AZ-140 · Domain 2 of 4

AZ-140 Domain 2: Plan and implement identity and security

Choose how session hosts and users authenticate, apply least-privilege Azure RBAC and Conditional Access, and harden session hosts with Microsoft Defender, network controls, App Control for Business and Trusted Launch.

Exam weight
15–20%
Official functional groups
2
Estimated questions estimate
7–10
Suggested study time estimate
12–16 hrs

About 12 min read Reviewed October 2026

Overview

Plan and implement identity and security has two functional groups with seven skills each. Identity integration covers choosing between AD DS, Microsoft Entra ID and Microsoft Entra Domain Services, preparing session hosts for that choice, Azure RBAC for Azure Virtual Desktop objects, Conditional Access, passwordless, smart card and multifactor sign-in, local rights on hosts, and Microsoft Entra single sign-on.

The security group covers Microsoft Defender for Cloud, Defender Antivirus and Defender for Endpoint on session hosts, network protection with UDRs, NSGs and Azure Firewall, administrative access through Azure Bastion or just-in-time access, Windows threat protection such as App Control for Business and Controlled Folder Access, and confidential VMs or Trusted Launch. At 15–20%, expect questions that hinge on a single role name, policy target or join type.

How it's tested

Identity and security items in AZ-140 are usually short and specific. A scenario names the directory setup, the device type or a compliance rule, and you choose the join type, role, Conditional Access target, RDP property or Defender feature. Distractors are often real features that solve a neighbouring problem, so match the answer to the exact symptom described.

  • Pick the identity scenario

    Given cloud-only, hybrid or legacy directory details, you choose AD DS, Microsoft Entra join or Microsoft Entra Domain Services for session hosts.

  • Name the right role

    A delegation or access need is described, and you select the built-in Azure Virtual Desktop or VM sign-in role at the correct scope.

  • Harden the host

    A threat or compliance requirement is stated, and you choose Defender for Endpoint, App Control, NSG rules, Bastion or Trusted Launch.

Reasoning it through

Users are assigned to a desktop application group on Microsoft Entra joined session hosts, yet sign-in to the desktop fails. Desktop Virtualization User lets them see and launch the resource, but signing in to an Entra joined VM also requires Virtual Machine User Login or Virtual Machine Administrator Login. Assigning Virtual Machine User Login on the resource group holding the hosts fixes access without granting administrator rights.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

2.1 Plan and implement identity integrationIdentity scenarios, session host requirements, Azure RBAC, Conditional Access, authentication methods, local rights and single sign-on.
What it means
This group covers selecting AD DS, Microsoft Entra ID or Microsoft Entra Domain Services, configuring session hosts for that scenario, assigning Azure RBAC roles, building Conditional Access policies, enabling passwordless, smart card and MFA sign-in, managing local groups and rights on hosts, and configuring Microsoft Entra single sign-on.
What to understand
Hybrid identities synced with Microsoft Entra Connect let hosts join AD DS or Microsoft Entra Domain Services, while Microsoft Entra joined hosts also accept cloud-only users. Desktop Virtualization User grants access to application groups; Entra joined hosts also need Virtual Machine User Login. Conditional Access for connections targets the Azure Virtual Desktop app, and with single sign-on the Windows Cloud Login app too. Single sign-on is enabled with an RDP property and supports passwordless methods such as Windows Hello for Business and FIDO2 keys.
How it shows up
Expect to choose a join type, role assignment, Conditional Access target app or RDP property from a short scenario.
Common confusion
Assuming Desktop Virtualization User alone is enough to sign in to Microsoft Entra joined session hosts.
2.2 Plan and implement securityDefender for Cloud, Defender Antivirus, Defender for Endpoint, network security, admin access, Windows threat protection, confidential VMs and Trusted Launch.
What it means
This group covers protecting session hosts with Microsoft Defender for Cloud, Defender Antivirus and Defender for Endpoint, securing connection traffic with UDRs, NSGs and Azure Firewall, giving administrators Azure Bastion or just-in-time access, enabling App Control for Business and Controlled Folder Access, and deploying confidential VMs or Trusted Launch.
What to understand
Defender Antivirus on multi-session hosts needs FSLogix exclusions for VHD and VHDX containers. Non-persistent hosts use the VDI onboarding script for Defender for Endpoint so reimaged machines keep one device entry. NSGs can use the WindowsVirtualDesktop service tag, and Azure Firewall offers an FQDN tag for required traffic when a UDR forces egress through it. Bastion and JIT avoid public RDP for admins. Trusted Launch adds Secure Boot and vTPM; confidential VMs add hardware-based memory encryption.
How it shows up
Scenarios ask which Defender capability, network control or VM security type meets a stated threat or compliance requirement.
Common confusion
Mixing up Trusted Launch with confidential VMs; confidential VMs encrypt memory in use and need specific VM sizes.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft Entra joined session hosts

    Hosts joined directly to Entra ID without domain controllers.

