Microsoft AZ-140: FSLogix, Profiles and User Data — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

FSLogix provides container-based user profiles for Azure Virtual Desktop, attaching a user’s profile as a virtual disk over SMB during sign-in. This design eliminates legacy roaming-profile pitfalls, speeds sign-in, and stabilizes app state across nonpersistent session hosts. FSLogix separates profile state (Profile Container) from Microsoft 365 data and caches (Office Data File Container), and can layer resiliency with Cloud Cache. Correct storage selection, identity-based SMB permissions, and profile-size governance are essential to deliver low-latency sign-ins and high session density.

FSLogix Containers and Data Architecture

FSLogix Profile Containers store the entire user profile in a single virtual disk file located on SMB storage. At sign-in, the disk is mounted to C:\Users\username and the OS sees a native profile.

Disk format: Use VHDX unless compatibility with very old OS is required. VHDX is more resilient to corruption, supports larger sizes, is less prone to metadata issues, and is the FSLogix default. Only use VHD when a specific application or legacy driver requires it.
Sizing: Containers are dynamically expanding by default. Set a maximum size (for example, 30 GB for Profile, 10 GB for Office) and allow dynamic growth. Fixed-size disks rarely improve performance and increase storage consumption and management overhead.
Locks and concurrency: A profile container is locked read/write by the first session host. A second concurrent session for the same user on a different host will be blocked or permitted read-only depending on policy. This protects profile integrity.

Office Data File Container (ODFC) separates high-churn Microsoft 365 data—Outlook OST/Dat files, OneDrive and Teams caches—into its own container. Benefits include:

Faster sign-ins because Office caches no longer inflate the Profile Container.
Independent cleanup or re-baselining of Office caches without touching the user profile.
Reduced risk that Office cache corruption impacts the profile.

Use redirections.xml to exclude volatile folders from the Profile Container to shrink growth and speed sign-in. Common exclusions include Teams cache, browser caches, Temp, and logs. When using ODFC, exclude Office-specific caches from the Profile Container to avoid duplication.

Example redirections.xml (place beside frxtray.exe or define via registry):

<?xml version="1.0" encoding="UTF-8"?>
<FrxProfileFolderRedirection ExcludeCommonFolders="0">
  <Exclude>
    <Path>%LOCALAPPDATA%\Microsoft\Teams\Cache</Path>
    <Path>%LOCALAPPDATA%\Microsoft\Teams\Service Worker</Path>
    <Path>%LOCALAPPDATA%\Temp</Path>
    <Path>%LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_*\AC\#!001\Cache</Path>
    <Path>%APPDATA%\Microsoft\Teams\media-stack</Path>
  </Exclude>
</FrxProfileFolderRedirection>

Storage Platforms and Access Control

Selecting SMB storage for FSLogix is a performance and operational decision:

Azure NetApp Files (ANF): Highest IOPS and lowest latency; ideal for very large and latency-sensitive deployments (for example, tens of thousands of users). Offers SMB volumes with predictable microsecond–low millisecond latency, per-volume throughput tied to capacity pools, snapshot and cross-region replication. Use when you must maximize desktop experience and handle extreme concurrency.
Azure Files Premium (FileStorage): SSD-backed, zone-redundant in many regions, minimal administration, cost-effective for broad enterprise use. Share performance scales with provisioned size; offers up to 100,000 IOPS and multi-GB/s throughput per share as capacity increases. Recommended for most host pools when you need SSD performance without ANF administration.
Azure Files Standard: HDD-backed; fit for small labs or light usage. Not recommended for production FSLogix profiles due to higher latency and variable performance.

UNC paths and DNS:

Azure Files uses the path format \storageaccount.file.core.windows.net\sharename. Ensure session hosts can resolve and reach this endpoint. Private endpoints are recommended for traffic containment.
ANF uses an SMB volume path like \anf-vol-name\share over a delegated subnet via private IP.

Identity-based SMB authentication and permissions depend on the directory service and join state of your session hosts:

Active Directory Domain Services (AD DS) or Azure AD DS: Session hosts are domain-joined; use Kerberos. Configure share permissions and NTFS ACLs with your AD groups.
Microsoft Entra ID Kerberos for Azure Files: Enables SMB access from Entra ID–joined session hosts without AD DS. Assign Azure RBAC at the storage account and ensure client OS and FSLogix versions support this mode.

