What's changed: Created AZ-140 Chapter 3 (Domain 2: identity integration (AD DS/Entra ID join/Entra Domain Services, Azure RBAC, Conditional Access, MFA/passwordless/smart card, Entra SSO); securing session hosts (Defender for Cloud posture/Defender Antivirus/Defender for Endpoint EDR onboarding, NSG/UDR/Azure Firewall, Azure Bastion/JIT, App Control for Business/Controlled Folder Access, Trusted Launch/confidential VM)).
3.1Identity integration and access control
Understand AVD identity scenarios (AD DS / Microsoft Entra ID / Microsoft Entra Domain Services), session-host identity configuration, Azure RBAC, Conditional Access, authentication options, and Microsoft Entra single sign-on.
AVD session hosts are Windows VMs, so they need an identity foundation for users to sign in. Which identity scenario you choose is the design foundation.
3.1.1Choosing the identity scenario
Session-host domain join has three lines: Active Directory Domain Services (AD DS) on-prem/IaaS, the managed domain Microsoft Entra Domain Services, and Microsoft Entra ID join (cloud-native). Whether FSLogix profile shares need AD-based authentication and whether Entra ID join is feasible depend on the identity scenario. For "integrate with on-prem AD while moving to cloud," AD DS (Entra Connect sync); for "don’t want to manage domain controllers," Entra Domain Services; for "fully cloud-native," Entra ID join.
3.1.2RBAC, Conditional Access, and authentication
Use Azure RBAC to delegate AVD management (role assignments on host pools/application groups—e.g., built-in Desktop Virtualization roles). Govern end-user access with Conditional Access applying "require MFA," "compliant devices only," and "block by risk" to the AVD app. Authentication can be MFA, passwordless, or smart card, and Microsoft Entra single sign-on (SSO) reduces sign-in prompts to feed and session. Distinguish "enforce MFA for AVD connections" = Conditional Access from "delegate AVD management roles to admins" = Azure RBAC.
Cues: "on-prem AD integration" = AD DS; "domain join without managing DCs" = Entra Domain Services; "fully cloud-native" = Entra ID join. "enforce MFA/compliant devices for AVD connections" = Conditional Access. "delegate AVD management" = Azure RBAC. "fewer sign-in prompts" = Entra SSO.
Watch the mix-ups: (1) Conditional Access (end-user access conditions) vs Azure RBAC (delegating management). (2) Entra ID join (cloud), Entra Domain Services (managed domain), and AD DS (self-managed DCs) are distinct. (3) FSLogix profile shares assume AD-based auth—pure Entra ID join alone has constraints.
3.1.3Section summary
- Identity = AD DS (on-prem) / Entra Domain Services (managed domain) / Entra ID join (cloud-native)
- Conditional Access = enforce MFA/compliant devices on users; Azure RBAC = delegate AVD management
- Auth = MFA/passwordless/smart card; Entra SSO reduces sign-in prompts
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to enforce MFA and compliant devices for AVD connections. Which feature is best?
Q2. You want to delegate only host-pool management to an admin. Which is best?
Q3. You want session hosts domain-joined without managing your own domain controllers. Which identity scenario is best?
Q4. You want to reduce repeated sign-in prompts to feed and session for users. Which is best?
Q5. You want to integrate with on-prem Active Directory while deploying AVD in the cloud. Which identity scenario is best?