Microsoft Azure Solutions Architect & DevOps Expert (AZ-900, AZ-305, AZ-400)

You can explain core cloud pricing, shared responsibility, and provision fundamental compute, storage, and networking resources in the Azure Portal.

1. Introduction to Cloud Computing: IaaS, PaaS, SaaS, and Shared Responsibility Model90 min
   • IaaS vs PaaS vs SaaS architectural trade-offs
   • Shared responsibility model across SaaS, PaaS, and IaaS
   • Public, private, and hybrid cloud deployment models
2. Azure Architectural Components: Regions, Availability Zones, Resource Groups, and Azure Resource Manager (ARM)90 min
   • Azure paired regions and cross-region replication
   • Availability Zones and fault domain isolation
   • Azure Resource Manager (ARM) provider registration and resource groups
3. Core Compute Services: Azure Virtual Machines, Virtual Machine Scale Sets (VMSS), Azure App Services, and Azure Container Instances (ACI)2 hrs
   • Virtual machine sizing and ephemeral OS disks
   • App Service plans and deployment slots
   • Container instance creation with Azure CLI az container create
4. Core Networking Services: Virtual Networks (VNet), Subnets, VPN Gateway, ExpressRoute, and Azure DNS2 hrs
   • CIDR block allocation and private subnet segmentation
   • Azure DNS private zones and record sets
   • Site-to-site VPN gateway configurations
5. Core Storage Services: Blob Storage, Azure Files, Queue Storage, Disk Storage, and Storage Tiering (Hot, Cool, Archive)2 hrs
   • Blob storage access tiers and lifecycle management
   • Azure Files SMB share mounting on Linux VMs
   • Managed disk types: Standard SSD, Premium SSD, and Ultra Disk

Hands-on project: Provision an isolated resource group containing a Standard_B1s Linux Virtual Machine, a managed disk, and a Standard tier Blob Storage account configured with public access disabled.

You can configure Microsoft Entra ID tenants, enforce role-based access control, apply Azure policies, and forecast monthly cloud expenditure.

1. Azure Security & Identity: Microsoft Entra ID (formerly Azure AD), Multi-Factor Authentication (MFA), and Role-Based Access Control (RBAC)90 min
   • Microsoft Entra ID user and group provisioning
   • Conditional Access policies and MFA enforcement
   • Built-in vs custom RBAC role definitions
2. Network Security: Network Security Groups (NSG), Azure Firewall, and Azure DDoS Protection90 min
   • NSG inbound and outbound security rules
   • Azure Firewall rule collections and DNAT configuration
   • Distributed Denial of Service (DDoS) network protection tiers
3. Governance & Compliance: Azure Policy, Azure Blueprints, Resource Locks, and Service Trust Portal2 hrs
   • Azure Policy initiative creation and JSON definition
   • CanNotDelete and ReadOnly resource locks
   • Compliance score evaluation in Microsoft Defender for Cloud
4. Azure Management & Monitoring Tools: Azure Portal, Azure CLI, PowerShell, Azure Advisor, and Azure Service Health2 hrs
   • Azure CLI syntax and az group deployment commands
   • Azure PowerShell Az module cmdlets
   • Azure Advisor cost and security recommendations
5. Pricing and Lifecycle: TCO Calculator, Pricing Calculator, Cost Management + Billing, and Service Level Agreements (SLAs)2 hrs
   • Azure Pricing Calculator cost estimation for multi-tier apps
   • Reserved Instances and Azure Savings Plans
   • Composite SLAs calculation across multi-service architectures

Hands-on project: Configure a custom Azure Policy that restricts virtual machine creation to approved SKUs and audit non-compliant resources across a subscription.

You can architect enterprise identity federation, multi-subscription governance hierarchies, and secure network perimeters using Azure Front Door and Private Link.

1. Designing Identity Solutions: Single Sign-On (SSO), Hybrid Identity with Microsoft Entra Connect, and External Identities (B2B/B2C)2 hrs
   • Pass-through authentication vs password hash sync
   • Microsoft Entra Connect Health monitoring
   • External identities and B2B guest user invitation flows
2. Designing Governance Solutions: Management Group Hierarchies, Subscription Strategies, and Resource Tagging Strategies2 hrs
   • Management group tree architecture design
   • Enterprise scale landing zone subscription models
   • Cost allocation tag inheritance via Azure Policy
3. Designing Security for Applications & Data: Key Vault design, Managed Identities, and Azure SQL Database Always Encrypted2 hrs
   • Azure Key Vault access policies and RBAC permissions
   • System-assigned vs user-assigned managed identities
   • Transparent Data Encryption (TDE) with customer-managed keys
4. Designing Network Security Architectures: Azure Front Door, Application Gateway, Web Application Firewall (WAF), and Private Link / Service Endpoints2 hrs
   • Azure Front Door Standard vs Premium tier routing
   • Application Gateway WAF custom rule configuration
   • Private endpoint DNS integration with private zones

Hands-on project: Design and implement a Hub-Spoke network topology with Azure Firewall in the hub and private endpoints for Azure SQL databases in spoke VNets.

