Microsoft Azure learning path: everything to study, topic by topic

Cloud computing characteristics, public/private/hybrid deployment models, IaaS/PaaS/SaaS, serverless, the shared responsibility model, CapEx versus OpEx, consumption-based pricing and the benefits of the cloud (elasticity, scalability, reliability, predictability, security, governance and manageability)

Regions, region pairs, availability zones, sovereign regions, the management group, subscription, resource group and resource hierarchy, Azure Resource Manager, and the portal, Cloud Shell, CLI, PowerShell, Azure Arc and Advisor tools

Azure support plans (Basic, Developer, Standard, Professional Direct, Premier/Unified) and what each includes, opening support requests and quota or subscription limit increases from Help + support, service level agreements and the composite SLA and uptime percentage calculation, SLA service credits, and the preview (private and public) versus generally available service lifecycle, including that preview services carry no SLA

Azure free account (credit, 12-month and always-free services, what happens when credit or the trial ends), subscription offer types and account types, factors that affect cost (resource type, region, VM size and operating system, usage, bandwidth and inbound versus outbound data transfer, egress between regions), billing for stopped (deallocated) VMs, free Entra ID versus paid public IPs, Azure Hybrid Benefit, and the Pricing Calculator and TCO Calculator

The Azure portal (blades, dashboards, URL and browser access from any device), Azure Cloud Shell with Bash or PowerShell, Azure CLI and Azure PowerShell installed on Windows, macOS and Linux, Azure mobile app, selecting the right management tool for a platform or automation need, and listing and managing resources with commands and cmdlets

Microsoft Entra tenants, users and groups (assigned and dynamic), bulk operations, license assignment, administrative units, device identity (joined, hybrid joined, registered), guest users with B2B collaboration, External ID, self-service password reset and the identity types in Entra

Entra authentication methods (passwordless, FIDO2, Authenticator, SSPR), multifactor authentication, Conditional Access policies and signals, Identity Protection risk policies, Privileged Identity Management, access reviews, entitlement management and Zero Trust-based access design

Azure role-based access control: built-in and custom roles, scopes and inheritance, role assignments, deny assignments, the difference between Entra roles and Azure roles, access conditions, and troubleshooting effective access

App registrations and enterprise applications, service principals, OAuth 2.0 and OpenID Connect flows, Microsoft identity platform and MSAL, delegated versus application permissions, admin consent, Microsoft Graph, managed identities (system- and user-assigned) and workload identities

Microsoft Entra Password Protection (global and custom banned password lists, on-premises agent deployment with the proxy service and DC agent placement), self-service password reset methods, security questions and password writeback, security defaults and what they enforce, Entra ID license editions, and password policy administration in Microsoft Entra Domain Services

Microsoft Entra Connect sync and its sign-in methods (password hash synchronization, pass-through authentication, federation), seamless single sign-on, domain and OU filtering of the sync scope, Entra Connect cloud sync agents and provisioning, IdFix remediation of directory errors, sync health monitoring, and user lifecycle automation with Microsoft Identity Manager

Enterprise application assignment and self-service access, single sign-on methods (SAML, OIDC, password-based, linked) for apps lacking identity provider support, Entra Application Proxy with Kerberos constrained delegation for on-premises apps, Microsoft Entra Domain Services for LDAP and Kerberos workloads, group naming policy, granting API permissions, external tenant access with B2B, Conditional Access scope and Entra role assignment

Designing application identity: system-assigned managed identities with Key Vault access, acquiring tokens from the instance metadata service (IMDS) and OAuth 2.0 endpoints, Privileged Identity Management for just-in-time access, access reviews as identity governance, and Conditional Access to restrict access to corporate devices

Advanced query capabilities on directory objects (ConsistencyLevel: eventual with $count, $search and complex $filter), following @odata.nextLink for paging and delta queries, JSON batching with POST /$batch up to 20 requests, change notification subscriptions (resource, changeType, notificationUrl, expiration and renewal, validation handshake, clientState) and handling throttling with Retry-After

VM sizes and series, managed disks and encryption, availability sets and zones, Virtual Machine Scale Sets and autoscale, images and extensions, resizing and moving VMs, Azure Hybrid Benefit and spot instances

App Service plans and pricing tiers, scaling up and out, autoscale, deployment slots and swap, custom domains and TLS certificates, networking features (VNet integration, private endpoints), app settings, backups and deployment methods

Container images and registries (Azure Container Registry, tasks), Azure Container Instances, Azure Container Apps (revisions, scaling, Dapr), and Azure Kubernetes Service fundamentals for choosing the right container hosting option

Azure Functions triggers and bindings, hosting plans (Consumption, Flex Consumption, Premium, Dedicated), Durable Functions orchestrations, timeouts, scaling and cold start, configuration and Logic Apps as a low-code complement

Azure IoT Hub and IoT Central for device ingestion, Azure Virtual Desktop host pools and session hosts, Microsoft Managed Desktop versus Azure Lab Services, Azure DevTest Labs VM templates, artifacts and cost policies, Azure AI Bot Service for digital assistants, and recognizing the core Azure service that fits a workload description

VM network interface rules (same region and subscription as the VNet, attaching and switching), availability set fault and update domain counts, virtual machine scale sets across availability zones, redeploying a VM to a new host, generalizing a VM with sysprep and capturing an image, uploading prepared VHDs, Azure CycleCloud for HPC clusters, the on-premises data gateway, Serial Console and Application Health extension

AKS networking (kubenet versus Azure CNI, pod CIDR sizing, service endpoints through CNI), ingress controllers with a single IP and TLS termination, Kubernetes StorageClasses and volume provisioners, liveness and readiness probes, Microsoft Entra integration for AKS, ACR Tasks with base image triggers, secure environment variables in ACI, Dockerfile instruction ordering and Web App for Containers persistent storage and log streaming

App Service WebJobs types (continuous and triggered), Kudu console and custom deployment scripts, App Service log streaming and container logs, session state and client certificate header handling, Logic Apps workflow design in the designer with connectors and Teams notifications, and Azure Notification Hubs for push messages

