App attach user access is controlled through AVD app publication and group entitlement. This describes the separate situation "A new packaged app must be available to only one department in a large AVD host pool" but does not justify the selected fix for the current issue. The decisive behavior is: Separating application delivery from a golden image can simplify approved app lifecycle updates.

Teams real-time media and remote device redirection have separate compatibility and policy requirements. This describes the separate situation "Microsoft Teams calls work, but user cameras do not appear in sessions after a client policy change" but does not justify the selected fix for the current issue. The decisive behavior is: Separating application delivery from a golden image can simplify approved app lifecycle updates.

Files On-Demand reduces unnecessary full-content downloads for eligible OneDrive files. This describes the separate situation "OneDrive sync fills session host OS disks because large synchronized files are cached without capacity controls" but does not justify the selected fix for the current issue. The decisive behavior is: Separating application delivery from a golden image can simplify approved app lifecycle updates.

ANF throughput and service-level quotas can constrain FSLogix operations under aggregate login load. This describes the separate situation "An Azure NetApp Files volume experiences sustained throughput pressure during simultaneous profile logons" but does not justify the selected fix for the current issue. The decisive behavior is: Deleting central profile storage can remove every user's portable desktop settings at once.

A private endpoint's existence does not automatically grant connectivity and name resolution from all peered networks. This describes the separate situation "An SMB private endpoint is reachable from one VNet but inaccessible from another peered workspace VNet" but does not justify the selected fix for the current issue. The decisive behavior is: Deleting central profile storage can remove every user's portable desktop settings at once.

Profile mount storms generate metadata and I/O pressure that can outgrow low-throughput file shares. This describes the separate situation "A high-density host pool reports slow FSLogix logons when standard file shares reach their IOPS ceiling" but does not justify the selected fix for the current issue. The decisive behavior is: Deleting central profile storage can remove every user's portable desktop settings at once.

Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts. This would be appropriate for the different task-specific situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections", because Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. It does not directly resolve the stated condition, which calls for Validate required AD DS DNS resolution and domain-join service ports across the session-host network.

Configure suitable QoS policies and verify prioritized interactive RDP traffic on managed network devices. This would be appropriate for the different task-specific situation "A branch has competing real-time desktop audio and bulk file traffic over one constrained WAN circuit", because QoS traffic classification can protect latency-sensitive remote desktop flows under congestion. It does not directly resolve the stated condition, which calls for Validate required AD DS DNS resolution and domain-join service ports across the session-host network.

Design Azure Virtual Desktop Private Link with appropriate private endpoints and published feature prerequisites. This would be appropriate for the different task-specific situation "A regulated desktop deployment must keep supported AVD service connections on private access paths", because AVD Private Link can restrict supported service connection traffic to private network access rather than public service endpoints. It does not directly resolve the stated condition, which calls for Validate required AD DS DNS resolution and domain-join service ports across the session-host network.

Use the supported Azure CLI desktopvirtualization extension commands with authorized credentials. This would be appropriate for the different task-specific situation "A Linux build worker is expected to create and configure an AVD host pool without using the Azure portal", because Azure CLI can manage AVD resource configurations through Azure Resource Manager APIs. It does not directly resolve the stated condition, which calls for Include the supported agent and registration process after VM provisioning.

Associate the application group with the intended AVD workspace and verify user assignment. This would be appropriate for the different task-specific situation "A newly created desktop application group is not shown in any user's remote workspace feed", because Workspace associations determine whether assigned application group resources are exposed in the user's feed. It does not directly resolve the stated condition, which calls for Include the supported agent and registration process after VM provisioning.

Choose the supported desktop or RemoteApp group types and publish through the intended workspace. This would be appropriate for the different task-specific situation "A host-pool administrator tries to place desktop and RemoteApp entitlements in incompatible application group arrangements", because Desktop and RemoteApp application groups represent different resource presentation and assignment models. It does not directly resolve the stated condition, which calls for Include the supported agent and registration process after VM provisioning.

Desktop and RemoteApp application groups represent different resource presentation and assignment models. This describes the separate situation "A host-pool administrator tries to place desktop and RemoteApp entitlements in incompatible application group arrangements" but does not justify the selected fix for the current issue. The decisive behavior is: A VM that exists in Azure Compute is not necessarily a healthy registered AVD session host.

Session-host registration and ongoing broker signaling require reliable agent outbound communication. This describes the separate situation "A private host pool is created but none of its session hosts can reach required Microsoft AVD control endpoints" but does not justify the selected fix for the current issue. The decisive behavior is: A VM that exists in Azure Compute is not necessarily a healthy registered AVD session host.

A session host stays unavailable for new placements until its drain state is removed. This describes the separate situation "A host in drain mode remains excluded from fresh connections after patch maintenance finishes" but does not justify the selected fix for the current issue. The decisive behavior is: A VM that exists in Azure Compute is not necessarily a healthy registered AVD session host.

Use scoped backup permissions, protected recovery copies and tested access separation. This would be appropriate for the different task-specific situation "A user profile store is deleted maliciously and snapshots are accessible to the same broad administrator group", because Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together. It does not directly resolve the stated condition, which calls for Keep the last approved image version and defined host rollback procedures.

Write and rehearse a complete failover runbook covering host pools, clients, DNS and user access. This would be appropriate for the different task-specific situation "The disaster recovery documentation contains a list of backup services but no tested routing or client reconnect process", because End-to-end AVD continuity depends on restoring usable sessions, not merely confirming backups exist. It does not directly resolve the stated condition, which calls for Keep the last approved image version and defined host rollback procedures.

