The Recovery Services vault is essential for managing and storing the backup data.

To deploy your application and monitor it on a confidential virtual machine (VM) within Azure Virtual Desktop (AVD), follow these steps:
1. Deploy the Confidential Session Host
When creating or adding session hosts to your AVD host pool, you must specify the correct security type to ensure hardware-based isolation.
Security Type: Select Confidential virtual machines during the host pool deployment or when adding session hosts.
Integrity Monitoring: When this security type is selected, Secure Boot, vTPM, and Integrity Monitoring (Guest Attestation) are automatically enabled.
Disk Encryption: You must check the Confidential compute encryption box to enable OS disk encryption for these VMs.
*-> 2. Enable File Integrity Monitoring (FIM)
FIM tracks changes to files and registries that could indicate a security breach. It is managed through Microsoft Defender for Cloud.
Prerequisite: Enable Microsoft Defender for Servers Plan 2 on the subscription.
Configuration:
Go to Microsoft Defender for Cloud > Environment settings > your subscription.
Under the Defenders for Servers plan, select Settings and toggle File Integrity Monitoring to On.
Select a Log Analytics workspace to store the monitoring data.
Configure the recommended or custom rules for the files and registries you want to monitor.
3. Install and Deploy the App
You can deploy the application using several methods suited for AVD:
App Attach: Package your app as an MSIX or App-V image and use App Attach to dynamically mount it to the session host without local installation.
VM Applications: Use the Azure Compute Gallery to define a VM Application and deploy it directly to the session hosts.
RemoteApp: If users only need the specific app rather than a full desktop, publish the application to a RemoteApp application group.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-enable-defender-endpoint

Using the OneDrive sync app with non-persistent environments requires that you install the sync app per machine.
https://learn.microsoft.com/en-us/sharepoint/sync-vdi-support

[B]
Autoscale requires assigning the Desktop Virtualization Power On Off Contributor role to give the service principal permission to automatically start and stop session hosts based on defined scaling schedules or load thresholds.
[D]
The Azure Virtual Desktop feature that requires you to assign Azure role-based access control (Azure RBAC) roles to the Azure Virtual Desktop service principal is app attach.
When using app attach, applications are packaged and stored on a remote file share (such as Azure Files or Azure NetApp Files). To allow the session hosts to access the storage account securely and mount these applications dynamically, you must assign the Reader and Data Access RBAC role to both the Azure Virtual Desktop and Azure Virtual Desktop ARM Provider service principals.
Incorrect:
[Not A]
Universal Print: Uses Microsoft Entra ID integration and print management configurations rather than requiring subscription-level service principal RBAC role assignments.
[Not C]
Azure Virtual Desktop Insights: Relies on diagnostic setting configurations that stream logs to a Log Analytics workspace, controlled via standard monitoring permissions rather than a dedicated AVD service principal RBAC assignment.
[Not E]
Device redirection: Managed strictly via Remote Desktop Protocol (RDP) properties configured directly on the host pool.
Reference:
https://learn.microsoft.com/en-us/azure/virtual-desktop/service-principal-assign-roles
https://docs.azure.cn/en-us/virtual-desktop/app-attach-overview

For a Transaction File share, the maximum IOPS is 1000. Enabling large file shares on the storage account will increase it to 10,000 IOPS. This change won't affect the environment.
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets?WT.mc_id=AZ-MVP-5004159#azure-file-share-scale-targets