You have a pooled host pool and a RemoteApp application group named Finance-Apps. A Microsoft Entra security group named AVD-Finance should be granted access to Finance-Apps. Which two actions should you perform? (Each correct answer presents part of the solution. Choose two answers.)

To grant users access to RemoteApps, you must assign them the Desktop Virtualization User role directly on the application group. This role provides the necessary permissions to access the applications within that specific group. Additionally, the application group must be associated with a workspace. Users subscribe to workspaces to see and access the applications published within them. Adding the group to the local Remote Desktop Users group on session hosts is not required for Azure Virtual Desktop users accessing RemoteApps, as access is managed through Azure RBAC. Assigning the Desktop Virtualization User role on the host pool is too broad and not specific enough for application group access. Opening inbound TCP 3389 is unnecessary because Azure Virtual Desktop uses the reverse connect transport for secure communication without requiring inbound RDP ports.