Application groups, workspaces and access roles
Three objects decide what users see: the host pool, application groups and workspaces. Getting the relationships right answers many scenario questions.
How the pieces connect
- A host pool holds session hosts.
- An application group publishes resources from one host pool. Type is Desktop or RemoteApp.
- A workspace is what the user subscribes to in the client. It lists the application groups registered to it.
Each application group belongs to exactly one host pool and is registered to one workspace. A workspace can contain groups from different host pools, which is how you combine, for example, a Windows 11 desktop and a RemoteApp from another pool.
Desktop and RemoteApp groups
| Desktop | RemoteApp | |
|---|---|---|
| Publishes | Full desktop | Individual apps or MSIX apps |
| Per host pool | One | Many |
| Created by default | Yes, with the pool | Only if you add one |
A host pool can have both, but do not assign the same user to a Desktop and a RemoteApp group in the same pool; the user would only get one experience. Create a second host pool if you need both for the same user.
Roles (Azure RBAC)
| Role | Purpose |
|---|---|
| Desktop Virtualization User | Connect through an application group (assign to the group) |
| Desktop Virtualization Host Pool Contributor | Manage host pools |
| Desktop Virtualization Application Group Contributor | Manage application groups |
| Desktop Virtualization Workspace Contributor | Manage workspaces |
| Desktop Virtualization Session Host Operator | Manage session hosts (drain mode, delete) |
| Desktop Virtualization User Session Operator | Disconnect, log off, send messages to sessions |
| Desktop Virtualization Contributor | Manage everything in the service |
| Desktop Virtualization Power On Contributor | Allows Start VM on connect |
Scope matters: assign Desktop Virtualization User to a Microsoft Entra ID group, on the application group. Do not rely on the local Remote Desktop Users group on session hosts; the service handles access through the application group.
Drain mode
Set a session host to drain mode (Allow new sessions = Off) before patching or removing it. Existing users stay connected; new users go elsewhere.
Exam traps
- Users need a role on the application group, not the host pool or session host.
- Session Host Operator and User Session Operator are different: one manages hosts, the other manages sessions.
- A workspace does not hold session hosts and has no RDP properties.
- Device redirection and RDP settings are set on the host pool, not the workspace or application group.
- Application groups cannot move between host pools.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users must see only a published Word icon, not a full desktop. What do you create for the host pool?
Show answer
Answer: B.A RemoteApp application group publishes individual applications. A Desktop group publishes the full desktop.
2. Group AVDusers must be able to connect to a pooled host pool and nothing more. What do you do?
Show answer
Answer: B.Users get access through Desktop Virtualization User on an application group. Higher roles are for administrators.
3. An operator must sign users out and send them messages but must not change host pool settings. Which role fits?
Show answer
Answer: B.User Session Operator can disconnect, log off and message user sessions, but cannot manage the pool itself.
4. Users must see a Windows 11 desktop, but the existing host pool has Windows 10 hosts. What is the first step?
Show answer
Answer: B.A host pool is built from one image family, and an application group belongs to one pool. A new OS means a new host pool and a new application group for it.