Exam AZ-140 topic 12 question 3 discussion

Reading the question together now :) Grant Admin1 permissions to manage workspaces, "including listing" which apps are assigned to the app groups. Looks like C+D!

B+E Q:Delegate the management of app groups to Admin2, including the ability to publish app groups to users and user groups. #Desktop Virtualization Application Group Contributor: The "Desktop Virtualization Application Group Contributor" role allows users to manage all aspects of application groups. If you want users to publish application groups to users or user groups, they'll also need the "User Access Administrator" role. https://docs.microsoft.com/en-us/azure/virtual-desktop/rbac

There are two admins ;) Delegate the management of app groups to Admin2, including the ability to publish app groups to users and user groups = not this question. Grant Admin1 permissions to manage workspaces, including listing which apps are assigned to the app groups. Minimize administrative effort to manage network security. Correct Answer for Admin1 = C. Desktop Virtualization Workspace Contributor D. Desktop Virtualization Application Group Reader

Given the focus on least privilege and the exact needs: C. Desktop Virtualization Workspace Contributor: Fits perfectly for managing workspaces and seeing app assignments. D. Desktop Virtualization Application Group Reader: Provides necessary read access without giving unnecessary write permissions. Correct Answer: C. Desktop Virtualization Workspace Contributor D. Desktop Virtualization Application Group Reader This combination fits both the security requirement and the least privilege principle effectively.

To meet the security requirements for Admin1, you should assign the following two roles: Desktop Virtualization Host Pool Contributor (Option A): This role allows Admin1 to manage all aspects of a host pool, which is essential for managing the Azure Virtual Desktop session hosts1. User Access Administrator (Option E): This role is necessary to assign user accounts or user groups to application groups, ensuring that Admin1 can manage access permissions effectively1. These roles together will provide Admin1 with the necessary permissions to manage the Azure Virtual Desktop environment while ensuring security and proper access control.

#Desktop Virtualization Application Group Contributor: The "Desktop Virtualization Application Group Contributor" role allows users to manage all aspects of application groups. If you want users to publish application groups to users or user groups, they'll also need the "User Access Administrator" role. https://docs.microsoft.com/en-us/azure/virtual-desktop/rbac

The Desktop Virtualization Workspace Contributor role allows managing all aspects of workspaces. To get information on applications added to a related application group, you also need the Desktop Virtualization Application Group Reader role. https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac

C + D Q: Grant Admin1 permissions to manage workspaces, including listing which apps are assigned to the app groups. A: Desktop Virtualization Workspace Contributor: The Desktop Virtualization Workspace Contributor role allows users to manage all aspects of workspaces. To get information on applications added to the application groups, they'll also need the "Application Group Reader role". Desktop Virtualization Application Group Reader = "Application Group Reader role"

C+D "Grant Admin1 permissions to manage workspaces, including listing which apps are assigned to the app groups." To manage workspaces it's the contributor, the key word for the app group is "listing". Reader is enough.

C&D for admin1.

correct

I would go for BE, • Application Group Contributor role: Lets you manage all aspects of app groups. If you want to publish app groups to users or user groups, you'll need the User Access Administrator role.

From the docs: The Desktop Virtualization Workspace Contributor role allows users to manage all aspects of workspaces. To get information on applications added to the application groups, they'll also need the Application Group Reader role. https://learn.microsoft.com/en-us/azure/virtual-desktop/rbac#desktop-virtualization-workspace-contributor

C and D for Admin 1.

There are 2 possible question: Question A) : Grant Admin1 permissions to manage workspaces, "including listing" which apps are assigned to the app groups.--> C+D! Question B) Delegate the management of app groups to Admin2, including the ability to publish app groups to users and user groups.--> B + E

this question is about Admin1, who needs to be able to (1) manage workspaces, and (2) list apps assigned to app groups. according to MS, "The Desktop Virtualization Workspace Contributor role allows users to manage all aspects of workspaces. To get information on applications added to the application groups, they'll also need the Application Group Reader role." https://docs.microsoft.com/en-us/azure/virtual-desktop/rbac#desktop-virtualization-workspace-contributor so, C and D is 100% correct.

The link clearly says : Publish Apps(Admin2) : Desktop Virtualization App Group Contributor + User Access Admin Manage workspace(Admin 1) : Desktop Virtualization Workspace Contributor + DV App Group Reader. How hard is to read and respond?