AZ-140 Domain 2: Plan and implement identity and security (15-20%) - Complete Study Guide 2026

Domain 2 Overview: Why Identity and Security Matters

Domain 2, "Plan and implement identity and security," makes up 15-20% of the AZ-140 exam - Configuring and Operating Microsoft Azure Virtual Desktop. It's the second-largest domain behind Domain 1's infrastructure planning content, and it's arguably the domain where candidates lose the most points simply because they underestimate it. Identity in Azure Virtual Desktop (AVD) is not a single topic; it spans Microsoft Entra ID (Azure AD), Active Directory Domain Services, Azure AD Domain Services, hybrid join configurations, FSLogix profile permissions, role-based access control, and Conditional Access enforcement.

If you've read the broader AZ-140 exam domains guide, you already know how the four domains fit together. Domain 2 is where Microsoft tests whether you can secure the environment you built in Domain 1 and prepare it for the user experience configured in Domain 3. It's a connective-tissue domain, and questions frequently blend identity concepts with host pool or session host details from other domains.

Identity Scenarios You Must Master

AVD supports several identity architectures, and Domain 2 questions expect you to know which scenario applies to which deployment model. You need working familiarity with:

• Microsoft Entra ID-joined session hosts - the cloud-native model where session hosts join Entra ID directly without an on-premises AD dependency.
• Hybrid Azure AD-joined session hosts - hosts joined to on-premises AD DS and synchronized to Entra ID via Azure AD Connect or Entra Connect.
• Azure AD Domain Services (Azure AD DS) - a managed domain service used when you need domain-join capability without managing domain controllers.
• Traditional AD DS with Entra ID sync - the classic hybrid pattern many enterprise customers still run.

Each model has implications for FSLogix profile storage, single sign-on behavior, and which users can be assigned to a host pool. Expect scenario questions that describe a company's existing identity setup and ask which session host join type is compatible, or what prerequisite is missing before user sign-in will succeed.

FSLogix, Conditional Access, and Session Host Security

FSLogix profile containers show up constantly in Domain 2 material because profile access is fundamentally a permissions problem. Candidates need to know how to configure NTFS and share-level permissions on the storage location hosting FSLogix containers, how to assign the correct security groups, and how profile container access fails silently when permissions are misaligned with the identity model in use.

Beyond FSLogix, session host security touches:

• Network security group (NSG) rules that restrict management traffic to session hosts
• Azure Bastion or just-in-time (JIT) VM access for administrative connections instead of exposing RDP publicly
• Disk encryption options for session host OS and data disks
• Restricting local administrator rights on session hosts while still allowing FSLogix and app installs to function

RBAC and Permission Boundaries in AVD

Role-based access control is a heavily tested subtopic inside Domain 2. AVD introduces built-in roles beyond the generic Azure roles you may already know, and the exam wants you to match the correct role to the correct administrative task at the correct scope (subscription, resource group, host pool, or application group).

Key roles to know cold include Desktop Virtualization Contributor, Desktop Virtualization User, Desktop Virtualization Session Host Operator, and the standard Azure Virtual Machine Contributor and Reader roles as they apply to session host management. Questions often present a help-desk scenario - someone needs to restart session hosts but shouldn't be able to delete a host pool - and ask which built-in role satisfies that requirement with least privilege.

MFA, Conditional Access, and Multi-Session Considerations

Multi-factor authentication and Conditional Access policies are core Domain 2 content because AVD sessions represent a distinct sign-in surface that security teams want to control separately from other app access. You should understand how to scope a Conditional Access policy specifically to the AVD client apps, how per-session MFA differs from per-device trust, and how Conditional Access interacts with RemoteApp versus full desktop sessions.

For multi-session host pools specifically, expect questions about how identity and security controls behave differently when multiple users share a single Windows 10 or Windows 11 Enterprise multi-session VM - including how Conditional Access sign-in frequency settings affect a shared-host experience compared to personal desktops.

How Domain 2 Questions Are Actually Written

Unlike straightforward recall questions, Domain 2 items on AZ-140 tend to be scenario-driven. A typical stem describes an organization's current identity setup (say, hybrid AD with Azure AD Connect) and a business constraint (contractors need access without domain accounts), then asks you to pick the configuration change that satisfies the requirement. The exam may include interactive components as part of the 100-minute proctored session, so you should be comfortable with drag-and-drop role-to-scenario matching and multi-step case study formats, not just single-answer multiple choice.

If you haven't yet reviewed how difficult candidates generally find this material, the AZ-140 difficulty guide breaks down where most people struggle, and Domain 2's blend of identity architecture and security policy is consistently cited as a pressure point - largely because it requires cross-referencing knowledge from Domain 1's networking and infrastructure decisions.

A Focused Study Plan for Domain 2

Given that Domain 2 sits in the middle of exam weight (15-20%), it deserves a dedicated study block but shouldn't consume the majority of your prep time - that belongs to Domain 1. A reasonable approach is to study Domain 2 material after you've built a mental model of host pools and session hosts from Domain 1, since identity concepts make more sense once you understand what they're protecting.

This four-week block fits naturally within a broader prep schedule. If you want the full multi-domain timeline, the AZ-140 study guide for passing on your first attempt lays out how to sequence all four domains together rather than studying them in isolation.

Domain 2 Compared to the Other AZ-140 Domains

It helps to see Domain 2 in context against the exam's full weighting so you can allocate study hours proportionally rather than treating every domain equally.

Notice how Domain 2's content overlaps with both Domain 1's infrastructure planning and Domain 3's user environment configuration. Security decisions rarely exist in a vacuum on this exam - a question framed around identity often requires you to also recall a storage or networking detail from another domain, which is why studying domains in isolation can leave gaps.

Registration and Exam-Day Mechanics That Affect Domain 2 Prep

AZ-140 has no formal prerequisite listed by Microsoft, though the exam targets server or desktop administrators who already have practical experience with Azure compute, networking, identity, storage, and resiliency. That matters for Domain 2 specifically: if your background is light on identity administration (for example, you've never configured Conditional Access or managed Entra ID roles), plan extra hands-on lab time rather than assuming exam-cram reading will be enough.

The exam is delivered through Pearson VUE with both online proctored and test-center options, runs 100 minutes, and may include interactive components - which is directly relevant to Domain 2 since role-assignment and Conditional Access scenarios lend themselves to drag-and-drop or ordered-list question formats. A passing score of 700 or greater is required, and once earned, the certification renews every 12 months through a free online Microsoft Learn renewal assessment - so the identity and security knowledge you build now will need periodic refreshing rather than being a one-time effort.

If you're still weighing logistics like fees and testing options before you schedule, the AZ-140 certification cost breakdown covers the full pricing picture, and the AZ-140 pass rate data article gives useful context on what the numbers actually show without relying on guesswork.

Beyond exam mechanics, it's worth understanding why employers value this credential in the first place. Organizations running hybrid or fully cloud-based virtual desktop environments need administrators who can secure identity boundaries correctly - misconfigured RBAC or missing Conditional Access policies are common real-world incident causes. If you're curious how this translates into job opportunities, the AZ-140 jobs overview and AZ-140 salary guide outline the roles that typically list this certification as a requirement or preference.

For hands-on practice that mirrors the scenario-based question style described above, working through timed practice questions on our AZ-140 practice test platform is one of the most efficient ways to confirm you've actually internalized Domain 2 concepts rather than just recognized them. Repeated exposure to realistic identity and security scenarios on the practice test site also helps you get comfortable with the pacing needed for a 100-minute proctored session.

Frequently Asked Questions