Move user state to supported persistent FSLogix storage with recoverable copies. This would be appropriate for the different task-specific situation "An organization relies on locally stored user profiles when replacing pooled session hosts during disaster recovery", because Session hosts are replaceable, but user profiles need independent protection and availability. It does not directly resolve the stated condition, which calls for Keep the last approved image version and defined host rollback procedures.

Azure RBAC supports delegated permissions at different resource hierarchy scopes. This describes the separate situation "Two administrative teams need independent control of host pools within the same subscription" but does not justify the selected fix for the current issue. The decisive behavior is: Broker authentication to AVD and Kerberos authentication to a legacy app are separate operations.

Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. This describes the separate situation "A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription" but does not justify the selected fix for the current issue. The decisive behavior is: Broker authentication to AVD and Kerberos authentication to a legacy app are separate operations.

Microsoft Entra Conditional Access can enforce sign-in controls using user and device context. This describes the separate situation "Users must pass multifactor authentication when connecting to AVD from unmanaged devices" but does not justify the selected fix for the current issue. The decisive behavior is: Broker authentication to AVD and Kerberos authentication to a legacy app are separate operations.

Create the required appropriately delegated subnet for Azure NetApp Files volumes. This would be appropriate for the different task-specific situation "A team tries to deploy Azure NetApp Files volumes in an ordinary subnet with no delegation", because Azure NetApp Files uses dedicated delegated subnet integration rather than an arbitrary generic NIC subnet. It does not directly resolve the stated condition, which calls for Set Azure Monitor capacity and latency alerts for the user profile storage service.

Verify both share-level role assignment and NTFS permissions on the SMB path. This would be appropriate for the different task-specific situation "Users have Azure Files share-level RBAC but still get access denied creating their FSLogix container folder", because Azure Files identity-based SMB authorization combines share-level permission checks with file and folder ACLs. It does not directly resolve the stated condition, which calls for Set Azure Monitor capacity and latency alerts for the user profile storage service.

Increase the appropriate file-share quota and address per-profile growth under retention policy. This would be appropriate for the different task-specific situation "A file share has a low quota and reaches capacity during an organization-wide sign-in event", because Share capacity ceilings can block new profile writes even when underlying storage connectivity is healthy. It does not directly resolve the stated condition, which calls for Set Azure Monitor capacity and latency alerts for the user profile storage service.

Apply least-privilege share and NTFS permissions with user-specific container ownership. This would be appropriate for the different task-specific situation "An administrator grants everyone Full Control on a profile share to fix a single user logon issue", because Broad write access to profile containers can expose or corrupt other users' data. It does not directly resolve the stated condition, which calls for Validate peering, route tables, private DNS resolution and storage access rules across both networks.

Separate shares or enforce authorized group-based ACLs and share-level role assignments. This would be appropriate for the different task-specific situation "One profile share serves users from different environments and has no permissions boundary between departments", because Isolation of users' profile data requires storage authorization in addition to Azure resource permissions. It does not directly resolve the stated condition, which calls for Validate peering, route tables, private DNS resolution and storage access rules across both networks.

Schedule compatible Azure NetApp Files snapshots and validate volume or file recovery procedures. This would be appropriate for the different task-specific situation "The enterprise needs rapid recovery of a damaged Azure NetApp Files profile volume", because ANF snapshots preserve point-in-time volume state that can support recovery from accidental modification. It does not directly resolve the stated condition, which calls for Validate peering, route tables, private DNS resolution and storage access rules across both networks.

Configure supported Microsoft Entra single sign-on and validate host and client prerequisites. This would be appropriate for the different task-specific situation "An AVD sign-in process asks users to authenticate to the broker and then enter credentials again at Windows", because AVD single sign-on can reduce repeated authentication prompts when its identity conditions are met. It does not directly resolve the stated condition, which calls for Test domain controller DNS discovery and authentication ports for the session-host network.

Grant the required management role at an appropriate common ancestor or explicitly on each target scope. This would be appropriate for the different task-specific situation "A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription", because Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. It does not directly resolve the stated condition, which calls for Test domain controller DNS discovery and authentication ports for the session-host network.

Evaluate supported Microsoft Entra joined AVD session hosts and configure required device and user sign-in prerequisites. This would be appropriate for the different task-specific situation "An organization wants cloud-managed Windows session hosts without maintaining an on-premises domain join dependency", because Entra join provides a cloud identity option for supported AVD Windows session hosts. It does not directly resolve the stated condition, which calls for Test domain controller DNS discovery and authentication ports for the session-host network.

Configure the virtual network DNS servers to resolve private AD DS records and retest SRV lookups. This would be appropriate for the different task-specific situation "A session host resolves its domain name to public addresses and cannot contact internal AD controllers", because Domain-joined Windows clients use DNS SRV records to discover domain controllers and authentication services. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.

Explain that RDP Multipath maintains alternate session transport paths and switches as network quality changes. This would be appropriate for the different task-specific situation "A network architect expects RDP Multipath to aggregate the bandwidth of five independent user desktops into one session", because RDP Multipath improves session resilience with monitored active and backup paths rather than merging multiple unrelated users into one connection. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.

Correlate user session transport statistics with packet loss, jitter and WAN link congestion. This would be appropriate for the different task-specific situation "A successful RDP connection suffers intermittent audio gaps only when UDP loss spikes", because Real-time media quality is particularly sensitive to packet loss and unstable transport timing. It does not directly resolve the stated condition, which calls for Evaluate supported TURN-relayed UDP RDP Shortpath and the required outbound UDP path.