Microsoft AZ-140: Security, Compliance and Endpoint Protection — Study Guide

By Laurynas Brazys · 12 August 2026 · #microsoft #az-140 #certification #exam-prep #study-guide

Part of the Microsoft Azure Virtual Desktop Specialty AZ-140 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Azure Virtual Desktop (AVD) environments process corporate identities, data, and applications at scale, so security, compliance, and endpoint protection must be engineered in from image design through runtime operations and evidence collection. The key pillars are standardized onboarding to Microsoft Defender for Endpoint, posture and workload protection with Microsoft Defender for Cloud, platform hardening with encryption and trusted launch, configuration and least privilege via Microsoft Intune and Windows LAPS, governance with Azure Policy, secret and key management in Azure Key Vault, rigorous data protection, and auditable logging for investigations and attestations.

Endpoint Threat Protection with Microsoft Defender

Microsoft Defender for Endpoint (MDE) is fully supported on Windows 10/11 Enterprise multi-session and on Windows Server session hosts. Use it for endpoint detection and response (EDR), attack surface reduction (ASR), automated investigation, and threat intelligence.

• Onboarding approaches

  • Intune: Deploy the MDE onboarding profile to Azure AD-joined or hybrid-joined session hosts, including multi-session. Use Endpoint Security policies to configure Defender Antivirus, firewall, and ASR rules.
  • Group Policy: For Active Directory–joined hosts, deploy the onboarding package and Defender policies via GPO.
  • Scripted/Golden image: Inject the onboarding script into the image build pipeline. Sysprep removes device identity; upon first boot MDE re-registers the device.
  • Defender for Cloud auto-provisioning: For Windows Server session hosts, Defender for Servers Plan 1/2 can auto-provision the MDE agent and manage licensing. This does not apply to Windows client multi-session.

• Licensing

  • Windows 10/11 Enterprise multi-session requires per-user MDE licensing (for example, Microsoft Defender for Endpoint Plan 2 as part of Microsoft 365 E5 Security). It is not covered by Defender for Servers.
  • Windows Server hosts are covered when Defender for Servers Plan 2 is enabled on the subscription or Arc–connected machines.

• Defender Antivirus baseline

  • Enable cloud-delivered protection, real-time monitoring, and automatic remediation. Keep platform and intelligence updates current via Windows Update for Business or a secure update source.
  • Configure ASR rules such as blocking Office from creating child processes, blocking credential stealing from LSASS, and controlling script abuse. Pair with MDE EDR in block mode where permissible.

• FSLogix-aware antivirus configuration

  • Aggressive scanning on FSLogix profile and ODFC containers can degrade logon performance. Exclude FSLogix binaries, mount points, and VHD(X) paths, plus consider excluding the VHD/VHDX file extensions when appropriate and allowed by policy.
  • Example configuration:

    Add-MpPreference -ExclusionPath 'C:\Program Files\FSLogix','C:\ProgramData\FSLogix','C:\Users\*\AppData\Local\FSLogix'
    Add-MpPreference -ExclusionProcess 'frxsvc.exe'
    Add-MpPreference -ExclusionExtension 'vhd','vhdx'
    

  • Also exclude the network path of the container share if policy allows, and ensure SMB signing and encryption are enabled on the share.

• Investigation and response

  • Connect MDE to Microsoft Sentinel for unified SOC workflows. Use MDE advanced hunting to trace suspicious user actions across ephemeral sessions using device and account pivots, and correlate with AVD diagnostics logs.

Platform Hardening: Disk Encryption and Trusted Launch

Harden every session host at the virtualization layer and at rest.

• Trusted launch for Gen2 VMs

  • Enable secure boot and virtual TPM (vTPM) to ensure measured and attested boot. Trusted launch reduces bootkit and rootkit risks and unlocks guest BitLocker key protection with the vTPM.
  • Require trusted launch through Azure Policy for all new session hosts.

• Disk encryption options

  • Server-side encryption (SSE) for managed disks is always on. For stricter control, use customer-managed keys (CMK) via a Disk Encryption Set backed by Azure Key Vault.
  • Azure Disk Encryption (ADE) with BitLocker protects volumes inside the guest and stores keys/secrets in Key Vault. ADE is supported on data and OS disks for persistent OS configurations.
  • Ephemeral OS disks cannot use ADE; instead rely on encryption at host and trusted launch with vTPM.
  • For Windows 10/11 Enterprise, BitLocker can be enabled inside the guest to protect data disks and, where supported, the OS disk; seal keys to the vTPM.