Minimum permissions (least privilege) for Azure Files in common scenarios:

Grant Storage File Data SMB Share Contributor (Azure RBAC) at the storage account or share scope to the user group when using Entra ID authentication.
Configure NTFS on the share root: Users (or a dedicated AVD users group) Modify; Creator Owner Full on subfolders; Administrators Full; remove inherited permissions that grant excessive access.
For AD DS-authenticated Azure Files, also set the share-level ACL to allow users Modify.

Resiliency, Cloud Cache, and Operational Health

Cloud Cache writes to local cache on the session host and replicates to one or more remote SMB repositories. Benefits include continued operation during a transient storage outage and cross-region resiliency. Design considerations:

Use two to four CCD locations to balance resiliency vs. logon latency. More locations increase attach timeouts during failures.
Ensure ample local cache disk space (typically 20–40 GB per concurrently active user on the host in worst-case scenarios).
Mix targets (for example, primary Azure Files Premium in-region and secondary Azure Files or ANF in paired region). Do not use slow HDD-backed targets for Cloud Cache unless absolutely necessary.

Example configuration (registry) for a profile container with Cloud Cache and ODFC:

reg add HKLM\SOFTWARE\FSLogix\Profiles /v Enabled /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\FSLogix\Profiles /v VolumeType /t REG_SZ /d VHDX /f
reg add HKLM\SOFTWARE\FSLogix\Profiles /v SizeInMBs /t REG_DWORD /d 30720 /f
reg add HKLM\SOFTWARE\FSLogix\Profiles /v IsDynamic /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\FSLogix\Profiles /v CCDLocations /t REG_MULTI_SZ /d "\\store1.file.core.windows.net\profiles\0!\\store2.file.core.windows.net\profiles\0" /f
reg add HKLM\SOFTWARE\FSLogix\Profiles /v DeleteLocalProfileWhenVHDShouldApply /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\FSLogix\ODFC /v Enabled /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\FSLogix\ODFC /v VolumeType /t REG_SZ /d VHDX /f
reg add HKLM\SOFTWARE\FSLogix\ODFC /v SizeInMBs /t REG_DWORD /d 10240 /f

Diagnosing failed sign-ins and profile locks:

Event Viewer: Applications and Services Logs > FSLogix > Apps provides attach, IO, and Cloud Cache diagnostics. Look for access denied (0x5), sharing violation (0x20), or timeouts.
Stale locks: If a crashed session host left handles open, the VHDX may appear in-use. Verify no active sessions, close open files from the SMB server side, and allow FSLogix to retry. Avoid manual deletion of lock files unless you have fully confirmed no active mounts.
Fallback behavior: Use PreventLoginWithFailure to control whether users can sign in with a temporary local profile if attach fails. Consider Try for read-only when the storage is degraded but you still want to allow access; understand changes will not persist.

Cleanup and hygiene:

Enable DeleteLocalProfileWhenVHDShouldApply to remove stale local profiles.
Periodically compact VHDX files offline if they have grown due to transient data.
With Cloud Cache, schedule cleanup of abandoned local cache if a host is decommissioned.

Performance, Scale, and Session Density

Storage IOPS and latency directly determine sign-in time, app responsiveness, and how many concurrent sessions each host can carry:

Latency target: Sub-2 ms to single-digit ms storage latency during logon storms yields the best experience. ANF commonly achieves the lowest latency. Azure Files Premium is typically low single-digit ms when accessed over private endpoints.
IOPS characteristics: FSLogix exhibits significant burst IOPS during sign-in (tens to hundreds per user) and modest steady-state IOPS (generally 3–15 per user depending on workload). Multiply by concurrent logons to size storage.
Azure Files Premium scaling: Increase provisioned share size to raise IOPS and throughput ceilings; enable SMB Multichannel on supported OS to improve per-host throughput.
ANF capacity and tiering: Choose ANF performance tiers based on MiB/s per provisioned TiB; Premium and Ultra tiers are common for heavy Office and CAD users. Use multiple volumes to parallelize I/O for very large deployments.

Network path matters. Use private endpoints and ensure session hosts are in the same region as storage to avoid WAN latencies. Place hosts and storage in the same virtual network or peered networks with low-latency paths.

