AZ-305: Microsoft Azure Solutions Architect Expert

Explore Azure's global backbone powering the cloud with 60+ regions, fiber and subsea cables, and over 172 network edge sites, enabling low-latency, compliant region pairs and availability zones.

Explore Azure regions, data centers, and the global backbone, learn to interpret region metadata, availability zones, geography, and compliance filters such as GDPR, HIPAA, GXP, and PCI DSS.

Understand the Azure resource hierarchy from the root management group to subscriptions, resource groups, and resources, and apply governance, inheritance, Azure policy, and RBAC for security, cost, and performance.

Explore the four Azure subscription types—free, student, pay as you go, and enterprise agreement—covering credits, billing, and eligibility, with practical guidance for learning Azure today.

Understand how Entra ID tenants provide identity services distinct from Azure resources, including subscriptions, resource groups, and application registrations, with optional access to Azure resources.

Sign up for Azure using the free option, verify your Microsoft account, and complete the form to access 12 months of popular services, 55 always-free services, and $200 credit.

Set up and navigate your Azure environment by exploring management groups, subscriptions, and the resource hierarchy, then create and manage a resource group in North Europe.

Create a monthly Azure budget via cost management, set the subscription as scope, and configure alerts on actual or forecasted spend without stopping resources.

Explore the five Azure management tools—Azure portal, Azure PowerShell, Azure CLI, Azure Cloud Shell, and Azure Copilot—to deploy, automate, and manage Azure resources.

Navigate the Azure portal, create resources, and deploy a virtual machine from a demo resource group, while exploring dashboards, compute options, and portal settings.

Explore how Azure PowerShell works across Windows and Mac OS, using the Azure PowerShell module to create, read, update, and delete resources like a resource group and a virtual machine.

Learn how to install PowerShell on Windows using WinGet, then install the Azure PowerShell module, run commands as administrator, and verify a successful setup to use Azure PowerShell on Windows.

Install PowerShell on macOS using Homebrew, then install the Azure PowerShell module to run Azure cmdlets from the macOS terminal.

Learn to use Azure PowerShell to authenticate, list subscriptions, create a North Europe resource group, deploy a Windows Server 2019 VM with RDP, and delete the group.

Install and use the Azure command line interface on Windows or macOS to deploy a resource group, virtual network, subnet, public ip address, and virtual machine with proper associations.

Install the Azure CLI on Windows using WinGet, then restart terminals to enable usage. Verify installation with az --version, which shows 2.77.0 for this Windows client.

install the Azure CLI on macOS using Homebrew and verify installation with az version, following the commands from the resources section.

Learn to manage Azure resources using Azure CLI from login and subscription selection to creating a resource group, VNet, subnet, public IP, NIC, and a Windows VM, with size troubleshooting.

Explore Azure Cloud Shell in the portal to run Azure PowerShell or the Azure CLI. Create a resource group and a VM, then delete the resource group when finished.

Azure Copilot guides resource management in the portal, lists resource groups and VMs via Azure Resource Graph queries, and assists creating a resource group and a Windows Server VM.

Explore how Azure Log Analytics ingests logs and metrics from data sources, acting as the backbone for Azure Monitor and other services like Sentinel, Defender for Cloud, and Logic Apps.

Explore how a log analytics workspace creates tables, such as the event and syslog tables, to ingest Windows event logs or syslog data, enabling queries with Kql.

Learn how data retention works in log analytics, from 30 days in the analytics tier to up to 12 years in basic or auxiliary, via workspace settings and table tiers.

Create a log analytics workspace to ingest logs for Azure Monitor, then deploy and inspect it in the Log Analytics blade, selecting the subscription, resource group, and region.

Explore azure monitor as a comprehensive solution for cloud and on-premises data. Analyze logs, metrics, and traces with log analytics and application insights, and auto-scale VMs when thresholds are met.

Explore how Azure Monitor unifies insights, metrics, alerts, and logs to visualize telemetry, with change analysis, service health, and dashboards via Grafana and KQL.

Explore data sources and collection methods to ingest metrics and logs into Azure Monitor and Log Analytics, using auto instrumentation and OpenTelemetry with data collection rules.

Configure the Azure Monitor agent to collect metrics and logs from Windows and Linux VMs and on-prem servers, routing data to Log Analytics workspaces for Azure Monitor and related services.

Learn how data collection rules (DCR) in Azure Monitor transform ingested data and route it to a Log Analytics workspace via associations or direct ingestion.

Configure the Azure Monitor agent on a virtual machine and create a data collection rule to ingest Windows event logs into a Log Analytics workspace.

