AZ-140 Study Guide 2026: Complete Azure Virtual Desktop Exam Prep
Everything you need to pass the AZ-140 Configuring and Operating Azure Virtual Desktop specialty exam — all 4 domains, FSLogix profile containers, MSIX app attach, scaling plans, identity and security, and a proven 6-week study strategy.
Quick Summary
- • AZ-140 is a Specialty exam with 40–60 questions, 120 minutes, 700/1000 passing score
- • Covers 4 domains: AVD infrastructure, identity & security, user environments & apps, monitoring & maintenance
- • Domain 1 (infrastructure) is the heaviest at 40–45% — host pools, FSLogix, and networking are critical
- • Exam cost: $165 USD | Recommended prerequisite: AZ-104 experience
What is the AZ-140 Exam?
AZ-140 is the Microsoft certification exam for Configuring and Operating Azure Virtual Desktop. Passing it earns the Microsoft Certified: Azure Virtual Desktop Specialty credential — the definitive certification for professionals who plan, deploy, and manage Azure Virtual Desktop (AVD) environments.
Azure Virtual Desktop is Microsoft's cloud-based desktop and application virtualization service. It allows organizations to deliver Windows 10/11 multi-session desktops, RemoteApp streaming, and full desktop experiences from Azure infrastructure. AZ-140 tests your ability to design and implement the full AVD stack: host pools, session hosts, FSLogix profile containers, MSIX app attach, identity integration (Entra ID, AD DS, Entra Domain Services), network design, security controls, and operational monitoring.
The target candidate is an infrastructure administrator or virtualization specialist who manages end-user computing environments in Azure. Solid Azure fundamentals (AZ-104 equivalent) and experience with Windows Server and Active Directory are expected — the exam assumes you know how to deploy VMs, configure virtual networks, and manage Entra ID identities.
| Detail | Information |
|---|---|
| Exam Code | AZ-140 |
| Credential Earned | Azure Virtual Desktop Specialty |
| Number of Questions | 40–60 questions |
| Time Limit | 120 minutes |
| Passing Score | 700 out of 1000 |
| Exam Price | $165 USD |
| Exam Level | Specialty |
| Prerequisites | None formal (AZ-104 + Windows Server/AD experience strongly recommended) |
| Renewal | Annual free online renewal assessment |
AZ-140 Exam Domains & Weightings
AZ-140 has four domains. Domain 1 (infrastructure) is the largest — host pools, FSLogix, storage, and networking are the technical heart of any AVD deployment and reflect the most complex real-world design decisions. Domain 3 (user environments and apps) is where FSLogix and MSIX app attach details live and often surprises candidates with its depth.
Domain 1: Plan and Implement Azure Virtual Desktop Infrastructure
40–45%- • Host pool types — pooled (multi-session) vs. personal (single-user), load balancing algorithms (breadth-first vs. depth-first)
- • Session host VMs — VM sizing guidelines, supported OS (Windows 11 multi-session, Windows Server), image types
- • Workspace and application group design — Desktop Application Groups (DAG) vs. RemoteApp Application Groups (RAG)
- • Custom images — Azure Compute Gallery (Shared Image Gallery), image versioning, Sysprep requirements
- • Network design — hub-spoke topology, subnet sizing for session hosts, private endpoints for AVD dependencies
- • RDP Shortpath — managed network RDP Shortpath (direct UDP path via ExpressRoute/VPN) vs. public network RDP Shortpath (STUN/TURN-based direct UDP)
- • Azure Files and Azure NetApp Files — SMB share for FSLogix profile containers, performance tiers, AD DS authentication
- • FSLogix profile containers — VHD vs. VHDX format, attachment type (dynamic vs. fixed), Cloud Cache for multi-region
- • MSIX app attach — package format, image (VHD/VHDX/CIM), staging/registration/deregistering lifecycle
- • Scaling plans — scheduled (time-based) and autoscale (capacity-based), ramp-up/peak/ramp-down/off-peak phases
Study tip: Host pool configuration options (pooled vs. personal, load balancing, max session limits) and FSLogix storage design (Azure Files Premium vs. Azure NetApp Files tiers) generate the most exam questions in this domain. Know when each storage option is recommended.
