Microsoft AZ-140: Applications and End-User Experience — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Applications and the end-user experience in Azure Virtual Desktop (AVD) center on how you package, publish, entitle, and optimize apps and desktops across heterogeneous clients while maintaining a predictable, secure experience. Delivering reliable, low-latency sessions requires careful design of application groups, dynamic application delivery (MSIX app attach), redirection policies, and media optimizations, plus an operational approach to monitoring and troubleshooting that scales.

Application Delivery Models and Entitlement Design

AVD publishes resources through application groups associated with a host pool. There are two types:

Desktop application group: delivers a full desktop. One desktop group is auto-created per host pool.
RemoteApp application group: delivers individual applications. You can create multiple RemoteApp groups per host pool.

RemoteApp publication and Start menu discovery:

When you add a RemoteApp, the admin center queries a session host to enumerate installed apps from Start menu shortcuts. This discovery assumes the app is identically installed across all hosts (same path and architecture). If not, specify a fully qualified path and working directory.
For MSIX app attach, published entries map to the package’s apps; ensure package availability on all hosts where users can land.

Workspace registration:

Each application group must be registered to exactly one workspace.
Workspaces and their application groups must reside in the same AVD metadata location. Users subscribe to a workspace with the Windows client, other platform clients, or the web client; assigned resources are aggregated in the user’s feed.

Selecting full desktop vs RemoteApp:

Choose full desktop when users require multi-application workflows, shell access, or dynamic app discovery, or when app interop is complex.
Choose RemoteApp when you need least privilege, narrow resource exposure, faster app startup, and lower session resource footprint.
Avoid assigning the same users both the desktop and RemoteApp groups of the same pool to minimize confusion and potential duplicate sessions.
If you need to present different OS experiences (for example, Windows 11 vs Windows 10), provision separate host pools; you cannot assign a Windows 11 desktop app group from a Windows 10 host pool.

Entitlement and RBAC:

Assign users via Azure AD groups to application groups for scalable lifecycle management. Keep assignments aligned to business roles and app bundles.
For least-privilege operations, use built-in roles (for example, Desktop Virtualization Session Host Operator for a host pool). Adding existing VMs to a host pool requires generating a registration key.
An application group can be registered in only one workspace; design workspaces by business unit, geography, or environment (dev/test/prod).

Packaging and Distribution of Applications

MSIX app attach (dynamic application delivery):

Packages: Convert MSIX to VHD/VHDX/CIM. Store packages in highly available SMB storage (Azure Files, Azure NetApp Files) with AD-based authentication and low latency to session hosts.
Staging: Mounts the package image on the session host (per-host action). Done at logon, on-demand, or pre-staged during maintenance to reduce logon time.
Registration: Per-user registration integrates the app into the user’s profile without modifying the base image. Deregistration at logoff cleans up cleanly.
Image separation: Keep your golden image minimal (OS, agents, frameworks like .NET, M365 Apps if required). Deliver apps via MSIX app attach or traditional tools to avoid image sprawl and reduce update risk.

Traditional Win32 and line-of-business (LOB) apps:

Use enterprise software distribution (Configuration Manager, scripting, or image baking) when apps are not suitable for MSIX (kernel drivers, system services, deep COM integrations).
Keep paths consistent across hosts. If you use RemoteApp, ensure the binary paths are stable and accessible by standard users.

Microsoft Store apps:

Microsoft Store for Business has been retired; use MSIX, winget, or Intune store integration where supported.
Intune support for Windows multi-session is limited; prefer MSIX app attach, ConfigMgr, or image-based install for multi-session host pools.

Microsoft 365 Apps and profiles:

For Windows multi-session, install M365 Apps with shared computer activation and enable FSLogix for profile and Office container roaming.

Image management and replication:

Use Azure Compute Gallery for image versioning and regional replication to place images near host pools and keep OS/app baselines consistent across geographies.

