Azure interview questions in 2026 test whether you can run a secure, governed and cost-aware Azure estate, not whether you can list service names. For administrator and cloud engineer roles, interviewers focus on Microsoft Entra ID and RBAC, management groups and Azure Policy, virtual networking and private connectivity, compute choices, storage redundancy, Bicep, monitoring with KQL, Key Vault, backup and cost. This guide works through 65 commonly asked questions with answers written the way a senior Azure engineer would give them, including 13 real-world troubleshooting and design scenarios.
How to use this guide. Interviewers probe different depths at different levels:
- Freshers and support engineers: the resource hierarchy, Entra ID versus RBAC, storage redundancy and tiers, VNets and NSGs, and the tools you use every day (portal, Azure CLI, PowerShell).
- Azure administrators (AZ-104 level): managed identities, Azure Policy effects, peering, private endpoints and DNS, VM availability, backup, monitoring and alerts.
- Cloud engineers and architects: landing zones, hub-and-spoke, outbound control, infrastructure as code with what-if, cost governance and how you diagnose an outage under pressure.
Where Microsoft has renamed or retired something, the current name and the old one are both given. Azure changes often, so check current documentation on Microsoft Learn before an interview.
Contents
- Fundamentals (Q1 to Q12)
- Identity and governance (Q13 to Q20)
- Networking (Q21 to Q29)
- Compute (Q30 to Q35)
- Storage and databases (Q36 to Q39)
- Infrastructure as code and automation (Q40 to Q42)
- Monitoring and KQL (Q43 to Q45)
- Security, backup, DR and cost (Q46 to Q49)
- Architecture (Q50 and Q51)
- AI on Azure (Q52)
- Real-world scenarios (Q53 to Q65)
- Key takeaways
- Interview preparation checklist
- FAQ
Fundamentals
1. What is Microsoft Azure, and how do IaaS, PaaS and SaaS map to Azure services?
Answer: Azure is Microsoft's public cloud platform: compute, networking, storage, databases, identity, security, monitoring and AI services delivered on demand from Microsoft-run regions and billed by usage. The service models describe how much you manage. In IaaS (Azure Virtual Machines, managed disks, VNets) you own the operating system, patching and runtime. In PaaS (App Service, Azure SQL Database, Azure Functions, Container Apps) Microsoft runs the platform and you deploy code or data. In SaaS (Microsoft 365, Dynamics 365) you consume a finished application.
2. Explain the Azure resource hierarchy: tenant, management groups, subscriptions, resource groups and resources.
Answer: A Microsoft Entra tenant is the identity boundary. Under it sits the root management group (display name "Tenant root group"), then your own management groups, then subscriptions (the billing and scale boundary), then resource groups (a lifecycle container), then resources. RBAC role assignments and Azure Policy assignments made at any level inherit downward.
Facts worth knowing: a management group tree supports up to six levels of depth (not counting root and subscription level), each management group or subscription has exactly one parent, and new subscriptions land under the root management group by default. A resource belongs to one resource group, but resources in a group can sit in different regions.
3. What are regions, availability zones, availability sets and paired regions?
Answer: A region is a set of datacenters in a geography (for example Central India or South India). An availability zone is a physically separate location inside a region with independent power, cooling and networking; spreading VMs across zones protects against a datacenter-level failure. An availability set is the older construct that spreads VMs across fault domains and update domains inside one datacenter, protecting against rack and host maintenance events but not a zone loss. Paired regions are Microsoft-defined pairs used, for example, as the fixed secondary for geo-redundant storage.
Interview tip: For new workloads, prefer zones and VMSS Flexible orchestration (Q30) over availability sets.
4. What is Azure Resource Manager, and what happened to the classic deployment model?
Answer: Azure Resource Manager (ARM) is the control plane that every portal click, CLI command, PowerShell cmdlet, ARM template and Bicep file goes through. It authenticates the caller with Entra ID, authorises with Azure RBAC, evaluates Azure Policy, and then hands the request to the resource provider (Microsoft.Compute, Microsoft.Network and so on). That is why RBAC, Policy, tags, locks and the activity log work consistently across services.
The old Azure Service Manager (classic) model is gone: Microsoft retired classic resources, Azure Service Manager and the classic administrator roles (Account Administrator, Service Administrator, Co-Administrator) as of 31 August 2024, and access must now be granted through Azure RBAC.
5. What is Microsoft Entra ID (previously Azure Active Directory)?
Answer: Microsoft Entra ID is Microsoft's cloud identity and access management service, renamed from Azure Active Directory. It holds users, groups, app registrations, service principals and managed identities, issues tokens (OAuth 2.0 and OpenID Connect, plus SAML for federation), and enforces sign-in controls such as MFA and Conditional Access. Every Azure subscription trusts exactly one Entra tenant.
It is not on-premises AD DS (no OUs or Group Policy); hybrid organisations sync identities from AD DS with Microsoft Entra Connect or Cloud Sync.
Interview tip: Use the current name, mention "previously Azure AD" once, and move on. Calling it only "Azure AD" in 2026 makes you sound out of date.
6. What is the difference between Azure RBAC roles and Microsoft Entra roles?
Answer: Azure roles (Owner, Contributor, Reader, Role Based Access Control Administrator, User Access Administrator and many service-specific roles) control what you can do to Azure resources and are scoped to a management group, subscription, resource group or resource. Microsoft Entra roles (Global Administrator, User Administrator, Billing Administrator and others) control the directory itself: users, groups, licences, app registrations, domains, scoped to the tenant, an administrative unit or an object.
By default they do not overlap: a Global Administrator has no access to Azure resources. A Global Administrator can, however, use "Access management for Azure resources" to elevate to User Access Administrator at root scope, which is the break-glass route for regaining access to a subscription.
7. Which tools do you use to manage Azure, and what is a cmdlet?
Answer: The main tools are the Azure portal, the Azure CLI (az commands, popular on Linux and in pipelines), Azure PowerShell (the Az module), Azure Cloud Shell (a browser shell with both preinstalled), and infrastructure as code with Bicep, ARM templates or Terraform. A cmdlet is a PowerShell command in Verb-Noun form, for example Get-AzVM or New-AzRoleAssignment; it returns objects, so you can pipe and filter results.
For directory work (users, groups, apps) you use the Microsoft Graph PowerShell SDK rather than the old AzureAD and MSOnline modules.