You can select optimal NoSQL and relational data tiers, configure multi-region disaster recovery, and integrate enterprise data pipelines.

1. Designing Non-Relational Data Storage: Azure Cosmos DB API selection, partitioning, and Azure Blob Storage lifecycle policies2 hrs
   • Cosmos DB consistency levels and partition key selection
   • Blob storage immutability policies and legal holds
   • Storage account geo-redundancy (GRS vs RA-GZRS)
2. Designing Relational Data Storage: Azure SQL Database elastic pools, hyperscale, and Azure Database for PostgreSQL2 hrs
   • SQL Database elastic pool sizing and DTU allocation
   • PostgreSQL Flexible Server high availability architecture
   • Read replica configuration and connection routing
3. Designing High Availability & Disaster Recovery (DR): Azure Backup, Azure Site Recovery (ASR) replication strategies, and multi-region failover design2 hrs
   • Azure Backup vault configuration and recovery services
   • ASR replication policies for virtual machine migration
   • Recovery Point Objective (RPO) and Recovery Time Objective (RTO) targets
4. Designing Data Integration Solutions: Azure Data Factory pipelines, Azure Synapse Analytics, and Azure Databricks integration2 hrs
   • Data Factory integration runtime provisioning
   • Synapse Analytics serverless SQL pool queries
   • Databricks cluster setup and notebook execution

Hands-on project: Deploy an Azure Cosmos DB multi-region write account with automatic failover configured, paired with an Azure SQL Hyperscale database backed by geo-replication.

You can choose compute and messaging services for distributed microservices and formulate comprehensive enterprise cloud migration strategies.

1. Designing Compute Solutions: Choosing between VMs, App Services, Functions, Container Apps, and Azure Kubernetes Service (AKS)2 hrs
   • Compute decision matrix based on statelessness and scale
   • Azure Container Apps microservices revision management
   • AKS node pool configuration and taint-tolerations
2. Designing Message & Event Architectures: Azure Event Grid, Event Hubs, Service Bus Queues, and Topics2 hrs
   • Service Bus sessions, dead-lettering, and duplicate detection
   • Event Grid custom topic publishers and webhook subscribers
   • Event Hubs throughput units and partition streaming
3. Designing Enterprise Networking: Hub-Spoke VNet peering topology, Virtual WAN, and global routing strategies2 hrs
   • VNet peering transit routing and user-defined routes (UDR)
   • Azure Virtual WAN hub configuration
   • ExpressRoute global reach and circuit redundancy
4. Designing Migration Strategies: Azure Migrate assessment, discovery, server migration, and database migration strategies2 hrs
   • Azure Migrate appliance deployment and dependency analysis
   • Agentless vs agent-based VMware migration
   • Database Migration Service (DMS) offline and online migrations

Hands-on project: Design an event-driven ingestion pipeline using Azure Event Hubs, Azure Functions, and Cosmos DB, documenting the architecture in an ADR format.

You can establish robust Git branching models, enforce pull request quality gates, and integrate static code analysis tools in Azure Repos.

1. Source Control Management: Git internals, local and remote repositories, and staging workflows90 min
   • Git object database and reflog mechanics
   • Interactive rebasing and cherry-picking commits
   • Submodules and multi-repository management
2. Branching Strategies: GitFlow, GitHub Flow, Release branching, and Trunk-Based Development90 min
   • Trunk-based development feature flagging practices
   • GitFlow release tagging and hotfix branching
   • Semantic versioning enforcement
3. Collaborative Workflows: Pull Requests, code reviews, branch policies, and branch security in Azure Repos2 hrs
   • Branch policies for minimum reviewer counts
   • Automatic work item linking on pull requests
   • Bypassing policies for administrative hotfixes
4. Managing Technical Debt: Integrating SonarQube, WhiteSource Bolt, and static code analysis in the development workflow2 hrs
   • SonarQube quality gate thresholds setup
   • Open-source vulnerability scanning in repositories
   • Secret detection hooks pre-commit configuration

Hands-on project: Set up an Azure Repos repository with branch policies requiring mandatory pull request reviewers, successful build validation, and SonarQube static analysis gates.

