The current AZ-140 blueprint forms one service-delivery map. Infrastructure creates networks, host pools, session hosts, images, and profile storage. Identity and security determine trusted access and host protection. User-environment and app settings shape the desktop experience. Monitoring, autoscaling, updates, backup, and disaster recovery keep the service healthy. The current AZ-140 weights are 40–45%, 15–20%, 20–25%, and 10–15%.
The user experience sits above the infrastructure
Every design decision should ultimately support a responsive, secure desktop or RemoteApp session. User location, latency, concurrency, application needs, profile size, peripherals, and availability requirements determine the infrastructure choices beneath them.
The map should therefore start with persona and workload rather than VM size.
Networking connects the endpoint to the session host
AVD broker/gateway services, RDP Shortpath, RDP Multipath, QoS, Private Link, VNet routing, NSGs, Firewall, and DNS all influence the path. A session can authenticate successfully yet perform poorly because media or interactive traffic follows a suboptimal route.
Network evidence belongs beside user-experience metrics.
Host pools create the scale and assignment model
Pooled host pools share session hosts across users, while personal desktops provide assigned resources. Load-balancing mode, scaling plan, host capacity, OS image, and licensing determine how the pool behaves under demand.
An AVD architecture should make pool type and assignment explicit instead of treating all session hosts as interchangeable VMs.
Images make session-host configuration repeatable
Custom images, VM Image Builder, Azure Compute Gallery, update strategy, and application packaging create a repeatable host baseline. Hosts should be replaceable from a controlled image rather than depend on manual configuration drift.
Image lifecycle connects directly to security patching and application compatibility.
FSLogix separates user state from the host
Profile Containers and ODFC containers allow user state to follow sessions independently of individual session hosts. Cloud Cache can add resilience across storage targets, and application masking can control app visibility.
Storage performance, permissions, backup, and network path therefore affect sign-in time and user experience.
Identity and access determine who may enter
AD DS, Entra ID, or Entra Domain Services scenarios affect session-host join and authentication requirements. Azure RBAC governs administration, Conditional Access governs connection context, and passwordless/MFA/smart-card options influence user authentication.
The map should distinguish admin authorization from end-user desktop sign-in.
Security continues inside the session host
Defender for Cloud, Defender Antivirus, Defender for Endpoint, App Control for Business, Controlled Folder Access, Trusted Launch, confidential VMs, Bastion, JIT access, and network security reduce the attack surface.
A Defender for Endpoint signal can reveal activity inside the desktop even when the AVD control plane is healthy.
Applications and clients create the working environment
RemoteApp, application groups, Microsoft 365 Apps, OneDrive, Teams optimization, browsers, App attach, client deployment, redirection, Universal Print, Intune/Group Policy, RDP properties, and session timeout all shape what users can do.
The user environment should be designed as a managed product rather than a collection of desktop tweaks.
Monitoring and autoscaling close the operating loop
Azure Monitor, AVD Insights, session and application-group data, host performance, and autoscaling help operators understand demand and capacity. A monitoring strategy should include both infrastructure metrics and user-session evidence.
Scaling decisions should balance cost with login storms, application load, and performance targets.
Backup and DR define the recovery path
AVD recovery includes more than recreating VMs. Profiles, images, personal desktops, network connectivity, identity, app packages, host-pool configuration, and user assignments may all be required in another region.
Licensing should be placed near host-pool and OS choice because it can constrain which users are entitled to access Windows client or Windows Server session hosts. Licensing is not just a billing detail; it is part of the valid deployment design.
Management groups, subscriptions, and resource groups should be drawn above AVD resources because they define policy, RBAC, cost, and administrative scope. A host pool may live in one resource group while profile storage or network resources are managed elsewhere, so ownership boundaries need to be explicit.
RDP Shortpath should be shown as an optimized media/interactive path, while the AVD service still handles brokering and session management. RDP Multipath adds the possibility of multiple network paths. This makes the data path and control/broker path separate concepts.
Private Link should sit on the service-access branch, not the session-host subnet itself. It can provide private access to selected AVD service endpoints, while the session hosts still need ordinary network access to dependent services and user-profile storage.
Storage should show identity and permissions as well as performance. FSLogix containers are files, so SMB access, storage-account or NetApp permissions, Kerberos/identity, encryption, backup, and availability all influence whether the profile can mount successfully.
