Microsoft AZ-140: Monitoring, Diagnostics and Troubleshooting — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Monitoring, diagnostics, and troubleshooting in Azure Virtual Desktop (AVD) combine resource-level platform logs, in-guest telemetry, and analytics to detect issues early, isolate root causes quickly, and validate user experience. A solid architecture uses Azure Monitor, Log Analytics, Azure Monitor Agent, data collection rules, and curated workbooks, with proactive alerting on service health and user-impacting conditions. This section explains how to design the monitoring pipeline, enable diagnostics, collect the right data from session hosts, analyze it with Kusto Query Language (KQL), and respond to the most common operational problems, including client connectivity, AVD agent failures, FSLogix profile issues, and resource bottlenecks.

Azure Monitor and Log Analytics Architecture for AVD Insights

Azure Virtual Desktop Insights is a solution built on Azure Monitor Workbooks and Log Analytics that correlates AVD platform resource logs with guest OS telemetry to provide health, capacity, and user-experience views. Its effectiveness depends on two data planes:

Platform/resource logs from AVD resources (host pools, workspaces, application groups, and the AVD service) via diagnostic settings.
Guest telemetry from session hosts via Azure Monitor Agent (AMA) and Data Collection Rules (DCRs), including Windows event logs and performance counters.

Workspace architecture and design considerations:

Centralized vs. per-landing-zone workspaces: A single, regionally close workspace simplifies queries, alerting, and governance. Very large estates or strict data-sovereignty requirements may justify multiple workspaces. Avoid unnecessarily cross-region data ingestion due to latency and cost.
Data retention and cost: Size retention to your investigation windows and regulatory needs. Typical operational retention is 30–90 days, with archive-to-storage for long-term. Enable basic logs only if appropriate; AVD diagnostic logs are best as analytics logs for query performance.
Multi-tenant/multi-subscription: Use Azure Monitor’s resource-centric access and Azure RBAC to grant scoped query permissions to operations teams. Stream logs to Event Hubs for SIEM when needed.
Dependency visibility: Enable VM insights or collect performance counters to correlate CPU, memory, disk, and network with AVD session and connection data.

AVD Insights workbooks rely on both diagnostic settings and in-guest telemetry; if either is missing, visualizations will be incomplete.

Enabling Diagnostics and Collecting Telemetry

Diagnostic settings on AVD resources

Enable diagnostic settings for each of the following resource types and send to your Log Analytics workspace. Optionally archive to storage for long-term retention and stream to Event Hubs for external analytics.

Host pools: Enable categories such as Connection, HostRegistration, Checkpoint, Management, Error, and NetworkData. These capture connection attempts, agent registration state changes, session checkpoints, and management operations.
Application groups and workspaces: Enable Management and Error to capture feed publishing, assignments, and configuration changes.
AVD service-level logs: Where available, enable Error and Management to gain visibility into service operations relevant to your tenant.

Azure Monitor Agent and DCRs on session hosts

Agent choice: Use Azure Monitor Agent (AMA). The legacy Log Analytics agent (MMA) is deprecated and should be removed to avoid duplication and confusion.
Data Collection Rules (DCRs): Author DCRs to collect:
- Windows event logs:
  - Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
  - Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
  - Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  - Microsoft-FSLogix-Apps/Operational and Admin
  - System and Application (for core OS, networking, VSS, SMB, storage, and profile events)
- Performance counters:
  - Processor(_Total)% Processor Time
  - System\Processor Queue Length
  - Memory\Available MBytes, Memory\Committed Bytes
  - LogicalDisk(_Total)\Avg. Disk sec/Read, Avg. Disk sec/Write, Disk Transfers/sec, Free Megabytes
  - Network Interface(*)\Bytes Total/sec, Output Queue Length
  - Terminal Services\Active Sessions, Inactive Sessions, Total Sessions
  - RemoteFX Graphics(*)\Frames Skipped/Second (server, network, client)
- Heartbeat (enabled by AMA) for host liveness.
Scope and governance: Assign DCRs to host pools’ resource groups or to dynamic VM scopes using tags. Avoid overlapping DCRs that collect the same counters or event channels to prevent duplicate data and excess cost.
VM insights: Optionally enable VM insights for curated performance and dependency views; it also populates InsightsMetrics for richer performance trend analysis.

Operational Analysis and Troubleshooting Techniques

Workbooks and dashboards

Use AVD Insights workbooks for a curated overview: connection success/failure rates, session distribution, host registration status, and session host performance. Create custom workbooks for business units or host pools with key performance indicators aligned to SLAs (for example, first-failure-time-to-detect, logon duration proxies, session density).

