AZ-140 · Domain 3 of 4

AZ-140 Domain 3: Plan and implement user environments and apps

Shape what users actually experience: FSLogix profile and Office containers, client choice and redirection, RDP and timeout settings, Start VM on Connect, application groups, Microsoft 365 Apps, Teams and App attach.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
10–13
Suggested study time estimate
18–24 hrs

About 12 min read Reviewed October 2026

Overview

Plan and implement user environments and apps has three functional groups and 26 listed skills, the most detailed outline in AZ-140. FSLogix covers recommending a configuration, Profile Containers, ODFC containers, Cloud Cache and application masking. User experience covers choosing and deploying clients, device and multimedia redirection, printing and Universal Print, Intune or Group Policy settings, RDP properties, session timeouts, Start VM on Connect and personal desktop assignment.

The apps group covers deployment methods, application groups, user assignment, RemoteApp publishing, Microsoft 365 Apps, OneDrive, Microsoft Teams with the WebRTC Redirector Service, browsers, and App attach packages. At 20–25%, this is the second-largest domain. Questions are practical: a user complaint or business rule is described and you choose the FSLogix setting, RDP property, client or app delivery method that resolves it.

How it's tested

This domain tests configuration detail. Expect scenarios built around a user complaint or a policy requirement, followed by a choice of FSLogix setting, RDP property, client, redirection feature or app delivery method. Distractors are usually valid features applied at the wrong layer, such as a Group Policy setting offered where a host pool RDP property is needed.

  • Profile behaviour

    A roaming, resilience or Office data requirement is stated, and you choose Profile Container, ODFC container, Cloud Cache or application masking.

  • Device and client experience

    A peripheral, media or printing problem is described, and you pick the RDP property, redirection feature or client to fix it.

  • Deliver the app

    An app delivery rule is given, and you choose RemoteApp versus desktop, image install versus App attach, or Teams optimization.

Reasoning it through

Finance users need a line-of-business app streamed on its own window, while other staff must not see it. A RemoteApp application group published to the finance group meets the first part, because only assigned users see the app in their feed. If the same app is installed on a shared desktop, FSLogix application masking can hide it from other users. Both may appear as options; RemoteApp alone satisfies the stated requirement.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

3.1 Plan and implement FSLogixFSLogix recommendations, Profile Containers, ODFC containers, Cloud Cache and application masking.
What it means
This group covers recommending an FSLogix design and then configuring Profile Containers, Office Data File Containers (ODFC), Cloud Cache, and application masking rules on session hosts, usually through registry settings, Group Policy templates or Intune.
What to understand
A Profile Container stores the whole user profile in a VHD or VHDX on SMB storage, set with Enabled and VHDLocations. An ODFC container holds only Microsoft 365 data such as Outlook cache and Teams data, useful when another profile solution handles the rest. Cloud Cache writes to several storage locations through CCDLocations and a local cache, adding resilience; it replaces VHDLocations rather than combining with it. Application masking uses rule sets to hide files, registry keys or fonts per user or group.
How it shows up
Questions ask which FSLogix feature or setting meets a resilience, Office data or app visibility requirement.
Common confusion
Configuring both VHDLocations and CCDLocations together; Cloud Cache uses CCDLocations instead of VHDLocations.
3.2 Plan and implement user experience and client settingsClients, deployment, redirection, multimedia, printing, policies, RDP properties, timeouts, Start VM on Connect and personal desktop assignment.
What it means
This group covers choosing and deploying clients, troubleshooting them, configuring device and multimedia redirection, printing and Universal Print, user settings through Intune or Group Policy, host pool RDP properties, session timeouts, Start VM on Connect, and assigning or unassigning personal desktops.
What to understand
Windows App is Microsoft's current client across Windows, macOS, iOS, Android and the web; the older Remote Desktop client for Windows reached end of support in 2026. Device redirection is set by RDP properties such as drivestoredirect, camerastoredirect and redirectclipboard on the host pool. Multimedia redirection offloads browser video to the client. Session time limits come from Group Policy or Intune. Start VM on Connect needs the Desktop Virtualization Power On Contributor role for the Azure Virtual Desktop service principal.
How it shows up
Expect to pick an RDP property, policy setting, client or role that fixes a described experience issue.
Common confusion
Trying to set device redirection only in Group Policy when the host pool RDP property is the expected answer.
3.3 Install and configure apps on a session hostDeployment methods, application groups, assignments, RemoteApp, Microsoft 365 Apps, OneDrive, Teams, browsers and App attach.
What it means
This group covers choosing how apps reach session hosts, creating application groups and assigning users, publishing RemoteApps, managing Microsoft 365 Apps, OneDrive and Microsoft Teams, managing browsers, and delivering apps dynamically with App attach packages.
What to understand
Desktop application groups publish a full desktop; RemoteApp groups publish individual apps; both are registered to a workspace so users see them. Microsoft 365 Apps on multi-session hosts need shared computer activation, and OneDrive should use the per-machine install. Teams uses media optimization, which depends on the Remote Desktop WebRTC Redirector Service on hosts. App attach mounts packaged apps such as MSIX, CimFS or VHDX images at sign-in, assigned to users and host pools, so apps can update without rebuilding the image.
How it shows up
Scenarios ask how to deliver or configure an app given update frequency, user targeting and multi-session constraints.
Common confusion
Thinking App attach replaces application groups; users still need a desktop or RemoteApp group to use the attached app.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Profile Container