8. What is a storage account, and what services does it provide?
Answer: A storage account is the ARM resource that gives you a unique namespace and endpoints for Blob Storage (objects, including Data Lake Storage with a hierarchical namespace), Azure Files (SMB and NFS shares), Queue Storage and Table Storage. Standard general-purpose v2 is the recommended default account type; premium account types exist for block blobs, file shares and page blobs. Redundancy, network rules and encryption settings apply to the whole account, so put data with different requirements in different accounts.
9. Explain the Azure Storage redundancy options.
Answer:
| Option | How data is copied | Survives |
|---|---|---|
| LRS | Synchronously within one datacenter in the primary region | Drive, server and rack failures |
| ZRS | Synchronously across availability zones in the primary region | Loss of a zone |
| GRS / RA-GRS | LRS in primary, asynchronous copy to the paired secondary (LRS there) | Regional outage (after failover); RA-GRS adds read access to the secondary |
| GZRS / RA-GZRS | ZRS in primary, asynchronous copy to the secondary | Zone loss and regional outage; RA- adds secondary reads |
Two points interviewers like: geo-replication is asynchronous, so a failover can lose recent writes; and redundancy does not protect against deletion or overwrites, which replicate too. Soft delete, versioning and backup cover that.
10. What are the blob access tiers, and when would you use each?
Answer: Hot is for frequently accessed data (highest storage cost, lowest access cost). Cool is for infrequent access with a 30-day minimum retention; cold is for rarely accessed data that still needs instant reads, with a 90-day minimum; archive is offline storage with a 180-day minimum, and a blob must be rehydrated to an online tier (which can take up to 15 hours) before it can be read. Moving or deleting a blob before its minimum period incurs a prorated early-deletion charge. Archive cannot be the account's default tier.
Use lifecycle management rules to move data down tiers automatically (for example, logs to cool after 30 days, archive after 180) and to delete it at end of life.
11. What are virtual networks, subnets and network security groups?
Answer: A VNet is your private network in a region, defined by one or more address spaces (plan non-overlapping RFC 1918 ranges so you can peer and connect on-premises later). Subnets divide it; some services need dedicated subnets (GatewaySubnet, AzureFirewallSubnet, AzureBastionSubnet) or delegated subnets. A network security group is a stateful set of allow and deny rules on source, destination, port and protocol, processed by priority, and associated with a subnet, a NIC or both.
Default NSG rules allow traffic within the VNet and from the Azure load balancer, allow outbound internet, and deny all other inbound traffic. Use service tags (such as Storage or AzureCloud) instead of hard-coded Microsoft IP ranges.
12. When would you use Azure Front Door, Azure CDN or Traffic Manager?
Answer: Azure Front Door (Standard or Premium) is the global layer 7 entry point for HTTP(S) apps: anycast edge, caching, TLS offload, path-based routing, fast failover between regional origins, and WAF (managed rule sets and bot protection in Premium, plus Private Link to origins). It is also Microsoft's CDN going forward. Traffic Manager is DNS-based global routing (priority, weighted, performance, geographic) for any protocol; because it works through DNS, failover depends on client DNS caching and TTLs, so it is slower than Front Door.
On CDN: Front Door (classic) retires on 31 March 2027 and Azure CDN Standard from Microsoft (classic) on 30 September 2027; both stopped accepting new profiles in 2025, and migrate to Front Door Standard or Premium.
Identity and governance
13. What are managed identities, and when would you choose system-assigned versus user-assigned?
Answer: A managed identity is an Entra identity attached to an Azure resource so code can get tokens without any secret you manage. You grant it RBAC roles on targets (Storage, Key Vault, Azure SQL), and the Azure SDK's credential classes fetch tokens automatically.
- System-assigned: created with the resource, deleted with it, used only by that resource. Good for a single VM or app with its own permissions.
- User-assigned: a standalone resource you attach to one or many resources. Good when instances are recycled often, when several resources share the same access, or when you must pre-authorise access before the compute exists. Microsoft recommends user-assigned identities for its own services, and some features (VMSS Flexible orchestration) support only user-assigned.
Interview tip: If a resource is recreated, its system-assigned identity gets a new principal ID and loses its role assignments, a common cause of failures after redeployment.
14. When do you still need an app registration and service principal instead of a managed identity?
Answer: When the workload does not run on Azure compute that supports managed identity: a GitHub Actions or Azure DevOps pipeline, an on-premises server, a SaaS integration, or a multi-tenant application. Prefer workload identity federation (federated credentials that trust tokens from GitHub, another identity provider or a managed identity) over client secrets or certificates, because there is nothing to rotate or leak. If a secret is unavoidable, store it in Key Vault, give it a short lifetime and monitor expiry (see Q57).
15. What is Privileged Identity Management (PIM), and why does it matter?
Answer: PIM, part of Microsoft Entra ID Governance, gives just-in-time privileged access. Instead of permanent ("active") assignments, admins hold eligible assignments for Entra roles, Azure resource roles or groups, and activate them for a limited window with MFA, a justification and optionally an approval. Assignments can be time-bound, activations are notified and audited, and access reviews remove standing access nobody uses. PIM requires appropriate licensing; check the current Entra ID Governance licensing page.
16. What is Conditional Access?
Answer: Conditional Access is Entra ID's policy engine: if a user, group or workload identity signs in to a given app under certain conditions (location, device state, sign-in or user risk, client app), then grant access with requirements (MFA, authentication strength, compliant or hybrid-joined device, terms of use) or block. Policies are evaluated after first-factor authentication. It needs Microsoft Entra ID P1; risk-based policies need ID Protection (P2). Tenants without P1 should at least use security defaults.
Interview tip: Mention report-only mode for testing and a monitored break-glass account excluded from policies.
17. What is Azure Policy, and what policy effects do you know?
Answer: Azure Policy evaluates resource properties against rules at create, update and on a compliance scan, and applies an effect. The supported effects are append, audit, auditIfNotExists, deny, denyAction, deployIfNotExists, disabled, manual, modify, mutate and addToNetworkGroup. Evaluation order matters: disabled first, then append and modify (which can change the request), then deny, then audit; auditIfNotExists and deployIfNotExists run after the resource provider succeeds.
Group definitions into initiatives, assign them at management group scope, use parameters for allowed values, and use exemptions rather than weakening the policy. For existing non-compliant resources, modify and deployIfNotExists need a remediation task and a managed identity on the assignment.
