Microsoft Azure Virtual Desktop Specialty Exam Prep 2026: A Hands-On Engineer's Path Through AZ-140

AZ-140 is the quiet one. It doesn't get the traffic AZ-104 or AZ-305 get, and that's exactly why it's worth your time — the people who hold it tend to get called about jobs, because the supply is thin and every enterprise that ran a VDI project in the last five years needs someone who understands it.

This is the Microsoft Azure Virtual Desktop Specialty exam prep 2026 guide I'd hand a colleague: what's on it, what to build, and where people lose marks.

The shape of AZ-140

• Roughly 40–60 questions, 100–120 minutes
• $165 USD in most regions
• Pass at 700/1000
• Includes a case study section — multiple questions against one long scenario, and you can't go back once you leave it
• Assumes you already know Azure fundamentals: identity, networking, storage, RBAC

That last point is the real prerequisite. AZ-140 is not a beginner exam wearing a specialist badge. It assumes AZ-104-level competence and then tests AVD on top. If you can't explain the difference between Entra ID, Entra Domain Services, and AD DS on an IaaS VM, start there — that distinction alone is worth several questions.

The four skill areas

1. Plan and implement an AVD infrastructure

Host pools first, because everything else hangs off them:

• Pooled vs personal. Pooled = many users share session hosts, breadth-first or depth-first load balancing, needs FSLogix. Personal = one user, one VM, direct or automatic assignment. Choose wrong in a scenario question and every downstream answer is wrong too.
• Session host sizing — Microsoft publishes VM sizing guidance by workload type (light, medium, heavy, power). Know the shape of it: users per vCPU, and that GPU workloads need the NV-series with the right driver extension.
• Multi-session Windows vs single-session client OS, and the licensing entitlements that make AVD cheap (Microsoft 365 E3/E5, Windows E3/E5, or per-user access pricing for external users).
• Images: custom images via Azure Compute Gallery, replication to the regions you deploy in, and the generalise/sysprep step people forget.
• App groups and workspaces: RemoteApp vs Desktop app groups, how app groups attach to workspaces, and that users need an assignment to the app group and the "Desktop Virtualization User" role.
• Networking: bandwidth and latency requirements, RDP Shortpath (managed and public networks), and the fact that AVD is a reverse-connect service — session hosts make outbound connections, so you don't open inbound RDP. That reverse-connect model is a favourite question.

2. Plan and implement identity and security

The identity chapter is where most people lose marks, so slow down here.

Session hosts must be joined to something: AD DS domain-joined (with Entra Connect syncing to the cloud), Entra Domain Services, or Entra-joined. Each has different implications for FSLogix profile storage and for what authentication works. If profiles live on Azure Files with identity-based authentication, the storage account needs the right domain configuration — this combination is the single most-tested integration on the exam.

Then: Conditional Access policies targeting the AVD app, MFA, RBAC roles specific to AVD (Desktop Virtualization Contributor, User, Reader, Host Pool Contributor), Azure Firewall or NSGs plus the required service tags and URLs, and Microsoft Defender for Cloud coverage of session hosts.

3. Plan and implement user environments and apps

FSLogix is the heart of this domain. Profile containers vs Office containers, VHD/VHDX on a file share, Cloud Cache for resilience across storage, and the storage options ranked: Azure Files (premium for real workloads), Azure NetApp Files (highest performance, highest cost), or a file server on IaaS. Know the IOPS-per-user guidance and know that Standard storage will make users hate you.

Also: MSIX app attach (how the package mounts, what the staging/registration lifecycle looks like), Start menu and language pack customisation, printing and device redirection through RDP properties.

4. Monitor and maintain

Azure Monitor Insights for AVD (which workbook shows what), Log Analytics with the diagnostic settings you must enable, session host scaling with the scaling plan feature, drain mode for maintenance, and image update workflows. Plus the backup and BCDR story: what you back up for pooled (nothing much — the profiles) versus personal (the VMs).

Build this, don't just read it

AZ-140 punishes pure theory harder than most Microsoft exams because the questions are operationally specific. Spend a weekend building:

1. A resource group with a small VNet peered to nothing, just to keep it simple.
2. An AD DS setup — a domain controller VM, or Entra Domain Services if you'd rather.
3. A pooled host pool with two session hosts from a marketplace image.
4. An Azure Files premium share with identity-based auth, and FSLogix configured via GPO or registry to point at it.
5. Log in as two different users, confirm the profile VHDs appear on the share, then log in as one of them on the other session host and confirm the profile follows.

That last verification is the moment AVD clicks. It costs maybe $15 of Azure credit if you delete it the same weekend. Set a budget alert first.

Where people actually lose marks

The case study. You get one long scenario — company, existing estate, requirements, constraints — and several questions. Read the requirements section twice before answering anything, and take note of the compliance and cost constraints because they're what discriminate between the plausible answers. Once you advance past the case study you cannot return to it.

Identity combinations. "Entra-joined session hosts with FSLogix profiles on Azure Files" has different requirements than "AD DS-joined with the same storage." Make a table of the three join types × the storage options and fill in what works. That table is probably worth 5% of your score.

Confusing AVD with Windows 365. They're different products with different management models and the exam will offer Windows 365 as a distractor. AVD = you manage the infrastructure, flexible, pooled possible. Windows 365 = fixed per-user Cloud PC, simpler, no pooling.

The four-week plan

• Week 1: Microsoft Learn AZ-140 path, front to back, plus the official study guide as a checklist.
• Week 2: build the lab above. Break FSLogix on purpose and fix it.
• Week 3: identity and security deep dive — the weakest area for most people — plus networking and Conditional Access.
• Week 4: questions only, timed, plus one full case-study rehearsal. Working through an AZ-140 practice test is how you find out whether your lab knowledge survives contact with exam phrasing, which is a genuinely different skill.

Worth it?

For a specialty exam, AZ-140 has an unusually good ratio of effort to market value. VDI is unglamorous, which means fewer people study it, which means the ones who can actually troubleshoot an FSLogix profile-load failure at 8am are in demand. If you're already doing Azure infrastructure work, this is one of the cheapest ways to become the person your organisation can't easily replace.

Take a free AZ-140 practice test to find your weak domain first — or see the full breakdown on the AZ-140 exam page. If you want each answer explained while you drill, ai.examcert.app does that and costs about as much as a coffee.