Kusto queries for common investigations

Connection failures by stage and message:

AzureDiagnostics
| where Category == "Connection"
| extend p = parse_json(Properties)
| summarize Attempts = count(), Failures = countif(tostring(p.Status) != "Success")
          by FailureStage = tostring(p.FailureStage),
             FailureMessage = tostring(p.FailureMessage)
| order by Failures desc

Session counts per host and capacity pressure:

Perf
| where ObjectName == "Terminal Services" and CounterName in ("Active Sessions","Total Sessions")
| summarize Avg=count(), AvgValue=avg(CounterValue) by bin(TimeGenerated, 5m), Computer, CounterName

Agent registration health:

AzureDiagnostics
| where Category == "HostRegistration"
| extend p = parse_json(Properties)
| summarize Latest = arg_max(TimeGenerated, tostring(p.RegistrationState), tostring(p.Details))
          by ResourceId
| where Latest_RegistrationState != "Registered"

High CPU detection:

Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total"
| summarize AvgCPU = avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| where AvgCPU > 85

FSLogix errors:

Event
| where Source == "Microsoft-FSLogix-Apps"
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc

Connection diagnostics and common client issues

Stages to validate:
- Feed discovery: Workspace retrieval requires internet access and successful Azure AD authentication. Conditional Access or time skew can block token acquisition; verify device compliance policies and NTP synchronization.
- Broker and gateway negotiation: Ensure outbound TCP 443 to AVD service endpoints is allowed through firewalls and proxies. SSL inspection can break WebSocket connections; exempt AVD endpoints from interception.
- RDP transport: When RDP Shortpath for public or managed networks is enabled, allow UDP 3390 as designed. If blocked, clients fall back to TCP, which can degrade user experience.
Symptoms and causes:
- Frequent disconnects or poor video: UDP blocked or high packet loss; verify QoS and WAN capacity, prioritize real-time traffic.
- “No available resources”: Host registration failed or capacity exhausted; confirm agent health and session limits.
- Slow logons: Profile container attach delays, GPO processing, or antivirus real-time scanning on profile paths.

Windows event logs, Remote Desktop components, and AVD agent

Key services: Remote Desktop Services (TermService), Remote Desktop Services Infrastructure Agent (RdAgent), and Remote Desktop Agent Loader (RDAgentBootLoader).
Agent logs on disk: C:\ProgramData\Microsoft\RDInfra\RDAgent\Logs and C:\ProgramData\Microsoft\RDInfra\RDAgentBootLoader\Logs.
Relevant event channels:
- RdpCoreTS/Operational for transport and protocol errors.
- TerminalServices-LocalSessionManager/Operational for session lifecycle.
- TerminalServices-RemoteConnectionManager/Operational for connection authorization and brokering.
Troubleshoot agent registration:
- Verify DNS, time sync, and outbound 443.
- Ensure session host can resolve and reach AVD service endpoints.
- Regenerate and apply a current registration token if the host was manually onboarded and the token expired.

FSLogix logs and profile troubleshooting

Logs: C:\ProgramData\FSLogix\Logs\Profile*.log and Event Viewer under Microsoft-FSLogix-Apps.
Common failure modes:
- Access denied or sharing violation on VHD(X): Fix share and NTFS ACLs; ensure only one active session per user profile if multi-session overlap is not allowed.
- Disk full or latency spikes: Monitor storage capacity and IOPS. Premium or Azure NetApp Files often required for large, IOPS-intensive estates.
- Cloud Cache: Review CCDLocations and cache drive capacity; WAN instability can inflate logon time.
Best practices:
- Exclude VHD(X) attach paths from antivirus on-access scanning.
- Use redirections.xml to keep large volatile folders out of the profile container.
- Validate Kerberos for Azure Files AD DS authentication; DNS and SPNs must be correct.

CPU, memory, disk, and network analysis

CPU: High % Processor Time with sustained System\Processor Queue Length > 2 per vCPU indicates CPU contention. Increase vCPU or reduce session density.
Memory: Low Memory\Available MBytes and high paging (Memory\Pages/sec) cause stalls; add RAM or reduce session density. Watch commit limit and working sets of heavy apps.
Disk: Latency thresholds typically < 5–10 ms for reads/writes on profile and temp paths; monitor LogicalDisk\Avg. Disk sec/Read and Write. Storage-class mismatch manifests as long logons and sluggish app I/O.
Network: Network Interface\Bytes Total/sec and Output Queue Length show saturation. High TCP retransmits and packet loss degrade RDP quality; confirm QoS prioritization for AVD traffic.