Domain 2: Plan and Implement Identity and Security
15–20%- • Identity model — Entra ID + AD DS (hybrid, most common), Entra ID only (cloud-native, limited features), Entra Domain Services (managed AD DS)
- • AVD-specific RBAC roles — Desktop Virtualization Contributor, Desktop Virtualization User, Desktop Virtualization Host Pool Contributor, Desktop Virtualization Reader
- • Conditional Access for AVD — targeting the AVD application (Windows Virtual Desktop app), device compliance requirements, MFA for session connections
- • Screen capture protection — prevents screenshots/screen recording from the remote session; configured per host pool
- • Watermarking — adds visible QR-code watermarks to sessions; requires Windows 11 22H2+ and Insider builds of the client
- • Clipboard and drive redirection policies — controlling data transfer paths for DLP compliance
- • Microsoft Intune for AVD — Intune enrollment of session hosts (multi-session), compliance policies, configuration profiles
- • Private endpoints for AVD — securing AVD control plane traffic (feed subscription, gateway connections)
- • Trusted Launch and security features for session host VMs
Study tip: The three identity models (Hybrid, Entra ID-only, Entra DS) have different trade-offs and supported features. Know which identity scenarios support which AVD capabilities — for example, Entra ID-only deployment restricts FSLogix to cloud-only configurations.
Domain 3: Plan and Implement User Environments and Apps
20–25%- • FSLogix Profile Container deep-dive — VHDLocations vs. CCDLocations (Cloud Cache), redirect.xml, inclusion/exclusion rules, Office Container
- • FSLogix Application Masking — hiding applications from users who should not see them without removing the install
- • OneDrive for Business in AVD — per-machine silent sign-in, known folder move (KFM), Files On-Demand in multi-session environments
- • Teams optimization for AVD — Teams WebRTC media optimization, supported client versions, Slim Core vs Classic Teams
- • MSIX app attach — configuration in Azure portal, package staging on file share (CIM format preferred), assign to app group, publish to users
- • Language packs and regional settings — adding language packs to custom images, per-user language configuration in multi-session
- • Universal Print — cloud-based printing without print servers, printer provisioning via Intune or Group Policy
- • RemoteApp vs. full desktop — when to use each, application group assignment, RemoteApp icon customization
- • Session time limits and idle disconnection — configuring via Group Policy or Intune for pooled host pools
Study tip: FSLogix Cloud Cache (CCDLocations) vs. standard profile containers (VHDLocations) and MSIX app attach staging lifecycle are the most technically complex topics in this domain. Understand when Cloud Cache is needed (multi-region HA) and the four MSIX lifecycle states (Staged, Registered, Deregistered, Destaged).
Domain 4: Monitor and Maintain Azure Virtual Desktop Infrastructure
10–15%- • Azure Monitor for AVD (AVD Insights) — workbook-based dashboard, data sources (diagnostics settings, Log Analytics), key metrics (session counts, connection reliability, user experience)
- • Diagnostics settings for AVD — enabling diagnostic logs for host pools, workspaces, and application groups to Log Analytics
- • Log Analytics queries for AVD — WVDConnections, WVDErrors, WVDHostRegistrations, WVDCheckpoints tables
- • Autoscale scaling plans — peak hours configuration, minimum host count, load balancing algorithm changes per phase
- • Start VM on Connect — allows Azure to start a stopped/deallocated VM when a user connects to it, reducing cost in personal host pools
- • Session host maintenance — drain mode for maintenance without disconnecting active users, session host update strategies
- • Azure Update Manager for AVD — patch management for session host VMs, maintenance windows
- • Backup and recovery for AVD — session host VM backup via Azure Backup, FSLogix profile container backup via Azure Backup for Azure Files
- • Capacity planning — monitoring session host load, adjusting max session limits, evaluating scaling plan effectiveness
Study tip: AVD Insights is the primary monitoring tool — know which Log Analytics tables it queries and what each table contains. Scaling plan phase configuration (ramp-up, peak, ramp-down, off-peak) generates exam questions on when hosts are started, stopped, and which load balancing algorithm applies per phase.
Ready to test yourself?
Try 40 Free AZ-140 Practice Questions
Scenario-based questions with detailed explanations covering all 4 domains. No credit card required.
Start Free Practice →How Hard is AZ-140?
AZ-140 is a Specialty-level exam with genuinely specialty-level depth. It is not a broad survey — it goes deep into AVD-specific configuration options that you must know precisely. Candidates who have hands-on AVD deployment experience find it manageable; those studying purely from documentation without lab experience typically struggle with the configuration-level scenario questions.
The exam is particularly challenging for its FSLogix and MSIX content, which involves many specific configuration options, file paths, registry settings, and behavioral nuances that do not translate well from conceptual study alone. Monitoring questions require familiarity with specific Log Analytics table names and what each field represents in AVD context.
