Logon storms create short-lived authentication, disk and CPU spikes that sustained averages can hide. This describes the separate situation "A capacity report shows brief 200-percent login spikes before employees start their shifts" but does not justify the selected fix for the current issue. The decisive behavior is: Pool separation supports divergent VM baseline, app and access-policy requirements.

Persistent desktop identity and VM power schedules are separate settings that must be compatible. This describes the separate situation "A user needs a persistent personal VM while administrators plan to deallocate all hosts nightly" but does not justify the selected fix for the current issue. The decisive behavior is: Pool separation supports divergent VM baseline, app and access-policy requirements.

Graphics workloads may require accelerated rendering resources rather than only more CPU cores. This describes the separate situation "Graphic designers run demanding 3D applications and CPU-only general-purpose VMs perform poorly" but does not justify the selected fix for the current issue. The decisive behavior is: Pool separation supports divergent VM baseline, app and access-policy requirements.

A container normally requires coordinated attachment and conflicting sessions can prevent consistent profile writes. This describes the separate situation "A help desk sees one user's profile VHD locked by an older disconnected session during a second login" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud Cache mitigates temporary remote storage connection disruptions through a local cache and multiple supported providers.

FSLogix cannot attach a profile disk when the user or host cannot access the backing container. This describes the separate situation "A user's FSLogix VHD exists but sign-in falls back to a local temporary profile due to SMB access denial" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud Cache mitigates temporary remote storage connection disruptions through a local cache and multiple supported providers.

App Masking can control application visibility without reinstalling the app per user. This describes the separate situation "An application that is installed on all pooled session hosts must be hidden from nonlicensed users" but does not justify the selected fix for the current issue. The decisive behavior is: Cloud Cache mitigates temporary remote storage connection disruptions through a local cache and multiple supported providers.

Use scoped backup permissions, protected recovery copies and tested access separation. This would be appropriate for the different task-specific situation "A user profile store is deleted maliciously and snapshots are accessible to the same broad administrator group", because Backup recovery is more resilient when an attacker cannot easily erase production and recovery data together. It does not directly resolve the stated condition, which calls for Validate VM family availability and reserve required quota for secondary-region session hosts.

Write and rehearse a complete failover runbook covering host pools, clients, DNS and user access. This would be appropriate for the different task-specific situation "The disaster recovery documentation contains a list of backup services but no tested routing or client reconnect process", because End-to-end AVD continuity depends on restoring usable sessions, not merely confirming backups exist. It does not directly resolve the stated condition, which calls for Validate VM family availability and reserve required quota for secondary-region session hosts.

Configure Azure Files share backup or snapshots and test individual profile recovery. This would be appropriate for the different task-specific situation "A user accidentally deletes important data from an FSLogix profile VHD stored on Azure Files and administrators have no recovery point", because Historical profile data recovery requires backup snapshots rather than profile roaming alone. It does not directly resolve the stated condition, which calls for Validate VM family availability and reserve required quota for secondary-region session hosts.

Set suitable retention and export policies for AVD diagnostics within compliance requirements. This would be appropriate for the different task-specific situation "Log Analytics retention is set too short for a security team's AVD incident review period", because Diagnostic data is only useful for historical investigations while it remains retained and accessible. It does not directly resolve the stated condition, which calls for Analyze AVD Insights connection reliability data and supported client transport information.

Configure appropriate Azure Virtual Desktop diagnostic settings to a Log Analytics workspace. This would be appropriate for the different task-specific situation "The AVD host pool is working but Azure Monitor has no connection history for troubleshooting", because AVD diagnostic logs require collection destinations before historical control-plane events can be queried. It does not directly resolve the stated condition, which calls for Analyze AVD Insights connection reliability data and supported client transport information.

Use session counts and host availability trends to refine scaling plan ramp-up times. This would be appropriate for the different task-specific situation "A host pool shows insufficient available session capacity during a predictable daily spike", because Scaling before known peak demand helps ensure ready capacity is available at sign-in. It does not directly resolve the stated condition, which calls for Analyze AVD Insights connection reliability data and supported client transport information.