    Remember
    Users need a VM sign-in role on the hosts.
    Tested as
    Identity scenario questions.
    Trap
    Forgetting Virtual Machine User Login.

  • Microsoft Entra Domain Services

    Managed domain synced from Entra ID.

    Remember
    Gives Kerberos and Group Policy without running domain controllers.
    Tested as
    Cloud-first designs needing a domain.
    Trap
    Thinking it syncs back to on-premises AD DS.

  • Desktop Virtualization User

    Role that lets users access an application group.

    Remember
    Assigned on the application group, not the host pool.
    Tested as
    Access assignment items.
    Trap
    Assigning it on the session host VMs.

  • Desktop Virtualization roles

    Built-in roles such as Contributor, Reader, Host Pool Contributor and User Session Operator.

    Remember
    Use the narrowest role for delegated admins.
    Tested as
    Delegation scenarios.
    Trap
    Granting Owner when User Session Operator fits.

  • Conditional Access target apps

    Azure Virtual Desktop and Windows Cloud Login cloud apps.

    Remember
    SSO sign-in to hosts uses Windows Cloud Login.
    Tested as
    MFA and access policy items.
    Trap
    Targeting only one app and leaving a gap.

  • Microsoft Entra single sign-on

    Single sign-in to session hosts using Entra authentication.

    Remember
    Enabled through the enablerdsaadauth RDP property.
    Tested as
    Sign-in experience scenarios.
    Trap
    Confusing it with AD FS based SSO.

  • Passwordless and smart card

    Windows Hello for Business, FIDO2 keys and smart cards inside sessions.

    Remember
    WebAuthn and smart card redirection carry the credential.
    Tested as
    Authentication method items.
    Trap
    Disabling redirection and expecting in-session use.

  • Defender for Endpoint VDI onboarding

    Onboarding script for non-persistent hosts.

    Remember
    Keeps a single device entry across reimages.
    Tested as
    Endpoint protection items.
    Trap
    Using the standard script and creating duplicate devices.

  • FSLogix antivirus exclusions

    Exclude profile container files from real-time scanning.

    Remember
    Prevents sign-in delays and locked containers.
    Tested as
    Defender Antivirus scenarios.
    Trap
    Excluding the whole C drive.

  • WindowsVirtualDesktop service tag

    Tag for Azure Virtual Desktop service traffic in NSGs and firewalls.

    Remember
    Simplifies outbound rules.
    Tested as
    Network security items.
    Trap
    Building rules from hard-coded IP lists.

  • Azure Bastion and JIT

    Admin access to hosts without public RDP exposure.

    Remember
    Bastion brokers browser RDP; JIT opens ports for a time window.
    Tested as
    Admin access scenarios.
    Trap
    Treating them as user access methods.

  • App Control for Business

    Windows policy that allows only trusted code to run.

    Remember
    Formerly Windows Defender Application Control.
    Tested as
    Threat protection items.
    Trap
    Confusing it with FSLogix application masking.

  • Trusted Launch

    Gen 2 VM security with Secure Boot, vTPM and integrity monitoring.

    Remember
    Default security type for new session hosts.
    Tested as
    VM security type questions.
    Trap
    Assuming it encrypts memory.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Session host identity scenarios

ConceptMeaningKey differenceCommon trap
AD DS join Hosts join an on-premises or Azure-hosted AD DS domain. Requires line of sight to domain controllers and hybrid users. Proposed for cloud-only users.
Microsoft Entra Domain Services join Hosts join a managed domain synced from Entra ID. No domain controllers to run, limited admin control. Expecting writeback to on-premises AD.
Microsoft Entra join Hosts join Entra ID directly. Supports cloud-only users; needs VM sign-in roles. Missing the RBAC VM login assignment.

Role assignments for access

ConceptMeaningKey differenceCommon trap
Desktop Virtualization User Access to published desktops or apps. Scoped to application groups. Applied at host pool scope.
Virtual Machine User Login Standard sign-in to Entra joined VMs. Needed in addition to application group access. Replaced with administrator login unnecessarily.
User Session Operator Manage user sessions, send messages, sign users out. Help desk delegation without host changes. Confused with Session Host Contributor.

Session host VM security types

ConceptMeaningKey differenceCommon trap
Standard No extra platform security features. Lowest protection. Chosen when Secure Boot is required.
Trusted Launch Secure Boot, vTPM and boot integrity monitoring. Protects against boot kits and rootkits. Believed to encrypt memory.
Confidential VM Hardware-based isolation with memory encryption. Protects data in use; limited sizes and regions. Selected without checking size support.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Missing VM login role

    What candidates pick
    Add more application group assignments.
    Why it looks right
    Users clearly lack some kind of access.
    Why it's wrong
    Entra joined hosts check a separate VM sign-in role; repeating the app group assignment changes nothing.