18. How do RBAC, Azure Policy, resource locks and tags differ?
Answer: They answer different questions:
| Control | Question it answers |
|---|---|
| Azure RBAC | Who can perform which actions at which scope? |
| Azure Policy | What configuration is allowed, whoever deploys it? |
| Resource locks | Can this be deleted (CanNotDelete) or changed at all (ReadOnly), even by an Owner? |
| Tags | Who owns it, which cost centre and environment is it? (metadata for cost and automation) |
An Owner can still be blocked by a deny policy. ReadOnly locks can break operations such as listing storage keys, so prefer CanNotDelete on critical shared resources.
19. How do you write a least-privilege custom role, and what are DataActions?
Answer: A custom role lists Actions and NotActions (control-plane operations through ARM, such as restarting a VM) and DataActions and NotDataActions (data-plane operations, such as reading blob contents or Key Vault secrets), plus AssignableScopes. Start from the closest built-in role, remove what is not needed, and test with a non-admin account.
Know the separation: Contributor on a storage account does not let you read blobs through Entra authentication; that needs a data role such as Storage Blob Data Reader. Note that NotActions is not a deny: another assignment can still grant the action.
20. What is an Azure landing zone, and how would you structure management groups?
Answer: An Azure landing zone, from the Cloud Adoption Framework, is a repeatable architecture for a governed, multi-subscription environment. It has a platform landing zone (management group hierarchy plus shared services: connectivity, identity, management and security) and workload landing zones (subscriptions where application teams deploy within the platform's guardrails). Microsoft provides accelerators using infrastructure as code, or you can build your own.
Tenant root group
โโ Organisation
โโ Platform
โ โโ Identity
โ โโ Management
โ โโ Connectivity
โโ Landing zones
โ โโ Corp (private, hub-connected)
โ โโ Online (internet-facing)
โโ Sandbox
โโ Decommissioned
Interview tip: Design management groups around policy differences, not the org chart, and mention subscription vending: automated creation of workload subscriptions already placed, peered and tagged.
Networking
21. What is the difference between an NSG, an application security group and a service tag?
Answer: An NSG holds the rules. An application security group (ASG) is a label you put on NICs ("web", "app", "db") so rules can say "allow 1433 from ASG app to ASG db" instead of listing IPs; when a VM scales out you just put its NIC in the ASG. A service tag is a Microsoft-maintained group of IP prefixes for an Azure service (Storage, Sql, AzureMonitor, AzureCloud) used as source or destination in rules.
22. How does VNet peering work, and is it transitive?
Answer: Peering connects two VNets (same region, or global peering across regions, across subscriptions and even tenants) over the Microsoft backbone with no gateway in the data path. It is not transitive: if spoke A and spoke B both peer with the hub, A cannot reach B unless you route through an NVA or Azure Firewall in the hub with user-defined routes, or use Azure Virtual Network Manager connectivity configurations or Virtual WAN. Address spaces must not overlap.
Gateway transit lets spokes use the hub's VPN or ExpressRoute gateway. Peering traffic is charged per GB.
23. VPN Gateway or ExpressRoute: how do you choose?
Answer: VPN Gateway creates IPsec tunnels over the internet (site-to-site, point-to-site, VNet-to-VNet). It is quick to set up and cheaper, but throughput and latency depend on the internet path. ExpressRoute is a private connection through a connectivity provider (or ExpressRoute Direct) that does not traverse the public internet, giving predictable latency and higher bandwidth. It is not encrypted by default (add IPsec, or MACsec on ExpressRoute Direct).
24. What is the difference between service endpoints and private endpoints?
Answer: A service endpoint is enabled on a subnet; traffic to a PaaS service (Storage, SQL, Key Vault) goes over the backbone with the subnet's private IP as the source, and the service's firewall can allow that subnet. DNS still resolves to the public IP, the public endpoint remains, and on-premises clients are not covered.
A private endpoint (Azure Private Link) puts a NIC with a private IP from your subnet in front of one specific resource (for example one storage account's blob sub-resource). Clients in the VNet, peered VNets and on-premises reach it privately, and you can disable public network access entirely. Microsoft recommends private endpoints for private access to PaaS. The cost is DNS work (Q25) and per-endpoint charges.
25. Why does DNS matter for private endpoints, and how do you design it?
Answer: Clients keep using the public name (myacct.blob.core.windows.net). With a private endpoint, that name CNAMEs to a privatelink zone, and a private DNS zone such as privatelink.blob.core.windows.net must return the private IP. If a client's resolver cannot see that zone, it resolves the public IP and is blocked, which is the classic private endpoint failure.
App (spoke VNet) โ DNS query: myacct.blob.core.windows.net โผ Azure DNS / DNS Private Resolver (hub) โ privatelink.blob.core.windows.net โผ A record โ 10.20.4.5 (private endpoint NIC)
Design: central private DNS zones in the connectivity subscription linked to the hub and spokes, records created automatically through a DNS zone group (often enforced by Policy), and Azure DNS Private Resolver with conditional forwarders so on-premises DNS can resolve privatelink names.
26. How does Azure Firewall differ from an NSG, and which SKU would you pick?
Answer: An NSG is a distributed layer 3/4 filter on subnets and NICs. Azure Firewall is a managed, stateful, central firewall in the hub: FQDN-based application rules, network rules, DNAT, SNAT, threat intelligence, central logging, and Firewall Manager policy across hubs. You use both: NSGs for micro-segmentation, the firewall for egress control and inspection between spokes and to on-premises.
- Basic: small environments, lower throughput, threat intelligence in alert mode only.
- Standard: autoscaling L3 to L7, threat intelligence filtering, DNS proxy, web categories.
- Premium: adds outbound TLS inspection, managed IDPS and full-path URL filtering for regulated workloads such as payments.
27. Load Balancer, Application Gateway, Front Door or Traffic Manager: how do you choose?
Answer: Ask two questions: is it HTTP(S), and is it global or regional?
| Service | Scope | Layer and use |
|---|---|---|
| Azure Load Balancer | Regional (plus a global tier) | Layer 4 TCP/UDP, internal or public, very low latency |
| Application Gateway | Regional | Layer 7 reverse proxy, path routing, TLS offload, WAF, into private backends |
| Azure Front Door | Global | Layer 7 edge, caching, acceleration, WAF, multi-region failover |
| Traffic Manager | Global | DNS-based routing for any protocol |
They combine: Front Door in front of a regional Application Gateway is common. Basic Load Balancer was retired on 30 September 2025; Standard is closed to inbound traffic unless an NSG allows it.