Why candidates fail AZ-140
- • Weak FSLogix knowledge: Confusing VHDLocations vs. CCDLocations (Cloud Cache), not understanding attachment modes, or not knowing when Office Container is separate from Profile Container
- • Confusing host pool types: Not knowing when breadth-first vs. depth-first load balancing applies, or when to choose pooled vs. personal host pools for specific use cases
- • Identity model gaps: Not understanding the limitations of each identity model — Entra ID-only deployments restrict some AVD features that require AD DS
- • No lab experience with MSIX app attach: The four lifecycle stages (staged, registered, deregistered, destaged) and CIM format advantages are hard to memorize without hands-on practice
- • Skipping AVD-specific monitoring: Not knowing the WVD* Log Analytics tables and what AVD Insights shows — monitoring questions appear in almost every exam attempt
6-Week AZ-140 Study Plan
This plan assumes 1.5–2 hours per day with lab time built into each week. A Pay-As-You-Go Azure subscription is sufficient — shut down session hosts when not studying to control costs. AZ-104-level Azure knowledge and basic Windows Server/AD experience are assumed.
Week 1: AVD Infrastructure — Host Pools, Session Hosts & Networking
- Days 1–2: AVD architecture — workspace, host pool, application group, session host relationships. Pooled vs. personal host pools. Breadth-first vs. depth-first load balancing. Max session limit configuration.
- Days 3–4: Session host VM design — supported OS images (Windows 11 multi-session, Windows Server 2019/2022), VM sizing for AVD workloads, Azure Compute Gallery for custom images, Sysprep and generalization requirements.
- Day 5: Network topology — hub-spoke for AVD, subnet sizing (Microsoft recommends /24 minimum per host pool), required outbound URLs/ports for AVD, RDP Shortpath (managed network vs. public network, UDP requirements).
- Days 6–7: Lab — deploy a pooled host pool with 2 session hosts, create a Desktop Application Group, assign to a test user, connect via the AVD web client. Verify connections in the portal diagnostics.
Week 2: FSLogix Profile Containers & Storage
- Days 1–2: FSLogix architecture — Profile Container vs. Office Container, VHDLocations (standard) vs. CCDLocations (Cloud Cache for HA), VHD vs. VHDX format, dynamic vs. fixed disk attachment type.
- Days 3–4: Storage options — Azure Files (Standard and Premium tiers, NTFS permissions via AD DS Kerberos authentication) vs. Azure NetApp Files (Ultra/Premium tiers for highest IOPS requirements). When to choose each.
- Day 5: FSLogix configuration — registry/Group Policy settings: VHDLocations path, SizeInMBs, VolumeType, FlipFlopProfileDirectoryName, inclusion/exclusion rules via redirect.xml.
- Days 6–7: Lab — configure Azure Files Premium with AD DS authentication, deploy FSLogix via Group Policy to session hosts, verify profile containers mount correctly. Test profile persistence across sign-out/sign-in.
Week 3: Identity, Security & Conditional Access
- Days 1–2: Identity models — Hybrid (Entra ID + AD DS sync, most features), Entra ID-only (limited, no traditional domain join for session hosts — uses Intune enrollment), Entra Domain Services (managed AD DS — no DC management). Feature matrix per identity model.
- Days 3–4: AVD RBAC roles — Desktop Virtualization Contributor (manage all AVD resources), Desktop Virtualization User (connect to session hosts), Desktop Virtualization Host Pool Contributor (manage host pool resources only), Desktop Virtualization Reader (view-only). Assignment patterns for admins vs. end users.
- Day 5: Conditional Access for AVD — targeting the Azure Virtual Desktop enterprise application, device compliance conditions, MFA for session connections, sign-in frequency for AVD sessions.
- Days 6–7: Security features — screen capture protection (per host pool, RDP properties), watermarking (Windows 11 22H2+ only), clipboard redirection policies, drive redirection policies, Intune for multi-session AVD (co-management requirements).
Week 4: MSIX App Attach, RemoteApp & User Environment
- Days 1–2: MSIX app attach — MSIX package format, converting installers to MSIX (MSIX Packaging Tool), packaging to VHD/VHDX/CIM (CIM preferred — read-only, no antivirus exclusions needed). The four lifecycle stages: Staged (disk attached, not registered), Registered (app visible in Start), Deregistered (app hidden), Destaged (disk detached).
- Days 3–4: MSIX app attach configuration — Azure Files share for MSIX images, configure in AVD portal (add MSIX package → upload image → assign to application group), user sign-in triggers registration.
- Day 5: User environment — OneDrive per-machine silent sign-in, Known Folder Move (KFM) in multi-session, Teams WebRTC media optimization (redirect audio/video processing to the client device). RemoteApp vs. full desktop use cases.
