Microsoft AZ-140: Networking, Connectivity and Transport — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Networking, connectivity, and transport underpin a stable and performant Azure Virtual Desktop (AVD) deployment. The control plane is internet-facing and fully managed by Microsoft, while the session hosts live in your virtual networks and must reach Azure platform services and, often, on-premises applications. Sound design balances least privilege and zero-trust principles with the need for low-latency, loss-tolerant transport for the user session. This section consolidates patterns and decisions for virtual network layout, access controls, outbound connectivity, hybrid links, private access, and troubleshooting.

Network design for session hosts: VNet, subnets, NSG, ASG, UDR, and DNS

• VNet and subnet topology

  • Use hub-and-spoke. Place shared services (Azure Firewall, NAT Gateway, VPN/ExpressRoute, Private DNS Resolver) in the hub; place AVD session hosts in one or more spoke VNets per region and workload tier.
  • Segment by function. Create dedicated subnets for session hosts, management/maintenance tooling, Azure Bastion, and any NVAs. Keep AzureBastionSubnet separate and at its required size.
  • Addressing. Allocate sufficient IPs for autoscale headroom and image lifecycle. Reserve growth capacity for scale sets and drain modes.

• NSGs and ASGs

  • Inbound: Deny by default. Do not expose TCP 3389 from the internet. Allow only:
    • Azure Bastion to session hosts on TCP 3389 for administrative break-glass, restricted to the AzureBastionSubnet or a management ASG.
    • RDP Shortpath for managed networks on UDP 3390 only from trusted private sources (branch subnets, corporate VPN address pools, or ExpressRoute prefixes).
  • Outbound: Allow the minimum set using service tags and FQDNs. Use the AzureVirtualDesktop, Storage, KeyVault, AzureActiveDirectory, AzureMonitor, WindowsUpdate, and MicrosoftGraph service tags where applicable. Prefer ASGs to target groups of session hosts rather than IPs.

• UDRs and routing

  • Default internet and forced tunneling. If you force-tunnel through an NVA or on-premises, ensure explicit routes for AVD control plane traffic remain allowed to the internet or are provided via Private Link. Avoid black-holing 0.0.0.0/0 without egress allowances for Azure services required by the AVD agent and FSLogix.
  • Gateway transit and peering. Enable gateway transit from hub to spokes and use BGP propagation carefully; validate effective routes on NICs for the final outcome.
  • Egress scaling. Attach a NAT Gateway to session host subnets when many hosts egress to the internet to eliminate SNAT port exhaustion and to stabilize egress IPs.

• DNS

  • For Active Directory–joined or Azure AD DS–joined hosts, configure the VNet to use the appropriate domain DNS servers; Azure-provided DNS cannot resolve AD SRV records. For Azure AD DS, point the VNet DNS to the managed domain IPs before domain-joining session hosts.
  • Hybrid name resolution: Use Azure DNS Private Resolver to bridge Azure Private DNS zones and on-prem DNS. Configure outbound rules to forward selected zones (for example, privatelink zones and Azure PaaS) and inbound rules to serve on-prem clients.
  • Private DNS. Link private zones to all VNets that must resolve private endpoints (for Storage, Key Vault, and AVD Private Link, if used).

Service connectivity and transport: reverse connect, Shortpath, UDP/TCP, and required endpoints

• Reverse connect transport

  • Session hosts initiate outbound TLS connections to the AVD control plane and gateways; clients connect to gateways over TLS. The broker orchestrates a reverse connection so the session host never requires public inbound RDP. This design removes the need to expose TCP 3389 to the internet and enables operation behind NAT, firewalls, and proxies.
  • Ensure outbound TCP 443 and, for optimal performance, UDP 443 from hosts and clients to the AVD gateways and service endpoints.

• RDP Shortpath

  • Managed networks: Enables a direct host-to-client UDP datapath using private IPs, typically over corporate LAN, site-to-site VPN, or ExpressRoute. Default UDP port is 3390 on the session host. Open host OS firewall and NSG for UDP 3390 from trusted private sources. This path lowers latency and jitter, improving interactivity and multimedia performance.
  • Public networks: Uses an AVD-managed relay to establish a UDP datapath over port 443, improving performance when direct private IP reachability is not available. Allow outbound UDP 443 to AVD service endpoints. This is ideal for work-from-home scenarios without corporate VPN.

