An on-prem universal security group AVDusers is synced to Azure AD. You have an AVD host pool of four Windows 10 multi-session hosts. How do you ensure only AVDusers members can establish AVD sessions to the host pool?

Assigning AVDusers to an application group is the correct method because application groups in Azure Virtual Desktop (AVD) are used to publish resources (desktops or applications) and control which users can access them. When users are assigned to an application group, they are granted permission to connect to the session hosts associated with that group. Assigning AVDusers to an Azure role scoped to the host pool or session hosts is incorrect because Azure roles control management plane operations (e.g., who can modify the host pool settings), not user access to AVD sessions. Adding AVDusers to the local Remote Desktop Users group on each session host is unnecessary and less scalable in AVD, as AVD's native authorization via application groups handles session access.