What's changed: Created AZ-140 Chapter 1 (Domain 1 first-half: network requirement assessment/reverse connect/RDP Shortpath-Multipath/QoS (DSCP); Azure Private Link for AVD (private endpoints/private DNS zone)/connectivity troubleshooting (DNS/UDR/FW/Azure Monitor); user-data storage (FSLogix profiles/Azure Files Premium SMB/Azure NetApp Files/AD DS-Entra Domain Services auth/IOPS-logon storms/same region)).
1.2Azure Private Link and connectivity troubleshooting
Understand planning/implementing an Azure Private Link solution for Azure Virtual Desktop, and monitoring/troubleshooting network connectivity.
By default, AVD connections traverse the internet (reverse connect). For stricter network requirements, Azure Private Link keeps traffic off the public internet and private.
1.2.1Private Link for AVD
Azure Private Link for AVD connects clients to the service (workspace/host pool/feed) via private endpoints, keeping traffic on the Microsoft backbone. This meets requirements like "do not traverse the internet" and "disable public endpoints." Combined with client-side private connectivity (ExpressRoute/VPN from on-prem), it designs end-to-end private AVD connections.
1.2.2Monitoring and troubleshooting connectivity
Isolate connectivity failures by layer: name resolution (DNS; for Private Link a private DNS zone is required), routing (whether UDR/firewall blocks outbound 443), and the service side (host pool/session host health). Check RTT and disconnects via connection quality and Azure Monitor metrics to pinpoint the cause. "Private Link but name resolution fails" is typically a missing private DNS zone configuration.
Cues: "keep traffic off the public internet, private" = Azure Private Link for AVD (private endpoints + private DNS zone). "check RTT/disconnects" = Azure Monitor/connection quality. Different purpose from RDP Shortpath (performance).
Watch the mix-ups: (1) Private Link (private connectivity) vs RDP Shortpath (direct-UDP performance). (2) Private Link requires private DNS zone configuration—name-resolution failure is the typical issue. (3) Verify outbound 443 is not blocked by UDR/firewall.
1.2.3Section summary
- Azure Private Link for AVD = private endpoints keep traffic off the public internet, on the backbone
- Private Link requires a private DNS zone—name-resolution failure is the typical issue
- Isolate connectivity by DNS/routing (UDR/FW)/service health; check RTT/disconnects via Azure Monitor
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want AVD connection traffic kept private, off the public internet. Which is best?
Q2. You configured Private Link for AVD but clients fail name resolution. What is the most likely cause?
Q3. Which correctly distinguishes Azure Private Link for AVD from RDP Shortpath?
Q4. When troubleshooting AVD connectivity, what should you check for blocked outbound traffic?
Q5. You want to continuously monitor AVD connection RTT and disconnects. Which is best?