Microsoft AZ-140: Identity, Access and Governance — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Identity, access, and governance define how users, devices, and automation interact with Azure Virtual Desktop resources. A robust design aligns Microsoft Entra ID as the identity control plane, applies least-privilege permissions with Azure RBAC scoped to AVD resources, enforces conditional access and multifactor authentication, and operationalizes automation with managed identities. Decisions such as whether session hosts are Microsoft Entra joined or hybrid Microsoft Entra joined drive downstream requirements for DNS, authentication, profile storage, and Conditional Access behavior.

Identity and Directory Design

Microsoft Entra ID tenants, users, and groups
- The AVD control plane is native to Microsoft Entra ID. Users must exist in the tenant that owns the AVD resources or be B2B guest users with appropriate assignments.
- Use Microsoft Entra security groups—static or dynamic—for application group assignments and for role-based administration. Avoid nested groups for AVD role assignments; Azure RBAC does not evaluate nested membership for role assignments.
Group-based assignment to AVD application groups
- Users are entitled to remote apps or desktops by assigning users or groups to the application group. At authorization time, Azure applies a role assignment of Desktop Virtualization User at the application group scope to those principals.
- Prefer group assignments over individual users to simplify lifecycle management and access reviews. Use dynamic groups driven by user attributes or department to map users to the correct RemoteApp or Desktop application groups.
Microsoft Entra joined versus hybrid Microsoft Entra joined session hosts
- Microsoft Entra joined: No line-of-sight to traditional domain controllers. Ideal for cloud-first deployments. Supports modern auth and SSO to the session with Microsoft Entra ID. For FSLogix, use Azure Files with Microsoft Entra Kerberos so hosts authenticate to profiles without AD DS.
- Hybrid Microsoft Entra joined (domain-joined to AD DS and registered in Entra ID): Required if you must use existing Group Policy, on-premises Kerberos/NTLM, or SMB targets that require AD DS. Ensure VNET DNS points to domain controllers that can resolve and service the domain. If using Azure AD DS (managed domain), set the VNET DNS servers to the managed domain IPs before domain-joining session hosts.
Hybrid identity, Microsoft Entra Connect, password hash synchronization, and seamless SSO
- Use Microsoft Entra Connect to synchronize user identities from AD DS. Password hash synchronization is the simplest, most resilient sign-in method and supports cloud-side Conditional Access.
- Enable Seamless SSO so corporate devices on the internal network can obtain Kerberos-based single sign-on to Entra ID without prompting for credentials. This improves user experience when launching AVD from managed networks while still allowing Conditional Access enforcement.

Access Control and Least Privilege

Built-in Azure RBAC roles for AVD
- Desktop Virtualization Administrator: Full administrative control over AVD resources.
- Desktop Virtualization Contributor: Manage AVD resources without granting access to end users.
- Desktop Virtualization Reader: View AVD resources.
- Desktop Virtualization Host Pool Contributor: Manage host pool settings and registration keys; not full control over other AVD resources.
- Desktop Virtualization Workspace Contributor: Publish or remove application groups from a workspace.
- Desktop Virtualization Application Group Contributor: Manage application group properties and published apps; does not grant user access.
- Desktop Virtualization Session Host Operator: Help-desk oriented; view session hosts, user sessions, send messages, disconnect or log off sessions.
- Desktop Virtualization User: Assigned to users/groups at the application group scope to authorize launches.
Role-assignment scopes and patterns
- Scope permissions as narrowly as possible:
  - Assign Desktop Virtualization User to users/groups at the application group scope only.
  - Assign Application Group Contributor to the app group; Workspace Contributor to the workspace; Host Pool Contributor to the host pool.
  - Assign Virtual Machine Contributor and related compute/storage/network roles at the resource group that contains session host VMs if operational staff must manage guest power, sizes, or network interfaces.
- Separate resource groups for control-plane objects (workspaces, host pools, application groups) and session host VMs improves scoping and auditability.
Managed identities, service principals, and delegated automation
- Prefer system- or user-assigned managed identities for AVD autoscale and operational runbooks. Grant only the roles needed, at the minimal scope, to manipulate the target resources (for example, Virtual Machine Contributor on the session host resource group and Desktop Virtualization Contributor on the host pool).
- Use service principals with certificate credentials for DevOps pipelines that publish app groups or update RDP properties. Confine their permissions to the specific AVD resources they manage.
Privileged Identity Management and emergency access
- Use Microsoft Entra Privileged Identity Management for both Azure RBAC and Microsoft Entra roles. Make high-risk roles, such as Desktop Virtualization Administrator and Subscription Owner, eligible and require MFA, approvals, and justification.
- Maintain at least two emergency access (break-glass) Global Administrator accounts, excluded from Conditional Access and PIM, stored offline, tested periodically, and used only for recovery.

