Microsoft AZ-140 Bundle

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Trusted Launch and confidential VM protections under AZ-140 objective group 2.2. It addresses a different failure risk: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A change manager needs canary validation of allow rules before enforcing them on all hosts. For the targeted topic (App Control for Business and Controlled Folder Access), the directly relevant paired response and evidence is: Approved business apps launch and a controlled unauthorized executable or folder-write test is denied as expected. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An AVD deployment requires Secure Boot and virtual TPM to protect supported Windows hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant risk is: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant risk is: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A custom image is incompatible with an intended Trusted Launch VM security type. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant risk is: A security flag cannot compensate for an unsupported image generation or size and might stop VM provisioning. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to App Control for Business and Controlled Folder Access under AZ-140 objective group 2.2. It addresses a different failure risk: An untested restrictive allowlist can block legitimate published RemoteApps and profile software after rollout. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Microsoft Defender Antivirus protection and exclusions under AZ-140 objective group 2.2. It addresses a different failure risk: Disabling broad antivirus directories to troubleshoot one profile issue can leave user sessions unprotected. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: A highly sensitive workload considers confidential VMs but its chosen SKU does not support them. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant verification is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Cloud security posture for session hosts under AZ-140 objective group 2.2. It addresses a different failure risk: Ignoring cloud security posture alerts can leave exposed management ports or unpatched configurations undetected. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant action is: Choose supported Trusted Launch secure boot and virtual TPM protections or confidential VM capability after checking image, guest OS and VM-size compatibility. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Defender for Endpoint device onboarding and incident response under AZ-140 objective group 2.2. It addresses a different failure risk: Golden images with incorrect onboarding or duplicate device identity artifacts may create blind spots or duplicate records. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant paired response and evidence is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to Azure Bastion and just-in-time management access under AZ-140 objective group 2.2. It addresses a different failure risk: Leaving inbound RDP open permanently to all sources increases exposure of privileged session-host management. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant paired response and evidence is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to NSGs, user-defined routes and Azure Firewall controls under AZ-140 objective group 2.2. It addresses a different failure risk: A deny-all outbound policy without exceptions for required AVD control-plane endpoints can cause widespread registration failures. But the observed requirement is: An operator needs proof that Trusted Launch was enabled on newly provisioned session hosts. For the targeted topic (Trusted Launch and confidential VM protections), the directly relevant paired response and evidence is: A compatible test VM boots with intended attestation or virtual TPM properties and can register as an AVD host. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix application masking rules under AZ-140 objective group 3.1. It addresses a different failure risk: Installing all apps into one image without controlled visibility can expose software to users who are not entitled to use it. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant action is: Enable supported FSLogix Profile Containers and configure the intended VHDLocations SMB path so pooled users receive roaming Windows profiles. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix profile security and policy consistency under AZ-140 objective group 3.1. It addresses a different failure risk: Different registry settings on hosts within one pool can cause inconsistent profile paths or allow inappropriate user access. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant action is: Enable supported FSLogix Profile Containers and configure the intended VHDLocations SMB path so pooled users receive roaming Windows profiles. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix container locking and profile attach diagnostics under AZ-140 objective group 3.1. It addresses a different failure risk: Simultaneous access conflicts or incorrect share permissions can prevent mounting the intended profile and create a temporary session. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant action is: Enable supported FSLogix Profile Containers and configure the intended VHDLocations SMB path so pooled users receive roaming Windows profiles. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix application masking rules under AZ-140 objective group 3.1. It addresses a different failure risk: Installing all apps into one image without controlled visibility can expose software to users who are not entitled to use it. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant verification is: A user signs in to two different pooled hosts in sequence and retains settings through the same approved VHDX. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix Office Data File Containers and Microsoft 365 under AZ-140 objective group 3.1. It addresses a different failure risk: Conflicting or redundant Office cache container policies can create wasted storage or inconsistent Outlook behavior across hosts. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant verification is: A user signs in to two different pooled hosts in sequence and retains settings through the same approved VHDX. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.

This option relates to FSLogix Cloud Cache multi-provider resilience under AZ-140 objective group 3.1. It addresses a different failure risk: Cloud Cache adds moving parts and cannot guarantee consistent profiles when all configured providers are inaccessible or unhealthy. But the observed requirement is: A pooled AVD user loses desktop settings whenever the broker routes the next session to another host. For the targeted topic (FSLogix Profile Container enablement and locations), the directly relevant verification is: A user signs in to two different pooled hosts in sequence and retains settings through the same approved VHDX. That other measure may be useful in a separate environment, but does not by itself establish the specific requested outcome. An independent qualified Azure Virtual Desktop expert must adjudicate any plausible overlapping alternatives before release.