App Service auto-heal rules (memory, request count, slow request and status code triggers with recycle actions), Health check with load balancer eviction of unhealthy instances, the ARR Affinity cookie and stateless scale-out, Run from package with WEBSITE_RUN_FROM_PACKAGE, App Service application and web server logging to the file system with its time limit, the .NET isolated worker model for Azure Functions versus the retiring in-process model, and queue trigger concurrency in host.json (batchSize, newBatchThreshold, maxDequeueCount, visibilityTimeout)

Hybrid Connections through Azure Relay to reach an on-premises host and port without inbound firewall rules, access restrictions that allow only Azure Front Door (AzureFrontDoor.Backend service tag plus the X-Azure-FDID header check), incoming client certificates and the X-ARR-ClientCert header, built-in authentication (Easy Auth) behavior for unauthenticated requests (redirect or HTTP 401) and the X-MS-CLIENT-PRINCIPAL header, and API Management named values that reference Key Vault secrets through a managed identity

Dockerfile instructions (FROM, WORKDIR, COPY, RUN, ENV, EXPOSE, ENTRYPOINT versus CMD), multi-stage builds that copy only build output to a small runtime image, ordering instructions for layer caching and .dockerignore, Azure Container Apps secrets referenced with secretRef or Key Vault, Dapr service invocation by app ID through the sidecar, and the WEBSITES_ENABLE_APP_SERVICE_STORAGE setting for persistent /home storage in Web App for Containers

App Service Environment v3 for isolated single-tenant App Service in a virtual network, Azure Dedicated Host for compliance and licensing, Azure Batch pools on Spot VMs for interruptible parallel work, Azure Red Hat OpenShift, Azure VMware Solution for vSphere workloads, Azure SignalR Service for real-time push, AKS workload identity with federated credentials for pods and Azure Backup for AKS cluster state and persistent volumes

Virtual networks and address spaces, subnets, IP addressing (public/private, static/dynamic), VNet peering and transitive routing, user-defined routes and system routes, NAT gateway, network interfaces and service endpoints

Network security groups and application security groups, Azure Firewall and policies, Azure Bastion, DDoS Protection, Web Application Firewall, service endpoints versus Private Link and private endpoints, and securing public access

Azure DNS public and private zones, DNS Private Resolver, Azure Load Balancer, Application Gateway, Front Door and Traffic Manager, health probes, routing methods, and choosing between regional and global, Layer 4 and Layer 7 options

Site-to-site and point-to-site VPN Gateway, ExpressRoute circuits and peering, Virtual WAN, hub-and-spoke topology, BGP, forced tunneling, Network Watcher diagnostics and network architecture design decisions

Storage account types and performance tiers, redundancy options (LRS, ZRS, GRS, GZRS), access tiers, shared access signatures, access keys, Entra ID authorization, storage firewalls and private endpoints, and customer-managed keys

Blob containers and blob types, lifecycle management, versioning, soft delete and immutability, AzCopy and Storage Explorer, Azure Files shares and snapshots, Azure File Sync, SDK properties and metadata, and hierarchical namespace for Data Lake Storage Gen2

Azure SQL Database, Managed Instance and SQL Server on VMs, DTU versus vCore purchasing models, elastic pools, serverless, high availability, geo-replication and failover groups, backups and PITR, and Azure Database for MySQL/PostgreSQL

Cosmos DB APIs, request units and throughput modes, partition keys, the five consistency levels, global distribution and multi-region writes, change feed, indexing, and SDK usage for developers

Structured, semi-structured and unstructured data, relational concepts (tables, keys, normalization, views, indexes), transactional versus analytical workloads, data roles, batch versus streaming, data lakes, warehouses, lakehouses and Power BI

Partition strategy, Azure Data Factory and Synapse pipelines, incremental loads, slowly changing dimensions, Spark and Databricks batch processing, Azure Stream Analytics and Event Hubs, windowing, late data handling, and pipeline management

Data encryption at rest and in transit, RBAC and POSIX ACLs on Data Lake, dynamic data masking and row-level security, Purview for data governance, monitoring pipelines and Spark jobs, data skew, shuffle, small files, and cost and performance tuning

Fabric workspaces, lakehouses, warehouses and Direct Lake, dataflows and notebooks, workspace roles and item security, deployment pipelines and version control, semantic models with DAX, star schema design, and Power BI performance tuning

Descriptive, diagnostic, predictive, prescriptive and cognitive analytics, data roles (database administrator, data engineer, data analyst) and their responsibilities, data visualization concepts, Power BI Desktop versus the Power BI service and Report Builder, reports versus dashboards, and choosing visuals such as treemap, waterfall, line and bar charts

Non-relational data models and when to choose each: key-value, document, column-family, graph with nodes and edges, and time series; Azure Table storage PartitionKey and RowKey, queue and file storage selection, and recognizing JSON objects, nested objects and arrays, XML and other semi-structured data formats

SQL Server Management Studio, Azure Data Studio, SQL Server Data Tools (SSDT), Visual Studio Code extensions and command-line tools for Azure SQL, MariaDB and PostgreSQL clients, T-SQL language categories (DDL, DML, DCL), INSERT, UPDATE and DELETE statements, SQL Database server-level firewall rules and server administrator accounts

Azure Synapse Analytics architecture (massively parallel processing, dedicated SQL pool, serverless SQL pool over lake files and Parquet, PolyBase external tables), distribution choices (hash, replicated, round robin), columnstore indexes and rowgroup maintenance, COPY INTO loading, pausing pools to save cost, Azure Databricks and HDInsight Spark provisioning, notebooks and data source integration, Stream Analytics outputs and partition alignment, and Power BI DirectQuery versus Import

Microsoft Entra authentication for Azure SQL including integrated authentication, auditing destinations (storage, Log Analytics, Event Hubs), Defender for SQL threat detection and vulnerability assessment, long-term backup retention, automatic tuning, purchasing tier and elastic pool selection, BACPAC export and DACPAC deployment, and MySQL server firewall rules

Cosmos DB composite indexing policies, the change feed and the change feed processor, server-side triggers, stored procedures, resource tokens for scoped client access, migration tooling, Azure Synapse Link for analytics, and Databricks integration

