You must restrict all outbound internet traffic from Azure Virtual Desktop session hosts while still allowing host registration and user sign‑in to Azure AD. Which two Azure service tags should you allow over TCP 443 from the session hosts to meet this requirement? (Select two answers.)

To allow Azure Virtual Desktop (AVD) session hosts to register and users to sign in to Azure AD while restricting outbound internet traffic, you need to permit specific service tags over TCP 443. The WindowsVirtualDesktop service tag covers the AVD control plane communication necessary for host registration and management. The AzureActiveDirectory service tag is essential for user authentication and sign-in processes. Storage is incorrect because while AVD uses storage, it's not directly required for host registration or user sign-in via Azure AD. AzureResourceManager is for managing Azure resources, not specifically for AVD host communication or user authentication. AzureTrafficManager is a DNS-based traffic load balancer and is not directly involved in AVD host registration or user sign-in.