What's changed: Created AZ-140 Chapter 3 (Domain 2: identity integration (AD DS/Entra ID join/Entra Domain Services, Azure RBAC, Conditional Access, MFA/passwordless/smart card, Entra SSO); securing session hosts (Defender for Cloud posture/Defender Antivirus/Defender for Endpoint EDR onboarding, NSG/UDR/Azure Firewall, Azure Bastion/JIT, App Control for Business/Controlled Folder Access, Trusted Launch/confidential VM)).
3.2Securing session hosts
Understand securing session hosts with Microsoft Defender for Cloud / Defender Antivirus / Defender for Endpoint, network security with UDR/NSG/Azure Firewall, Azure Bastion / JIT VM access, Windows threat protection, and confidential VM / Trusted Launch.
Session hosts are multi-user Windows VMs and attractive targets, so defend them in depth (protection, detection, network, admin access, platform integrity).
3.2.1Protection and detection (Defender)
Microsoft Defender for Cloud assesses session-host security posture (recommendations/secure score) and remediates weak configurations. Microsoft Defender Antivirus provides real-time malware protection; Microsoft Defender for Endpoint (MDE) onboards session hosts as EDR for detection, investigation, and response (mind multi-session onboarding and scan settings). Distinguish "surface/remediate VM config risk" = Defender for Cloud from "EDR detect/respond to compromise" = Defender for Endpoint.
3.2.2Network, admin access, and platform integrity
Secure the network with NSGs (subnet/NIC traffic control), UDRs (forced tunneling through a firewall), and Azure Firewall (outbound FQDN filtering—allow AVD required endpoints). For admin access, do not expose public RDP on session hosts—use Azure Bastion (secure browser-based RDP/SSH) or JIT (Just-In-Time) VM access (open ports only when needed, time-bound). Strengthen the platform with Trusted Launch (secure boot + vTPM against bootkits) and confidential VMs (in-use memory encryption). On Windows, apply App Control for Business (run only allowed apps) and Controlled Folder Access (ransomware protection).
Cues: "surface/remediate config risk, secure score" = Defender for Cloud; "EDR detect/respond" = Defender for Endpoint. "admin connect without exposing public RDP" = Bastion; "open ports only when needed, time-bound" = JIT. "secure boot + vTPM" = Trusted Launch; "in-use memory encryption" = confidential VM. Outbound FQDN control = Azure Firewall.
Watch the mix-ups: (1) Defender for Cloud (posture/recommendations) vs Defender for Endpoint (EDR). (2) Bastion (a persistent secure path) and JIT (time-bound port opening) are complementary. (3) Trusted Launch (boot integrity) and confidential VM (memory encryption) are different layers. (4) AVD uses reverse connect, but outbound FQDNs still need allow-listing in Azure Firewall.
3.2.3Section summary
- Defender for Cloud = posture/recommendations/secure score; Defender for Endpoint = EDR detect/respond (onboarding)
- Admin access = Bastion (secure path)/JIT (time-bound ports); network = NSG/UDR/Azure Firewall
- Platform integrity = Trusted Launch (secure boot + vTPM) and confidential VM (in-use memory encryption)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to surface session-host config risk and improve posture via recommendations and secure score. Which is best?
Q2. You want EDR to detect, investigate, and respond to compromise on session hosts. Which is best?
Q3. Admins want to connect securely to session hosts without exposing public RDP (3389). Which is best?
Q4. You want to open session-host management ports only when needed, time-bound. Which is best?
Q5. You want to strengthen session-host boot integrity against bootkits and rootkits. Which is best?