and session hostsPortal and scripted deployment, host pool and session host settings, session host licensing.
What it means
This group covers creating host pools and session hosts in the Azure portal, automating the same work with PowerShell, Azure CLI, ARM templates and Bicep, configuring host pool and session host properties, and applying licensing for Windows client and Windows Server hosts.
What to understand
Session hosts join a host pool by installing the agent with a registration token, which can be valid from one hour to 27 days. The Az.DesktopVirtualization PowerShell module and the Azure CLI desktopvirtualization extension expose the same objects as the portal. Host pool settings include load balancing, max session limit, validation environment and RDP properties; session host settings include drain mode. Windows client hosts use the Windows_Client license type to apply existing user eligibility.
How it shows up
Questions ask which tool, parameter or setting completes a deployment or stops new sessions landing on a host.
Common confusion
Deleting a session host to stop new connections when drain mode (allow new sessions off) is the intended control.
1.5 Create and manage session host imagesManual images, Azure VM Image Builder, image changes, lifecycle, updates, custom image hosts and Azure Compute Gallery.
What it means
This group covers building an image manually, automating builds with Azure VM Image Builder, modifying an image, planning image lifecycle, applying OS and application updates, deploying session hosts from a custom image, and storing images in Azure Compute Gallery.
What to understand
A manual image is built on a VM, generalized with Sysprep and captured; after capture that VM cannot be reused. Azure VM Image Builder, also surfaced as custom image templates in the Azure Virtual Desktop portal, scripts the build and customizations. Azure Compute Gallery holds image definitions and numbered versions, replicates them to other regions, and supports Trusted Launch, which managed images do not. Lifecycle planning means versioning, testing in a validation pool, and retiring old versions.
How it shows up
Expect to choose between a manual capture, Image Builder, and Compute Gallery features such as replication or versioning.
Common confusion
Using a managed image for Trusted Launch session hosts; Trusted Launch requires a Compute Gallery image.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Reverse connect

    Session hosts open outbound connections to the Azure Virtual Desktop service.

    Remember
    No inbound internet ports are needed on session hosts.
    Tested as
    Network and security design items.
    Trap
    Opening inbound 3389 to fix a connection problem.

  • RDP Shortpath

    A UDP-based transport between client and session host.

    Remember
    Managed networks use direct UDP; public networks use STUN or TURN.
    Tested as
    Latency and quality scenarios.
    Trap
    Assuming it replaces the TCP reverse connect channel entirely.

  • Private Link sub-resources

    Private endpoints named global, feed and connection.

    Remember
    The global endpoint handles initial feed discovery for all workspaces.
    Tested as
    Private access designs.
    Trap
    Creating only the connection endpoint and expecting feed access.

  • Pooled vs personal host pool

    Shared multi-session hosts versus one VM per user.

    Remember
    The host pool type cannot be changed after creation.
    Tested as
    Core design questions.
    Trap
    Choosing personal for cost savings.

  • Breadth-first vs depth-first

    Spread sessions across hosts or fill one host first.

    Remember
    Depth-first pairs well with autoscale cost goals.
    Tested as
    Load-balancing items.
    Trap
    Picking breadth-first when cost is the priority.

  • Registration token

    Key used by the agent to join a VM to a host pool.

    Remember
    Validity ranges from one hour to 27 days.
    Tested as
    Deployment and troubleshooting items.
    Trap
    Reusing an expired token and blaming the network.

  • Drain mode

    Session host setting that blocks new sessions.

    Remember
    Existing sessions keep running until users sign out.
    Tested as
    Maintenance scenarios.
    Trap
    Confusing it with putting the VM into a stopped state.

  • Windows 11 Enterprise multi-session

    Client OS that allows many concurrent users per VM.

    Remember
    Available only on Azure Virtual Desktop and related Microsoft platforms.
    Tested as
    OS selection items.
    Trap
    Choosing Windows Server and forgetting RDS CAL requirements.

  • Per-user access pricing

    Monthly charge to stream to external commercial users.