28. How should VMs get outbound internet access, and what changed with default outbound access?
Answer: Historically, a VM with no explicit outbound method got a Microsoft-owned "default outbound" IP. That IP can change without notice and conflicts with Zero Trust. For new virtual networks created with API versions released after 31 March 2026, subnets default to private (defaultOutboundAccess = false), and the portal already defaults to private subnets. Existing VNets are not changed. VMSS Flexible instances never get default outbound access.
Explicit options: a NAT gateway on the subnet (Microsoft's recommended method for most cases), a Standard load balancer with outbound rules, a Standard public IP on the NIC, or a UDR sending 0.0.0.0/0 to Azure Firewall or an NVA. In a private subnet without one of these, things like Windows activation and OS updates fail.
29. How do you give admins RDP or SSH access without exposing VMs to the internet?
Answer: Use Azure Bastion: a managed service in its own subnet that brokers RDP and SSH over TLS from the portal or native client, so VMs need no public IP and NSGs need no inbound 3389 or 22 from the internet. Add just-in-time VM access from Defender for Servers where ports must open temporarily, Entra ID login for VMs, and PIM for the admins.
Want to practise these networking and identity designs on real subscriptions rather than slides? Cloudsoft's Azure training in Hyderabad covers hands-on labs in Entra ID, VNets, private endpoints, Bicep and monitoring, in the Ameerpet classroom or live online. Call +91 96660 19191 for a free demo.
Compute
30. How do you design a VM workload for high availability, and why use VMSS Flexible orchestration?
Answer: Run at least two instances, spread across availability zones, behind a Standard load balancer or Application Gateway with health probes, on managed disks, with stateless instances wherever possible. Virtual Machine Scale Sets add autoscale, instance repair and rolling upgrades.
Flexible orchestration is Microsoft's recommended mode: it manages standard Azure VMs (so normal VM APIs, Azure Backup and Site Recovery work), mixes VM sizes and Spot with on-demand capacity, spreads across zones or fault domains, and scales to 1,000 instances. Uniform orchestration manages identical scale-set-specific instances and is still what AKS node pools and Service Fabric use. The mode is fixed at creation and can't be changed later.
31. What managed disk types does Azure offer, and how are disks encrypted?
Answer: Standard HDD (dev/test, backups), Standard SSD (light production), Premium SSD (production databases and IO-sensitive apps), Premium SSD v2 (performance set independently of size) and Ultra Disk (very high IOPS and throughput, set dynamically). Choose by IOPS, throughput and latency, not just capacity, and remember the VM size also caps disk throughput.
Managed disks are encrypted at rest by default with platform-managed keys; use customer-managed keys through a disk encryption set, and encryption at host to cover temp disks and caches.
32. Explain App Service plans and deployment slots.
Answer: An App Service plan is the compute (region, OS, tier, instance size and count) that one or more web apps share; all apps in a plan scale together, so isolate noisy or critical apps in their own plan.
Deployment slots are live apps with their own hostnames inside the same app (staging, canary). You deploy to staging, warm it up, then swap with production with near-zero downtime, and swap back to roll back. Mark connection strings and settings as "slot settings" so a swap does not point production at the staging database.
33. What are the Azure Functions hosting plans in 2026?
Answer: Flex Consumption (serverless pay-per-execution with fast scale-out, VNet integration, selectable instance memory and optional always-ready instances; Microsoft's recommendation for new serverless apps), Premium (prewarmed instances, no cold start, VNet integration), Dedicated (runs on an App Service plan) and Azure Container Apps hosting for containerised functions. The original Consumption plan is now legacy; hosting on Linux in the Consumption plan is on a retirement path (Microsoft lists 30 September 2028), and migration to Flex Consumption is recommended.
Interview tip: An HTTP-triggered function must respond within 230 seconds whatever the timeout setting; long work belongs in Durable Functions or a queue.
34. AKS, Azure Container Apps or App Service: how do you choose?
Answer: App Service fits standard web apps and APIs where you want the least operational work. Azure Container Apps is serverless containers built on Kubernetes concepts without managing a cluster: revisions, traffic splitting, scale to zero, event-driven scaling and Dapr integration. Good for microservices, background workers and APIs. AKS gives full Kubernetes: custom operators, service meshes, GPU node pools, fine control of networking and multi-team platforms. You also take on upgrades, node pool management and cluster security.
Interview tip: Justify AKS by a requirement ("we need custom controllers and a shared platform for many teams"), not by fashion. For deeper Kubernetes questions, see our Kubernetes interview questions.
35. What were web roles and worker roles, and where do Service Fabric and Cloud Services fit today?
Answer: They came from Azure Cloud Services, the original PaaS: a web role ran IIS-hosted web apps, a worker role ran background processing, and each running copy was a role instance defined in the .csdef/.cscfg files. Cloud Services (classic) was retired with the classic deployment model in 2024. Its ARM-based successor, Cloud Services (extended support), is deprecated and retires on 31 March 2027. Microsoft points migrations to App Service, Container Apps, AKS, VM Scale Sets or Service Fabric.
Service Fabric is Microsoft's platform for stateless and stateful microservices; it suits teams with existing Service Fabric code, while most new container workloads go to AKS or Container Apps.
Storage and databases
36. How do you secure access to a storage account?
Answer: In order of preference: Entra ID authentication with RBAC data roles (Storage Blob Data Reader or Contributor) for users and managed identities; a user delegation SAS (signed with Entra credentials, short-lived) when you must hand out a URL; service or account SAS signed with account keys only when unavoidable. Then disable shared key authorisation where your tools support it, so leaked keys and key-based SAS stop working.
On the network side, disable public network access and use private endpoints; also enable soft delete, versioning for critical data and Defender for Storage.
37. What are the deployment options for SQL Server workloads on Azure?
Answer: Azure SQL Database (fully managed single databases or elastic pools; vCore or DTU purchasing; serverless compute that can auto-pause; Hyperscale for large databases), Azure SQL Managed Instance (near full SQL Server engine compatibility with SQL Agent, cross-database queries and VNet injection, which suits lift-and-shift), and SQL Server on Azure VMs (full control of the OS and engine, for features or versions PaaS does not support). Decide by compatibility needs first, then operations effort and cost.
