Microsoft Azure Administrator

Access begins with identity. You create and manage users and groups in Microsoft Entra ID, assign licenses, invite guests, and set up self-service password reset.

• Users, guests and bulk operations
• Security groups and dynamic membership
• License assignment to groups
• Self-service password reset
• Devices and join types
• Hybrid identity overview

You build A tenant with groups, a dynamic group and a guest user, with self-service reset enabled.

Role-based access control decides who can do what to which resource. You assign built-in roles at the right scope, create custom roles, and read the effective access of any user.

• Scopes and inheritance
• Built-in roles and least privilege
• Creating a custom role
• Checking and troubleshooting access
• Managed identities for resources
• Entra roles compared with Azure roles

You build A role assignment model with a custom role, verified with the access check tool.

Governance keeps many resources inside the rules. You organize subscriptions with management groups, enforce standards with Azure Policy, protect resources with locks, and control spend with tags and budgets.

• Management groups and subscription structure
• Azure Policy: definitions, assignments and effects
• Resource locks
• Tags and tag inheritance
• Budgets, alerts and cost analysis
• Moving and organizing subscriptions

You build A governance setup with a policy that enforces tags, a lock on production and a budget alert.

A storage account is the base of many solutions. You choose account types and redundancy, secure access with firewalls, identity and shared access signatures, and set up encryption.

• Account types, performance tiers and redundancy
• Storage firewalls and virtual network rules
• Shared access signatures and stored access policies
• Entra authorization and account keys
• Encryption and customer-managed keys
• Moving data with AzCopy and Storage Explorer

You build A storage account with redundancy chosen for a stated need, locked to a network and accessed with a SAS.

Blobs and file shares serve different jobs. You configure containers, tiers and lifecycle rules for blobs, and create and secure Azure file shares, including snapshots and backup.

• Containers, blobs and access levels
• Access tiers and lifecycle management
• Versioning, soft delete and object replication
• Azure Files shares and protocols
• Share snapshots and sync
• Identity-based access to files

You build A blob container with lifecycle rules, and an Azure file share mounted from a virtual machine.

Repeatable environments need templates. You read and write ARM templates and Bicep, deploy them at the right scope, and export and modify existing resources as a starting point.

• Infrastructure as code: why and how
• ARM template structure
• Bicep: syntax, parameters and modules
• Deploying at resource group and subscription scope
• Exporting and converting existing resources
• Template specs and deployment troubleshooting

You build A Bicep file that deploys a virtual network and a VM, parameterized for two environments.

Virtual machines remain a core workload. You deploy and size them, manage disks and encryption, configure availability, and use scale sets to add and remove capacity.

• Choosing sizes, images and disks
• Availability zones and availability sets
• Managed disks, snapshots and encryption
• Extensions and custom script
• Virtual machine scale sets and autoscale
• Connecting securely with Bastion

You build A scale set behind autoscale rules, and a VM reachable only through Bastion.

Not every workload needs a VM. You run containers on Azure Container Instances and Container Apps, host web apps on App Service, and configure scaling, slots and settings.

• Container Registry and images
• Azure Container Instances
• Azure Container Apps: environments, ingress and scaling
• App Service plans and web apps
• Deployment slots and swaps
• Configuration, custom domains and certificates

You build A container app and a web app deployed from a registry, with a slot swap.

Every connected resource depends on the network. You design address spaces and subnets, peer networks, control routes, and connect virtual networks to each other and to on premises.

• Address spaces and subnets
• Virtual network peering
• System routes and user-defined routes
• VPN gateway basics
• Public IP addresses and NAT
• Troubleshooting with Network Watcher

You build Two peered virtual networks with a user-defined route, verified with Network Watcher.

Traffic must be filtered, balanced and named. You write network security group rules, configure load balancers, use Azure DNS and private zones, and reach platform services through private endpoints.

• NSG rules and application security groups
• Azure Load Balancer: rules and probes
• Application Gateway at a glance
• Azure DNS zones and private DNS
• Private endpoints and service endpoints
• Azure Firewall and Bastion at a glance

You build A load-balanced pair of VMs behind NSG rules, with a storage account reached over a private endpoint.

You cannot run what you cannot see. You collect metrics and logs, query them with KQL, create alerts and action groups, and use Network Watcher and Advisor to find problems early.

• Metrics, logs and diagnostic settings
• Log Analytics workspaces and basic KQL
• Alert rules and action groups
• VM insights and the Azure Monitor Agent
• Application Insights overview
• Azure Advisor and Service Health

You build A workspace collecting logs from a VM, with an alert that notifies a team.

Recovery plans are only real if they have been tested. You protect VMs and files with Azure Backup, replicate workloads with Site Recovery, and restore from both.

• Recovery Services vaults and Backup vaults
• Backup policies and retention
• Backing up VMs, files and databases
• Restoring items and whole machines
• Site Recovery replication and failover
• Test failovers

You build A backup policy for a VM with a completed restore, and a Site Recovery test failover.

Operate one environment from start to finish. You set up identity and governance, deploy network, compute and storage from a template, monitor it, and prove you can recover it.

• Designing the estate and its access model
• Deploying with a template
• Securing network, storage and compute
• Monitoring and alerting
• Backing up and recovering

You build A template-deployed estate with governance, monitoring and a tested recovery.