Explain diagnostic settings for Azure resources, enabling telemetry via logs and metrics to Azure Monitor, and applying Azure policy to scale diagnostics across subscriptions and resource groups.

Configure diagnostic settings for an Azure Key Vault, selecting logs and metrics and sending to a Log Analytics workspace, then monitor via Azure Monitor and logs.

Explore application instrumentation with auto instrumentation and OpenTelemetry to collect traces, metrics, and logs in Azure Monitor and Application Insights.

Configure application instrumentation by creating an Azure App Service web app and enabling Application Insights during setup; verify data in Azure Monitor and Insights Applications.

Review the data platform’s role after data ingestion and before consumption. Identify metrics, logs, traces, and changes as core components driving insights and visualizations.

Configure Azure environment by creating a resource group, a Log Analytics workspace, and diagnostic settings to export the Azure Activity Log to Log Analytics, enabling audit-trail visibility.

Learn how Azure Monitor metrics collect platform, custom, and Prometheus data from resources and AKS, visualize with dashboards and workbooks, and trigger alerts for autoscaling.

Explore Azure Log Analytics and Azure Monitor logs to collect, ingest, and query data with KQL in near real time, configure workspaces, and support security, observability, and alerting.

Kusto Query Language (KQL) enables fast, pipe-driven querying of large logs across Microsoft services, focusing on filtering, aggregating, and joining for security and operational insights in log analytics.

Develop kql queries by forming a hypothesis, identifying network and devices tables, filtering for an IP address, and summarizing results to link the IP to a device.

Explore the where operator in KQL within Log Analytics, navigate workspaces and tables, and filter events, heartbeat, and activity data using pipes and time-based conditions.

Use where with contains or has to filter azure activity logs by operation name; contains checks substrings, while has tests whole words, with has any and has all.

Explore the search operator in KQL, its slow performance with terabytes of logs, and how to use where filters and conditions to optimize queries.

Use the project operator to select and rename columns and to compute new values, like duration minutes and event time, across heartbeat, event, and azure activity tables.

learn how the extend operator in kql creates new columns, computes dynamic values like minutes since heartbeat, day of week, and hour, and uses conditional logic and string operations.

Learn to use the sort by operator in KQL to order results by time generated, or by fields like source computer ID or IP address, in ascending or descending order.

Learn to apply the count operator in KQL to tally heartbeat entries and filtered events, including last 24 hours of Azure activity with four lines of code.

Explore the summarize operator in KQL to aggregate logs, count events by source, compute total and distinct counts, and perform multi-column heartbeat analyses with max, min, bin, and sort.

Leverage the render operator in KQL to create time and category charts. Summarize heartbeats over the last 24 hours and render charts (time, column, bar, pie, area) from event data.

Configure a KQL-based alert in Azure Monitor to notify when a VM stops heartbeats. Test by stopping the VM, then review and delete the alert rule and action group.

Explore the four pillars of Microsoft Entra, from zero-trust identity and governance to external and workload identities, with licensing options and secure access for employees, customers, and cloud resources.

Learn about Microsoft Entra ID, formerly Azure Active Directory, a cloud-based identity and access management service securing access to Microsoft 365, Azure Portal, and apps with features like access reviews.

Entra ID user identities cover human identities, synchronized with on-premises Active Directory via Entra Connect, cloud identities, and guest identities from Facebook, Microsoft, Apple, or Google.

Create and manage users in Microsoft Azure ID by configuring user principal names, display names, provisioning accounts in the tenant, and assigning roles or groups for secure access and monitoring.

Learn how Azure managed identities remove credential management and enable secure authentication. Compare system assigned and user assigned identities, including lifecycle and the preference for system assigned where possible.

Explore how to leverage managed identities in Azure by creating resources, configuring system and user assigned identities, and granting a virtual machine access to a SQL database via role assignments.

Enable external identities to collaborate with your Azure resources using B2B collaboration, B2B Direct Connect, and B2C, with guest identities or mutual tenant trust.

Configure external collaboration settings in android to manage guest access and invitations, self-service signup, and external user leave. Align restrictions with security needs by controlling domain invitations and guest permissions.

Register apps in the Azure AD tenant to grant identities, choose secret or certificate authentication, and access resources like virtual machines, databases, and storage across clouds.

Register an application in entra by creating a new app, choosing account types, and configuring a redirect URI to enable authentication, generating a client ID and object ID.

Explore why groups simplify permissions at scale by assigning roles to groups rather than individuals. Learn about security and M365 groups, dynamic memberships, and self-service for Azure access.

Create a group in Entra ID by selecting the group type (security or M365), name it, set ownership and membership type, and configure Azure role assignments, administrative units, or memberships.