Security hardening:

To restrict users to published apps when using RemoteApp, implement AppLocker rules. This prevents launching arbitrary executables (for example, from Save As dialogs).

Media, Devices, and Client Experience

Teams optimization, WebRTC, and multimedia redirection:

Teams optimization for AVD offloads audio/video to the client via WebRTC, reducing CPU on the session host and improving call quality. Ensure supported Teams builds on the host and supported AVD clients on endpoints. Validate that the “AVD optimized” banner appears in Teams About.
Multimedia redirection (MMR) for browsers offloads HTML5 video decoding and rendering to the client. Requires the AVD redirection service on the host and a supported browser extension on the client.
For call quality, ensure UDP connectivity to AVD and Teams services, configure QoS/DSCP for real-time media, and use Teams Call Analytics/CQD for analysis.

Device and resource redirection policies:

Configure via host pool RDP properties or GPO:
- Printers: Easy Print redirection or use Universal Print for enterprise-managed, cloud-first printing.
- Drives and clipboard: Restrict to mitigate data exfiltration; allow text-only clipboard when needed.
- USB and smart cards: Enable only for validated scenarios and compliant endpoints. USB redirection is supported on the Windows client; web and mobile clients have limitations.
- Audio capture and video devices: Enable for voice/video scenarios with Teams optimization.

Example host pool RDP property configuration:

drivestoredirect:s:;
redirectclipboard:i:0;
redirectprinters:i:1;
redirectsmartcards:i:1;
redirectcomports:i:0;
usbdevicestoredirect:s:;
audiocapturemode:i:1;
videoplaybackmode:i:1

RDP clients and update strategy:

Clients: Windows desktop client (MSRDC) provides the richest experience; macOS, iOS/iPadOS, Android, and the web client deliver broad reach with feature variances (for example, limited USB on non-Windows, constrained multi-monitor on web/mobile).
Maintain client currency to receive codec, redirection, and Teams optimization updates. Use a ringed rollout (pilot, broad) and enforce minimum client versions with policy. Where thin clients are used, align firmware and AVD client updates.

Accessibility, displays, and visual tuning:

Accessibility: Leverage Windows Ease of Access features within the session; high contrast and magnifier work well over RDP.
Displays: Multi-monitor and high-DPI are supported; balance resolution and monitor count with GPU/CPU budgets. Avoid ultra-high frame rates on constrained WAN.
Codecs and graphics: Use AVC/H.264 for WAN, consider AVC444 for better text rendering on high-motion desktops at the cost of bandwidth. Tune frame rate limit and enable hardware encoding where available. Disable unnecessary animations and background apps on the image to improve perceived responsiveness.
Screen capture protection can be enabled for sensitive apps or desktops.

Operations and Troubleshooting for End-User Experience

Readiness and connectivity:

Before domain join to Azure AD DS, update the virtual network DNS to the managed domain controllers to ensure proper name resolution and Kerberos authentication.
Measure user-to-region latency with the Azure Virtual Desktop Experience Estimator and select regions accordingly.
For existing VMs, generate a host pool registration key before installing the AVD agents to join them to the pool.

Profiles and storage:

Use FSLogix profile and Office containers to deliver consistent sessions across hosts. For very large user populations or IOPS-sensitive workloads, Azure NetApp Files provides the lowest latency and highest throughput. Configure the FSLogix Profiles setting on session hosts and validate NTFS/SMB permissions.

Security and platform hygiene:

Install antimalware via the Microsoft Antimalware VM extension and onboard hosts to Microsoft Defender for Endpoint in your base image or via first-start scripts so all newly deployed hosts enroll consistently.
If VM license metadata is incorrect post-deployment, update with PowerShell (for example, Update-AzVm) to apply the correct Windows license type.
Use Start VM on connect for cost optimization; assign the necessary custom role to the Azure Virtual Desktop service principal.