Validate managed-network RDP Shortpath prerequisites and permitted UDP reachability between client and session host. This would be appropriate for the different task-specific situation "Session hosts connect to an on-premises domain controller over ExpressRoute but user sessions still take TCP reverse-connect paths", because RDP Shortpath over a managed network can establish direct UDP transport when client and host have suitable private connectivity. It does not directly resolve the stated condition, which calls for Correlate user session transport statistics with packet loss, jitter and WAN link congestion.

Review user-defined routes and allow required AVD service endpoints through the approved inspection path. This would be appropriate for the different task-specific situation "A forced-tunnel route sends all AVD session-host egress to an on-premises firewall that blocks required service traffic", because Routing required control traffic into an unprepared firewall can disrupt AVD broker and agent communication. It does not directly resolve the stated condition, which calls for Correlate user session transport statistics with packet loss, jitter and WAN link congestion.

Compare client path diagnostics, public endpoint reachability and ISP routing before rebuilding session hosts. This would be appropriate for the different task-specific situation "A help desk sees healthy host availability but only one ISP reports failed client-to-service connections", because Client-side internet path failures can prevent broker access without any failure in Azure session-host resources. It does not directly resolve the stated condition, which calls for Correlate user session transport statistics with packet loss, jitter and WAN link congestion.

Narrow NSG rules to documented necessary sources and service ports. This would be appropriate for the different task-specific situation "A security group allows all inbound network traffic to pooled session hosts for troubleshooting", because NSGs enforce network filtering and broad inbound allows enlarge the reachable attack surface. It does not directly resolve the stated condition, which calls for Use Defender for Cloud, Azure Policy and endpoint management compliance reports at the intended scope.

Apply Conditional Access and secure administrative access workflows to sensitive AVD operations. This would be appropriate for the different task-specific situation "Privileged operators connect from untrusted devices to production session hosts without strong authentication controls", because Strong identity and device conditions reduce the risk of unauthorized high-impact management activity. It does not directly resolve the stated condition, which calls for Use Defender for Cloud, Azure Policy and endpoint management compliance reports at the intended scope.

Configure Controlled Folder Access with suitable protected folder and application allow rules. This would be appropriate for the different task-specific situation "Ransomware routinely tries to modify protected user document folders within remote desktops", because Controlled Folder Access restricts untrusted processes from modifying protected data locations. It does not directly resolve the stated condition, which calls for Use Defender for Cloud, Azure Policy and endpoint management compliance reports at the intended scope.

Choose the supported desktop or RemoteApp group types and publish through the intended workspace. This would be appropriate for the different task-specific situation "A host-pool administrator tries to place desktop and RemoteApp entitlements in incompatible application group arrangements", because Desktop and RemoteApp application groups represent different resource presentation and assignment models. It does not directly resolve the stated condition, which calls for Check AVD agent installation, service connectivity, domain readiness and host registration state.

Confirm the required RDS licensing model and configure valid licensing servers or entitlement as applicable. This would be appropriate for the different task-specific situation "Windows Server session hosts are deployed for pooled desktops but the organization has not planned RDS CALs", because Windows Server-hosted remote sessions have RDS licensing obligations distinct from Windows Enterprise multi-session rights. It does not directly resolve the stated condition, which calls for Check AVD agent installation, service connectivity, domain readiness and host registration state.

Disable drain mode after verifying the host is healthy and ready for user traffic. This would be appropriate for the different task-specific situation "A host in drain mode remains excluded from fresh connections after patch maintenance finishes", because A session host stays unavailable for new placements until its drain state is removed. It does not directly resolve the stated condition, which calls for Check AVD agent installation, service connectivity, domain readiness and host registration state.

AVD compute sizing is driven by actual concurrent workload demand, not merely assigned headcount. This describes the separate situation "A purchasing plan sizes desktop infrastructure by total employees but ignores concurrent usage patterns" but does not justify the selected fix for the current issue. The decisive behavior is: Graphics workloads may require accelerated rendering resources rather than only more CPU cores.

