Delegate approved management access through narrowly scoped Azure and Windows administrative roles. This would be appropriate for the different task-specific situation "An administrator needs to troubleshoot a live host's vulnerability without giving broad local admin privileges to all help desk staff", because Least-privilege role separation limits the number of principals able to modify session-host configuration. It does not directly resolve the stated condition, which calls for Configure supported update reporting and remediation for the session-host operating system.

Layer endpoint security, patching, application control and least privilege on top of network segmentation. This would be appropriate for the different task-specific situation "A team assumes a private VNet guarantees an AVD session host cannot be compromised by malicious browser content", because Private network placement does not eliminate host-level attack and malicious execution risks. It does not directly resolve the stated condition, which calls for Configure supported update reporting and remediation for the session-host operating system.

Include supported onboarding and validation in the session-host image or deployment lifecycle. This would be appropriate for the different task-specific situation "One group of image versions ships without Defender for Endpoint because the agent was added manually after provisioning", because A repeatable endpoint security baseline reduces gaps created by manual per-VM setup. It does not directly resolve the stated condition, which calls for Configure supported update reporting and remediation for the session-host operating system.

Gallery resource access governs who can read or deploy image versions across subscriptions. This describes the separate situation "A security team needs to control which subscription can deploy an approved custom AVD image" but does not justify the selected fix for the current issue. The decisive behavior is: Image disk characteristics must be compatible with the VM provisioning request.

Azure Compute Gallery can distribute versioned image artifacts to configured regions for VM deployment. This describes the separate situation "Host pools across two regions require the same tested Windows multi-session image release" but does not justify the selected fix for the current issue. The decisive behavior is: Image disk characteristics must be compatible with the VM provisioning request.

Cloning a unique joined-machine identity can create domain trust and management conflicts. This describes the separate situation "A domain-joined source VM is captured with its existing computer account and deployed to dozens of hosts" but does not justify the selected fix for the current issue. The decisive behavior is: Image disk characteristics must be compatible with the VM provisioning request.

Select a supported Azure Files identity approach such as Microsoft Entra Kerberos and validate all prerequisites. This would be appropriate for the different task-specific situation "A cloud-only Entra user needs to reach a domain-dependent SMB profile share with unsupported identity configuration", because FSLogix profile storage authentication must be compatible with the host's chosen join and user identity model. It does not directly resolve the stated condition, which calls for Apply resource-group or individual resource-scoped RBAC assignments for each team.

Use the minimum supported Windows session-login role for eligible desktop users and restrict admin login roles. This would be appropriate for the different task-specific situation "A service desk assigns the Virtual Machine Administrator Login role to all desktop users to fix one access issue", because Administrative VM login rights exceed the privileges needed for ordinary user desktops. It does not directly resolve the stated condition, which calls for Apply resource-group or individual resource-scoped RBAC assignments for each team.

Plan protected break-glass accounts and exclusions consistent with identity security policy. This would be appropriate for the different task-specific situation "A deployed Conditional Access policy blocks emergency administrators from recovering a failed host pool", because Emergency access procedures reduce the risk of total administrative lockout from a failed Conditional Access configuration. It does not directly resolve the stated condition, which calls for Apply resource-group or individual resource-scoped RBAC assignments for each team.

Plan managed domain network reachability and DNS settings for the intended session-host VNet. This would be appropriate for the different task-specific situation "An Entra Domain Services deployment is proposed without confirming its managed domain DNS and network requirements", because Managed domain authentication depends on the session hosts locating Entra Domain Services controllers. It does not directly resolve the stated condition, which calls for Configure supported Microsoft Entra single sign-on and validate host and client prerequisites.

Grant the required management role at an appropriate common ancestor or explicitly on each target scope. This would be appropriate for the different task-specific situation "A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription", because Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. It does not directly resolve the stated condition, which calls for Configure supported Microsoft Entra single sign-on and validate host and client prerequisites.

Plan supported smart-card redirection and certificate trust along with identity integration. This would be appropriate for the different task-specific situation "A smart-card based workforce needs to use certificate-backed authentication inside published desktops", because Smart-card authentication requires both remote device access and a valid certificate or directory trust path. It does not directly resolve the stated condition, which calls for Configure supported Microsoft Entra single sign-on and validate host and client prerequisites.

Use supported FSLogix storage plus an independently tested snapshot and backup strategy. This would be appropriate for the different task-specific situation "A tenant wants both profile portability and recoverable historical profile data", because FSLogix provides profile roaming, while separate storage protection covers deletion and corruption recovery. It does not directly resolve the stated condition, which calls for Inspect FSLogix profile service logs and configured profile container locations.

Plan remote provider availability and cache recovery rather than treating a local cache as permanent backup. This would be appropriate for the different task-specific situation "An administrator expects Cloud Cache to eliminate the need for any reachable remote storage indefinitely", because Cloud Cache supports resilience to interruptions but still needs remote providers for durable profile synchronization. It does not directly resolve the stated condition, which calls for Inspect FSLogix profile service logs and configured profile container locations.

Use narrow documented exclusions and preserve persistent user folders and application settings. This would be appropriate for the different task-specific situation "An admin excludes the entire user profile from FSLogix roaming to reduce storage cost", because Overly broad exclusions undermine the purpose of a roaming profile container. It does not directly resolve the stated condition, which calls for Inspect FSLogix profile service logs and configured profile container locations.

Compute Gallery image definitions distinguish generalized images from specialized VM images. This describes the separate situation "Operations needs a way to describe whether a gallery image uses generalized or specialized OS state" but does not justify the selected fix for the current issue. The decisive behavior is: Generalization removes computer-specific identity data so an image can provision independent session hosts.