Direct Lake mode on OneLake, framing and reframing, fallback to DirectQuery and its triggers, guardrails per Fabric capacity SKU, V-Order, row group sizing, VertiPaq cardinality and compression, and diagnosing fallback to optimize semantic models

Delta table maintenance (OPTIMIZE compaction, VACUUM retention, V-Order tradeoffs, scheduled maintenance), OneLake shortcuts to internal and external storage with cross-region cost and latency, Eventstream streaming ingestion, and KQL time-series aggregation in an Eventhouse

PySpark and Spark SQL notebooks, parameter cells and base parameters, orchestration from pipelines including On failure dependencies, Fabric Environments for libraries, choosing Spark notebooks or Dataflow Gen2, Warehouse visual query editor and cross-warehouse T-SQL with three-part names, Git integration update actions and branch-out workspaces, and DAX calculation groups

Azure Import/Export service requirements by account and data type, AzCopy, copying storage through template export, preparing and uploading VHDs, blob SDK methods for metadata, leases and change feed, Azure Queue storage SDK code, SAS with stored access policy, per-tenant encryption scopes, and selecting storage account types for requirements

Azure Stream Analytics query design: embarrassingly parallel jobs with PARTITION BY and matching input and output partition counts, WITH steps feeding multiple outputs, stream-to-stream joins with DATEDIFF bounds, geospatial functions (CreatePoint, ST_DISTANCE, ST_WITHIN), built-in anomaly detection (AnomalyDetection_SpikeAndDip, AnomalyDetection_ChangePoint), and choosing an output sink for interactive queries versus archive

Operating streaming jobs: SU % utilization, backlogged input events and watermark delay for scaling streaming units, the output error handling policy (Retry versus Drop), input deserialization error metrics, and Event Hubs throughput units (1 MB/s or 1,000 events/s ingress per unit), auto-inflate and server-busy throttling

Orchestrating pipelines: self-hosted integration runtime high availability (multiple nodes) and scaling, Azure-SSIS integration runtime, Azure Batch with the Custom activity, Webhook activity callbacks, tumbling window trigger dependencies, pipeline concurrency, rerun from failed activity, ADF CI/CD promotion with adf_publish, plus Databricks job repair run, task values (dbutils.jobs.taskValues) and notebook orchestration (dbutils.notebook.run versus %run)

Loading data at scale: Copy activity source partitioning (partitionOption, parallelCopies) and sink copy behavior (PreserveHierarchy, FlattenHierarchy, MergeFiles), mapping data flow Parse transformation and schema drift, data flow cluster TTL, COPY INTO for dedicated SQL pools and its load parallelism, the Spark connector for a dedicated pool, parallel JDBC reads in Spark (partitionColumn, numPartitions) and Synapse Link for SQL

Delta Lake on Databricks and Synapse Spark: Auto Loader (cloudFiles) incremental ingestion with schema inference, schema evolution and the rescued data column, VACUUM and retention to physically erase deleted data, change data feed (delta.enableChangeDataFeed, _change_type), CHECK and NOT NULL constraints, and foreachBatch with MERGE for streaming upserts

Spark transformations and tuning: malformed-record parse modes (PERMISSIVE, DROPMALFORMED, FAILFAST), explode, explode_outer and posexplode on arrays and maps, avoiding slow Python UDFs in favor of built-in functions or pandas UDFs, DataFrame caching versus the Databricks disk cache, and managed versus external tables

Tuning a Synapse dedicated SQL pool (formerly SQL Data Warehouse; Microsoft directs new analytics builds to Fabric Warehouse, but the pool remains supported): result set caching, CTAS versus UPDATE for large changes, scaling DWUs, data movement DMVs such as sys.dm_pdw_request_steps and sys.dm_pdw_dms_workers, and Query Store for plan regressions

Synapse serverless SQL pool: reading Delta tables with OPENROWSET FORMAT='DELTA', UTF-8 collation Latin1_General_100_BIN2_UTF8 for string columns, cost control (billing per TB processed, sp_set_data_processed_limit), shared metadata from Spark databases, and Power BI Import versus DirectQuery connectivity

Securing analytics platforms: Databricks secret scopes (Key Vault-backed versus Databricks-backed) read with dbutils.secrets.get, Synapse RBAC roles that are separate from Azure RBAC, Unity Catalog metastore, catalogs, schemas and GRANT, Synapse managed virtual network data exfiltration protection with approved tenants and managed private endpoints, and SQL Data Discovery and Classification

Observability and retention for data platforms: sending Synapse Spark application logs to Log Analytics with the diagnostic emitter, detecting storage throttling through ServerBusy and ClientThrottling transaction metrics, Databricks cluster log delivery and diagnostic settings, and Cosmos DB time to live (defaultTtl and per-item ttl)

Calculation groups with calculation items and SELECTEDMEASURE for reusable time intelligence (YTD, prior year) and precedence, dynamic format strings with SELECTEDMEASUREFORMATSTRING, field parameters created with NAMEOF so users switch measures or dimensions in a visual, perspectives that expose focused subsets of a model (not a security feature), sort by column (month name by month number) and usability settings such as hiding key columns and setting Summarize by to None

DIVIDE with an alternate result to handle division by zero safely, ISINSCOPE to detect the current hierarchy level in a measure (percent of parent, subtotal handling), INFO.TABLES, INFO.MEASURES, INFO.COLUMNS and INFO.RELATIONSHIPS to read model metadata with DAX, and DAX query view in Power BI Desktop and the service to write EVALUATE queries, test measures with DEFINE and update the model with them

VertiPaq dictionary encoding and why high-cardinality columns (GUIDs, datetimes with seconds) compress poorly, splitting date and time and reducing precision, the hidden date tables created by auto date/time, attribute hierarchy memory and turning off IsAvailableInMdx for unused columns, the memory and refresh cost of calculated columns versus source or Power Query columns, and measuring model size with VertiPaq Analyzer