    Remember
    Applies to users outside your organization.
    Tested as
    Licensing scenarios.
    Trap
    Applying it to employees who already hold Microsoft 365 E3.

  • Azure Files Premium

    SSD-backed file shares for FSLogix containers.

    Remember
    Needs identity-based SMB auth plus share and NTFS permissions.
    Tested as
    Storage design items.
    Trap
    Using Standard tier for heavy sign-in storms.

  • Azure NetApp Files

    Enterprise NAS service with very low latency.

    Remember
    Requires a delegated subnet and a capacity pool.
    Tested as
    Large-scale storage scenarios.
    Trap
    Forgetting the delegated subnet.

  • Azure Compute Gallery

    Stores image definitions and versions with regional replication.

    Remember
    Required for Trusted Launch images and scale-out.
    Tested as
    Image management items.
    Trap
    Treating managed images as equivalent.

  • Azure VM Image Builder

    Managed service that builds images from templates.

    Remember
    Powers custom image templates in the AVD portal.
    Tested as
    Automation scenarios.
    Trap
    Assuming it replaces the gallery for storage.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Host pool and load-balancing choices

ConceptMeaningKey differenceCommon trap
Pooled, breadth-first Spreads new sessions evenly across available hosts. Best per-user performance at higher running cost. Selected when cost is the stated goal.
Pooled, depth-first Fills one host to its max session limit before the next. Fewer hosts need to run, so autoscale saves more. Used with an unrealistic max session limit.
Personal, automatic assignment First available VM is assigned when a user connects. Simple, no admin step per user. Assumed to let admins pick the exact VM.
Personal, direct assignment Admin assigns a specific VM to a specific user. Gives control over which user gets which VM. Forgotten when a user must keep a known machine.

FSLogix storage options

ConceptMeaningKey differenceCommon trap
Azure Files Standard HDD-backed SMB shares billed on usage. Lowest cost, lower IOPS. Chosen for large production pools with sign-in storms.
Azure Files Premium SSD-backed provisioned shares. Consistent performance for most production FSLogix use. Missing identity-based auth configuration.
Azure NetApp Files Managed NetApp volumes in a delegated subnet. Highest performance and scale, higher entry cost. Proposed for a small pilot where cost matters.

Image build methods

ConceptMeaningKey differenceCommon trap
Manual capture Customize a VM, run Sysprep, capture. Quick for one-off builds, hard to repeat. Reusing the source VM after generalization.
Azure VM Image Builder Template-driven automated build. Repeatable and scriptable for patch cycles. Thinking it stores and replicates the image itself.
Azure Compute Gallery Versioned image storage with replication. Distribution and lifecycle, not building. Picking it when the question asks how to build.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Inbound port fix

    What candidates pick
    Open TCP 3389 on the NSG for users.
    Why it looks right
    RDP has traditionally needed that port.
    Why it's wrong
    Azure Virtual Desktop uses reverse connect; session hosts only need outbound access to service endpoints.

    Clue to watch for Look for mentions of the required URL list or outbound rules.

  2. Wrong load-balancing method

    What candidates pick
    Breadth-first for a cost-focused pool.
    Why it looks right
    It gives each user the most resources.
    Why it's wrong
    When cost is the priority, depth-first lets fewer hosts run and pairs with autoscale.

    Clue to watch for Words such as minimize cost or fewest running VMs.

  3. Expired registration token

    What candidates pick
    Redeploy the VM or rebuild networking.
    Why it looks right
    Agent registration failures look like connectivity problems.
    Why it's wrong
    A new token must be generated and supplied to the agent; the network may be fine.

    Clue to watch for Session host shows unavailable right after deployment days later.

  4. Licensing mix-up

    What candidates pick
    Per-user access pricing for employees.
    Why it looks right
    It sounds like the general AVD license.
    Why it's wrong
    Per-user access pricing is for external commercial users; employees use eligible Microsoft 365 or Windows licenses.

    Clue to watch for The users are customers or partners, not staff.