Short examples for role scoping:

# End-user entitlement to one application group
az role assignment create \
  --assignee <groupObjectId> \
  --role "Desktop Virtualization User" \
  --scope /subscriptions/<subId>/resourceGroups/rg-avd-control/providers/Microsoft.DesktopVirtualization/applicationGroups/ag-fin-remoteapps

# Help-desk session operations on a host pool
az role assignment create \
  --assignee <helpdeskGroupId> \
  --role "Desktop Virtualization Session Host Operator" \
  --scope /subscriptions/<subId>/resourceGroups/rg-avd-control/providers/Microsoft.DesktopVirtualization/hostPools/hp-fin

Conditional Access, MFA, and Session Controls

Cloud apps to target
- Apply Conditional Access to both Azure Virtual Desktop and Azure Virtual Desktop Azure Resource Manager to protect end-user connections and administrative actions. Exclude break-glass accounts and non-interactive workload identities.
Multifactor authentication and authentication strengths
- Require MFA for all external or high-risk sign-ins. Use authentication strengths to mandate phishing-resistant methods (for example, FIDO2 security keys, device-bound passkeys in Microsoft Authenticator, or certificate-based authentication).
- For best user experience with Windows client, pair phishing-resistant MFA with AVD single sign-on so users authenticate once to Entra ID and are seamlessly signed into the Windows session.
Device compliance and Intune signals
- To restrict access to managed endpoints, use Conditional Access with Require device to be marked as compliant. This evaluates Microsoft Intune compliance state from Windows, macOS, iOS, and Android devices using the Remote Desktop client.
- For BYOD or unmanaged devices, use alternative controls such as MFA, sign-in risk-based policies, Terms of Use, and session limitations. Consider separate application groups for BYOD with restricted apps.
Session controls and sign-in frequency
- Configure sign-in frequency appropriate for productivity and risk (for example, 12 hours) to avoid repeated prompts during reconnects. Persistent browser session is not applicable to native Remote Desktop clients. Leverage Continuous Access Evaluation where supported for rapid policy changes and risk revocation.
Network and location considerations
- Use named locations to reduce friction for trusted office networks. For remote workers, combine MFA and device compliance to maintain a strong posture.

Operational Identity Considerations for Hosts

DNS and domain join
- For AD DS or Azure AD DS-joined hosts, set VNET DNS servers to the domain controller IPs or managed domain IPs before provisioning. Without correct DNS, domain join will fail, and FSLogix, GPO, and Kerberos will be inoperable.
- For Microsoft Entra joined hosts, you do not need AD DS DNS; however, profile SMB targets still require modern auth capability (Microsoft Entra Kerberos with Azure Files).
Registration keys and scale-out
- Adding existing or new session hosts to a host pool requires a valid registration key. Limit key lifetime and scope the VM extension deployment to the host pool resource only.
Start VM on Connect and autoscale
- For autoscale features that deallocate/allocate VMs, assign the scaling plan’s managed identity Virtual Machine Contributor on the host VM resource group and Desktop Virtualization Contributor on the host pool. Avoid granting subscription-wide rights.
Access reviews and entitlement lifecycle
- Implement periodic access reviews for Entra groups that are assigned to application groups. Integrate with Entitlement Management where application access spans multiple app groups or resources.
Auditing
- Monitor Microsoft Entra sign-in and audit logs for AVD app access, and Azure Activity Logs for AVD resource changes. Stream to Log Analytics or a SIEM with alerts for anomalous activity (for example, mass session logoffs or unexpected role assignments).