The large semantic model storage format on Premium and Fabric capacity, query caching of first-load report results, query scale-out with read-only replicas, Performance Analyzer in Power BI Desktop to separate DAX query, visual rendering and other time, automatic page refresh with change detection against a DirectQuery measure, incremental refresh with hybrid tables (latest partition in DirectQuery), and the enhanced refresh REST API for partition-level refreshes with commit mode and parallelism

Power BI project (PBIP) folders with TMDL text files for Git diffs and merges, deploying repository items with the fabric-cicd Python library and parameter files, variable libraries with value sets per stage, Warehouse schema as code with SQL database projects, dacpac builds and SqlPackage publish, rule-based review of models with the Tabular Editor Best Practice Analyzer, Power BI template (.pbit) files and .pbids data source files for distributing connections

Cross-warehouse queries with three-part names in one workspace, GROUP BY ROLLUP subtotals with GROUPING, STRING_AGG with WITHIN GROUP, TRY_CAST returning NULL on conversion failure, APPROX_COUNT_DISTINCT for fast approximate distinct counts, OPENROWSET over Parquet files in OneLake or storage, COPY INTO, and the Warehouse visual query editor that builds queries by drag and drop and generates T-SQL

Warehouse T-SQL time travel with FOR TIMESTAMP AS OF within the retention window, zero-copy table clones, automatic and manual statistics maintenance, dynamic management views and KILL for live sessions, queryinsights views for long-running and frequently run queries, SQL analytics endpoint metadata sync lag for Lakehouse tables and how to force a refresh, and inferred dimension members for late-arriving dimension rows

Database mirroring that continuously replicates an operational database into OneLake as Delta tables with a SQL analytics endpoint, open mirroring where applications write files with row markers to a landing zone, and the SQL database in Fabric (SQL engine for OLTP with automatic mirroring to OneLake), plus how to choose between mirroring, a SQL database, a Warehouse, a Lakehouse and pipelines

Dataflow Gen2 Fast Copy for high-volume ingestion, Combine files from a folder (sample file query and function), merge join kinds (left outer, right outer, full outer, inner, left anti, right anti), changing type using a locale for dates and decimals, and Fill Down to propagate values into null cells

Copy activity with the REST connector and pagination rules for next-page links, event-based pipeline triggers from storage events through Fabric Activator and the Real-Time hub, and the on-premises data gateway for pipelines and Dataflow Gen2 reading on-premises sources

Data Wrangler for low-code data preparation that generates PySpark or pandas code, Delta schema evolution on append with mergeSchema, exact decimal typing with DecimalType instead of floating point, semantic link (sempy) to read semantic model tables and evaluate measures or DAX from notebooks, and OneLake file explorer to sync workspace files to Windows

Kusto Query Language basics (where, summarize, bin, render), make-series for time-series aggregation, series_decompose_anomalies for anomaly detection, OneLake availability that exposes Eventhouse tables as Delta for Spark, SQL and Direct Lake, and Real-Time Dashboard parameters such as _startTime and _endTime used in tile queries

Configuring preferred regions in the Cosmos DB SDK, bulk mode with AllowBulkExecution, using a single long-lived CosmosClient, SDK retry options for 429 rate limiting (MaxRetryAttemptsOnRateLimitedRequests and wait time), optimistic concurrency with the item ETag and IfMatchEtag, partial document updates with Patch operations, unique key policies scoped to a logical partition, conflict resolution policies for multi-region writes (last writer wins or custom) and migrating MongoDB data with Azure Database Migration Service

Cross-origin resource sharing rules on the Blob service for browser clients, blob index tags for key-value queries across a storage account versus metadata, static website hosting from the $web container with index and error documents, optimistic concurrency with ETags and conditional headers (If-Match, If-None-Match) versus leases, and range requests that return 206 Partial Content for resumable and parallel downloads

Azure Database for MySQL and PostgreSQL flexible server high availability with a zone-redundant standby and synchronous replication versus same-zone HA, automatic failover behavior, read replicas including cross-region replicas for disaster recovery and promotion, geo-redundant backup, and long-term retention of PostgreSQL backups beyond the built-in 35 days

Elastic jobs to run T-SQL across many Azure SQL databases, ledger tables with cryptographic digests for tamper evidence, Cosmos DB data-plane role-based access control with Microsoft Entra identities (disabling key-based access), continuous backup with point-in-time restore versus periodic backup, Azure Hybrid Benefit and reserved capacity to reduce cost, and Oracle Database@Azure for Exadata workloads

Encryption scopes that isolate tenant data with separate keys within one storage account, NFS 3.0 protocol support on Blob storage with hierarchical namespace, asynchronous object replication between storage accounts (versioning and change feed), Azure Elastic SAN for consolidated block storage over iSCSI, Azure NetApp Files for enterprise NFS and SMB file workloads, and Azure Storage Mover for migrating on-premises file shares

Shared responsibility, defense in depth, Zero Trust, the CIA triad, encryption and hashing, authentication versus authorization, identity providers, federation, directory services, and governance, risk and compliance concepts

Azure Policy definitions, initiatives, effects and remediation, resource locks, tags, management groups, Blueprints and landing zones, Cost Management and budgets, the pricing calculator, TCO, reservations, savings plans and Azure Hybrid Benefit

Azure Monitor metrics and logs, Log Analytics workspaces and KQL, diagnostic settings, alert rules and action groups, VM, container and network insights, Network Watcher, Service Health and Advisor, and monitoring design

Application Insights and OpenTelemetry instrumentation, availability tests, Application Map, live metrics, sampling, custom telemetry, alerts, KQL analysis, and troubleshooting application performance and failures

Recovery Services and Backup vaults, backup policies and soft delete, Azure Site Recovery, RPO and RTO, availability zones and SLAs, composite SLA calculation, paired-region failover and business continuity design

Azure Key Vault secrets, keys and certificates, access policies versus RBAC, soft delete and purge protection, managed HSM, key rotation, customer-managed keys, Azure App Configuration and Key Vault references

Cloud security posture management, secure score and recommendations, regulatory compliance, Defender plans for servers, storage, SQL and containers, just-in-time VM access, adaptive hardening, alerts, workflow automation and multicloud connectors