Image Builder and Compute Gallery should be connected as build and distribution components. A controlled image pipeline can create a version, validate it, publish it, and roll it out to host pools. This reduces configuration drift across session hosts.
Load balancing and autoscaling should be shown as different controls. Load balancing decides where a new session is placed among available hosts; autoscaling decides how many hosts should be running and available. Tuning one cannot fully compensate for a poorly configured other.
Drain mode should sit between maintenance/autoscaling and active sessions. It prevents new sessions from landing on a host while existing sessions complete or are managed. This is a practical mechanism for image replacement, patching, or scale-in without abrupt disruption.
Conditional Access should connect to the user’s AVD sign-in, while Defender for Endpoint and host security continue protecting the session after connection. Strong login controls do not make endpoint or workload protection unnecessary.
Intune and Group Policy should be shown on the user/session configuration layer. They can control Windows settings, redirection, security, and user experience. The chosen identity/join model affects which management path is practical.
Personal desktop assignment should branch from pooled host pools because the lifecycle differs. A personal desktop can contain user-specific state on the VM and may require separate backup or assignment handling, while pooled hosts are expected to be more replaceable.
RemoteApp should sit on the application-delivery branch above session hosts. Users can receive a published application without receiving a full desktop. Application groups and user assignments determine what each user sees after connecting.
Microsoft 365 Apps and OneDrive should be placed near FSLogix because profile and cached-data behavior can dominate performance in multisession environments. Incorrect settings can produce repeated downloads, large profiles, or sign-in delays.
Teams optimization should connect the session to the endpoint through the WebRTC redirector. Media can be offloaded to the local client while signaling and collaboration remain part of the remote session. This is a concrete example of AVD performance depending on both endpoint and host configuration.
App attach should be drawn as a dynamic app layer attached to session hosts. The package can be stored separately from the base image, reducing image churn. Storage reachability and package registration become dependencies during user sign-in or app publication.
Azure Monitor and Insights should receive data from host pools, session hosts, and user sessions. CPU/memory alone are insufficient; connection latency, sign-in metrics, FSLogix health, and session counts can explain user complaints more directly.
Backup should cover the artifacts that cannot simply be rebuilt or whose rebuild time would violate recovery requirements. Profiles, personal desktops, images, and configuration need different protection strategies. Pooled hosts may be disposable if images and automation are trustworthy.
Multi-region design should show which components are active in each region and which are pre-staged. DNS, identity, network, images, storage replication, host pools, and profile recovery all influence how quickly users can reconnect after a regional event.
The map can be used for troubleshooting in dependency order: client/network → authentication → AVD broker/host pool → session host → profile storage → app/user settings → security policy → monitoring evidence. This sequence narrows broad “desktop unavailable” symptoms efficiently.
RDP properties should be placed between host-pool configuration and client experience. They control redirection, display, audio, and other session behavior at a host-pool level, while Intune or Group Policy may manage settings inside Windows. Effective behavior can therefore depend on several policy layers.
Universal Print should sit on the peripheral-services branch because it enables cloud-managed printing without relying on the same legacy print-server model. Printing problems can still involve client redirection, permissions, printer registration, or network access, so the map should keep the dependencies visible.
Start VM on Connect should connect personal or powered-down capacity with user sign-in. It can reduce idle compute cost while preserving access, but startup time and user expectations matter. The feature is an example of cost optimization tied directly to user experience.
Application groups should sit between host pools and user assignments. Desktop Application Groups expose a full desktop, while RemoteApp groups expose selected applications. Users can only launch what the assigned application group publishes.
Use the final map to answer one design question: if users complain about slow sign-in, check profile storage and host capacity before redesigning the network; if sessions disconnect under congestion, inspect the RDP/network path; if an app is missing, inspect image/App attach/application-group assignment. The map narrows the likely layer.
Licensing and cost should also be shown beside autoscaling and host selection. A design with many always-on large VMs may meet performance goals while wasting budget; an aggressively minimized pool may create login delays. The correct architecture balances entitlements, cost, and service-level targets.
The complete map is user requirement → network/host/image/profile → identity/security → apps/client experience → monitoring/recovery. That is the end-to-end logic behind AZ-140.