38. Explain Cosmos DB consistency levels and partition keys.
Answer: Cosmos DB offers five consistency levels, strongest to weakest: Strong, Bounded staleness, Session, Consistent prefix and Eventual. Session (read-your-own-writes within a client session) is the most widely used and the default for new accounts. Strong costs more read throughput and adds write latency across regions, and it cannot be used with multiple write regions.
The partition key decides how data and throughput (request units) spread across physical partitions. Choose a high-cardinality key that matches your most common query filter (for example customerId), so queries stay in one partition and no single "hot" partition gets throttled with 429 responses.
39. When would you use Blob Storage, Azure Files or managed disks?
Answer: Blob for unstructured objects accessed over HTTPS (documents, images, backups, data lake files). Azure Files for shared file systems over SMB or NFS: lift-and-shift apps expecting a network share, FSLogix profiles for Azure Virtual Desktop, shared configuration; Azure File Sync can cache shares on Windows servers. Managed disks for block storage attached to a VM (OS and data disks, databases on IaaS). The wrong choice usually shows up as performance problems, for example a database put on a file share.
Infrastructure as code and automation
40. ARM templates, Bicep or Terraform: how do you compare them?
Answer: ARM templates are the native JSON format. Bicep is Microsoft's domain-specific language that transpiles to ARM JSON: concise syntax, type safety, modules, automatic dependencies, day-zero support for new resource types and API versions, and no state file because Azure is the source of truth. Terraform uses HCL with the azurerm and azapi providers, keeps a state file you must store and lock securely (for example in a storage account with state locking), and works across clouds and SaaS providers.
Interview tip: Choose by team context: Bicep for Azure-only teams, Terraform for multi-cloud estates. For Terraform depth, see our Terraform interview questions for 2026.
41. What does "what-if" do, and what is the difference between incremental and complete deployment mode?
Answer: The what-if operation previews a Bicep or ARM deployment against the current state: which resources will be created, modified or deleted and which properties change. Run it in pull requests and before production. Bicep and ARM deployments are idempotent: deploying the same file again with the same values changes nothing.
Incremental mode (the default) adds or updates resources in the template and leaves others in the resource group alone. Complete mode deletes resources in the group that are not in the template, which is powerful for drift removal and dangerous if someone deploys a partial template to a shared group.
42. How should a GitHub Actions or Azure DevOps pipeline authenticate to Azure?
Answer: Use OpenID Connect workload identity federation: create a user-assigned managed identity or an app registration, add a federated credential that trusts the pipeline's token for a specific repository, branch or environment, and grant it the minimum RBAC role at the right scope. The pipeline exchanges its short-lived token for an Entra token; no client secret is stored anywhere. Separate identities per environment, require approvals on the production environment, and run what-if or terraform plan as a gated step.
Monitoring and KQL
43. Explain Azure Monitor: metrics, logs, the activity log and diagnostic settings.
Answer: Metrics are numeric time series (CPU, requests, latency) stored in a time-series database, ideal for fast alerts and charts. Logs are records stored in tables in a Log Analytics workspace and queried with KQL. The activity log records control-plane events (who created, changed or deleted what, at subscription level). Resource logs (data-plane and service logs) are not collected until you create a diagnostic setting that sends them to a workspace, storage account or Event Hubs.
44. Write a KQL query to find failed control-plane operations in the last 24 hours.
Answer: Query the AzureActivity table (after routing the activity log to the workspace):
AzureActivity
| where TimeGenerated > ago(24h)
| where ActivityStatusValue == "Failure"
| summarize Failures = count()
by OperationNameValue, Caller
| top 10 by FailuresKnow where, project, extend, summarize, bin(), join and render timechart, and be ready to explain a query line by line.
45. What are the Azure Monitor Agent, data collection rules, alerts and table plans?
Answer: The Azure Monitor Agent collects guest OS data (Windows events, Syslog, performance counters, text logs) from Azure VMs and, through Azure Arc, from on-premises and other clouds. It replaced the legacy Log Analytics agent. What it collects and where it sends data is defined in data collection rules (DCRs), which can also filter and transform data before ingestion to cut cost.
Alert rules (metric, log search, activity log) trigger action groups (email, SMS, webhook, Logic App, ITSM). Workspace table plans (Analytics, Basic, Auxiliary) trade query features for lower ingestion cost.
Security, backup, DR and cost
46. How do you run Azure Key Vault securely?
Answer: Use the Azure RBAC permission model: it is the default for new vaults from Key Vault API version 2026-02-01, and access policies are now described as legacy. Grant data roles such as Key Vault Secrets User to managed identities at vault scope; one vault per application per environment is Microsoft's recommendation. Keep soft delete on and enable purge protection in production so a deleted vault or secret can be recovered and cannot be purged early. Disable public network access and use a private endpoint, and set expiry dates and rotation policies on secrets and certificates.
Interview tip: Know the trap with the legacy model: anyone with Contributor on the vault's control plane can grant themselves data access by editing access policies. Switching a vault to RBAC invalidates existing access policies, so assign the equivalent roles first or you cause an outage.
47. What does Microsoft Defender for Cloud do?
Answer: Defender for Cloud is Microsoft's cloud-native application protection platform with three parts: CSPM (posture: recommendations based on the Microsoft cloud security benchmark, secure score, multicloud coverage of AWS and GCP), CWPP (workload protection plans such as Defender for Servers, Containers, Storage, Databases, Key Vault, App Service, Resource Manager, APIs and AI services) and DevSecOps (connecting GitHub, Azure DevOps and GitLab to find IaC misconfigurations and exposed secrets). Foundational CSPM is free; the paid Defender CSPM plan adds attack path analysis, the cloud security explorer and governance rules.
48. What is the difference between Azure Backup and Azure Site Recovery?
Answer: Azure Backup keeps recoverable copies of data (VMs, disks, files, SQL and SAP HANA in VMs, blobs) for restore after deletion, corruption or ransomware, with retention policies, soft delete and immutable vaults. Azure Site Recovery keeps workloads running: continuous replication of VMs to another region (or from on-premises to Azure), with failover, failback and recovery plans that sequence multi-tier apps. Backup answers "restore last Tuesday's data"; Site Recovery answers "run in the other region in minutes". Most production estates need both.