Explore Android authentication options, from password and SMS MFA to passwordless solutions like Windows Hello for business, Fido2 keys, OAuth tokens, and certificate-based authentication, with SPR for password-based methods.

Examine authentication methods to determine true multi-factor authentication. Showcases passwordless options like Windows Hello for Business, FIDO keys, and authenticator apps as phishing-resistant, secure, and convenient MFA.

Configure multi-factor authentication in entra by enabling and configuring authentication methods. Manage per-user MFA settings and enforcement options for passkeys, Fido2, and SMS.

Explore passwordless authentication with Windows Hello for business, where a device-bound nonce signs a token for TPM-protected single sign-on and a path to eliminate passwords.

Configure passwordless authentication in android using Microsoft Authenticator, enabling number matching to prevent phishing and MFA fatigue, with controlled push options and location targets in Intune.

Enable single sign-on in the Microsoft ecosystem by authenticating once at a central location to access multiple apps, with on-premises Active Directory synchronized to Entra ID via Entourage Connect.

Explore interconnect for hybrid environments, enabling password hash synchronization and pass-through authentication between on-premises Active Directory and Entra ID in the cloud; compare cloud sync, connect sync, and health monitoring.

Explore hybrid authentication in cloud and on-premises environments, guided by Microsoft documentation. Learn how to choose password hash sync or other methods using requirement-driven questions.

Explore Entra ID roles and how they grant permissions across the Microsoft ecosystem, from Teams administration to security policy management and read-only access for audits.

Explore built-in and custom Entra ID roles in the Azure portal, focusing on the security administrator role, its permissions like conditional access policy creation, and configurable activation and assignment workflows.

Explore Azure RBAC to grant access to specific resources via role assignments, including security principals, role definitions, and scopes, with built-in and custom roles for least-privilege enforcement.

Learn to assign built-in and custom Azure RBAC roles via Access Control (IAM), selecting roles like Virtual Machine Contributor, choosing members, and choosing eligible or active time-bound assignments.

Configure Azure RBAC custom roles by creating a resource group, adding a custom role, selecting and granting permissions (including explicit excludes), and defining an assignable scope.

Compare Azure RBAC and Entra ID roles: Azure RBAC manages access to resources like VMs and databases, while Entra ID roles govern directory tasks for users, groups, and policies.

Enable just-in-time privileged access with PIM to manage and monitor privileged identities across Entra ID, Azure, M365, and Intune, with MFA, approvals, and time-bound roles.

Learn how to use Privileged Identity Management in Entra ID to assign eligible and active roles, view requests and approvals, and enable just-in-time access with MFA and conditional access.

Explore access reviews in Azure to manage group memberships, enterprise applications access, and role assignments, with monthly reviews and auto-applied results to reduce permission creep.

Manage access across Azure resources by configuring access reviews that regularly validate group memberships, access to enterprise applications, and RBAC role assignments, reducing permission creep and audit risk.

Learn how conditional access uses signals from identity protection and Defender for Identity, Defender for Endpoint, and Intune to enforce zero-trust security with MFA for cloud and on-prem resources.

Configure conditional access policies in Azure, define assignments and resource targets like Office 365, set risk-based conditions, and enforce grants with MFA and device compliance, testing in report-only mode.

Enable secure remote access to on-premises apps via the Azure Entra application proxy, offering single sign-on, conditional access, and TLS without inbound firewall openings or VPN.

Learn Microsoft global secure access, including intra internet access and intra private access, and how zero trust with conditional access enables VPN-free access to cloud and on-prem resources.

Configure resource locks in Azure to prevent modification or deletion of resources by applying read-only or delete locks at subscription, resource group, or resource level, with inheritance.

Define and enforce azure resource configurations with JSON policy definitions, bundle rules into policy initiatives, and apply audit, deny, or deploy effects across management groups to support Defender for Cloud.

Explore how to use Azure policy by browsing built-in policy definitions, selecting the allowed locations policy, and assigning it to a subscription to enforce region-based resource creation.

Discover Azure Advisor, a digital cloud assistant that analyzes resource configurations and offers proactive recommendations from the five well-architected pillars: cost, performance, reliability, security, and operational excellence across subscriptions.

Explore Azure Advisor to view five pillar scores and drill into security recommendations, such as enabling disk encryption on impacted virtual machines, with filters and Well-Architected framework validation.

Explore Azure storage types, including blob storage for unstructured data, Azure files for shared access, queue storage for asynchronous messaging, and table storage for NoSQL key-value data.