    Clue to watch for The hosts are Microsoft Entra joined.

  2. Domain Services as sync tool

    What candidates pick
    Use Entra Domain Services to push accounts to on-premises.
    Why it looks right
    Its name sounds like a domain bridge.
    Why it's wrong
    Entra Domain Services syncs one way from Entra ID into the managed domain only.

    Clue to watch for Requirement mentions on-premises writeback.

  3. Owner for help desk

    What candidates pick
    Grant Owner or Contributor on the host pool.
    Why it looks right
    It definitely grants enough rights.
    Why it's wrong
    User Session Operator lets staff manage sessions without changing hosts, matching least privilege.

    Clue to watch for Help desk must only sign out or message users.

  4. Scanning profile containers

    What candidates pick
    Leave Defender real-time scanning on everything.
    Why it looks right
    More scanning sounds more secure.
    Why it's wrong
    Scanning VHDX containers during mount causes slow sign-ins; Microsoft documents FSLogix exclusions.

    Clue to watch for Slow sign-ins after enabling antivirus.

  5. Confidential VM for Secure Boot

    What candidates pick
    Deploy confidential VMs.
    Why it looks right
    They are the strongest option on the list.
    Why it's wrong
    Trusted Launch already provides Secure Boot and vTPM at lower cost and wider size support.

    Clue to watch for Requirement is boot integrity, not data in use.

  6. Opening RDP for admins

    What candidates pick
    Allow inbound 3389 from the admin office IP.
    Why it looks right
    It is restricted to one address.
    Why it's wrong
    Bastion or JIT removes standing exposure, which is what the hardening requirement asks for.

    Clue to watch for Words like no public exposure or time-limited access.

Answer framework

Use these steps when an identity or security requirement must be mapped to an Azure Virtual Desktop control.

  1. Establish where users and devices live: cloud-only or hybrid identities, and whether domain controllers or a managed domain are available.
  2. Choose the session host join type that fits those identities and confirms FSLogix storage can authenticate the same users.
  3. Grant access with the narrowest roles: Desktop Virtualization User on application groups, VM sign-in roles for Entra joined hosts, operator roles for staff.
  4. Layer sign-in controls: Conditional Access on the correct cloud apps, MFA or passwordless methods, and single sign-on through the RDP property.
  5. Harden the hosts and network with Defender, FSLogix exclusions, NSG and firewall rules, Bastion or JIT, and Trusted Launch or confidential VMs.

Practice question

A help desk team must be able to send messages to users and sign them out of Azure Virtual Desktop sessions. They must not change host pool settings or session host VMs. Which built-in role should be assigned to the help desk group?

Want more like this? The AZ-140 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan roughly 12 to 16 hours for this domain, weighted toward identity. Build two small host pools if you can: one with hybrid-joined hosts and one with Microsoft Entra joined hosts. Assign users through application groups, try signing in before and after adding the VM sign-in role, and note exactly what fails. Then enable single sign-on, add a Conditional Access policy requiring MFA, and watch which cloud apps appear in the sign-in logs.

For the security half, onboard a host to Defender for Endpoint, review the FSLogix antivirus exclusion list, and create an NSG using the WindowsVirtualDesktop service tag. Deploy a host with Trusted Launch and compare the options shown for confidential VMs. Make a one-page table of every built-in Azure Virtual Desktop role with its scope and typical user. Most points in this domain come from naming the exact role, app or feature, so flash-card style review in the final week works well alongside timed practice sets.

FAQ

How much of AZ-140 is Plan and implement identity and security?

Microsoft weights Plan and implement identity and security at 15–20% of the exam. That is likely around 7 to 10 questions on a typical form, an editorial estimate since Microsoft does not publish per-domain counts.

Can cloud-only users sign in to Azure Virtual Desktop?

Yes, when session hosts are Microsoft Entra joined. Users still need access to an application group and a VM sign-in role on the hosts.

Which cloud apps should Conditional Access policies target?

Target the Azure Virtual Desktop app for connections. When Microsoft Entra single sign-on is enabled, also include Windows Cloud Login so the sign-in to the session host is covered.

Is Microsoft Entra Domain Services required for FSLogix?

No. Azure Files can authenticate through AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos for hybrid identities. Pick the option that matches your session host identity scenario.

What is the difference between App Control for Business and FSLogix application masking?

App Control for Business is a security control that blocks untrusted code from running. Application masking only hides installed apps from users who should not see them, which is a user experience feature.

Do I need both Trusted Launch and Defender for Endpoint?

They protect different layers. Trusted Launch protects the boot chain, while Defender for Endpoint detects and responds to threats inside the running operating system, so many designs use both.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

Check that you can name the right Azure Virtual Desktop role, Conditional Access target and session host protection for each scenario.

Take the AZ-140 practice test Check your AZ-140 readiness

Keep going