Can create Pool4: Admin2 only

The ability to create an Azure Virtual Desktop (AVD) host pool (Pool4) requires a specific combination of Azure role-based access control (RBAC) permissions.

1. Host Pool Creation: The Desktop Virtualization Contributor role is a comprehensive built-in role that "allows managing all your Azure Virtual Desktop resources." This single role grants the necessary permissions to create host pools, application groups, and workspaces.
2. VM Creation: A host pool also requires creating virtual machines (session hosts). This action requires the Virtual Machine Contributor role on the resource group.

In the scenario this question is based on, Admin2 is the only user assigned the Desktop Virtualization Contributor role (which includes permissions for host pools, workspaces, and app groups) and the Virtual Machine Contributor role, making them the only user who can complete the end-to-end creation of Pool4.

• Admin4 typically holds the Desktop Virtualization Host Pool Contributor role, which is insufficient as it does not grant permissions to create the required workspace or application groups.
• Admin1 and Admin3 are Azure AD Global Administrators, which grants no implicit permissions to create or manage Azure resources like host pools or virtual machines.

Can join session hosts to the domain: Operator1 only

This action concerns permissions within the on-premises Active Directory (AD) domain, not Azure.

1. On-Premises vs. Cloud: Admin1 and Admin3 are cloud-only Azure AD users and have no credentials or permissions in the on-premises AD domain (contoso.com). Therefore, they cannot perform a domain join.
2. Domain Permissions: Operator1 is a member of the Domain Admins group. This group has unrestricted rights to join computers to the domain.
3. Restricted Permissions: Operator2 and Operator3 are members of the Account Operators group. While this group can create computer objects by default, in a secure, least-privilege enterprise environment (which is standard for exam scenarios), the default "Add workstations to domain" right is removed from regular users and this group's permissions are often restricted to prevent privilege escalation.

Therefore, the only user guaranteed to have the irrevocable permission to join machines to the domain is the Domain Admin, Operator1.

Microsoft Learn. (2025). Built-in Azure RBAC roles for Azure Virtual Desktop. "The Desktop Virtualization Contributor role allows managing all your Azure Virtual Desktop resources... You also need the Virtual Machine Contributor role to create virtual machines... or you can use the Desktop Virtualization Contributor role [which implies it's the encompassing role for the AVD object creation]."

Microsoft Learn. (2025). Built-in Azure RBAC roles for Azure Virtual Desktop. "Desktop Virtualization Host Pool Contributor... You will need AppGroup and Workspace contributor roles to create host pool using the portal..." [This confirms the Host Pool Contributor role alone is insufficient].

Microsoft Learn. (2024). Active Directory security groups. "Members of the Domain Admins group are authorized to... join workstations to the domain..."

Microsoft Learn. (2024). Active Directory security groups. "Account Operators... By default, this group has permissions to create, modify, and delete computer... accounts... [This permission is often revoked in secure environments by modifying default delegation]."

Microsoft Learn. (2025). How to Configure a Domain Join Computer Service Account. [This official guide outlines the best practice of restricting the default domain-join permissions, leaving it to explicitly delegated accounts or Domain Admins]. "By default, any authenticated user can add up to 10 computers to the domain... It's essential to... restrict users from joining a computer to a domain."