Microsoft Sentinel workspaces, data connectors, analytics rules, incidents, automation rules and playbooks, hunting and workbooks, UEBA, Defender XDR (endpoint, identity, email, cloud apps) and security operations workflows

Service Trust Portal, Microsoft privacy principles, Compliance Manager, sensitivity labels, DLP, retention and records management, Data Map and Unified Catalog, insider risk management, eDiscovery and audit

Advanced compute security: Azure Disk Encryption, confidential computing, trusted launch, AKS and container security; storage security (Defender for Storage, encryption scopes, immutability) and Azure SQL security (TDE, Always Encrypted, dynamic data masking, auditing, Entra authentication)

Microsoft Trust Center, Privacy Statement and compliance documentation, GDPR and data protection commitments, Azure Government and Azure China (21Vianet) sovereign clouds and their eligibility, the shared responsibility model for security, the Cloud Adoption Framework phases, authentication versus authorization, and identity as a managed SaaS service

Azure Blueprints and blueprint assignments, resource locks (CanNotDelete and ReadOnly), moving resources between resource groups and subscriptions, subscription ownership transfer, deployment history and exporting the deployed template, Azure Policy compliance evaluation and the managed identity used by remediation tasks, and tag-based governance operations

Microsoft Defender XDR portal incidents and advanced hunting, Defender for Endpoint (supported platforms, network protection), Defender for Identity, Defender for Office 365, Defender for Cloud Apps (cloud app security), Microsoft 365 Secure Score versus the Defender for Cloud secure score, Intune device management and security baselines, and Sentinel integration with Defender XDR

Microsoft Purview Audit (Standard and Premium/Advanced Audit, audit retention), eDiscovery (Standard and Premium), Insider Risk Management policies, alerts and case workflow, communication compliance, information barriers, and Customer Lockbox for controlled Microsoft engineer access

Microsoft Purview portal as the hub for data protection and governance, Compliance Manager score, improvement actions and action types (preventive, detective, corrective), sensitivity labels and their actions, trainable and pre-trained classifiers, data loss prevention including Endpoint DLP platform support, and retention policies and labels that preserve deleted content

Azure Monitor agent and legacy Log Analytics (MMA) agent deployment, data collection rules and endpoints, diagnostic settings to Log Analytics, storage and Event Hubs, Activity Log for control-plane and ARM deployment events, Network Watcher flow logs, workspace design and access, retention, pricing tiers, tables such as Event and Syslog, monitoring solutions scope, ITSM connector and synthetic availability tests

Fabric domains for federated governance, endorsement levels (Promoted, Certified, Master data) and who can set them, the OneLake catalog for discovery and governance insights, lineage impact analysis of downstream items, Power BI admin scanner APIs (getInfo, scanStatus, scanResult) for tenant metadata scanning, tenant settings that let service principals call Fabric and admin APIs, and workspace monitoring that logs workspace activity into an Eventhouse

Workspace-level private link that restricts inbound access for chosen workspaces, trusted workspace access using workspace identity and resource instance rules on a firewalled ADLS Gen2 account, Build permission on a shared semantic model, and item sharing permissions for lakehouses and warehouses (Read, ReadData for T-SQL only, ReadAll for OneLake and Spark access)

Usage analysis tools in Application Insights (users, sessions, events, funnels, retention, user flows, cohorts), Azure Workbooks that combine text, KQL queries and parameters, the daily volume cap on the Log Analytics workspace and what happens when it is reached, release annotations that mark deployments on charts, and creating ITSM work items from alerts

Azure Monitor managed service for Prometheus with an Azure Monitor workspace, PromQL and Azure Managed Grafana for Kubernetes and application metrics, Network Watcher flow logs (NSG flow logs being retired in favor of virtual network flow logs) with Traffic Analytics, Connection Monitor for end-to-end connectivity and latency tests, Microsoft Entra Connect Health agents for sync and AD FS monitoring, and collecting Windows event logs and syslog with Azure Monitor Agent and data collection rules

ARM template structure, Bicep syntax, parameters, variables and modules, deployment scopes, what-if, incremental versus complete mode, template specs, deployment stacks, exporting templates and IaC in pipelines (including Terraform awareness)

Azure Boards and GitHub Projects, work item linking and traceability, flow of work (cycle time, lead time, WIP), DORA metrics, dashboards and queries, wikis, release notes, and team collaboration integrations such as Teams and Slack

Git branching strategies (trunk-based, GitHub flow, feature and release branches), branch policies and protection, pull request workflows, code owners, repository organization, Git LFS, large repository strategies, permissions and tags

YAML pipelines in Azure Pipelines and GitHub Actions, agents (Microsoft-hosted, self-hosted, scale set), templates, variables and variable groups, caching, Azure Artifacts package feeds and versioning, test strategy and pipeline health

Environments, approvals and checks, deployment gates, blue-green, canary, ring and progressive exposure deployments, feature flags, rolling updates, slots, deploying containers and IaC, hotfixes and rollback

Service connections and workload identity federation, managed identities for pipelines, Key Vault integration and secret scanning, GitHub Advanced Security and Defender for DevOps, SAST, SCA and dependency scanning, container image scanning and compliance gates

Git history rewriting and removing large files with BFG or filter-branch, git gc and prune maintenance, tags, .gitignore, importing repositories, external Git service connections, choosing between Git and TFVC, and choosing among Azure Repos, GitHub Enterprise, Bitbucket and Subversion, with Jenkins integration against Azure Repos

Azure DevOps users, licenses and access levels, security groups and least privilege, personal access token (PAT) authentication for third-party tools, wiki and dashboard permissions, agent pool roles, Continuous Assurance and project configuration drift, Dependency Tracker, GitHub App authentication for Azure Pipelines and Azure Boards, and monitoring tool categories

Service hooks and notifications, Microsoft Teams integration with Azure Pipelines and Azure Boards, Logic Apps notifications, Jenkins and Octopus integration, mapping Azure DevOps services to Jira and other tools, TFS to Azure DevOps migration with the Database Import Service, GitHub notifications and the Log Analytics ITSM connector

