What is the primary purpose of a Microsoft Entra Conditional Access policy in an Azure Virtual Desktop environment?

To assign users to application groups in Azure Virtual Desktop

To configure network security group rules for the virtual network

To manage the lifecycle of session host virtual machines

To enforce security requirements based on conditions like user location or device state

Your organization uses Azure Virtual Desktop and has a Conditional Access policy that requires MFA for all users. You are introducing a new group of users who will use Windows 10 devices that are not managed by your organization. You need to ensure that these users can access Azure Virtual Desktop only from compliant devices. What should you do?

Block access for the new user group until they are managed

Use Intune to enroll the new users' devices and then require compliance

Create a Conditional Access policy that requires device compliance for the Azure Virtual Desktop app and assign it to the new user group

Modify the existing MFA policy to also require device compliance for all users

Your organization wants to enable passwordless authentication for Azure Virtual Desktop using Windows Hello for Business. Users are hybrid-joined to Microsoft Entra ID. What must you configure to support this?

Use Microsoft Authenticator for all users

Deploy smart cards and configure the session hosts to require them

Enable Windows Hello for Business in the tenant and configure the session hosts to support it

Configure Conditional Access to require MFA for all users

A company has AVD session hosts joined to an on-premises AD DS domain. They want to enable SSO for users who are synced to Microsoft Entra ID. They also want to require MFA for all AVD access. What should you configure?

Configure the session hosts to use passwordless authentication and skip MFA.

Enable Microsoft Entra Kerberos and configure a Conditional Access policy that requires MFA for the AVD app.

Use a federation trust and configure the session hosts to accept federated tokens.

Enable Microsoft Entra Seamless SSO and configure a Conditional Access policy that requires MFA.

Your company uses AVD with session hosts joined to an on-premises AD DS domain. Users currently sign in twice: once to the AVD web client and again to the Windows session. You want to enable single sign-on so users only authenticate once. What should you configure?

Enable Microsoft Entra Seamless SSO and configure the AVD RDP properties to use the Entra ID token.

Use passwordless authentication with FIDO2 keys for the RDP connection.

Configure the session hosts to use Microsoft Entra Kerberos for the RDP connection.

Set up a federation trust between AD DS and Microsoft Entra ID.

Microsoft Certified:Azure Virtual Desktop Specialty

Domain 2Objective 1

Plan and Implement Identity Integration AZ-140 Practice Questions (Page 2)

Part of the Plan and implement identity and security domain, which accounts for 15–20% of the AZ-140 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

15–20%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of a Microsoft Entra Conditional Access policy in an Azure Virtual Desktop environment?
Select an answer first
7expert · hard
Your organization uses Azure Virtual Desktop and has a Conditional Access policy that requires MFA for all users. You are introducing a new group of users who will use Windows 10 devices that are not managed by your organization. You need to ensure that these users can access Azure Virtual Desktop only from compliant devices. What should you do?
Select an answer first
8application · medium
Your organization wants to enable passwordless authentication for Azure Virtual Desktop using Windows Hello for Business. Users are hybrid-joined to Microsoft Entra ID. What must you configure to support this?
Select an answer first
9expert · hard
A company has AVD session hosts joined to an on-premises AD DS domain. They want to enable SSO for users who are synced to Microsoft Entra ID. They also want to require MFA for all AVD access. What should you configure?
Select an answer first
10application · medium
Your company uses AVD with session hosts joined to an on-premises AD DS domain. Users currently sign in twice: once to the AVD web client and again to the Windows session. You want to enable single sign-on so users only authenticate once. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-140

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-140” is a trademark of its owner, used for identification only.