Practical Problem Scenario

Tailwind Traders is enabling secure remote access to line-of-business apps via Azure Virtual Desktop for 3,000 users. They have an on-premises AD forest synchronized to Microsoft Entra ID with password hash synchronization and Seamless SSO. They will modernize with Microsoft Entra joined session hosts for net-new pools while retaining one legacy hybrid pool that requires GPOs. They must enforce phishing-resistant MFA, allow access only from compliant devices when off-premises, delegate help-desk session operations, and run autoscale with least privilege.

Decide host join models and DNS
- Action: Deploy a new pooled host pool with Microsoft Entra joined Windows 11 Enterprise multi-session for most users; keep a smaller hybrid-joined pool for an app requiring GPO.
- Why: Entra joined reduces dependency on domain controllers and simplifies Conditional Access. The legacy pool preserves required GPOs. For the hybrid pool, VNET DNS is set to on-prem DC IPs reachable via VPN to ensure domain join and Kerberos.
Profile storage with modern auth
- Action: Use Azure Files with Microsoft Entra Kerberos for FSLogix for the Entra-joined pool. Configure share-level and file permissions for users and session host managed identities.
- Why: Enables domainless SMB access using Entra ID, eliminating AD DS dependency for profiles in the cloud-first pool.
Group-based entitlements
- Action: Create Entra security groups per persona (for example, grp-tt-hr-remoteapps, grp-tt-sales-desktop). Assign these groups to the appropriate application groups; avoid nested groups.
- Why: Centralizes access control and enables access reviews. Direct group assignments are reliably evaluated by Azure RBAC for AVD.
Conditional Access with authentication strengths
- Action: Create policies targeting Azure Virtual Desktop and Azure Virtual Desktop Azure Resource Manager:
  - Require authentication strength “Phishing-resistant MFA.”
  - For locations outside trusted offices, also require device to be marked as compliant.
  - Set sign-in frequency to 12 hours for end users.
  - Exclude two break-glass accounts and the autoscale managed identity.
- Why: Enforces strong factors and managed device access without excessive prompts, and avoids blocking emergency or workload identities.
Delegate least-privilege operations
- Action: Assign roles at minimal scopes:
  - Desktop Virtualization User to entitlement groups on their application group scopes.
  - Desktop Virtualization Session Host Operator to the help-desk group at each host pool.
  - Desktop Virtualization Workspace Contributor to the app publishing team at the workspace.
  - Virtual Machine Contributor to the ops team on the session host resource group only.
- Why: Aligns duties to scopes they manage, preventing over-privilege at the subscription level.
Configure autoscale with a managed identity
- Action: Enable autoscale on the host pool with a user-assigned managed identity. Grant it Virtual Machine Contributor on the session host resource group and Desktop Virtualization Contributor on the host pool. Example:

az role assignment create --assignee <miObjectId> --role "Virtual Machine Contributor" --scope /subscriptions/<sub>/resourceGroups/rg-tt-avd-hosts
az role assignment create --assignee <miObjectId> --role "Desktop Virtualization Contributor" --scope /subscriptions/<sub>/resourceGroups/rg-tt-avd-control/providers/Microsoft.DesktopVirtualization/hostPools/hp-tt-prod

Why: Autoscale can start and stop VMs and update host pool metrics without broad privileges.

Protect administration with PIM and break-glass
- Action: Onboard administrative RBAC roles to Microsoft Entra PIM with approval workflows and MFA. Maintain two break-glass Global Administrator accounts excluded from CA and PIM.
- Why: Reduces standing privilege and ensures recoverability if Conditional Access or identity services misconfigure.
Monitor and review access periodically
- Action: Stream Entra sign-in logs and Azure Activity Logs to Log Analytics. Run quarterly access reviews for groups assigned to application groups and for help-desk operator roles.
- Why: Sustains least privilege over time and detects anomalies such as unexpected increases in denied AVD sign-ins or mass session terminations.

This approach combines cloud-first identity with precise scoping and strong access policies, balances user experience with security, and ensures operations and automation are delegated only the rights required.

← Azure Virtual Desktop Architecture and Service Design · All domains · Networking →

Practice these questions → · Timed practice on ExamRoll.io →