Microsoft • AZ-140
Validates expertise in designing, implementing, managing, and maintaining Microsoft Azure Virtual Desktop experiences and remote apps for any device.
Questions
517
Duration
100 minutes
Passing Score
700/1000
Difficulty
SpecialtyLast Updated
Jan 2025
The Microsoft Certified: Azure Virtual Desktop Specialty (AZ-140) validates subject matter expertise in designing, implementing, managing, and maintaining Microsoft Azure Virtual Desktop (AVD) experiences and remote apps for any device. The certification covers the full lifecycle of an AVD deployment — from planning network topology and host pool architecture, to configuring FSLogix profile containers, securing session hosts with Microsoft Defender for Endpoint, and optimizing performance through autoscaling and Azure Monitor Insights. The exam was last updated on January 14, 2026, with minor changes to the security and FSLogix domains, ensuring alignment with current Azure capabilities.
Candidates must demonstrate hands-on proficiency across Azure compute, networking, storage, identity, and resiliency as they relate to virtual desktop infrastructure. This includes working with technologies such as RDP Shortpath, Azure Private Link, Azure NetApp Files, Microsoft Entra ID (formerly Azure AD), Conditional Access, app attach for dynamic application delivery, and Azure VM Image Builder for image lifecycle management.
This certification is designed for server or desktop administrators who specialize in virtual desktop infrastructure and are transitioning to or expanding within Azure-hosted environments. Ideal candidates include desktop virtualization engineers, systems administrators, and infrastructure architects who design and operate end-user computing solutions at scale for remote or hybrid workforces.
Candidates typically collaborate cross-functionally with Azure administrators, Azure architects, Azure security engineers, Microsoft 365 administrators, and Azure Local administrators. The certification is well-suited for professionals already holding the AZ-104 (Azure Administrator Associate) credential who want to deepen their specialty in virtual desktop delivery.
There are no formal prerequisites required to sit the AZ-140 exam, but Microsoft recommends candidates have hands-on experience with Azure technologies spanning compute, networking, identity, storage, and resiliency before attempting it. Practical knowledge of managing end-user desktop environments — including deploying applications and configuring user settings via the Azure portal, PowerShell, Azure CLI, ARM templates, and Bicep — is strongly advised.
A working understanding of Active Directory Domain Services (AD DS), Microsoft Entra ID, and Microsoft Entra Domain Services is important given the identity-heavy content. Candidates without prior Azure administration experience are encouraged to first pass the AZ-104 (Azure Administrator Associate) exam. Familiarity with FSLogix, Windows Virtual Desktop concepts, and Microsoft 365 workloads such as Teams and OneDrive in multi-session environments will also be beneficial.
Exam AZ-140 is a single proctored exam that must be passed to earn the Microsoft Certified: Azure Virtual Desktop Specialty credential. Candidates are given 100 minutes to complete the assessment, which contains a variable number of questions (typically 40–60) that may include multiple-choice, scenario-based single answer, drag-and-drop, ordered-sequence, and interactive lab-style components. The exam is delivered through Pearson VUE, available both online (proctored remotely) and at in-person testing centers.
A minimum score of 700 out of 1000 is required to pass. The scoring scale is not linear — performance is evaluated against a scaled model. The exam is available in English, German, Spanish, French, Japanese, Portuguese (Brazil), and Chinese (Simplified). Non-English speakers may request an additional 30 minutes when the exam is not available in their preferred language. Candidates who fail may retake after 24 hours; subsequent retake wait times vary per Microsoft's retake policy. The certification expires annually and can be renewed at no cost via an online assessment on Microsoft Learn.
Professionals holding the Azure Virtual Desktop Specialty certification are positioned for roles such as Desktop Virtualization Engineer, End-User Computing (EUC) Architect, Azure Infrastructure Administrator, and Cloud Workspace Specialist. As organizations continue to expand hybrid and remote work infrastructure, demand for AVD expertise remains strong — particularly for enterprises migrating from on-premises Remote Desktop Services (RDS) or Citrix/VMware Horizon environments to Azure-native VDI. Average salaries for virtual desktop engineers in the United States exceed $120,000 per year, with certified professionals typically earning 10–11% more than non-certified peers according to industry salary surveys.