You can author multi-stage YAML build pipelines, configure self-hosted agents, and manage enterprise artifact feeds.

1. Introduction to Azure Pipelines: Classic Editor vs YAML pipelines multi-stage architecture90 min
   • YAML pipeline syntax structure and schema validation
   • Multi-stage pipeline triggers and job dependencies
   • Template reuse across multiple repositories
2. Build Agents: Hosted vs Self-Hosted Linux/Windows Build Agents configuration90 min
   • Microsoft-hosted agent pool limitations and capabilities
   • Installing self-hosted Linux agents as systemd services
   • Agent pool tagging and targeted job execution
3. Pipeline Customization: Variables, variable groups, secret management with Azure Key Vault, and task libraries2 hrs
   • Variable groups linked to Azure Key Vault secrets
   • Runtime parameters vs build-time variables
   • Task marketplace extensions installation
4. Continuous Integration Execution: Building .NET, Java, and Node.js applications, running unit tests, and code coverage reporting2 hrs
   • Maven and Gradle build tasks in Azure Pipelines
   • Publishing JUnit test result XML files
   • Code coverage visualization integration
5. Artifact Management: Creating and managing feeds in Azure Artifacts, publishing NuGet, npm, and Maven packages2 hrs
   • Azure Artifacts feed scoping and permissions
   • Upstream sources configuration for public registries
   • Publishing and consuming packages in pipeline tasks

Hands-on project: Create a multi-stage YAML pipeline that compiles a Spring Boot application, executes unit tests with JaCoCo coverage reports, and publishes artifacts to Azure Artifacts.

You can execute blue-green and canary deployments, containerize applications, and deploy workloads to Azure Kubernetes Service.

1. Designing Release Pipelines: Multi-stage deployment workflows, deployment gates, and manual approvals2 hrs
   • Environment environments and approval gates
   • Pre-deployment and post-deployment gate evaluations
   • Deployment rollback mechanisms on failure
2. Deployment Strategies: Blue-Green deployments, Canary deployments, Rolling updates, and Feature Flags2 hrs
   • Blue-Green deployment switching via Azure App Service slots
   • Canary routing with Application Gateway traffic weights
   • Feature flag integration in application code
3. Containerization & Orchestration: Dockerizing applications, pushing to Azure Container Registry (ACR), and deploying to AKS2 hrs
   • Multi-stage Dockerfile creation for production optimization
   • ACR task authentication and vulnerability scanning
   • Kubernetes manifest deployment using kubectl apply task
4. Integrating Testing in Pipelines: Automated UI testing, load testing, and integration testing execution2 hrs
   • Selenium and Playwright test execution in build agents
   • Load testing integration with Apache JMeter tasks
   • API integration testing using Newman and Postman CLI

Hands-on project: Build an automated CD pipeline that containerizes a Node.js API with Docker, pushes the image to Azure Container Registry (ACR), and performs a rolling update deployment on an AKS cluster.

You can manage immutable infrastructure states using Terraform remote backends, Bicep templates, and Ansible configuration playbooks.

1. Infrastructure as Code Fundamentals: Declarative vs Imperative infrastructure, and idempotency2 hrs
   • Declarative state definition vs imperative CLI scripts
   • Idempotency principles in infrastructure automation
   • State drift detection and remediation workflows
2. Authoring Templates: Creating and deploying Azure Resource Manager (ARM) templates and Bicep files2 hrs
   • Bicep modules, parameters, and decorators
   • Decompiling ARM templates to Bicep files
   • What-if deployment validation command
3. Terraform Enterprise Workflow: State file management, remote backends in Azure Blob Storage, locking, modules, and workspaces2 hrs
   • Terraform remote backend configuration with SAS tokens
   • State locking via Blob lease mechanism
   • Creating reusable Terraform modules with input variables
4. Automating IaC with Pipelines: Building CI/CD pipelines to validate, plan, and apply Terraform configurations2 hrs
   • Terraform plan file artifact passing between pipeline stages
   • Automated approval gates for terraform apply execution
   • Environment isolation using Terraform workspaces
5. Configuration Management: Using Ansible and Azure Automation Desired State Configuration (DSC) for VM provisioning2 hrs
   • Ansible playbooks for Linux package installation and hardening
   • Azure VM extension execution via Ansible azure_rm modules
   • Desired State Configuration (DSC) push mode deployment

Hands-on project: Write modular Terraform configurations with remote state in Azure Blob Storage to provision a complete Azure Virtual Network, database, and AKS cluster, automated entirely via Azure Pipelines.

You can implement DevSecOps pipeline scans, configure centralized logging with KQL, and establish SRE observability practices.