- Days 6–7: Lab — convert a simple application to MSIX using the MSIX Packaging Tool, upload to Azure Files, configure MSIX app attach in a pooled host pool, verify the app appears for assigned users.
Week 5: Scaling, Monitoring & Maintenance
- Days 1–2: Scaling plans — scheduled scaling (time-based phases: ramp-up, peak, ramp-down, off-peak) and autoscale (capacity-based). Configuration per phase: min host count, load balancing algorithm change, shutdown threshold. Assigning scaling plans to pooled host pools.
- Days 3–4: AVD Insights and monitoring — enabling diagnostics (host pool, workspace, app group) to Log Analytics. AVD Insights workbook — key tabs (Overview, Connection Reliability, User Experience, Session Hosts). Key KQL tables: WVDConnections, WVDErrors, WVDHostRegistrations.
- Day 5: Start VM on Connect — enabling for personal host pools (stops VMs when idle, starts on user connection), role assignment requirement (Desktop Virtualization Power On Contributor), cost implications.
- Days 6–7: Maintenance — drain mode (graceful maintenance without disconnection), session host registration and de-registration, Azure Update Manager for patching, backup of Azure Files FSLogix shares (Azure Backup for Azure Files).
Week 6: Mock Exams & Targeted Review
- Days 1–2: Review highest-weighted areas: FSLogix storage selection (Azure Files vs. ANF), host pool configuration decisions, MSIX app attach lifecycle, identity model feature matrix.
- Day 3: Full 180-minute timed mock exam.
- Days 4–5: Targeted review of any domain below 70%. Re-do FSLogix and MSIX labs if those were weak areas.
- Day 6: Second full mock exam — aim for 80%+.
- Day 7: Light review of monitoring tables and scaling plan phases. Book exam if consistently 80%+.
Best AZ-140 Study Resources
1. Microsoft Learn AZ-140 Learning Path (Free)
The official learning path is the most authoritative source and essential for staying current — AVD receives continuous feature updates. Complete every sandbox exercise, particularly the FSLogix, scaling plan, and MSIX app attach modules. The learning path is structured to match the exam domain weightings. Pay special attention to the monitoring module — AVD Insights configuration details appear frequently on the exam.
2. MSCertQuiz AZ-140 Practice Tests
500 AZ-140 practice questions across all four domains with detailed explanations. The question bank is particularly strong on FSLogix storage selection scenarios (Azure Files Premium vs. ANF), MSIX app attach lifecycle questions, host pool configuration decisions, scaling plan phase configuration, and identity model feature comparisons — the areas where most candidates lose the most marks.
Start free AZ-140 practice →3. John Savill's AZ-140 Study Cram (YouTube)
Savill's AZ-140 coverage is among the most comprehensive available on YouTube. His visual diagrams of the FSLogix Cloud Cache architecture, MSIX app attach staging pipeline, and AVD scaling plan phase logic are particularly helpful for understanding how the components fit together. Watch his full AZ-140 study cram playlist before your exam week review.
4. Azure Virtual Desktop Documentation (Microsoft Docs)
The AVD product documentation is unusually detailed and exam-accurate. Read the FSLogix configuration reference (VHDLocations, CCDLocations, all Group Policy settings), the MSIX app attach setup guide (CIM format, lifecycle stages), the scaling plan configuration reference, and the network connectivity requirements page. The "Required URL list" for AVD outbound connectivity has appeared as an exam topic.
5. Azure Virtual Desktop — Hands-On Lab Environment
Deploy a complete AVD environment in a Pay-As-You-Go Azure subscription. Create a pooled host pool with 2 session hosts, configure FSLogix with Azure Files, test MSIX app attach with at least one application, configure a scaling plan, enable AVD Insights, and use drain mode to simulate maintenance. Shut down session hosts when not studying — a minimal AVD lab costs $2–5/day if session hosts are running, near zero if deallocated.