49. What are your main levers for Azure cost optimisation?
Answer: Visibility first: tags enforced by Policy, Cost Management cost analysis by resource group and tag, budgets with alerts, and anomaly alerts per subscription. Then rate optimisation: Azure Reservations and savings plans for steady compute, Azure Hybrid Benefit for existing Windows Server and SQL licences, Spot VMs for interruptible work. Then usage optimisation: Advisor rightsizing, auto-shutdown for non-production, deleting orphaned disks and IPs, storage tiering and controlling log ingestion.
Interview tip: A budget alerts you; it does not stop spending unless you wire an action group to automation. For FinOps depth, see our FinOps interview questions for cloud engineers.
Architecture
50. Design a multi-region web application on Azure that survives a regional outage.
Answer: Start from the business RPO and RTO, because they decide active-active versus active-passive and the cost.
Users
โ
Azure Front Door + WAF
โ โ
Central India South India
App Service App Service
(zone-redundant) (warm standby)
โ โ
Azure SQL failover group (geo-replica)
Storage: GZRS / RA-GZRS
Key Vault per region ยท Log Analytics
Front Door health-probes both regions and routes to the healthy one. Each region is zone-redundant on its own, so most failures never need a regional failover. Data is the hard part: Azure SQL failover groups give a listener that follows the primary, and storage uses geo-redundancy. Deploy both regions from the same IaC and run failover drills.
Production consideration: Asynchronous replication means a forced failover can lose recent writes. Say that out loud, and agree with the business whether automatic or manual failover is acceptable.
51. How would you design a "no public endpoints" PaaS application for a regulated customer?
Answer: Consider a hospital group that wants a patient-portal API with no data service reachable from the internet. Ingress only through Front Door Premium with WAF and Private Link to the origin (or Application Gateway with WAF in the hub). App Service or Container Apps with VNet integration for outbound and a private endpoint for inbound. Azure SQL, Storage and Key Vault with public network access disabled and private endpoints, central private DNS zones, and a user-assigned managed identity for all data access (no connection-string passwords). Azure Policy denies public network access on those resource types; Defender for Cloud and diagnostic settings feed a central workspace; egress goes through Azure Firewall with FQDN rules.
Interview tip: Say what breaks first: private endpoint DNS, and build agents that can no longer reach the services (use VNet-connected agents).
AI on Azure
52. How do Azure administration skills apply to AI workloads?
Answer: Almost directly. AI workloads on Azure, built with Microsoft Foundry (previously Azure AI Foundry), Azure OpenAI models in Foundry, Azure AI Search and Azure Machine Learning, are still Azure resources. They need managed identities instead of API keys, RBAC data roles, private endpoints and DNS, Azure Policy guardrails (allowed regions for data residency, no public network access), quota and capacity planning per region, diagnostic logs, budgets and cost alerts. The failure modes are familiar too: a 403 from a missing data-plane role, a timeout from a private DNS gap, or a 429 from exhausted quota.
AI also helps the admin directly: Copilot experiences in the Azure portal and GitHub Copilot can draft CLI commands, KQL and Bicep. Review that output like a junior engineer's draft and run what-if before applying it.
Go deeper: service-level AI questions are covered in our Azure AI interview questions and Azure Machine Learning interview questions. For how cloud engineers take this further into customer-facing AI delivery, read Azure for Forward Deployed Engineers and identity and access for AI agents.
Real-world scenarios
53. A newly built VM cannot reach the internet. How do you troubleshoot?
Answer: First suspect the 2026 default: if the VNet was created recently (portal, or IaC on a newer API version), the subnet is probably private, so the VM has no outbound path until you add one. Then work through routing, filtering and DNS methodically rather than guessing.
What I would check:
- Subnet "Default outbound access" setting and whether a NAT gateway, Standard LB outbound rule, public IP or firewall route exists.
- Effective routes on the NIC (
az network nic show-effective-route-table): is there a 0.0.0.0/0 UDR to a firewall or NVA, and is that appliance healthy and allowing the traffic? - Effective NSG rules on NIC and subnet: an outbound deny to Internet or a missing allow above a deny-all.
- Azure Firewall logs, if traffic is forced through it: is the destination FQDN allowed?
- DNS: custom DNS servers on the VNet that cannot resolve public names.
- Network Watcher connection troubleshoot and IP flow verify to confirm the exact hop that drops traffic.
Production consideration: A subnet change between private and non-private applies to existing VMs only after stop and deallocate. Standardise outbound (NAT gateway or hub firewall) in the landing zone.
54. An application gets 403 errors from a storage account that has been locked down. What do you do?
Answer: A storage 403 has two separate causes: the network blocked the request, or the identity lacks permission. The error details and the storage resource logs tell you which, so check those before changing anything.
What I would check:
- Storage diagnostic logs (
StorageBlobLogs): authorisation failure versus network rule failure, and the caller's IP and identity. - Networking: is public access disabled? Does the client reach the private endpoint? Run
nslookup myacct.blob.core.windows.netfrom the client; a public IP means the private DNS zone isn't linked or forwarded. - If service endpoints are used, is the client subnet in the account's allowed VNets? Did a firewall rule reference the old public source IP?
- Identity: does the managed identity have a data role (Storage Blob Data Reader or Contributor)? Contributor alone is not enough.
- Shared key disabled? Old code using connection strings or account-key SAS will now fail by design.
- Role assignment propagation: new assignments can take a few minutes; tokens cached by the app may need a refresh.
Production consideration: Roll out "disable public access" with Policy in audit mode first, because lockdowns also break the portal and pipelines.
55. Design a hub-and-spoke network for an enterprise moving to Azure.
Answer: Consider a retailer with stores, a head-office datacenter and a dozen application teams. The hub in the connectivity subscription holds shared services; each workload gets its own spoke VNet in its own subscription.
On-premises / stores
โ ExpressRoute + VPN backup
โโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโ
โ Hub VNet (Connectivity sub) โ
โ ER/VPN gateway ยท Firewall โ
โ Bastion ยท DNS Resolver โ
โโโโฌโโโโโโโโโโโฌโโโโโโโโโโโโฌโโโโ
โ peering โ โ
Spoke A Spoke B Spoke C
(Corp app) (Data) (Online)
UDR 0.0.0.0/0 โ Firewall
Key decisions: a non-overlapping IP plan for all regions and on-premises; peering with gateway transit; UDRs in spokes sending internet and spoke-to-spoke traffic through Azure Firewall (peering is not transitive); central private DNS zones and DNS Private Resolver; Bastion in the hub; NSGs in every spoke subnet; Policy to deny public IPs in Corp spokes; DDoS protection on public-facing VNets. At larger scale, Azure Virtual Network Manager can manage hub-and-spoke connectivity across many spokes, or Virtual WAN can replace the customer-managed hub.