Credentials baked into image disks are copied to every descendant VM and increase compromise exposure. This describes the separate situation "A source VM image includes a private admin credential in a startup script visible to every provisioned host" but does not justify the selected fix for the current issue. The decisive behavior is: Generalization removes computer-specific identity data so an image can provision independent session hosts.

Accelerated desktop applications require matching GPU virtual hardware and supported device drivers. This describes the separate situation "A new graphics-intensive image boots successfully but 3D applications fall back to software rendering" but does not justify the selected fix for the current issue. The decisive behavior is: Generalization removes computer-specific identity data so an image can provision independent session hosts.

Versioned image artifacts permit controlled restoration of a known-good desktop baseline. This describes the separate situation "A desktop outage occurs after a new golden image is released and operations have no safe rollback version" but does not justify the selected fix for the current issue. The decisive behavior is: Disaster recovery capacity depends on having deployable compute SKU resources when failover begins.

Testing patched images catches application regressions before affecting an entire user population. This describes the separate situation "A release pipeline automatically patches images but does not test application compatibility before production" but does not justify the selected fix for the current issue. The decisive behavior is: Disaster recovery capacity depends on having deployable compute SKU resources when failover begins.

Point-in-time snapshots help recover profile volumes from accidental modification or corruption. This describes the separate situation "Azure NetApp Files stores FSLogix data but no immutable recovery schedule is defined" but does not justify the selected fix for the current issue. The decisive behavior is: Disaster recovery capacity depends on having deployable compute SKU resources when failover begins.

Disable unapproved drive and USB redirection through supported RDP properties or policies. This would be appropriate for the different task-specific situation "Users can see local USB storage devices from the session host despite a data-loss-prevention requirement", because Device redirection may expose local client storage to remote applications unless explicitly restricted. It does not directly resolve the stated condition, which calls for Verify compatible client versions and AVD Teams optimization components and settings.

Assign an appropriate RemoteApp group and publish the selected applications. This would be appropriate for the different task-specific situation "An AVD user wants only a few business apps instead of an entire Windows desktop", because RemoteApp presents authorized application windows without requiring a full published desktop experience. It does not directly resolve the stated condition, which calls for Verify compatible client versions and AVD Teams optimization components and settings.

Limit printer redirection or publish only approved printers in the remote environment. This would be appropriate for the different task-specific situation "Remote desktop users complain that every connection exposes all their local printers to a sensitive session", because Printer redirection can be restricted to reduce unnecessary device exposure and confusion. It does not directly resolve the stated condition, which calls for Verify compatible client versions and AVD Teams optimization components and settings.

Grant the relevant Microsoft Entra directory role separately from Azure resource management permissions. This would be appropriate for the different task-specific situation "A new AVD admin is made subscription Contributor but still cannot manage directory group membership", because Azure RBAC and Microsoft Entra directory administration are separate permission systems. It does not directly resolve the stated condition, which calls for Join session hosts to AD DS and validate network, DNS and domain controller reachability.

Plan supported smart-card redirection and certificate trust along with identity integration. This would be appropriate for the different task-specific situation "A smart-card based workforce needs to use certificate-backed authentication inside published desktops", because Smart-card authentication requires both remote device access and a valid certificate or directory trust path. It does not directly resolve the stated condition, which calls for Join session hosts to AD DS and validate network, DNS and domain controller reachability.

Review existing sessions and apply a controlled disconnect or sign-out policy when access is revoked. This would be appropriate for the different task-specific situation "A user has been removed from a group but still retains a previously established AVD session", because Removing future entitlement does not necessarily terminate an already running remote Windows session immediately. It does not directly resolve the stated condition, which calls for Join session hosts to AD DS and validate network, DNS and domain controller reachability.

Enable drain mode on that session host before maintenance. This would be appropriate for the different task-specific situation "A production host must stop accepting new pooled connections while existing user sessions remain active", because Drain mode prevents new user sessions from landing on a host while allowing existing sessions to finish. It does not directly resolve the stated condition, which calls for Use the supported Az.DesktopVirtualization commands and verify the selected subscription and resource group.

Remove or repair stale session-host registration records and register the new agent safely. This would be appropriate for the different task-specific situation "A session host VM is rebuilt with the same name but its old AVD registration object remains unhealthy", because Host-pool inventory and Azure VM resources may need reconciliation after destructive replacement. It does not directly resolve the stated condition, which calls for Use the supported Az.DesktopVirtualization commands and verify the selected subscription and resource group.

Check maintenance drain mode and release only verified healthy hosts back into rotation. This would be appropriate for the different task-specific situation "A host pool reports healthy hosts but all are configured to reject new sessions during an overnight update", because Host registration health and eligibility for new session placement are separate status properties. It does not directly resolve the stated condition, which calls for Use the supported Az.DesktopVirtualization commands and verify the selected subscription and resource group.

NSGs enforce network filtering and broad inbound allows enlarge the reachable attack surface. This describes the separate situation "A security group allows all inbound network traffic to pooled session hosts for troubleshooting" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.

EDR findings support controlled endpoint investigation and containment of suspicious behavior. This describes the separate situation "Security engineers need to determine whether malicious user processes are performing credential theft on a shared host" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.

Storage encryption controls protect data at rest independently of access-control lists. This describes the separate situation "Azure Policy audit shows AVD session-host disks without required encryption configuration" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud security posture management surfaces configuration and protection gaps that need targeted remediation.