AZ-140 Renewal 2025 – What Microsoft Really Tested (and what they didn’t)

AZ-140 – Your Certification Expires Soon

• Have you ACTUALLY done this in real life?
• Are you an admin or a tourist?
• Did you read anything in the last 12 months?

• How RDP Shortpath behaves when DNS is moody
• Why UDP is king and TCP is the sad fallback
• Wheter you know Bastion exists (and that Public IPs are a crime)
• How load-balancing logic affects user experience
• The relationship between VNets, peering and session hosts

1. A user reports that Shortpath was working yesterday but (oh oh ) isn’t today. What’s the first think you check?
   1. Think UDP accessibility, routing, DNS resolution, firewall behavior
2. An architect insists on deploying a Bastion host in every region. Should you?
   1. Hint: Cross-region peering. One Bastion (Ring) can rule them all. 

If FSLogix doesn’t work… nothing works. This section was ruthless… just like my previous blog Admin Renewal; Storate… always storage

• Azure Files vs Premium Files vs NetApp Files
• Identity based access with Kerberos
• NTFS vs Share level permissions
• FSLogix profile container behavior
• Cloud Cache multi location design

1. A profile container fails to mount on only half the session hosts. What do you investigate first?
   1. Permissions consistency, Kerberos delegation, DNS, SMB signing
2. Your manager wants Cloud Cache with two Azure Files endpoints in different regions. Does that make sense?
   1. Think latency, writes, FSLogix performance impact.

• Image preparation (golden image discipline is real)
• Azure Compute Gallery Usage
• Gen2 requirements
• Scaling plan mechanics
• VM registration failures (everyone’s favorite monday morning problem)

1. A new session host doesn’t register with the host pool. What’s the first thing you check?
   1. AVD agent status, workspace registration, time sync, hybrid join
2. Your organization wants to update the image monthly without breaking the world. What do you recommend?
   1. Shared Image Gallery + versioning + host pool draining

Just like in my Azure Admin Renewal blog where Microsoft hits you with subtle logic traps, the AZ-140 renewal … did the exact same thing.

They want you to know if you understand:

• Who can add session hosts
• Who can manage drain mode
• Which identity runs autoscale
• What start VM on connect actually needs
• The difference between “Contributor” and “You just gave someone full control of Azure”

1. You need to give someone permissions to add session hosts but not remove them. Which role fits?
   1. Thin granular AVD roles… not Owner… not contributor
2. Start VM on Connect isn’t working. What role is missing?
   1. Hint: Desktop Virtualization Power On Contributor (assigned on the ARM Prover SPN).

• VHDLocations
• CCDLocations for Cloud Cache
• ProfileType selection
• Redirections.xml logic
• Disk compaction behavior
• Multi session quirks

1. Users complain their profile loads slowly in the morning. What’s your first suspect?
   1. Storage latency, Azure Files throughput, Cloud Cache warm up
2. You need redundant profile endpoints across two storage accounts. How do you set that up?
   1. CCDLocations… Always…

• Log Analytics Workspaces
• Diagnostic Settings (Workspace level + Host pool level)
• AVD Insights
• KQL basics
• Performance baselining
• Session reporting

1. You need to investigate why users can’t subscribe to the workspace feed. Where do you enable logs?
   1. On the Workspace resource (not the host pool)
2. A scaling plan fails randomly and nobody knows why. What’s your move?
   1. Collect logs from the autoscale engine via Diagnositcs -> Log analytics

• If you’ve ever deployed AVD in production…
• If you’ve ever rebuilt an image at midnight…
• If you’ve ever chased a broken FSLogic container like it owed you money…