Microsoft AZ-140: Session Host Images and Provisioning — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Session host images and provisioning underpin the reliability, performance, and security posture of Azure Virtual Desktop. Well-governed image pipelines minimize drift, accelerate rollout, and enable safe rollback while ensuring every session host is identically configured and properly joined to the right identity boundary. This section covers image source selection, Windows Enterprise multi-session options, Azure Compute Gallery, generalization and lifecycle, automation tooling, join models, agent registration, update strategy, and hardening with validation.

Image Sources and Operating System Options

Choosing the right base image and OS determines supportability, management effort, and user experience.

Azure Marketplace images versus custom images
- Marketplace images provide Microsoft-maintained baselines such as Windows 11 Enterprise multi-session and variants that include Microsoft 365 Apps. They reduce time-to-deploy, ensure current patches, and include image metadata required by Azure.
- Custom images are recommended when you must preinstall line-of-business apps, agents (FSLogix, Defender for Endpoint), language packs, or security baselines. Build from a Marketplace base, customize, generalize, and publish to Azure Compute Gallery for versioned distribution.
- Operational guidance: Prefer Marketplace where possible for agility. Move to custom images once repeatable customization requirements arise; avoid ad-hoc per-VM configuration to reduce drift.
Windows Enterprise multi-session images and supported operating-system choices
- Windows 11 Enterprise multi-session is the current strategic client OS for pooled host pools; Windows 10 Enterprise multi-session remains supported for existing estates.
- Microsoft Entra ID join is supported for Windows 11 Enterprise and Windows 11 Enterprise multi-session. Windows Server (2019/2022) remains valid for app remoting scenarios or where server-only features and hotpatching are desired, but it lacks the full M365 desktop experience available on client multi-session.
- Marketplace variants (for example, “Windows 11 Enterprise multi-session + Microsoft 365 Apps”) simplify correct M365 App servicing and shared computer activation.

Image Management with Azure Compute Gallery

Azure Compute Gallery (formerly Shared Image Gallery) is the authoritative way to manage golden images at scale.

Image definitions and versions
- A definition captures OS type, publisher/offer/SKU semantics, and “family” attributes. Versions represent immutable, timestamped snapshots of the definition.
- Use semantic versioning (for example, 1.0.0 → 1.1.0 → 1.2.0) aligned to change scope (patch, minor, major). Always leave the prior production version available for rollback.
Replication and regional placement
- Replicate image versions to the Azure regions where host pools will be deployed to minimize provisioning time and avoid cross-region dependencies. For example, replicate Image1 from East US to South India before creating host VMs in South India.
- Update replication settings at the image version level to introduce or remove regions without rebuilding the image.
Exclusions and “latest” alias
- The gallery exposes a “latest” alias per definition that templates can target. To pin deployments to a specific version or hold back a candidate, set ExcludeFromLatest on the newer version.
- Example: To make 1.1.0 the default while 1.2.0 is still being validated, mark 1.2.0 as excluded from latest so new VMs provision from 1.1.0 by default.
Governance and access
- Assign reader roles on the gallery to deployment identities; use RBAC and resource locks to protect production versions. Employ Azure Policy to restrict images allowed for session hosts.

Provisioning, Generalization, and Automation

A disciplined image lifecycle and automation prevent configuration drift and ensure unique identities across hosts.

Sysprep, generalization, and unique identities
- Before capturing a Windows image, remove machine-specific data so new hosts get distinct names, SIDs, and identities. From an elevated prompt:
```
sysprep /oobe /generalize /shutdown /mode:vm
```
- Validate that Windows is updated, any per-user secrets are cleared, and event logs rotated. Do not domain-join the image to be captured.
Azure Image Builder and repeatable customization
- Azure Image Builder orchestrates image creation using a declarative pipeline that can add software, apply baselines, inject language packs, run Windows Update, and publish to Azure Compute Gallery.
- Enforce repeatability: store AIB templates in version control, drive parameterized builds, and promote images through dev → validation → production galleries or regions.
Azure Resource Manager templates, Bicep, and deployment automation
- Define host pools, application groups, workspaces, VM scale sets, and session host VMs as code. Parameterize image reference (gallery/definition/version), network, size, and identity.
- Use Key Vault references for secrets where AD DS domain join is required. For large deployments, pre-validate regional vCPU quotas to avoid provisioning failures.

Example: Bicep snippet to install the AVD agent with a registration token during VM provisioning

@secure()
param avdRegistrationToken string

resource avdAgent 'Microsoft.Compute/virtualMachines/extensions@2023-09-01' = {
  name: '${vmName}/Microsoft.DesktopVirtualization-AVDAgent'
  location: location
  properties: {
    publisher: 'Microsoft.DesktopVirtualization'
    type: 'rdagent'
    typeHandlerVersion: '1.0'
    autoUpgradeMinorVersion: true
    settings: {
      registrationInfoToken: avdRegistrationToken
    }
  }
}

Join Options, Registration, and Network/DNS Considerations

Identity join and agent registration must be planned alongside name resolution and routing.