App Center build, test and distribute for mobile apps, distribution groups, iOS ad hoc distribution and signing certificates and provisioning, App Center SDK initialization, crash reporting and analytics, and in-app feedback tooling

Deployment groups and target agents for VMs, deployment queue settings, release retention policies, Azure DevTest Labs VM templates, artifacts and auto-shutdown, GitHub Codespaces development environments, and App Service backup and app settings

Azure Automation State Configuration (DSC) for Windows and Linux, automation account modules, Hybrid Runbook Worker, Update Management, Terraform tooling and testing frameworks such as Terratest and Yeoman, and Logic Apps Designer workflow automation

Agile retrospectives, technical debt and how to measure and reduce it, test plans and test case association with work items, and quality metrics used to steer delivery

Template specs as versioned, RBAC-controlled templates, deployment stacks with deny settings and actionOnUnmanage to manage resource lifecycle, Azure Resource Graph KQL queries for inventory across subscriptions, Bicep linter rules configured in bicepconfig.json, and Azure VM Image Builder publishing versions to Azure Compute Gallery

Customizing an inherited process in Azure Boards (custom fields, work item types, states and rules) versus the system processes, Kanban column WIP limits and the cumulative flow diagram for finding bottlenecks, sprint capacity planning with activity and days off, cross-team dependencies with Delivery Plans and dependency tracking extensions, and mapping Jira, Jenkins and Octopus Deploy to Azure Boards and Azure Pipelines

Git submodules and how they pin a commit, reverting a merge commit with the mainline parent (-m 1) and re-merging afterwards, cherry-picking commits across branches, restoring a deleted Azure Repos branch, signed commits with GPG or SSH keys and verification, importing a Git repository into Azure Repos, and choosing between Git, Subversion, Bitbucket, GitHub Enterprise Server and other hosting for on-premises source

GitHub notification settings (participating and watching, email routing per organization), watching and unsubscribing from repositories and threads, automatically generated release notes grouped by labels with .github/release.yml, publishing packages and container images to GitHub Packages using the workflow GITHUB_TOKEN with packages: write, and workflow artifact retention days

Conditional steps and jobs with if expressions and status functions (success, failure, always, cancelled), service containers for databases in tests, re-running failed jobs without repeating successful ones, Actions Runner Controller for autoscaled self-hosted runners on Kubernetes, GitHub Actions Importer to audit, forecast and migrate Jenkins and other CI pipelines, and Azure Static Web Apps pull request preview environments

Mapping secret pipeline variables into script environments, masking runtime-generated secrets in logs (issecret and add-mask), secure files in Azure Pipelines, least-privilege GITHUB_TOKEN permissions, GitHub environment secrets with required reviewers, pipeline decorators that inject steps into every pipeline, extends templates enforced with the required template check, and the retirement of Continuous Assurance tooling in favor of Defender for Cloud

Detecting and managing flaky tests with rerun-failed-tests settings, test impact analysis that runs only tests affected by a code change, an Azure Load Testing task as a pipeline quality gate with failure criteria, and verbose diagnostics with System.Debug in Azure Pipelines and step debug logging in GitHub Actions

Deploying schema changes with a DACPAC and the SQL Azure DACPAC task versus exporting schema and data in a BACPAC, YAML deployment job lifecycle hooks (preDeploy, deploy, routeTraffic, postRouteTraffic, on failure and success), setting App Service application settings from a pipeline, configuring scheduled App Service backups, and opening Azure Database for MySQL firewall rules for pipeline agents

API Management tiers and gateway, products, subscriptions and keys, policies (rate limit, transform, validate-jwt, caching), versions and revisions, OAuth 2.0 protection, developer portal and self-hosted gateway

Event Grid topics, subscriptions and filters, Event Hubs partitions and consumer groups, Service Bus queues, topics and sessions, dead-lettering, Azure Queue Storage, delivery guarantees, and choosing between events and messages

Well-Architected Framework pillars, choosing compute and application architectures (microservices, event-driven, serverless), data integration choices, Azure Migrate, Database Migration Service, Data Box, Storage Mover, landing zones and the 6 Rs of migration

API Management Premium with VNet for private ingress, rate limiting and external OAuth authorization, exposing APIs to partners and importing OpenAPI definitions with PowerShell, Event Grid webhook delivery security and endpoint validation, Service Bus subscription filters (SQL, correlation, boolean) and asynchronous messaging, and Event Hubs capture with Functions

Sending events in batches with EventDataBatch, the event processor and blob checkpoint store for at-least-once processing across partitions, Event Hubs Capture to Blob or Data Lake in Avro, the Kafka-compatible endpoint on port 9093, Event Grid schemas (Event Grid, CloudEvents 1.0 and custom input schema) and subscription retry policy (maximum delivery attempts, event time-to-live) with dead-lettering

Deferring messages and retrieving them by sequence number, duplicate detection with MessageId and a history time window set at creation, scheduled messages with ScheduledEnqueueTimeUtc and cancellation, auto-forwarding from a queue or subscription to another entity, sessions for ordered processing, dead-lettering and the claim-check pattern that stores large payloads in Blob storage

Event Hubs geo-replication and geo-disaster recovery pairing, Service Bus geo-disaster recovery with an alias that replicates metadata only and requires manual failover, Azure Virtual Network Manager security admin rules that take precedence over NSG rules across subscriptions, and DDoS Network Protection versus DDoS IP Protection

AD DS domain controller deployment, sites, replication, forests, domains and trusts, FSMO roles, users, groups and OUs, service accounts (gMSA), Group Policy processing, Microsoft Entra Connect and Cloud Sync, password hash sync, pass-through authentication, federation, seamless SSO and Entra Domain Services

Windows Admin Center, PowerShell remoting, Azure Arc-enabled servers, Azure Automation and Update Manager, Azure Monitor agent, Defender for Servers, Azure Policy guest configuration, Azure Hybrid Benefit and Windows Server VMs on Azure

Hyper-V host and guest configuration, generation 1 versus 2 VMs, virtual switches, checkpoints, live migration, Hyper-V Replica, nested virtualization, Windows containers, Docker on Windows Server, container networking and storage