What I would check:
- Throughput needs versus firewall SKU and cost.
- Whether spoke-to-spoke traffic must be inspected.
- Prefix summarisation to on-premises and asymmetric routing.
Production consideration: The hub is a shared blast radius. Put it behind CanNotDelete locks, change it only through reviewed IaC, and give workload teams no write access to it.
56. The monthly Azure bill has suddenly jumped. How do you investigate?
Answer: Narrow it from subscription to resource to meter, then find who changed what and why. Cost Management's anomaly detection compares each day with a forecast built from the previous 60 days, so start there.
What I would check:
- Cost analysis smart views and anomaly insights for the subscription; daily granularity, grouped by resource group, then resource, then meter.
- New versus changed costs: a new resource starting from zero, or a SKU change (a VPN gateway or VM resized to a larger tier shows as one meter replacing another).
- Usual suspects: large VMs left running, log ingestion growth (Q64), egress, snapshots, firewall data processing.
- Activity log and Resource Graph change history for who created or modified the resource; tags for the owner and cost centre.
Production consideration: Fix the process, not only the bill: anomaly alerts on every subscription, budgets per team, Policy-enforced owner tags, allowed VM SKU lists, and auto-shutdown on non-production.
57. Production went down because a client secret expired. How do you respond and prevent it happening again?
Answer: Restore service first, then remove the reason the secret exists. Typical symptom: the app's calls to Entra ID fail with an invalid client secret error (AADSTS7000222), and every downstream call fails after that.
What I would check:
- Which app registration and credential expired (Entra sign-in logs for service principals, app registration "Certificates and secrets").
- Create a new secret, store it in Key Vault, update the reference, and restart or refresh the app. If the app reads the secret at startup, it will not pick up the new value until restarted.
- Whether the workload can move to a managed identity or workload identity federation so no secret is needed at all.
- If a secret must remain: Key Vault expiry dates, rotation policies, and alerts on near-expiry (Key Vault emits events you can route through Event Grid).
Production consideration: Keep a credential and certificate inventory with owners and expiry dates, reviewed in a blameless post-incident review.
58. A user was just assigned Contributor but still gets "AuthorizationFailed". Why?
Answer: Usually scope, timing or the wrong plane.
What I would check:
- The scope of the assignment versus the resource being accessed (assigned on resource group A, working in B).
- Propagation and token caching: sign out and in, or run
az account clearand log in again. - Whether the action is data-plane (blob read, Key Vault secret get), which Contributor does not grant.
- A
denypolicy or a deny assignment (for example from a managed application) blocking the action, which shows a different error that people often misread. - PIM: the user is eligible but has not activated the role.
Production consideration: Grant roles to groups, not individuals, and use "Check access" to see effective assignments.
59. A deployment fails with "RequestDisallowedByPolicy". How do you handle it?
Answer: The error names the policy assignment and definition. Read it before asking for an exemption, because the policy is usually doing its job.
What I would check:
- Which assignment and scope (often inherited from a management group the team doesn't see).
- Which property violated it: region, SKU, missing tag, public network access, TLS version.
- Fix the template to comply (the normal outcome), or, if there is a valid business reason, request a time-bound exemption with an owner and expiry.
Production consideration: Publish the policy set with examples and roll out new deny policies in audit mode first.
60. An App Service app cannot connect to Azure SQL after a private endpoint was added. What is wrong?
Answer: Almost always DNS or outbound routing from the app, not SQL itself.
What I would check:
- Is VNet integration enabled on the app, so outbound traffic enters the VNet at all?
- From the app's console (Kudu), does
nslookup myserver.database.windows.netreturn the private IP? If not, link theprivatelink.database.windows.netzone to the integration VNet (or the hub resolver path). - Did someone disable public access on SQL before DNS was fixed?
- NSG or firewall rules on the path to port 1433 (and the redirect port range if the connection policy is Redirect).
- Authentication: an Entra-only server rejecting SQL logins, or the managed identity not created as a database user.
Production consideration: Create the private endpoint, DNS record and app connectivity test together in one IaC change, and only then disable public access.
61. You cannot RDP or SSH to a production VM. How do you proceed?
Answer: Separate "the network path is blocked" from "the guest OS is unhealthy".
What I would check:
- Resource Health and boot diagnostics (serial console, screenshot): is the OS booted or stuck on updates or a full disk?
- Path: Bastion subnet NSG rules, VM NSG allowing 3389 or 22 from the Bastion subnet, JIT access expired, UDR asymmetry through a firewall.
- IP flow verify and connection troubleshoot in Network Watcher.
- Guest issues: firewall inside the OS, the SSH or RDP service stopped. Fix via Run Command, the serial console, or "reset configuration" on the VM.
Production consideration: Monitoring and Run Command should make interactive logins rare.
62. AKS pods are stuck in ImagePullBackOff pulling from Azure Container Registry. What do you check?
Answer: It is either authentication between the cluster and the registry, networking, or simply a wrong image reference.
What I would check:
kubectl describe pod: 401/403 (auth), "not found" (tag or repository typo), or a timeout (network).- The kubelet identity has AcrPull on the registry (
az aks check-acrvalidates this). - If the registry has public access disabled: private endpoint, the
privatelink.azurecr.iozone linked to the cluster VNet, and firewall rules for the registry's data endpoints. - Egress through Azure Firewall: are the required AKS and registry FQDNs allowed?
Production consideration: Pin images by digest in production, scan them with Defender for Containers, and use Policy to allow images only from approved registries.
63. Someone deleted a Key Vault (or a critical resource group). How do you recover?
Answer: For Key Vault, soft delete means the vault and its objects can be recovered within the retention period: list deleted vaults and recover them (az keyvault list-deleted, then az keyvault recover), and with purge protection on nobody can purge them early. A deleted resource group has no general undelete: use each service's soft delete, Azure Backup restores, and redeploy the rest from IaC.
What I would check:
- Activity log: who deleted it, when, and through which tool or pipeline.
