Switch Embedded Teaming (SET) is the only Windows Server NIC teaming technology that preserves each member adapter ' s RDMA capability and supports Dynamic VMMQ, because SET is implemented as an integrated capability of the Hyper-V virtual switch itself rather than as a separate teaming driver layered underneath it; this integration lets SET-teamed adapters continue to expose RDMA and advanced offloads such as d.VMMQ to the virtual switch and its VMQ/VMMQ queue allocation logic. The legacy NIC Teaming feature -- also called load balancing and failover (LBFO), which includes both static teaming mode and LACP teaming mode as configuration options -- sits below the virtual switch as a separate intermediate driver and explicitly does not support RDMA passthrough or Dynamic VMMQ on its member adapters; teaming LAN2 and LAN3 (both RDMA-capable, 25 Gbps adapters) with classic LBFO would strip their RDMA capability entirely, defeating both the RDMA benefit and the d.VMMQ requirement. Since LAN2 and LAN3 are both RDMA-capable adapters and the requirement explicitly calls for Dynamic VMMQ support, Switch Embedded Teaming is the only option among those listed that meets the requirement; static teaming mode and LACP teaming mode are simply LBFO configuration variants and share the same RDMA/d.VMMQ incompatibility.

Explanation:

First action: Enable supplemental allow rules in the base policy. Second action: Create a signer rule in a supplemental policy.
A Windows Defender Application Control supplemental policy is a separate policy that expands what an existing, enforced base policy allows, without editing the base policy ' s own allow rules, but a base policy must explicitly permit supplemental policies before any supplemental policy can be linked to and take effect alongside it, which is why enabling supplemental allow rules in the base policy has to happen first; this is a one-time change to the base policy ' s own options (adding the Enabled:Allow Supplemental Policies rule option), not a modification of its allow rules, so it satisfies the requirement not to change the base policy ' s allow rules. With supplemental policies permitted, creating a signer rule inside a new supplemental policy, keyed to the vendor ' s single code-signing certificate rather than to individual file hashes, allows every binary the vendor signs with that certificate, including all of App1 ' s monthly updates, without requiring the supplemental policy (or the base policy) to be edited again each time a new signed build ships, which directly minimizes ongoing policy maintenance. The supplemental policy can then be deployed only to the six pilot servers, leaving the other 34 servers unaffected. Adding hash-based rules or path rules to the base policy would both violate the no-base-policy-allow-rule-changes requirement and would require constant hash updates every time the vendor releases a new monthly build, and putting the pilot servers into audit mode would stop enforcing the base policy ' s controls entirely rather than selectively permitting App1.

App1 ' s requirement to update objects in AD DS as part of its Kerberos-authenticated operation rules out any deployment built solely on read-only domain controllers (RODCs), because an RODC holds a read-only copy of the AD DS database and cannot accept or process write operations, such as the object updates App1 performs or password changes tied to Kerberos ticket processing; only a writable domain controller can service those requests, immediately eliminating both RODC-based options regardless of how they are made redundant. Between the two writable-DC options, deploying the two writable domain controller virtual machines across availability zones provides genuine redundancy within the same Azure region and VNet, keeping both DCs on the same low-latency virtual network VM1 already reaches through the Azure Firewall, so a zone failure still leaves a writable, reachable DC online for App1; placing the two writable DCs in physically distinct Azure regions instead would require extending VNet1 ' s connectivity (and the Azure Firewall ' s filtering) across regions and introduces materially higher replication latency between the two DCs, which the scenario ' s single-VNet, single-firewall design does not call for or support. Deploying two writable domain controller virtual machines across availability zones therefore both satisfies VM1 ' s write requirement and provides the requested redundancy with the least architectural disruption.

Conditional Access policies can target and evaluate signals from device objects (such as device compliance or device state) only when those devices are actually registered as recognized device identities in Microsoft Entra ID -- an on-premises, domain-joined Windows device that is merely synced as a generic object does not automatically become usable as a Conditional Access device signal. Selecting the " Configure Hybrid Microsoft Entra join " option during Microsoft Entra Connect setup is what registers on-premises, domain- joined computer objects as hybrid Microsoft Entra joined devices in the tenant, which is the specific prerequisite that makes those device objects usable in Conditional Access policy conditions (such as requiring a compliant or hybrid-joined device). Clearing the " Configure device writeback " option would disable the flow of Entra-registered device information back to on-premises AD DS, which is the opposite of what ' s needed and would not help device objects become usable in Conditional Access. Changing a group ' s scope to Universal or Global affects that group ' s replication/nesting behavior across domains but has no bearing on whether device or other objects are recognized identities usable in Conditional Access policies. Therefore, enabling the Configure Hybrid Microsoft Entra join option during the Microsoft Entra Connect sync configuration is the necessary step.

IKEDiagnosticLog provides verbose, packet-level debug logging of the IKE and IPsec negotiation process itself, including the SA_INIT exchanges and the send and receive events exchanged between the two VPN endpoints, which is exactly the level of detail needed to understand why an IPsec tunnel keeps dropping and renegotiating. TunnelDiagnosticLog, by contrast, is a lighter-weight record that only captures TunnelConnected and TunnelDisconnected state-change events; it is useful for confirming when a disconnect happened and how often, but it does not contain the negotiation-level detail needed to determine the underlying cause of the failure. GatewayDiagnosticLog records configuration changes made to the gateway resource itself, and RouteDiagnosticLog tracks static and BGP route additions and updates, neither of which has anything to do with IPsec tunnel negotiation. The standard Microsoft-documented troubleshooting workflow is to first use TunnelDiagnosticLog to identify the disconnect timestamps and then use IKEDiagnosticLog to analyze what actually happened during negotiation at that time, making IKEDiagnosticLog the log to review to actually debug the tunnel.