Windows Server DNS zones and records, forwarders and conditional forwarders, DNS policies, DHCP scopes, failover, and relays, IPAM, Azure DNS Private Resolver, Azure Extended Network, hybrid name resolution and connectivity (VPN, ExpressRoute, Azure Network Adapter)

Storage Spaces and Storage Spaces Direct, ReFS and NTFS, deduplication, iSCSI, SMB shares and permissions, DFS namespaces and replication, FSRM, Storage Replica, Storage Migration Service and Azure File Sync and Azure Files for hybrid files

Active Directory group scopes (domain local, global, universal) and nesting rules within and across forest trusts, group strategy (AGDLP), delegation of control and built-in administrative groups, delegation groups in Microsoft Entra Domain Services (GPO and DNS administration), read-only domain controllers and the filtered attribute set, application directory partitions with ntdsutil, Backup Operators scope and permissions for site link changes

Group managed service accounts (KDS root key, creation, installation and credential specs for Windows containers), Storage Spaces Direct cluster quorum and witness, RDMA and Data Center Bridging validation on Switch Embedded Teaming, Hyper-V checkpoint types and nested virtualization, AKS on Azure Stack HCI, File Server Resource Manager file screens, DNSSEC trust anchors, Azure Network Adapter, Azure Automation Hybrid Runbook Worker and Serial Console prerequisites

Microsoft Entra Domain Services (formerly Azure AD Domain Services) as a managed domain: no domain controller or Domain Admin access, one-way sync from Microsoft Entra ID, password hash synchronization so cloud-only users must reset passwords to create NTLM and Kerberos hashes, the AAD DC Administrators group, custom OUs with delegated control, fine-grained password policies, built-in Group Policy objects (AADDC Users and AADDC Computers), secure LDAP, replica sets and joining Azure VMs to the managed domain

Schema and forest preparation with adprep or the promotion wizard, offline domain join with djoin, Directory Services Restore Mode with non-authoritative and authoritative restore using ntdsutil, cloning virtualized domain controllers (Cloneable Domain Controllers group, VM-GenerationID, DCCloneConfig.xml), migrating SYSVOL replication from FRS to DFSR with dfsrmig, re-registering DC locator records with nltest /dsregdc and Netlogon, placing the AD DS database, logs and SYSVOL on an Azure data disk with host caching set to None, and universal group membership caching at sites without a global catalog

Built-in administrative groups and scope (Enterprise Admins, Schema Admins, Domain Admins, Backup Operators, Account Operators), group scope nesting rules and AGDLP, the Protected Users group protections, account lockout troubleshooting with event 4740 on the PDC emulator, redirecting the default computer container with redircmp, Windows LAPS schema extension and permissions, alternative UPN suffixes for hybrid sign-in, and the Group Policy ADMX central store in SYSVOL

Server Core configuration with sconfig, the PowerShell remoting second-hop problem and its solutions (resource-based Kerberos constrained delegation, avoiding CredSSP), Just Enough Administration endpoints with session configuration and role capability files, PowerShell Direct from a Hyper-V host to a guest without networking, and the Azure Serial Console for Windows VMs (boot diagnostics, SAC and required roles)

DNSSEC zone signing and trust anchors on validating resolvers and clients (NRPT), DNS aging and scavenging with no-refresh and refresh intervals, DNS policies with zone scopes for split-brain, geo-location and time-of-day responses, Network Policy Server as a RADIUS server for VPN with network and connection request policies, and Always On VPN device and user tunnels deployed with ProfileXML

File Server Resource Manager active and passive file screens with file groups, auto apply quotas that cascade a template to existing and new subfolders, Shadow Copies of Shared Folders and previous versions, SMB over QUIC for access to file shares over the internet without a VPN, and Azure Files identity-based authentication with AD DS or Microsoft Entra (share-level Azure RBAC plus NTFS permissions)

Initializing disks as MBR or GPT (2 TB and four primary partition limits versus large disks and UEFI), the iSCSI Target Server role service with iSCSI virtual disks, targets and initiator access, Multipath I/O for iSCSI with multiple sessions and load balance policies, and choosing between NTFS, ReFS and exFAT

AI workload types (machine learning, computer vision, NLP, generative AI, document intelligence), core machine learning concepts (regression, classification, clustering, training and inference), Azure AI services overview and the six responsible AI principles

Selecting Azure AI and Foundry services, creating resources and projects, model deployments and quotas, authentication with keys and Entra ID, network security, monitoring, cost control, content safety, and implementing AI responsibly

Azure OpenAI models and deployments, tokens and parameters, prompt engineering, prompt flow, retrieval-augmented generation, grounding with your data, fine-tuning, evaluation, content filters, provisioned throughput, and operationalizing generative AI

Agent concepts and use cases, Foundry Agent Service, tools and knowledge, Microsoft Agent Framework, multi-agent orchestration patterns, multiple users and autonomous capabilities, testing, optimizing and deploying agents

Azure AI Vision image analysis and OCR, custom vision models, video analysis, Azure AI Language (sentiment, entities, summarization, question answering, CLU), Translator, Speech to text and text to speech, and custom language models

Azure AI Search indexes, indexers, skillsets and enrichment, semantic ranking and vector search, hybrid queries, Azure Document Intelligence prebuilt and custom models, and Content Understanding for multimodal extraction

Azure Machine Learning workspaces, compute targets, data assets and environments, automated ML, notebooks and jobs, hyperparameter sweeps, pipelines, MLflow tracking, model registry and managed online and batch endpoints

How AI models are built and configured: model families (language, multimodal, embedding, image, speech), large versus small language models, tokens and context windows, system and user prompts, inference parameters (temperature, top p, max tokens), embeddings, training data and inference, model catalog selection criteria and deployment options

Using the Foundry portal and playgrounds, deploying a model, calling it with the Foundry SDK and the chat completions or responses API, system prompts, grounding with your data, built-in tools such as file search and code interpreter, creating and testing a basic agent, evaluating output and applying content filters

Foundry Tools for language and speech: text analysis (sentiment, key phrases, entities, PII), summarization, translation, question answering, speech to text, text to speech with SSML, speech translation, real-time voice interaction, and calling these services from code with endpoints and credentials