The AZ-140 differentiates candidates from general Azure administrators (AZ-104) by demonstrating deep, scenario-specific expertise in desktop virtualization — a niche that commands a premium in the job market. Compared to vendor-neutral VDI certifications, the Microsoft Specialty badge carries particular weight with Microsoft partner organizations and enterprise customers on Microsoft's ecosystem. The certification renews annually at no cost via a free online assessment on Microsoft Learn, keeping holders current as the AVD platform evolves.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 517 questions.
1. IdentityIntegration Corp has an existing on-premises Active Directory environment and wants to implement Azure Virtual Desktop with hybrid identity. They need to ensure that users can access their virtual desktops using their existing domain credentials while maintaining security best practices. Which identity scenario should they implement?
Explanation
Hybrid identity with on-premises Active Directory Domain Services and Microsoft Entra ID Connect provides the optimal solution for organizations with existing AD infrastructure. This allows users to authenticate with their existing domain credentials while enabling integration with Azure services and modern authentication features like conditional access. Pure cloud identity would require recreating all user accounts and group memberships. Microsoft Entra Domain Services is a managed service that would require significant changes to existing identity infrastructure. Local accounts on session hosts would not provide centralized identity management or single sign-on capabilities.
2. A financial company needs to implement single sign-on (SSO) for its AVD environment. Their session hosts are Microsoft Entra joined. The goal is for users to authenticate to Windows on the session host using their Microsoft Entra credentials without having to re-enter their password after the initial AVD client login. What needs to be configured to enable this?
Explanation
To enable a seamless single sign-on experience for Microsoft Entra joined session hosts, you must configure a specific RDP property on the host pool. The property is 'enablerdsaadauth:i:1'. This can be done in the Azure portal under the host pool's RDP Properties by selecting 'Enable single sign-on for Microsoft Entra authentication'. This setting instructs the connection client and the host to use Microsoft Entra credentials for the session logon, creating the SSO experience. This is not enabled by default and requires this explicit configuration. AD FS is not required for this native Microsoft Entra SSO capability.
3. FlexiWork Corporation needs to configure location redirection so that applications like Maps can use the physical location of the user's device rather than the session host. Which RDP property should they configure?
Explanation
To enable location redirection so applications can use the physical location of the user's device, configure redirectlocation:i:1. When enabled, this setting sends the location of the local device to the session host and sets it as the session location. This allows applications like Maps or Printer Search to use the user's actual physical location rather than the session host's location. When disabled (redirectlocation:i:0), applications will use the session host's location instead.
4. ConditionalAccess Corp wants to implement advanced authentication policies for their Azure Virtual Desktop environment to enhance security. They need to require multi-factor authentication for external users but allow trusted internal users to authenticate with single-factor when accessing from corporate networks. What should they configure?
Explanation
Azure AD Conditional Access policies can implement sophisticated authentication requirements based on multiple conditions including user location, network location, device compliance, and risk level. You can create policies that require MFA for external users or users connecting from untrusted locations while allowing single-factor authentication for internal users on corporate networks. Network Security Groups control network access but cannot enforce authentication requirements. Azure Firewall controls network traffic but doesn't manage authentication policies. Group Policy on session hosts cannot implement the granular, location-based authentication policies needed for this scenario.
5. A law firm, CaseClosed LLP, has a business continuity plan that requires their entire AVD deployment, including user profiles, to be recoverable in a different Azure region. The user profiles are stored using FSLogix Profile Containers on an Azure Files share. What is the recommended strategy to design for the backup and restore of these user profiles?
Explanation
Azure Backup provides a robust, managed solution for protecting Azure Files shares. You can configure a backup policy in a Recovery Services vault to take application-consistent snapshots of the file share on a regular schedule and retain them for short or long-term periods. In a disaster, you can restore the entire share or individual files to the original location or an alternate location in the disaster recovery region. While Cloud Cache can provide high availability, Azure Backup is the recommended service for the backup and point-in-time restore requirement. Site Recovery is for VMs, not file shares.
One-time access to this exam