Application launch issues:

Validate app presence on all session hosts, consistent paths, correct bitness, and dependency frameworks.
For MSIX app attach, verify storage latency, package signatures, and that staging/registration completed. Review AVD Agent and FSLogix logs.
Check AppLocker events for denials if users report “nothing happens” on launch.
Ensure application groups are properly associated with a workspace in the same metadata location and that user group assignments have propagated.

Disconnected sessions and session stability:

Review idle and session limits in RDP properties and GPO; ensure Keep-Alive is configured appropriately.
Confirm UDP is allowed; RDP Shortpath and UDP provide more resilient media and graphics paths.
Investigate session host health and capacity: CPU ready, RAM pressure, page faults, storage latency, and NIC throughput. Enable drain mode only during maintenance.

On-session rapid triage:

From the user’s session, run Performance Monitor with RemoteFX Graphics Frames Skipped/Second counters to determine if drops are server-, network-, or client-induced.
Examine Event Viewer logs: RemoteDesktopServices-RdpCoreTS, TerminalServices-LocalSessionManager, and AVD agent logs under C:\ProgramData\Microsoft\RDInfra and \RDAgent.
Use Azure Monitor for AVD Insights to correlate connection stages, brokering, and host health.

Practical Problem Scenario

Microsoft deploys Azure Virtual Desktop to deliver productivity and engineering tools to a global workforce with mixed devices. They report inconsistent Teams call quality, occasional RemoteApp launch failures for a CAD viewer, and data leakage concerns from drive redirection.

Select regions and validate latency
- Use Azure Virtual Desktop Experience Estimator from primary user geos to candidate regions and choose host pool regions with the lowest measured latency.
- Why: Minimizes round-trip delay for graphics and media, improving responsiveness and call stability.
Standardize images and dynamic app delivery
- Create a minimal Windows 11 Enterprise multi-session image with AVD agents, FSLogix, Defender for Endpoint onboarding, and M365 Apps (shared activation). Publish via Azure Compute Gallery and replicate to required regions.
- Package the CAD viewer as MSIX where possible and deliver via MSIX app attach from Azure NetApp Files.
- Why: Image separation reduces update churn; the gallery ensures consistent, regionally available versions; ANF provides low-latency app attach I/O.
Harden entitlements and redirection
- Publish the CAD viewer and Office as RemoteApps from a RemoteApp application group. Assign users via Azure AD groups and register the application group to a workspace in the same metadata region.
- Set host pool RDP properties to disable drive and clipboard redirection except text; enable printers via Easy Print; allow smart cards.
- Why: Principle of least privilege reduces risk and attack surface; controlled redirection mitigates data exfiltration.
Optimize media and browsers
- Enable Teams optimization and validate the optimized state on clients. Deploy multimedia redirection for Edge with the required service and extension.
- Configure QoS/DSCP for real-time media and confirm UDP egress is permitted from clients and session hosts.
- Why: Offloading media to endpoints reduces session host CPU and improves A/V quality under network variability.
Scale and profile performance
- Store FSLogix profiles on Azure NetApp Files with appropriate SMB multichannel and NTFS permissions. Implement autoscale and Start VM on connect; assign the required custom role to the Azure Virtual Desktop service principal.
- Why: ANF delivers the highest IOPS/lowest latency at scale; autoscale and SVOC lower costs while keeping user experience consistent.
Troubleshoot launch and stability
- For RemoteApp failures, verify MSIX app attach staging/registration and review AppLocker logs for denials; confirm consistent package availability across hosts.
- For screen performance, use PerfMon RemoteFX Frames Skipped/Second counters to isolate server, network, or client issues. Validate that no session hosts are in drain mode unexpectedly.
- Why: Targeted telemetry shortens mean time to resolution and avoids blind image rebuilds.
Maintain client and platform currency
- Roll out Windows and macOS AVD clients in rings, enforcing a minimum client version. Update session hosts with validated image versions from the gallery. Push antimalware as a VM extension.
- Why: Current clients carry codec, optimization, and security fixes; controlled rollouts reduce regression risk while maintaining experience parity.