Learn to create an Azure storage account in the portal, selecting subscription, resource group, region, and primary service such as blob storage, then configure redundancy, security, networking, and encryption.

Discover how Azure storage encryption protects data at rest with server-side encryption and FIPS 142, and compare Microsoft managed keys with customer managed keys via Azure Key Vault.

Explore authentication and authorization for Azure storage, comparing storage account access keys, shared access signatures, Android-based authentication, and anonymous access across blobs, queues, and file shares.

Understand storage account access keys, their security risks, and how to secure them with Azure Key Vault, rotate keys regularly, and prefer managed identities over shared keys for authentication.

Learn how to access storage account access keys in Azure, rotate them to mitigate leaks, and understand that regenerating a key invalidates the old one, with keys giving full access.

Explore shared access signatures (SAS) in Azure Storage, including user delegation SAS, service SAS, and account SAS, to securely grant blob and queue access using credentials or storage keys.

Configure shared access signatures for a storage account by selecting services (blob, files, queues, tables), resource types, and permissions. Generate a SAS token and connection string for controlled access.

Explore Azure sql services across administration effort and cost, from on premises sql server to Azure Arc, Azure sql on vm, managed instance, and database, highlighting iaas and paas offerings.

Create an Azure SQL database by selecting SQL databases, configuring subscription and resource group, choosing a server, enabling Microsoft Entra authentication with system assigned managed identity, then review and create.

Learn how Azure SQL transparent data encryption (TDE) protects data at rest across Azure SQL databases, managed instances, and Synapse Analytics with real-time encryption, key management, and minimal application impact.

Configure transparent data encryption for Azure SQL databases by enabling it in security settings and choosing between server-level or customer-managed keys; prefer Microsoft-managed keys unless you must bring your own.

Always encrypted and the secure enclave protect sensitive data on the client side across Azure SQL databases, ensuring encryption keys never reach the database engine.

Enable always encrypted for Azure SQL databases via data encryption, choose virtualization-based security as enclave type, and note it cannot be disabled after enabling; a new database must be deployed.

Azure sql dynamic data masking limits exposure for users across sql database, sql managed instance, and synapse analytics; it masks data, not encrypts, showing last four digits of credit card.

Learn how Azure backups protect availability and business continuity by backing up Azure VMs, on-premises workloads, with Recovery Services Vaults, disk snapshots, and backup policies.

Learn how to configure an Azure recovery services vault and set up backups for Azure virtual machines, including vault creation, networking, encryption options, backup policy selection, and monitoring backup items.

Initiate a manual backup from the Recovery Services Vault by selecting the Azure Virtual Machine in backup items, clicking backup now, and setting retention, then monitor progress in backup jobs.

Azure site recovery delivers a bcdr solution that automatically replicates virtual machines and physical servers to a secondary site, enabling automated failover with configurable rpo and rto.

Compare Azure Arc enabled servers to functions, noting administration and cost. Understand how on-premises, IaaS, and platform as a service offerings differ and when to use them.

Azure virtual machines deliver on-demand, scalable compute with more control than app services, while Microsoft handles hardware and you manage the operating system plus virtual network, disks, and security groups.

Configure an Azure virtual machine by selecting subscription, resource group, region, image, size, and administrator credentials; configure networking, security, and management options before deployment.

Master Azure Arc to centralize governance and management across on-premises, multi-cloud, and edge environments, provisioning arc-enabled resources from a single pane of glass.

Extend Azure services to SQL Server instances hosted outside Azure through Azure Arc enabled SQL servers, enabling centralized management, inventory with queries, and security monitoring.

Compare Azure container services from on-premises Kubernetes and Azure Arc to AKS, Azure Container Apps, and Azure Container Instances, highlighting administration effort and cost trade-offs.

Discover Azure container registry (ACR): a managed docker registry in Azure to store and deploy container images, integrate with pipelines and AKS, ACA, or ACI.

Create an Azure container registry by selecting resource group, name; configure domain name label scope to prevent domain takeover, choose a SKU, and enable private access with encryption and RBAC.

Run containers quickly with Azure Container Instances, without managing VMs or Kubernetes, including Windows or Linux containers and Azure Files storage. Not suited for complex deployments; ideal for isolated containers.

Provision an Azure container instance via the portal, select a resource group, region, and a quickstart image, enable logging with log analytics, configure key management, and verify the running container.

Azure container apps are a serverless platform that eliminates server management and Kubernetes concerns. Deploy API endpoints, background processing jobs, event-driven processing, or microservices with VNet connectivity and log analytics.

Provision an Azure container app via the portal and configure image sources with a registry. Use managed identities for authentication and deploy a quickstart hello world container.