AZ-140: Configuring and Operating Microsoft Azure Virtual DesktopDemo

By Microsoft · Question Mode

QuestionQ276

Plan and implement user environments and apps

On-premises Active Directory domain contoso.com is synchronized to an Azure AD tenant. An Azure subscription contains an Azure Virtual Desktop host pool, and a storage account named storage1 has been created.

You need to use FSLogix profile containers in storage1 to store user profiles for a group named Group1, applying the principle of least privilege.

What should you include in the solution? Select the appropriate options in the answer area.

Question Image

Select
For storage1:
To Group1, assign the role of:
Explanation

Because contoso.com is an existing on-premises AD domain already synchronized to Azure AD, Azure Files should be configured to use AD DS authentication by joining the storage account to the existing on-premises domain, avoiding the need to stand up a separate Azure AD DS managed domain. For the RBAC role, FSLogix profile data resides on an SMB file share, so users need the Storage File Data SMB Share Contributor role, which grants read/write access needed to create and update profile containers while following least privilege (the Elevated Contributor role, which also allows changing permissions, is unnecessary for regular users, and the Reader role would not allow writing profile data).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!