• UDP transport, TCP fallback, and user experience

  • RDP uses a dual transport: a reliable TCP control channel and an optimized UDP media channel. If UDP is blocked, RDP falls back to TCP-only, which is more sensitive to latency, jitter, and packet loss; users may see lower frame rates and degraded audio.
  • Target round-trip latency under 100 ms to the host pool region; under 50 ms provides near-desktop responsiveness. Use the Azure Virtual Desktop Experience Estimator to inform region selection.
  • QoS and DSCP. Prioritize UDP 3390 (Shortpath managed) or UDP 443 (Shortpath public) and the TCP 443 control channel on edge devices to protect session quality during contention.

• Required Azure service connectivity and outbound endpoint patterns

  • Allow session hosts to reach:
    • AzureVirtualDesktop service tag over TCP 443 and UDP 443.
    • Storage endpoints for FSLogix containers and diagnostics.
    • AzureActiveDirectory and Microsoft Graph for identity and token flows.
    • WindowsUpdate and Microsoft content delivery endpoints for patching and Microsoft 365 Apps.
    • AzureMonitor and Log Analytics if using AVD Insights.
  • Prefer service tags and FQDN-based rules on Azure Firewall. For NVAs, maintain an updated allowlist and avoid TLS interception for these endpoints.

• Proxy considerations

  • The AVD agent supports outbound via system proxy. Configure WinHTTP on session hosts if an explicit proxy is mandatory; avoid proxies requiring interactive authentication for service traffic.
  • Example to configure system proxy:

netsh winhttp set proxy "http=myproxy.contoso.com:8080;https=myproxy.contoso.com:8080" bypass-list="localhost;127.0.0.1"

Hybrid connectivity and perimeter: VPN, ExpressRoute, Azure Firewall, proxies, Private Link, private DNS, and Bastion

• To on-premises applications

  • VPN Gateway: Fast to deploy, suitable for small-to-medium bandwidth and branch connectivity. Use active-active with BGP for resiliency.
  • ExpressRoute: Private, predictable connectivity for high-throughput, latency-sensitive workloads and large-scale user populations. Enable ExpressRoute FastPath to reduce dataplane hops. Use connection to Microsoft peering for SaaS if needed, but keep in mind AVD service endpoints still require internet or Private Link.
  • Virtual WAN can simplify multi-branch designs with integrated SD-WAN partners, centralized policies, and global transit.

• Azure Firewall and perimeter controls

  • Use Azure Firewall Premium for TLS inspection where supported; do not perform TLS inspection on AVD control plane traffic, as certificate pinning and WebSocket usage can break connectivity and degrade performance.
  • Use the AzureVirtualDesktop and WindowsUpdate FQDN tags to simplify rule management. Place Azure Firewall in the hub and publish default routes via UDR to spokes; carve out necessary internet-bound exceptions for AVD service access or implement Private Link.

• Private endpoints and Private Link

  • Storage and Key Vault: Use Private Endpoints for FSLogix profile containers and any secrets used during provisioning. Link the corresponding privatelink private DNS zones to your VNets and configure forwarding for on-prem clients if needed.
  • Azure Virtual Desktop: Configure Private Link for AVD where available to restrict control plane and gateway access to your private network. Create the AVD private endpoints in a dedicated subnet and enable the corresponding privatelink DNS zones, for example, the avd service privatelink zones, so hosts and clients resolve AVD FQDNs to private IPs. This reduces public egress and tightens zero-trust posture.

• Azure Bastion for administrative access

  • Use Azure Bastion for just-in-time, browser-based RDP to session hosts over TCP 443 without exposing inbound ports to the internet. Limit RDP allow rules on session hosts to the AzureBastionSubnet via NSG or ASG. Retain direct RDP disabled from untrusted networks.

Monitoring and troubleshooting: Network Watcher and diagnostics

• Azure Monitor and AVD Insights

  • Enable AVD Insights for end-to-end visibility into connection quality, sign-in times, and session performance. Correlate spikes in round-trip time or UDP loss with user complaints.

• Network Watcher tools

  • Connection troubleshoot. Validate reachability from a session host to Azure services, storage accounts, and on-prem endpoints. Example PowerShell:

$nw = Get-AzNetworkWatcher -Location "EastUS"
Test-AzNetworkWatcherConnectivity -NetworkWatcher $nw `
  -SourceId "/subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.Compute/virtualMachines/<vmName>" `
  -DestinationAddress "store1.file.core.windows.net" -DestinationPort 445

• Effective security rules and routes. Inspect NIC-effective NSG rules and routes to confirm that UDP 3390, UDP 443, and TCP 443 are allowed as intended.