Managing Microsoft 365 Data and Profile Growth

Combine ODFC, OneDrive Files On-Demand, and Known Folder Move (KFM) to control growth:

ODFC: Roams Outlook OST, OneNote caches, and Office Wef data in a separate container. This reduces churn in the Profile Container and speeds logons.
OneDrive per-machine with Files On-Demand: Installs OneDrive in Program Files so all users share the binary; Files On-Demand keeps placeholders in the profile and hydrates content on access, limiting container growth.
KFM: Redirects Desktop, Documents, and Pictures into OneDrive with the same user experience on any device. With Files On-Demand, only accessed files hydrate locally, further reducing growth.
Exclusions: If you aggressively minimize container size, you can exclude OneDrive’s sync cache via redirections.xml; this will rehydrate on-demand after each sign-in. This approach saves space but may increase first-open latency for large files. In most cases, Files On-Demand alone is sufficient without excluding OneDrive.
Microsoft Teams optimizations: Use the AVD-optimized Teams and exclude ephemeral Teams caches with redirections.xml to avoid repeated heavy I/O.

Security, Backup, and Recovery

Encryption in transit: SMB 3.1.1 encryption and signing protect data over the wire. Enforce encryption where supported.
Encryption at rest: Azure Files and ANF encrypt data at rest by default. For higher assurance, use customer-managed keys with Azure Files; ANF supports double encryption and volume-level keys in certain regions.
Access control: Minimize privileges. For Azure Files with Entra ID Kerberos, grant Storage File Data SMB Share Contributor and restrict NTFS to Modify for users. For AD DS-based access, set share and NTFS ACLs to least privilege. Use separate groups for read/write and admins.
Network isolation: Use private endpoints or ANF delegated subnets. Restrict storage firewall to trusted subnets.
Backup and snapshots:
- Azure Files: Use Azure Backup for Azure Files; configure daily snapshots with retention that meets RPO/RTO. Enable soft delete to protect against accidental deletions.
- ANF: Use snapshot policies and, if required, cross-region replication for DR. Test mounting a snapshot as a read-only share to recover individual profiles quickly.
Recovery: Preferred restore is item-level (restore a single user’s VHDX) to a quarantine path, validate integrity, and swap pointers. Maintain a playbook for profile corruption that includes quick detach, snapshot-restore, and user communication.

Practical Problem Scenario

Siemens AG needs to improve Azure Virtual Desktop sign-in times for 12,000 engineers using Windows 11 Enterprise multi-session with Microsoft 365 Apps, Teams, and OneDrive. Profiles are on an overloaded standard file share, causing high latency during morning logon storms and frequent profile lock incidents.

Migrate profile storage to Azure NetApp Files Premium SMB volumes in the same region as the host pools.

Why: ANF delivers the lowest latency and predictable high IOPS needed for thousands of concurrent logons. Keeping storage and hosts co-located minimizes round-trip time.

Separate Office caches using FSLogix ODFC and reduce Profile Container max size to 20 GB while setting ODFC to 10 GB, both as dynamic VHDX.

Why: Isolating volatile Microsoft 365 data reduces profile churn and speeds container attach. Dynamic VHDX conserves capacity while allowing burst growth when needed.

Implement Cloud Cache with two CCD locations: primary ANF volume and secondary Azure Files Premium share in the paired region over private endpoints.

Why: Cloud Cache ensures continuity during maintenance or transient storage events. The secondary region improves resiliency without manual failover.

Enforce least-privilege access with Azure RBAC and NTFS: assign the engineering AVD group Storage File Data SMB Share Contributor on the Azure Files secondary and grant Modify NTFS on both repositories; administrators receive Full Control. Enforce SMB encryption.

Why: Proper share and NTFS permissions enable FSLogix to create and write VHDX files securely while preventing over-privileged access. Encryption protects data in transit.

Deploy OneDrive per-machine with Files On-Demand and enable Known Folder Move for Desktop, Documents, and Pictures. Keep OneDrive within the container but exclude transient Teams caches via redirections.xml.

Why: KFM standardizes user data locations and Files On-Demand prevents bulk hydration, controlling profile growth. Excluding Teams caches reduces repeated I/O without affecting user files.

Tune FSLogix and monitor: enable DeleteLocalProfileWhenVHDShouldApply, set PreventLoginWithFailure to allow temporary local profiles only for Tier-0 break-glass accounts, and instrument sign-in telemetry.

Why: Automated cleanup eliminates stale local profiles, while controlled fallback prevents silent data divergence. Monitoring verifies reduced logon times and detects anomalies.

Protect and recover: configure ANF snapshot policies with hourly short-term and daily long-term retention; enable cross-region replication on critical volumes; enable Azure Backup for the Azure Files secondary. Test restoring an individual user VHDX monthly.

Why: Snapshots give fast point-in-time recovery for individual profiles; replication and backup provide layered protection against regional or operational failures and ensure predictable RPO/RTO.

← Session Host Images and Provisioning · All domains · Session Host Operations →

Practice these questions → · Timed practice on ExamRoll.io →