Proactive Dashboards, Alerts, and Service Health

Dashboards: Publish workbooks showing per-host session density vs. configured max, agent state counts (Registered vs. Unregistered), top connection failure messages, and performance heat maps.
Alerts:
- Registration failures:

AzureDiagnostics
| where Category == "HostRegistration"
| extend p = parse_json(Properties)
| where tostring(p.RegistrationState) != "Registered"

Capacity pressure (example threshold: average active sessions within 1 of host limit for 10 minutes):

Perf
| where ObjectName == "Terminal Services" and CounterName == "Active Sessions"
| summarize AvgActive = avg(CounterValue) by Computer, bin(TimeGenerated, 10m)
| join kind=leftouter (
    // Replace 20 with your per-host maximum sessions
    datatable(Computer:string, MaxSessions:int) [
      // Populate from CMDB or tag-driven mapping
    ]
) on Computer
| where AvgActive >= MaxSessions - 1

User-impact events: Trigger on spikes in connection failures, FSLogix attach errors, or logon durations when available in AVD connection properties.
Resource contention: Alert on sustained CPU > 85%, Memory\Available MBytes < 500 MB, Disk Avg. sec/Write or Read > 20 ms.
Action groups: Route alerts to email, Teams, ITSM, Automation runbooks, or Functions for autoscale or remediation.
Service health: Configure Azure Service Health alerts for Azure Virtual Desktop, Storage, Azure Files, Azure NetApp Files, and Azure AD to learn about outages or maintenance that could affect sign-ins, profiles, or sessions before users do.

Practical Problem Scenario

Adobe Inc. reports intermittent Azure Virtual Desktop disconnections and long logons during peak hours for a pooled Windows 11 Enterprise multi-session host pool using FSLogix on Azure Files Premium.

Verify service and network prerequisites

Why: Rules out external causes that no host fix can address.
Actions:
- Check Azure Service Health for incidents in the target region affecting Desktop Virtualization or Storage.
- Confirm branch firewalls allow outbound TCP 443 and do not SSL-inspect AVD endpoints; verify UDP 3390 is allowed to improve RDP quality via Shortpath where applicable.

Validate diagnostics pipeline

Why: AVD Insights requires both resource logs and in-guest telemetry to correlate failures with resource bottlenecks.
Actions:
- Ensure diagnostic settings are enabled for the host pool, workspace, and application groups with Connection, HostRegistration, Checkpoint, Management, Error, and NetworkData categories to the central Log Analytics workspace.
- Confirm AMA is installed on all session hosts and the DCR is collecting RDP-related event logs and performance counters.

Analyze connection failures and agent health

Why: Frequent disconnects often correlate with transport fallback or agent registration instability.
Actions:
- Run AVD Connection queries to identify failure stages and messages; isolate proxy or token-related errors.
- Query HostRegistration to find Unregistered hosts; if present, restart RDAgentBootLoader and RdAgent, verify DNS and time sync, and re-register hosts if registration tokens expired.

Investigate logon delays and FSLogix profile attach issues

Why: Profile operations are a primary contributor to long logons.
Actions:
- Review Microsoft-FSLogix-Apps logs for access denied, sharing violations, or mount timeouts; validate share and NTFS ACLs, and exclude VHD(X) paths from antivirus scanning.
- Check Azure Files Premium metrics and VM Perf counters for disk latency; increase file share throughput or migrate profiles to Azure NetApp Files if IOPS are consistently over capacity.

Identify resource bottlenecks and capacity pressure

Why: Overloaded hosts cause both performance degradation and disconnect symptoms under contention.
Actions:
- Use Perf counters to detect sustained CPU > 85%, low available memory, or high disk latency; reduce per-host session limits or scale out hosts.
- Enable or tune autoscale to add capacity ahead of peak; validate drain mode behavior to protect active sessions during scale-in.

Implement proactive alerting and dashboards

Why: Prevent recurrence by detecting early warning signals.
Actions:
- Create alerts for HostRegistration not Registered, rising Connection failures, and FSLogix error spikes.
- Build a capacity dashboard showing active sessions vs. max per host and resource heat maps; share with operations and service owners.

This approach combines Azure Service Health for external dependencies, diagnostic settings for platform visibility, AMA+DCR for host telemetry, KQL-driven analysis to isolate failure domains, and targeted remediation across networking, agent health, profiles, and capacity—ensuring Adobe Inc. stabilizes user experience and prevents future regressions.

← Security · All domains · Resilience →

Practice these questions → · Timed practice on ExamRoll.io →