- Which dependent apps are failing, and the restore order (identity and Key Vault first, then data, then compute).
- Whether the deletion came from automation, such as a complete-mode deployment or a Terraform destroy against the wrong workspace.
Production consideration: CanNotDelete locks on shared and production resources, purge protection, backups in a separate subscription, and PIM so no one has standing delete rights in production.
64. The Log Analytics bill doubled after a release. How do you find the cause and reduce it?
Answer: Find which table grew, then decide whether that data is needed, at what fidelity, and in which table plan.
Usage
| where TimeGenerated > ago(7d)
| where IsBillable == true
| summarize GB = sum(Quantity) / 1000
by DataType
| sort by GB descWhat I would check:
- The table that grew (often container logs, debug-level application traces, or verbose firewall or diagnostic categories).
- The release change: log level set to Debug, a new diagnostic setting sending every category.
- Options: fix the log level, filter with DCR transformations at ingestion, move verbose tables to Basic or Auxiliary plans, sample application telemetry, and set a daily cap only as a safety net.
Production consideration: Alert on ingestion volume per table.
65. The engineer who owned the subscription has left, and nobody has Owner access. What do you do?
Answer: Use the documented break-glass path rather than raising a panic ticket. A Global Administrator in the tenant can elevate access ("Access management for Azure resources"), which grants User Access Administrator at root scope. They then assign Owner on the subscription to the right group, and remove the elevated access immediately afterwards. If the subscription sits in a different tenant, or billing ownership is the issue, the billing account owner or Microsoft support has to be involved.
What I would check:
- Which tenant the subscription trusts, and who holds Global Administrator there (through PIM).
- Whether the leaver's account was disabled or deleted, and what role assignments now show "Identity not found".
- Audit logs for the elevation, with a ticket linking the business justification.
Production consideration: Prevent the situation: assign roles to groups, never individuals; have at least two eligible Owners through PIM; and include access reviews in the leaver process.
Key takeaways
- Interviewers reward current knowledge: Microsoft Entra ID (previously Azure AD), private-by-default subnets for new VNets, Flex Consumption for Functions, RBAC as the Key Vault default, and the retirements of Basic Load Balancer, classic resources and Cloud Services.
- Separate the planes in every answer: control plane (ARM, Azure RBAC, Policy) versus data plane (blob, secret and database access).
- Networking questions are mostly about routing, NSGs and DNS. Private endpoints fail on DNS far more often than on anything else.
- Prefer identities to secrets: managed identities, workload identity federation, PIM, and Key Vault with purge protection when a secret is unavoidable.
- Governance is designed once at management group level: landing zones, initiatives, locks and tags enforced by Policy.
- For scenarios, show a method: symptoms, logs, hypothesis, test, fix, then the prevention that stops it recurring.
Interview preparation checklist
- Build a small hub-and-spoke in your own subscription with Bicep or Terraform: hub firewall or NAT gateway, two spokes, Bastion and a private endpoint with a private DNS zone.
- Deploy an App Service or Container Apps app that reads from Storage and Key Vault with a user-assigned managed identity and no secrets.
- Assign an Azure Policy initiative (allowed locations, required tags, deny public IP) in audit mode, then deny, and fix a failed deployment.
- Route activity logs and resource logs to Log Analytics and write five KQL queries you can explain line by line.
- Back up a VM, restore a file, and run a Site Recovery test failover.
- Set a budget and an anomaly alert, then explain a cost breakdown by resource group and meter.
- Practise three scenario answers out loud (VM outbound, storage 403, expired secret) in the format: check, cause, fix, prevention.
- Review the AZ-104 study guide skill areas and check the current exam page for changes.
FAQ
What does an Azure administrator do day to day?
An Azure administrator manages identities and access, subscriptions and policies, virtual networks, VMs and PaaS services, storage, backups and monitoring. Day to day that means access requests, deployments through IaC, alert triage, patching and backup checks, cost reviews and supporting application teams.
Is AZ-104 still a current certification in 2026?
Yes. Microsoft Learn lists Microsoft Certified: Azure Administrator Associate (exam AZ-104) as current, covering identities and governance, storage, compute, virtual networking, and monitoring and maintenance. It renews every 12 months through a free online assessment. Check the exam page for the latest skills outline.
How should I prepare for an Azure interview?
Combine concepts with hands-on practice: build a small landing zone with IaC, break and fix networking and access on purpose, write KQL queries, and rehearse scenario answers out loud. Interviewers value how you troubleshoot more than memorised limits.
Do I need to know AWS as well as Azure?
Not for an Azure-focused role, but many Indian services firms and GCCs run multi-cloud estates, so being able to map concepts across clouds helps. Our AWS interview questions guide covers the equivalent topics on AWS.
How much networking do I need for Azure interviews?
More than most candidates expect. You should be comfortable with CIDR planning, routing and UDRs, NSGs, peering, VPN and ExpressRoute, private endpoints and DNS, load balancing choices and outbound connectivity, because most production issues involve one of these.
Should I learn Bicep or Terraform for Azure roles?
Learn one well and understand the other. Bicep is common in Azure-only platform teams, Terraform in multi-cloud organisations. Interviewers care that you understand idempotency, state, modules, what-if or plan, and pipeline authentication.
Is Azure a good career choice for freshers?
Azure skills are widely used across enterprises, especially organisations already on Microsoft 365 and Windows Server. Freshers who pair Azure fundamentals with Linux, networking, scripting and one IaC tool, and can show hands-on projects, are well placed for cloud support and junior engineer roles.
How do Azure skills connect to AI engineering roles?
AI applications on Azure still depend on identity, networking, private endpoints, quotas, monitoring and cost control. Engineers who can secure and run that foundation are needed on AI projects, and can grow into AI platform or Forward Deployed Engineer roles.
What hands-on projects help in an Azure interview?
A hub-and-spoke network deployed with IaC, a web app using managed identity and private endpoints, a monitoring setup with KQL alerts, and a backup and DR test. Document each with an architecture diagram and the problems you solved along the way.
If you want structured, lab-driven preparation for administrator and cloud engineer interviews, explore Cloudsoft's Azure course in Ameerpet, Hyderabad, with classroom or live online batches and mock interviews. If your goal is a broader path that combines cloud with AI, ML and cyber security, look at the APEX AI, ML, Cloud and Cyber Security program. Call +91 96660 19191 to book a free demo.