Domain join and Microsoft Entra join during session-host deployment
- AD DS join: Supported for Windows 10/11 Enterprise multi-session and Windows Server. Use the “JSONADDomainExtension” or native domainJoin properties in your deployment workflow. Delegate join rights to a service account with constrained OU scope.
- Microsoft Entra ID join: Supported for Windows 11 Enterprise and Windows 11 Enterprise multi-session. This removes the dependency on domain controllers and can simplify device lifecycle with cloud-only identity and Conditional Access. Ensure AVD client and management prerequisites are met before enabling.
- Azure AD DS join: When using a managed domain, configure the VNet DNS servers to the Azure AD DS IPs first; otherwise, deployment and join will fail because session hosts cannot resolve the managed domain.
DNS and connectivity requirements
- Ensure VNet DNS points to resolvers that can resolve the target domain and records for Azure services. For hybrid AD DS, use domain controller IPs reachable over peering or VPN; configure multiple DNS servers to maintain resiliency.
- For cross-VNet deployments, update the child VNet DNS settings; do not rely on default Azure DNS for AD DS joins.
Session-host agent bootstrapping and registration-token use
- The AVD agent pair (Remote Desktop Agent Loader and side-by-side stack) registers a VM to a host pool using a time-limited registration token. Generate the token at the host pool level and inject it at build time or via VM extensions.
- When onboarding existing VMs to a host pool, generate a new registration key before installing the agent so the VM can register with the broker.

Update, Security Hardening, and Validation

Treat session hosts as immutable; scale out new hosts with a new image, drain and retire old ones.

Update strategy: image updates, hotpatching, and rollback planning
- Image updates: Produce a new gallery version for monthly quality and feature updates, validate, then scale out. Use “drain mode” to evict users before deallocation and removal of old hosts.
- Hotpatching: Only applicable to Windows Server Azure Edition; it reduces reboots during patching. Windows 10/11 Enterprise multi-session does not support hotpatching—use normal cumulative updates in your image pipeline plus emergency out-of-band patches as needed.
- Rollback: Keep at least one prior production image version replicated in all regions. If issues are detected, provision new hosts from the previous version and reassign capacity. Use gallery ExcludeFromLatest to hold back problematic builds.
Image security hardening
- Baselines: Apply Microsoft security baselines for Windows 10/11 or equivalent CIS hardening in the image pipeline. Validate with Defender for Cloud and vulnerability assessment.
- Identity and access: Remove local admin where possible, enable Windows LAPS for any local administrator accounts, and enforce MFA/Conditional Access for AVD sign-in.
- Disk and data protection: Use platform-managed or customer-managed keys for disk encryption sets. Store FSLogix profiles on resilient storage; for very large user counts and low latency requirements, Azure NetApp Files provides the highest IOPS and lowest latency profile storage.
- Application control and attack surface reduction: Enable Windows Defender Application Control where feasible, configure ASR rules, and deploy Microsoft Defender for Endpoint.
- Policy and drift control: Use Azure Policy to restrict VM images and extensions; audit deviations and block out-of-process changes.
Testing in a validation host pool
- Maintain a small, separate validation host pool. Set it as a validation environment to receive AVD agent pre-release updates and validate new image versions, FSLogix changes, and GPOs before production promotion.
- Measure user experience in-session. For example, to quickly triage perceived display issues, check RemoteFX Graphics Frames Skipped/Second counters in Performance Monitor to isolate client, network, or server bottlenecks.

Practical Problem Scenario

Siemens needs to standardize Azure Virtual Desktop across Western Europe and South India with Windows 11 Enterprise multi-session hosts. They require repeatable image customization, fast rollouts, safe rollback, and the ability to support both Microsoft 365 Apps and a line-of-business add-in. A managed Azure AD DS domain exists in the European hub VNet, and Siemens plans to deploy pooled host pools in both regions.

Prepare name resolution and join prerequisites
- Action: Set the DNS servers on both VNets to the Azure AD DS IPs and ensure VNet peering allows forwarded DNS traffic.
- Why: Session hosts must resolve the managed domain for AD DS join. Updating VNet DNS first prevents join-time failures and ensures Kerberos and LDAP resolution.
Build a golden image with Azure Image Builder
- Action: Start from the Marketplace “Windows 11 Enterprise multi-session + Microsoft 365 Apps” image. Use Azure Image Builder to add FSLogix, Defender for Endpoint, language packs, and security baselines; then run Windows Update and sysprep generalization.
- Why: AIB guarantees a repeatable, auditable pipeline that minimizes drift and produces a sealed image, ensuring every host is identical and compliant.
Publish and replicate via Azure Compute Gallery
- Action: Publish the captured image as version 1.0.0 in the Azure Compute Gallery and replicate to West Europe and South India. Mark 1.0.0 as latest; when preparing 1.1.0, set 1.1.0 to ExcludeFromLatest until validation completes.
- Why: Gallery replication positions the image close to where hosts are created for faster provisioning and provides controlled promotion via latest and exclusion flags.
Automate host pool and VM provisioning with Bicep
- Action: Deploy host pools, application groups, and scaling plans as code. Create session hosts from the gallery version using a parameterized Bicep template that installs the AVD agent with a freshly generated registration token and performs AD DS domain join via the domain extension.
- Why: Infrastructure as code ensures consistency across regions, makes rollouts idempotent, and streamlines registration to the broker with minimal manual steps.
Validate in a dedicated validation host pool
- Action: Stand up a small validation host pool in West Europe, enable validation environment, and direct a pilot group to it. Measure login performance, FSLogix behavior, and graphics counters; resolve findings, then remove ExcludeFromLatest on 1.1.0.
- Why: Early detection of regressions prevents broad user impact and allows Siemens to promote only proven images.
Execute production rollout with rollback safety
- Action: Scale out new hosts in both regions from 1.1.0. Place old hosts in drain mode, deallocate and remove them after sessions end. Keep 1.0.0 available for two release cycles.
- Why: Blue-green style replacement avoids in-place drift and enables instant rollback by provisioning from the previous image if issues arise.
Harden and govern continuously
- Action: Apply Azure Policy to restrict allowed images and required extensions, enable Defender for Cloud recommendations, and store FSLogix profiles on Azure NetApp Files for predictable high performance.
- Why: Ongoing governance and high-performance profile storage sustain user experience at scale while preserving security posture.