AZ-140 Exam Day Tips
Do
- • For FSLogix questions: when a question mentions multi-region HA for profiles, Cloud Cache (CCDLocations) is almost always the answer
- • For storage questions: Azure Files Premium for standard AVD deployments; Azure NetApp Files Ultra for very high IOPS (>20,000 IOPS per share) or large-scale environments
- • For load balancing: breadth-first = spread users across all hosts (good for pooled, keeps VMs active for cost). Depth-first = fill one host before moving to the next (good for autoscale, allows VM shutdown)
- • For MSIX questions: CIM is preferred over VHD/VHDX because CIM is read-only, no antivirus exclusions needed, and performs better
- • For scaling plan questions: ramp-up phase uses breadth-first to spread load; peak uses whatever is configured; ramp-down force-logs idle users to allow host shutdown
Don't
- • Don't confuse VHDLocations and CCDLocations — VHDLocations is standard single-storage profile; CCDLocations is Cloud Cache (multi-storage, HA, prioritized list)
- • Don't forget that Start VM on Connect only works for personal host pools by default — pooled host pools use scaling plans instead
- • Don't confuse Desktop Application Group (DAG — full desktop) with RemoteApp Application Group (RAG — specific apps) — only one DAG allowed per host pool, multiple RAGs allowed
- • Don't apply Conditional Access to the "Microsoft Graph" or "Azure management" app — for AVD, target the "Azure Virtual Desktop" enterprise application specifically
- • Don't assume Entra ID-only deployment supports all AVD features — FSLogix requires a traditional domain (AD DS or Entra DS) for proper profile container functionality in most configurations
AZ-140 FSLogix Quick Reference
VHDLocations (Standard)
- • Single storage location
- • VHD or VHDX format
- • Dynamic or fixed attachment
- • No HA across regions
CCDLocations (Cloud Cache)
- • Multiple storage locations
- • Active/passive replication
- • Survives storage failure
- • Required for multi-region HA
Storage Selection
- • Azure Files Premium: standard
- • Azure NetApp Files: high IOPS
- • AD DS auth required for both
- • SMB 3.0 protocol
MSIX App Attach Lifecycle Stages
1. Staged
Disk image attached to session host. Package files accessible but app not yet visible.
2. Registered
Application registered for the user session. App appears in Start menu / RemoteApp feed.
3. Deregistered
User signs out — app removed from Start menu. Disk remains attached (staged).
4. Destaged
Disk image detached from session host. Session host shutdown or package removed.
Ready to Practice AZ-140?
500 scenario-based questions across all 4 domains. Practice mode with explanations + timed exam simulation.
Start Free Practice →Related Resources
Free AZ-140 Practice Questions
25 free AZ-140 practice questions with detailed explanations covering all 4 domains.
AZ-104 Study Guide 2026
AZ-104 Azure Administrator covers the networking, storage, and compute fundamentals that AZ-140 builds on.
AZ-500 Study Guide 2026
AZ-500 Azure Security Engineer — complements AZ-140 identity and security domain with deeper security controls.
AZ-140 Certification Page
Full exam details, domain breakdown, and start your free practice quiz.
Frequently Asked Questions
Do I need AZ-104 before AZ-140?
AZ-104 is not a formal prerequisite, but AZ-140 assumes you understand Azure networking (virtual networks, subnets, NSGs, private endpoints), storage accounts, virtual machines, and Microsoft Entra ID basics. AZ-140 goes straight into AVD-specific configuration without re-explaining Azure fundamentals. Without AZ-104-level knowledge, the networking design and storage configuration questions will be very difficult.
Is Azure Virtual Desktop (AVD) the same as Windows 365?
No. Azure Virtual Desktop (AVD) is an infrastructure service where you manage the session host VMs, scaling, images, and FSLogix profiles yourself. Windows 365 is a fully managed Cloud PC service where Microsoft handles all the infrastructure — you simply assign licenses and users get a dedicated Cloud PC. AZ-140 covers AVD (the self-managed service), not Windows 365.
Is FSLogix the hardest part of AZ-140?
FSLogix is the most technically detailed topic, especially the Cloud Cache (CCDLocations) configuration, storage authentication requirements, and Office Container separation from Profile Container. Many candidates underestimate the depth of FSLogix content. Deploy FSLogix in a lab environment — the hands-on experience of seeing profile containers mount, troubleshooting storage permission issues, and testing profile persistence makes the exam questions much easier to answer.
What is the passing score for AZ-140?
The passing score for AZ-140 is 700 out of 1000. Microsoft uses scaled scoring, so the exact percentage needed varies slightly by exam version. Aim for 80%+ on practice exams before booking — this provides sufficient margin for question variability.
How long does it take to study for AZ-140?
Candidates with AZ-104 experience and some virtualization background typically need 5–7 weeks at 1.5–2 hours per day, including lab time. Those with direct AVD deployment experience in production may be ready in 3–4 weeks. Candidates coming from a VDI background (Citrix, VMware Horizon) but new to Azure need to invest extra time on Azure-specific components (networking, Entra ID integration, Azure Files authentication) while the user environment concepts (profiles, app delivery) will feel familiar.