Image analysis (captions, tags, object detection, people, OCR), multimodal models that reason over images, image generation and editing models with prompts, size and quality settings, video analysis, content safety for images, and responsible use of generated media

Extracting structured data from documents, images, audio and video with Azure Content Understanding and Document Intelligence: analyzers and field schemas, prebuilt versus custom extraction, confidence scores, multimodal inputs, and feeding extracted fields into downstream apps and search

Azure Machine Learning managed online endpoints versus Kubernetes endpoints, the scoring script init and run contract, loading the model in init, handling input skew, readiness and liveness probe timeout tuning, and responsible AI error analysis

Azure Bot Service and Bot Framework conversation state persistence, channel configuration, and running Azure AI containers disconnected from the cloud with commitment tiers, including Content Safety containers

Submitting Azure Machine Learning v2 command jobs to a compute cluster with the SDK v2 or CLI v2 (SDK v1 and CLI v1 are legacy), job input modes (ro_mount, download, direct), outputs bound to datastores, the special outputs and logs folders, the code snapshot and .amlignore, the job timeout limit, interactive job services (SSH, JupyterLab, VS Code, TensorBoard) for debugging, user identity pass-through, and checkpointing to survive Spot node eviction

Azure Machine Learning workspace isolation with a managed virtual network (allow internet outbound versus allow only approved outbound, private endpoint, service tag and FQDN outbound rules), customer-managed keys for the workspace, compute clusters without public IP, AcrPull on a private Azure Container Registry for environments, OneLake datastores, compute instance file persistence, and VM family quota and workspace quota allocation

Securing and operating Azure Machine Learning endpoints: key, aml_token and Microsoft Entra token authentication and key regeneration, public_network_access and managed network isolation, endpoint identity with data-plane roles, max_concurrent_requests_per_instance and request timeouts, extra quota headroom for rolling updates, the online data collector, and batch endpoints with error_threshold, retry settings and pipeline component deployments

Registering an MLflow model from a job output path (azureml://jobs/.../outputs/artifacts/paths/model), logging models with a signature so they deploy without a scoring script (no-code deployment), custom mlflow.pyfunc wrappers (PythonModel, load_context, predict), pipeline schedules with cron expressions and recurrence triggers, and the parallel job type with mini_batch_size and max_concurrency_per_instance

Loading datastore data in notebooks with mltable and identity-based access, attaching serverless Spark compute in Azure Machine Learning notebooks with user identity or managed identity and abfss paths, and validating AutoML forecasting with time-ordered rolling-origin cross-validation instead of random splits

Building LLM apps with prompt flow: connections (Azure OpenAI, custom connections with secret fields) managed as Microsoft Foundry project connections so keys stay out of flow files, node types (LLM, Prompt, Python, tools such as vector index lookup), the DAG of node inputs and outputs, and evaluation flows whose aggregation nodes compute metrics over all line-level results with log_metric

Shortlisting models with Foundry model catalog benchmarks (quality, cost, latency, throughput), migrating before a model version retires (version upgrade policy), diagnosing fine-tuning overfitting with training versus validation loss, the automatic deletion of idle fine-tuned deployments after 15 days of inactivity, reducing text-embedding-3 vector size with the dimensions parameter, security trimming at retrieval time in RAG, and the Azure OpenAI Global Batch deployment type

Azure AI Face detection, verification, identification and similarity, the Limited Access policy that gates identification, verification and liveness behind an approved intake, retired facial-attribute inference, detection and recognition model versions (recognition_01 to recognition_04) that must match between enrolled and queried faces, and face liveness detection sessions where the backend creates a session, the client SDK captures, and the backend reads the result to block print and replay spoofing

Custom keyword models created in Speech Studio and used with the KeywordRecognizer for wake words, pronunciation assessment (reference text, Phoneme/Word/FullText granularity, accuracy, fluency, completeness and prosody scores, miscue detection), language identification with AutoDetectSourceLanguageConfig at start or continuous, text language detection, and the GPT realtime audio API over WebSocket or WebRTC for low-latency speech-in speech-out conversations with server voice activity detection

Azure AI Search security trimming with a filterable group-ID field and a search.in filter, shared private links so indexers reach storage or databases over private endpoints, faceted navigation and OData filters (filterable and facetable attributes), suggesters for the Suggest and Autocomplete APIs, and replicas and partitions for query throughput, high availability and the 99.9 percent read SLA with two replicas and read-write SLA with three

Custom Translator (training a neural machine translation model on parallel documents and calling it with the category ID), custom text classification single-label versus multi-label, custom question answering with metadata filters, Text Analytics for health (medical entities, relations, assertion detection, UMLS linking), and Document Translation reading and writing blob containers with the managed identity of the Translator resource instead of SAS tokens

OpenTelemetry tracing of Foundry agents and their run steps in Application Insights, agent evaluators (intent resolution, tool call accuracy, task adherence) alongside groundedness and relevance, token usage tracking with the usage object and the APIM llm-emit-token-metric and llm-token-limit policies, semantic caching with the APIM semantic cache lookup and store policies backed by Azure Managed Redis and an embeddings deployment, the model router deployment that selects an underlying model per prompt, and Azure OpenAI abuse monitoring retention and the approved modification process

Rotating the two keys of an Azure AI services resource and preferring Microsoft Entra ID with managed identity and disableLocalAuth, long-running operations that return 202 with an Operation-Location header polled until succeeded, Image Analysis calls by publicly reachable URL or binary body (SAS URL for private blobs), and disconnected containers that use a commitment-tier license (download license, mount license and output directories) including approved Content Safety containers

Bot Framework conversation, user and private conversation state with storage providers (MemoryStorage only for testing, Cosmos DB or Blob storage for production) and saving state at the end of each turn, Azure Bot resource channel configuration (Teams, Web Chat, Direct Line, Slack, Telegram), messaging endpoint and app identity type, exchanging a Direct Line secret for a short-lived token on the server so the browser Web Chat widget never holds the secret, and the move from the Bot Framework SDK to the Microsoft 365 Agents SDK