1. Implementing DevSecOps: Vulnerability scanning in pipelines, container image scanning (Trivy/Prisma), and credential scanning2 hrs
   • Trivy CLI integration for container vulnerability checks
   • Gitleaks secret scanning in CI pipelines
   • Software Bill of Materials (SBOM) generation
2. Continuous Feedback Loop: Integrating Azure App Insights, tracking user telemetry, page views, and exceptions2 hrs
   • Application Insights SDK instrumentation in Node.js and Java
   • Custom telemetry tracking and dependency mapping
   • User session tracking and performance diagnostics
3. Production Monitoring: Configuring Azure Monitor alerts, Log Analytics workspaces, and Kusto Query Language (KQL) queries2 hrs
   • KQL queries for log aggregation and error frequency filtering
   • Log Analytics workspace data retention and ingestion settings
   • Metric and log-based alert rule configuration
4. Site Reliability Engineering (SRE): Defining Service Level Indicators (SLIs), Service Level Objectives (SLOs), and post-mortem workflows2 hrs
   • SLI metric selection for availability and latency
   • SLO error budget calculation and burn-rate alerts
   • Blameless post-mortem template and incident review process

Hands-on project: Configure Trivy container scanning in a build pipeline and set up Azure Monitor alerts triggered by Kusto queries monitoring application exception rates.

You can run a production AKS cluster and deploy to it from a pipeline without manual steps.

1. Provisioning AKS properly90 min
   • Node pools and system pool
   • Azure CNI vs kubenet
   • Managed identity
2. Deploying and releasing90 min
   • Helm charts and values
   • Rolling update strategy
   • Readiness probes
3. Scaling and reliability90 min
   • Cluster autoscaler
   • HPA on metrics
   • Pod disruption budgets
4. Securing the cluster90 min
   • Azure AD workload identity
   • Key Vault CSI driver
   • Network policy

Hands-on project: Provision an AKS cluster with Bicep using a managed identity and Azure CNI, deploy an application with Helm through an Azure DevOps pipeline, enable the cluster autoscaler, and prove a zero-downtime rolling update.

You can cut a cloud bill with evidence and show the architecture against Azure's own review framework.

1. Reading and attributing a cloud bill90 min
   • Cost Management exports
   • Tagging for showback
   • Finding orphaned resources
2. Reducing spend without breaking things90 min
   • Reservations and savings plans
   • Right-sizing from metrics
   • Autoscale and shutdown schedules
3. Governance and guardrails90 min
   • Azure Policy and initiatives
   • Management group hierarchy
   • Budgets and action groups
4. Well-Architected review90 min
   • The five pillars
   • Scoring a workload
   • Prioritising remediation

Hands-on project: Analyse a supplied Cost Management export to find the three largest avoidable line items, implement budgets with alerts and a tagging policy enforced by Azure Policy, and produce a Well-Architected review of one workload with a ranked remediation list.

You can design, build, test, secure, and deploy a production-grade multi-tier enterprise architecture on Azure, managed entirely through Terraform and automated CI/CD pipelines.

1. Architecture Blueprinting & Enterprise Requirements Review4 hrs
   • Translating enterprise stakeholder requirements into an Azure Well-Architected Framework design
   • Documenting network topology, security perimeters, and data residency constraints
   • Establishing CI/CD pipeline trunk-based workflow contracts across team pods
2. Infrastructure Provisioning via Terraform Modules5 hrs
   • Writing reusable Terraform modules for networking, compute, and data stores
   • Configuring remote backends and validating state locking across environments
   • Running terraform plan and apply inside automated pipeline stages
3. Container Orchestration & Microservice Deployment on AKS5 hrs
   • Deploying containerized microservices with Kubernetes manifests and Helm charts
   • Configuring ingress controllers, TLS certificates, and internal service mesh routing
   • Implementing rolling updates and zero-downtime deployment strategies
4. Pipeline Automation & Security Hardening5 hrs
   • Integrating security gates, Trivy container scans, and SonarQube quality checks into pipelines
   • Configuring Azure Key Vault secret injection for database connection strings and API keys
   • Setting up automated rollback triggers on health check failures
5. Production Observability, Alerting & Capstone Defense5 hrs
   • Configuring Azure Monitor dashboards and Log Analytics KQL alert rules
   • Simulating traffic spikes and node failures to verify high-availability failover
   • Conducting a formal architecture defense and post-mortem review

Hands-on project: Deliver a fully operational enterprise architecture on Azure featuring a Hub-Spoke VNet, secured AKS cluster, Cosmos DB, Application Gateway WAF, and automated GitHub Actions / Azure DevOps pipelines with comprehensive monitoring.