    Full user profile in a VHDX mounted at sign-in.

    Remember
    Configured with Enabled and VHDLocations.
    Tested as
    Core FSLogix items.
    Trap
    Using roaming profiles alongside it.

  • ODFC container

    Container for Microsoft 365 app data only.

    Remember
    Useful when another tool manages the profile.
    Tested as
    Office data scenarios.
    Trap
    Choosing it when the full profile must roam.

  • Cloud Cache

    Writes containers to multiple storage locations with a local cache.

    Remember
    Uses CCDLocations, not VHDLocations.
    Tested as
    Resilience and DR items.
    Trap
    Expecting it to reduce local disk needs.

  • Application masking

    Hides apps, files or registry keys per user or group.

    Remember
    It is not a security boundary.
    Tested as
    App visibility scenarios.
    Trap
    Using it to block malware.

  • Windows App

    Current Microsoft client for Azure Virtual Desktop.

    Remember
    Available on Windows, macOS, mobile and web.
    Tested as
    Client choice items.
    Trap
    Recommending a retired client for new deployments.

  • Host pool RDP properties

    Settings such as redirection, display and SSO applied at connection.

    Remember
    Set once on the host pool for all users.
    Tested as
    Redirection and experience items.
    Trap
    Changing local client settings instead.

  • Multimedia redirection

    Offloads browser video playback to the client device.

    Remember
    Needs the extension on the host and a supported client.
    Tested as
    Video performance scenarios.
    Trap
    Confusing it with Teams optimization.

  • Start VM on Connect

    Starts deallocated hosts when a user connects.

    Remember
    Requires the Power On Contributor role for the service principal.
    Tested as
    Cost and personal desktop items.
    Trap
    Assigning the role to users instead.

  • Desktop vs RemoteApp groups

    Full desktop or individual published apps.

    Remember
    Groups must be registered to a workspace.
    Tested as
    Publishing scenarios.
    Trap
    Forgetting workspace registration.

  • Shared computer activation

    Licensing mode for Microsoft 365 Apps on multi-session hosts.

    Remember
    Required for multiple users on one host.
    Tested as
    Microsoft 365 Apps items.
    Trap
    Leaving per-device activation on a pooled host.

  • Teams media optimization

    Offloads audio and video to the client.

    Remember
    Relies on the WebRTC Redirector Service on hosts.
    Tested as
    Teams call quality items.
    Trap
    Adding GPU VMs to fix call quality.

  • App attach

    Mounts packaged apps dynamically per user and host pool.

    Remember
    Separates app updates from image rebuilds.
    Tested as
    Dynamic delivery scenarios.
    Trap
    Assuming it needs no application group.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

FSLogix features

ConceptMeaningKey differenceCommon trap
Profile Container Entire profile in one VHDX. Primary roaming solution for pooled hosts. Combined with Cloud Cache paths.
ODFC container Office data in a separate container. Complements other profile tools. Treated as a full profile solution.
Cloud Cache Multiple storage providers with local cache. Adds resilience across storage targets. Configured alongside VHDLocations.
Application masking Rules to hide items per user. Controls visibility, not execution. Presented as a security control.

App delivery methods

ConceptMeaningKey differenceCommon trap
Install in golden image App baked into every session host. Simple, but updates need an image rebuild. Chosen for apps updated weekly.
App attach Package mounted at sign-in. Update apps without touching the image. Expecting it to publish apps by itself.
RemoteApp group Streams a single app window to users. Controls who sees which app in the feed. Confused with app installation.

Video and calling optimization

ConceptMeaningKey differenceCommon trap
Teams media optimization Teams audio and video processed on the client. Specific to Teams, uses WebRTC Redirector Service. Applied to browser video.
Multimedia redirection Browser video and media played on the client. For web video sites, uses a browser extension. Expected to optimize Teams calls.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Wrong layer for redirection

    What candidates pick
    Change Group Policy on each client device.
    Why it looks right
    Group Policy controls so many Windows settings.
    Why it's wrong
    Redirection for all users is set as an RDP property on the host pool, applied at connection.

