Free Microsoft AZ-140 Actual Exam Questions - Question 7 Discussion
DRAG DROP - Your on-premises network contains an Active Directory domain named fabrikam.com that syncs with Azure Active Directory (Azure AD). The domain contains a global group named AVDusers. You have an Azure subscription that contains the resources shown in the following table. 
All Azure Virtual Desktop users are members of the AVDusers group. You plan to create FSLogix profile containers in Profiles1. You need to configure Profiles1 and fabrikam.com to ensure that the HostPool1 sessions hosts can access the FSLogix profile containers. What should you do? To answer, drag the appropriate configurations to the correct targets. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. 
Assign AVDusers Storage Blob Data Contributor on Profiles1 for access rights.
I’d check if the HostPool1 VMs have a managed identity and assign that identity Storage Blob Data Contributor on Profiles1. That way, session hosts get direct access without involving user groups.
Assign AVDusers Storage Blob Data Contributor on Profiles1 for access rights.
I think one key point is making sure the HostPool1 session hosts have the right permission on Profiles1 storage. Assigning the AVDusers group the Storage Blob Data Contributor role on Profiles1 seems necessary so they can read/write profile containers. On the domain side, making sure the session hosts are joined to fabrikam.com and that the AVDusers group has access to relevant policies or folder permissions is also crucial. So, it’s about combining Azure RBAC roles on Profiles1 with proper domain join and permission settings for HostPool1 to access those FSLogix containers smoothly.
Make sure HostPool1 VMs have access rights in both domain and Profiles1 storage.
This question is missing some key details, especially about what level of permissions or configurations are currently set on Profiles1 and the domain side. Without knowing if the hosts already have delegated access or if Azure AD DS is set up correctly, it’s hard to pick exactly which options to move where. Also, it’s not clear whether the storage account’s networking or identity controls are preconfigured to allow access from HostPool1. A better explanation of the baseline setup would really help clarify how to assign the right permissions and which settings need enabling for FSLogix containe