• Network access controls

  • Block public management ports. Use Azure Bastion or Private endpoints and private DNS. For RDP session traffic, favor RDP Shortpath over UDP for lower latency; if using Shortpath for public networks, deploy a server-auth TLS certificate to session hosts via Intune or GPO.

• Update and image integrity

  • Maintain a secure golden image pipeline: patch monthly, scan with MDE, validate CIS or Microsoft security baselines, and seal with Sysprep. Require images to originate from approved Shared Image Gallery definitions via Azure Policy.

Configuration, Baselines, and Least Privilege

Standardize configuration and minimize administrative blast radius.

• Microsoft Intune for AVD

  • Windows 10/11 Enterprise multi-session is supported for device configuration with the Settings Catalog, Endpoint Security policies, Microsoft Defender AV, firewall, and Update rings.
  • Security baselines: Start with the Microsoft security baseline for Windows client and adjust for AVD-specific needs such as enabling clipboard control, redirection policies, and optimizing for multi-session.
  • App management: Prefer MSIX app attach for packaged apps; Intune Win32 app deployment to multi-session has limitations.

• Policy deployment patterns

  • Azure AD–joined hosts: Use Intune MDM and device groups. Layer Settings Catalog, Endpoint Security, and custom OMA-URI profiles for RDP properties as needed.
  • AD DS–joined hosts: Use Group Policy for core settings; optionally co-manage with Intune for Defender and updates.

• Local administrator controls

  • Restrict local Administrators group to a managed identity set. For Azure AD–joined VMs, use the Azure AD device administrator role and Intune’s Local user group memberships policy.
  • Remove interactive logon rights from global admin accounts; use separate break-glass accounts stored offline and rotated.

• Windows LAPS

  • Use Windows LAPS to rotate unique local Administrator passwords per VM. For Azure AD–joined hosts, configure Azure AD-based LAPS policies in Intune. For AD DS–joined hosts, use LAPS with passwords stored in AD computer objects. Enforce rotation on check-in and on-demand.

• Just-in-time administration

  • Use Microsoft Entra Privileged Identity Management for JIT activation of Azure RBAC roles that manage AVD and session host resources.
  • Limit VM-level access using Defender for Cloud Just-in-Time VM access to open inbound management ports only when requested and approved.

Governance, Data Protection, and Compliance Evidence

Govern the environment end-to-end and maintain audit-ready evidence.

• Azure Policy and guest configuration

  • Enforce allowed VM images, require trusted launch, disallow public IPs, mandate diagnostics to Log Analytics, and require VM Insights/MDE extensions.
  • Use Guest Configuration to audit BitLocker status, Defender real-time protection, RDP property compliance, and local group membership. Assign policies at management group or subscription scope for inheritance.

• Azure Key Vault

  • Store ADE BitLocker keys, CMK for managed disks via Disk Encryption Sets, domain-join credentials for automation, and certificates for RDP Shortpath or application TLS.
  • Enable soft delete and purge protection. Use Key Vault RBAC and private endpoints with firewall restrictions to constrain access. Integrate with deployment pipelines using managed identities and Key Vault references.

• Data protection and user data handling

  • FSLogix containers: Secure the file share with AD-based or Entra Kerberos authentication, least-privilege NTFS ACLs, and storage firewall plus private endpoints. Enable share-level and SMB encryption.
  • Apply sensitivity labels and data loss prevention policies with Microsoft Purview to govern content in Microsoft 365 Apps running in AVD. Use Controlled Folder Access to block ransomware behaviors if compatible with apps.
  • Reduce exfiltration channels using AVD RDP properties: Disable drive, device, and clipboard redirection where prohibited; enable watermarking and screen capture protection for high-sensitivity workloads.

• Audit logs and investigations

  • Enable AVD diagnostics to Log Analytics to capture connection, management, and agent events. Ingest Windows Security, Sysmon (if used), and FSLogix operational logs.
  • Connect Microsoft Defender for Endpoint alerts and telemetry to Microsoft Sentinel. Build analytic rules for suspicious process trees, credential access attempts, anomalous session behavior, and data egress.
  • Retain logs per regulatory obligations with immutable storage or Sentinel long-term retention. Export Azure Activity Logs and Policy compliance states to a secure workspace for attestation.