Available memory and application working sets bound stable multi-session density. This describes the separate situation "An enterprise chooses a very small VM type for 15 Office users without measuring memory pressure" but does not justify the selected fix for the current issue. The decisive behavior is: Graphics workloads may require accelerated rendering resources rather than only more CPU cores.

Pool separation supports divergent VM baseline, app and access-policy requirements. This describes the separate situation "An organization needs different security policy scope for high-risk developers and ordinary staff" but does not justify the selected fix for the current issue. The decisive behavior is: Graphics workloads may require accelerated rendering resources rather than only more CPU cores.

Correct Windows user-rights assignments and the applied domain policy for authorized AVD users. This would be appropriate for the different task-specific situation "A workstation group applies a GPO that denies remote interactive logon to the very users assigned to AVD", because Application group entitlement cannot override a host policy that explicitly denies the requested logon type. It does not directly resolve the stated condition, which calls for Plan supported smart-card redirection and certificate trust along with identity integration.

Grant the required management role at an appropriate common ancestor or explicitly on each target scope. This would be appropriate for the different task-specific situation "A host pool administrator attempts to manage AVD resources across subscriptions using a role assigned in only one subscription", because Azure RBAC rights do not automatically extend to unrelated subscriptions outside the assignment scope. It does not directly resolve the stated condition, which calls for Plan supported smart-card redirection and certificate trust along with identity integration.

Evaluate Microsoft Entra Domain Services and its supported session host and application requirements. This would be appropriate for the different task-specific situation "A legacy application needs AD domain join but the company does not want to administer domain controllers", because Managed domain services provide domain join and supported directory protocols without self-managed domain controllers. It does not directly resolve the stated condition, which calls for Plan supported smart-card redirection and certificate trust along with identity integration.

Include the supported agent and registration process after VM provisioning. This would be appropriate for the different task-specific situation "A PowerShell automation creates only session-host Azure VMs but never registers their AVD agent", because AVD service placement depends on completed host-pool registration, not simply Azure VM creation. It does not directly resolve the stated condition, which calls for Parameterize and validate subscription, resource group and host pool IDs before executing automation.

Check AVD agent installation, service connectivity, domain readiness and host registration state. This would be appropriate for the different task-specific situation "New session host VMs deploy successfully but appear as unavailable in the Azure Virtual Desktop portal", because A VM that exists in Azure Compute is not necessarily a healthy registered AVD session host. It does not directly resolve the stated condition, which calls for Parameterize and validate subscription, resource group and host pool IDs before executing automation.

Use supported Bicep or ARM templates with parameterized environment values and reviewed deployment stages. This would be appropriate for the different task-specific situation "A platform team must reproduce the same AVD host pool topology across staging and production", because Declarative Azure deployments make repeatable host-pool resource creation less dependent on portal clicks. It does not directly resolve the stated condition, which calls for Parameterize and validate subscription, resource group and host pool IDs before executing automation.

Configure supported ANF snapshot or backup policies and test restoration. This would be appropriate for the different task-specific situation "Azure NetApp Files stores FSLogix data but no immutable recovery schedule is defined", because Point-in-time snapshots help recover profile volumes from accidental modification or corruption. It does not directly resolve the stated condition, which calls for Back up the required personal VM disks and separately protect user profiles and application data.

Use compatible Azure Update Manager or endpoint management reporting to assess and deploy patches. This would be appropriate for the different task-specific situation "A critical Windows update is required but administrators have no compliance report for AVD VMs", because Update compliance monitoring helps verify that required OS fixes reach the intended session-host fleet. It does not directly resolve the stated condition, which calls for Back up the required personal VM disks and separately protect user profiles and application data.

Add a supported geographically independent recovery copy and test a secondary-region restore. This would be appropriate for the different task-specific situation "An Azure Files profile share has snapshots but a region failure makes both active storage and snapshots unavailable", because Local snapshots in an affected region are not by themselves an effective cross-region DR plan. It does not directly resolve the stated condition, which calls for Back up the required personal VM disks and separately protect user profiles and application data.