    Clue to watch for Requirement applies to every user of a host pool.

  2. ODFC as full roaming

    What candidates pick
    Deploy ODFC containers for profile roaming.
    Why it looks right
    It is part of FSLogix and stores user data.
    Why it's wrong
    ODFC holds Office data only; the full profile needs a Profile Container.

    Clue to watch for Requirement mentions desktop settings or the whole profile.

  3. Cloud Cache as storage saver

    What candidates pick
    Enable Cloud Cache to cut storage cost.
    Why it looks right
    Cache sounds like it reduces load.
    Why it's wrong
    Cloud Cache writes to several providers and uses local disk, so it adds resilience, not savings.

    Clue to watch for Requirement is about surviving a storage outage.

  4. GPU for Teams calls

    What candidates pick
    Move hosts to GPU-enabled VMs.
    Why it looks right
    Video seems like a graphics problem.
    Why it's wrong
    Teams media optimization offloads calls to the client device; GPU hosts do not fix that path.

    Clue to watch for Complaints about Teams call quality only.

  5. Masking to block apps

    What candidates pick
    Use application masking for security.
    Why it looks right
    Hidden apps seem blocked.
    Why it's wrong
    Masking hides items from view; App Control for Business is the control that blocks execution.

    Clue to watch for Words such as prevent execution or compliance.

  6. App attach without publishing

    What candidates pick
    Assign the package and stop there.
    Why it looks right
    Assignment sounds complete.
    Why it's wrong
    Users still need a desktop or RemoteApp application group to launch the attached app.

    Clue to watch for Users report the app is missing from their feed.

Answer framework

Use these steps to choose the right user environment or app delivery setting in a scenario.

  1. Classify the request: profile data, device or media experience, power and assignment behaviour, or application delivery and visibility.
  2. For profile needs, pick Profile Container, ODFC container or Cloud Cache, and confirm the matching registry setting and storage location.
  3. For experience issues, decide whether the fix is a host pool RDP property, a client choice, a redirection feature or a session policy.
  4. For app delivery, weigh image install against App attach by update frequency, then choose a desktop or RemoteApp group for visibility.
  5. Check supporting requirements such as shared computer activation, the WebRTC Redirector Service and service principal roles before answering.

Practice question

An organization stores FSLogix Profile Containers on one Azure Files share. Users must keep signing in with their profiles if that share becomes unavailable, using a second share in another region. What should the administrator configure on the session hosts?

Want more like this? The AZ-140 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Allow roughly 18 to 24 hours here and split it into three blocks matching the functional groups. Start with FSLogix, because it carries the most specific facts. Configure a Profile Container on a lab host, then switch to Cloud Cache with two storage locations and watch the local cache behaviour. Add one application masking rule so you understand how rule sets are assigned.

In the second block, connect with Windows App and the web client, change RDP properties for drive, clipboard and camera redirection, and confirm what changes after reconnecting. Enable Start VM on Connect on a personal pool and test assignment. In the final block, publish a RemoteApp group, install Microsoft 365 Apps with shared computer activation, configure Teams media optimization, and package one app for App attach. Write each RDP property and FSLogix setting you used on a flash card, because questions often turn on recalling the exact setting name.

FAQ

How much of AZ-140 is Plan and implement user environments and apps?

Plan and implement user environments and apps carries 20–25% of the exam weight. That suggests roughly 10 to 13 questions on a typical form, an editorial estimate because Microsoft does not publish per-domain question counts.

Do I need to memorize FSLogix registry values?

Know the key setting names, such as Enabled, VHDLocations, CCDLocations and the size limit, and what each controls. Exact default values matter less than knowing which setting solves which requirement.

Which client should I recommend for new deployments?

Windows App is Microsoft's current client across platforms, including a browser version. Scenarios may still name older clients, so focus on platform support and deployment method when choosing.

What is the difference between multimedia redirection and Teams optimization?

Multimedia redirection improves video playback in browsers by rendering media on the client. Teams media optimization handles Teams calls and meetings through the WebRTC Redirector Service, so each solves a different problem.

Can a user access both a desktop and RemoteApps from the same host pool?

Yes. A pooled host pool can publish a desktop application group and RemoteApp groups, and users assigned to both see each in their feed once the groups are registered to a workspace.

Why use App attach instead of installing apps in the image?

App attach lets you add, update or remove apps for specific users and host pools without rebuilding and redeploying the golden image, which shortens app update cycles.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

Practice AZ-140 questions on FSLogix containers, RDP properties, application groups and App attach to confirm your user environment skills.

Take the AZ-140 practice test Check your AZ-140 readiness

Keep going