• NSG Flow Logs v2. Send to a Log Analytics workspace to verify session host egress and identify denies that force TCP fallback.

• Packet capture. Use on a test host to confirm UDP Shortpath establishment and to analyze retransmissions and jitter.

• Client and host diagnostics

  • Within a session, monitor RemoteFX Graphics Frames Skipped and RDP transport status to distinguish server, network, or client bottlenecks.
  • Use the AVD client’s connection information to confirm transport mode (UDP/Shortpath vs TCP) and round-trip time. If you see TCP-only paths, validate proxy and firewall allowances and check for UDP 3390/443 blocks.

Practical Problem Scenario

IKEA plans to provide Azure Virtual Desktop to 1,200 store planners and buyers across Europe. Users access SAP GUI and a license server on-premises while half the users work remotely without corporate VPN. Users report inconsistent responsiveness during peak hours and occasional sign-in failures after a new outbound proxy was introduced.

1. Design hub-and-spoke with egress scaling

   • Create a hub VNet with Azure Firewall Premium and NAT Gateway; deploy spoke VNets per region for session hosts. Attach NAT Gateway to each session host subnet to avoid SNAT exhaustion when thousands of UDP/TCP flows open during morning logons.
   • Why: Stabilizes egress IPs and provides sufficient ephemeral ports, preventing intermittent connection failures to AVD gateways and storage.

2. Implement precise NSG and ASG rules

   • Assign session host NICs to an ASG. Permit inbound UDP 3390 from trusted private prefixes only, allow TCP 3389 inbound from AzureBastionSubnet, and allow outbound TCP/UDP 443 to AzureVirtualDesktop, Storage, AzureActiveDirectory, and AzureMonitor service tags.
   • Why: Enforces least privilege while enabling Shortpath managed networks and secure administration via Bastion.

3. Configure DNS for hybrid name resolution

   • Point VNet DNS to domain controllers in Azure. Deploy Azure DNS Private Resolver with outbound rules to forward privatelink zones and Azure PaaS zones; configure on-prem DNS to forward Azure private zones to the resolver’s inbound endpoint.
   • Why: Ensures AVD hosts resolve AD SRV records, FSLogix private endpoints, and any AVD Private Link FQDNs consistently across cloud and on-prem networks.

4. Enable RDP Shortpath for both managed and public networks

   • Turn on Shortpath for managed networks on session hosts and open UDP 3390 internally; enable Shortpath for public networks to allow UDP 443 relay for remote workers without VPN. Update QoS on branch routers to prioritize UDP 3390 and UDP/TCP 443 for AVD flows.
   • Why: Maximizes interactive performance for in-office users via direct private UDP and improves home-user experience via UDP 443, with QoS protecting these flows during congestion.

5. Secure and simplify perimeter with Azure Firewall and proxy policy

   • On Azure Firewall, use FQDN tags for AzureVirtualDesktop and WindowsUpdate; exclude these from TLS inspection. On the new outbound proxy, configure explicit allowances for AVD WebSocket over TLS and disable authentication for AVD agent traffic. Set WinHTTP proxy consistently on session hosts.
   • Why: Avoids breaking reverse connect and Shortpath public networks due to TLS interception or proxy auth, while maintaining centralized governance.

6. Provide private access to critical PaaS

   • Create Private Endpoints for the FSLogix storage accounts and link the necessary privatelink private DNS zones to all AVD VNets; validate SMB over private IPs succeeds. Evaluate AVD Private Link to restrict control plane and gateway access to private IPs where corporate policy requires it.
   • Why: Removes dependency on public egress for user profiles and optionally the AVD service, improving security posture and predictability.

7. Establish hybrid connectivity to on-prem applications

   • Deploy ExpressRoute with FastPath to the primary data center for low-latency SAP and license server access; retain VPN Gateway for branch backup. Advertise required on-prem prefixes with BGP, and verify next hop and effective routes on session host NICs.
   • Why: ExpressRoute provides predictable performance at scale, with VPN failover for resiliency.

8. Monitor and validate

   • Enable AVD Insights and Network Watcher Connection Monitor for synthetic tests to SAP and storage. Turn on NSG Flow Logs to confirm UDP 3390 and UDP 443 usage. Use Connection troubleshoot during peak hours to isolate proxy or firewall bottlenecks.
   • Why: Data-driven visibility confirms that Shortpath paths are active, egress capacity is adequate, and perimeter policies are not introducing unexpected loss or latency.

← Identity · All domains · Session Host Images and Provisioning →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →