Session hosts are joined to the on-premises contoso.com Active Directory. To limit user sessions to three hours, where should you configure the session time limit?

Since the session hosts are joined to the on-premises Active Directory domain (contoso.com), Group Policy Objects (GPOs) are the appropriate mechanism for configuring user session limits. GPOs allow centralized management of settings for users and computers within an Active Directory domain, including session timeout policies. The GPO would be linked to an Organizational Unit (OU) containing the session host computer objects or user objects, applying the desired three-hour session limit. The workspace properties and RDP properties of a host pool in Azure Virtual Desktop primarily control settings related to the AVD service itself, such as display settings or client redirection, not Active Directory-managed user session timeouts. Just-in-time (JIT) VM access is a security feature for granting temporary access to virtual machines, unrelated to user session duration limits.