  5. Managed image for Trusted Launch

    What candidates pick
    Capture to a managed image and deploy.
    Why it looks right
    Managed images are the older familiar path.
    Why it's wrong
    Trusted Launch and Generation 2 security features require an Azure Compute Gallery image definition.

    Clue to watch for Requirement mentions Secure Boot or vTPM.

  6. Single Private Link endpoint

    What candidates pick
    Only the connection sub-resource.
    Why it looks right
    It sounds like the one that carries sessions.
    Why it's wrong
    Feed download and discovery also need the feed and global sub-resources to stay private.

    Clue to watch for Requirement says all traffic, including workspace discovery, stays private.

Answer framework

Use these steps to work through an Azure Virtual Desktop infrastructure design question.

  1. Identify the users: internal or external, task, knowledge or power workers, and whether they need a persistent machine or can share a multi-session host.
  2. Pick the host pool type and load-balancing method, then set a max session limit that matches the workload and the cost priority stated.
  3. Choose the operating system, VM family and licensing route, checking for GPU needs, Windows Server CAL needs and external-user pricing.
  4. Plan network and storage together: outbound service access, RDP Shortpath or Private Link where required, and a FSLogix storage tier sized for sign-in peaks.
  5. Decide how images are built and distributed, preferring automated builds and Compute Gallery versions replicated to every region that hosts session hosts.

Practice question

A company will deploy Azure Virtual Desktop session hosts in two Azure regions. Hosts must use Trusted Launch, and a new image version must be built automatically every month with the latest updates. Which combination should the administrator implement?

Want more like this? The AZ-140 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the biggest block of your study plan, roughly a third of total hours. Start with the architecture: workspaces, application groups, host pools and session hosts, and how reverse connect ties them to the Azure Virtual Desktop service. Then build a pooled host pool in a lab subscription through the portal, add a second host with PowerShell or a Bicep file, and practice draining and removing hosts.

Next, set up a Premium Azure Files share joined to your identity source and point FSLogix at it so you see the permissions model first hand. Build an image with a custom image template, publish it to Azure Compute Gallery, and deploy a host from that version. Finish with networking: read the required URL list, enable RDP Shortpath, and review how Private Link sub-resources map to feed discovery and connections. Close each session by writing a one-line rule for every design choice, such as when depth-first beats breadth-first, then test those rules against timed practice questions.

FAQ

How much of AZ-140 is Plan and implement an Azure Virtual Desktop infrastructure?

Microsoft weights this domain at 40–45% of the exam, the largest of the four. On a typical form that could mean roughly 19 to 23 questions, though Microsoft does not publish per-domain counts.

Do I need to know PowerShell and Bicep syntax?

You should recognize the main cmdlets and resource types, such as creating host pools and registration tokens, and know what a template parameter controls. Writing long scripts from memory is less important than knowing which tool fits.

Is Windows 10 still a valid session host OS?

Windows 10 reached end of support in October 2025, so new designs should use Windows 11 Enterprise multi-session or single-session. Older scenarios may still mention Windows 10, so read the requirement carefully.

When should I choose Azure NetApp Files over Azure Files?

Choose it when the scenario stresses very large user counts, strict latency or throughput targets, or existing NetApp skills. For most small and mid-size pools, Azure Files Premium meets FSLogix needs at lower cost.

Do session hosts need public IP addresses?

No. Session hosts connect outbound to the service, and users reach them through the Azure Virtual Desktop gateway, so public IPs and inbound RDP rules are not required.

What does RDP Multipath add to RDP Shortpath?

RDP Multipath lets the client keep several candidate network paths and switch to the healthiest one, which improves session reliability. Shortpath provides the UDP transport; Multipath adds path resilience on top of it.

Does this domain cover the Azure Virtual Desktop classic model?

No. AZ-140 targets the Azure Resource Manager based service. The classic model was scheduled for retirement on 30 September 2026, so focus on current portal, PowerShell and template workflows.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

Try timed AZ-140 questions on host pools, FSLogix storage, RDP Shortpath and image pipelines, the largest scoring area on the exam.

Take the AZ-140 practice test Check your AZ-140 readiness

Keep going