• Defender for Cloud recommendations and Defender for Servers

  • Enable Defender for Cloud on subscriptions hosting AVD infrastructure. Use its recommendations to remediate identity, network, encryption, and update posture gaps.
  • For Windows Server session hosts or supporting IaaS (gateways, brokers in specialized designs), enable Defender for Servers:
    • Plan 1 provides foundational server protection and integration.
    • Plan 2 adds EDR with MDE for Servers, vulnerability management, adaptive application controls, file integrity monitoring, and JIT VM access.
  • Use auto-provisioning of agents and at-scale remediation via workflows to keep posture consistent.

Practical Problem Scenario

Siemens AG must host confidential engineering applications in AVD for contractors across Europe while meeting strict data-handling and audit requirements. Key challenges include preventing data exfiltration, proving encryption and baseline compliance, onboarding EDR to multi-session hosts, and rotating local admin credentials without persistent standing access.

1. Enforce trusted launch and encryption

   • Create a Disk Encryption Set with a Key Vault–backed CMK and require it via Azure Policy on all session host disks. Deploy Gen2 VMs with trusted launch (secure boot and vTPM) to enable measured boot and protect BitLocker keys.
   • Why: Trusted launch hardens the boot chain, while CMK ensures Siemens controls key lifecycles and can demonstrate crypto governance.

2. Onboard Microsoft Defender for Endpoint

   • Use Intune to deploy the MDE onboarding profile and Defender Endpoint Security policies to Windows 11 Enterprise multi-session hosts. For any Windows Server utilities, enable Defender for Servers Plan 2 in Defender for Cloud for automatic MDE provisioning.
   • Why: Intune provides repeatable onboarding for client multi-session, and Plan 2 supplies EDR and advanced threat detection on any server components.

3. Apply security baselines and ASR rules

   • Assign the Windows security baseline via Intune’s Settings Catalog, tuned for engineering apps. Enable key ASR rules and EDR in block mode with exclusions tested against CAD tools.
   • Why: Baselines standardize hardened configurations; ASR reduces exploit and macro abuse without custom signatures.

4. Configure FSLogix and antivirus exclusions

   • Store profiles on Azure Files secured with AD-based authentication, private endpoints, and NTFS ACLs. Push Defender AV exclusions for FSLogix binaries, mount points, and VHD(X) extensions, plus SMB signing and encryption.
   • Why: Preserves logon performance and reduces I/O contention while keeping data encrypted in transit and at rest.

5. Implement least privilege with LAPS and PIM

   • Configure Windows LAPS via Intune to rotate per-VM local admin passwords and restrict local Administrators membership through Intune policy. Use Entra Privileged Identity Management for JIT elevation to manage AVD resources and JIT VM access for any management ports.
   • Why: Eliminates standing credentials and narrows the attack surface from lateral movement or credential theft.

6. Control data egress in sessions

   • Set AVD RDP properties to disable drive and device redirection for contractor host pools, allow clipboard as read-only, enable screen capture protection and watermarking. Use Purview DLP for Microsoft 365 Apps to prevent sensitive data exfiltration.
   • Why: Combines in-session controls with content-aware policies to stop leakage through common channels.

7. Govern with Azure Policy and Guest Configuration

   • Assign policies requiring trusted launch, prohibiting public IPs, mandating diagnostics to Log Analytics, and restricting images to approved Shared Image Gallery definitions. Use Guest Configuration to audit BitLocker, Defender status, and local group membership.
   • Why: Ensures every host remains compliant and produces machine-verifiable evidence.

8. Centralize logs and detection

   • Route AVD diagnostics, Windows Security, and MDE alerts to Microsoft Sentinel. Author analytics for suspicious engineering-tool child processes and anomalous data transfer. Store ADE/BitLocker key events and Policy compliance results for 1-year retention.
   • Why: Provides end-to-end visibility and long-term, queryable evidence to satisfy audits and accelerate incident response.

This approach gives Siemens hardened session hosts with provable encryption and baseline compliance, enterprise-grade EDR across client and server components, strict least-privilege controls, governed secrets and certificates, and comprehensive logging for both security operations and regulatory attestations.

← Applications and End-User Experience · All domains · Monitoring →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →