Easy Microsoft Azure Interview Questions

Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.

A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.

A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.

ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.

A region is a set of datacenters in one geography, such as Central India in Pune. Availability zones are physically separate datacenter groups inside a region with independent power, cooling and network; supported regions have three. Many regions are paired with another region in the same geography for platform updates and geo-replication. Use zones for datacenter failure and a second region for regional disasters.

Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.

Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.

Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.

Tags are name-value pairs such as env=prod, owner=payments, costcenter=CC101 applied to resources, groups and subscriptions. They help filter cost reports, automate shutdown scripts and track ownership. Tags are not inherited by default, so teams use Azure Policy with modify or append effects to inherit tags from the resource group or require them at creation. A resource can carry up to 50 tags.

CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.

Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.

Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.

Virtual Machines give full OS control for legacy or custom software. Virtual Machine Scale Sets add autoscaling of identical VMs. App Service hosts web apps and APIs as PaaS. Azure Functions runs event-driven code serverlessly. AKS runs Kubernetes for container microservices, and Container Apps runs containers without managing Kubernetes. Batch handles large parallel jobs. Choose based on control needed, scaling pattern and team skills.

Series are optimised for workload type: B for burstable low-cost, D for general purpose, E for memory heavy like SQL Server, F for compute intensive, L for storage throughput, N for GPU and M for very large memory such as SAP HANA. Start from CPU, memory, disk IOPS and network needs, test with real load, then right-size using Azure Advisor recommendations after a few weeks of metrics.

Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.

App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.

A trigger is what starts a function, and each function has exactly one: HTTP, Timer, Blob, Queue, Service Bus, Event Grid, Event Hubs or Cosmos DB change feed. Bindings declaratively connect inputs and outputs, for example reading a blob and writing to a queue without writing SDK code. They reduce boilerplate, but for complex error handling or batching you may still use the SDK directly.

Azure Bastion is a managed PaaS service that gives RDP and SSH access to VMs through the browser or native client over TLS, without giving the VMs public IPs. It is deployed into a dedicated subnet named AzureBastionSubnet in the VNet. This removes exposed ports 3389 and 22 from the internet, a common attack path. Pair it with just-in-time access from Defender for Cloud for tighter control.

A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.

LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.

Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.

Situation: a release deadline pushed us to skip enabling backups and soft delete on a new storage account. Task: deliver on time without risking customer files. Action: I explained to the lead that enabling soft delete, versioning and a backup policy took under an hour through our Bicep module, and added it to the same pull request. Result: we shipped on time, and a month later versioning saved a file a user overwrote.

A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.

Situation: our analytics team kept every raw file in the Hot tier with GRS, costing about 3 lakh rupees a month. Task: reduce cost without breaking reports. Action: I analysed access logs, moved files older than 60 days to Cool and older than a year to Archive with lifecycle rules, and switched scratch containers to LRS. Result: storage cost fell by around 45% with no complaints from users.

Situation: finance asked why we needed GZRS instead of cheaper LRS. Task: justify the cost clearly. Action: I compared the options in business terms: LRS survives a disk failure, GZRS survives losing a whole region, and I showed the cost of downtime per hour for our app versus the extra monthly charge. Result: they approved GZRS only for critical data and LRS for the rest.

A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.

An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.

Create a public DNS zone in Azure DNS for the domain, note the four Azure name servers it shows, and update the NS records at your domain registrar to those servers. Add records such as an A alias record pointing to the Front Door or public IP and CNAME for www. Verify with nslookup. Apply a lock on the zone so records cannot be deleted accidentally.

Situation: security rejected my design because the app used public endpoints for storage and SQL. Task: meet their standards without delaying launch. Action: I met them, listed their controls, and redesigned with private endpoints, Azure Firewall egress and WAF, then shared a diagram and cost impact. Result: they approved it in one review cycle, and the design became a reusable team template.

Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.

Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.

A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.

Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.

RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.

Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.

Relational options are Azure SQL Database, Azure SQL Managed Instance, SQL Server on VMs, and Azure Database for PostgreSQL and MySQL flexible servers. Azure Cosmos DB is the globally distributed NoSQL and vector database. Azure Cache for Redis and Azure Managed Redis provide in-memory caching. For analytics there are Synapse, Fabric and Azure Data Explorer. Choose by data model, compatibility and how much operations you want to manage.

Azure SQL Database is a fully managed single database or elastic pool, best for new cloud apps. SQL Managed Instance offers near 100% SQL Server compatibility including SQL Agent, cross-database queries and CLR, in a VNet, ideal for lift-and-shift. SQL Server on a VM gives full OS and instance control for unsupported features but you handle patching, HA and backups yourself, although the SQL IaaS extension helps.

Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.

Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.

Move them to serverless General Purpose with auto-pause, or into an elastic pool if they are always on but lightly used. Use Azure Hybrid Benefit if you own SQL licences, use the Azure Dev/Test pricing offer for non-production subscriptions, delete databases nobody has connected to in months, and use smaller backup retention and LRS backup storage for non-production.

Situation: a developer wanted to store all order data as JSON blobs in one table. Task: agree on a design that would scale. Action: I listened to his reason, faster development, then built a small benchmark showing filter and reporting queries on both designs and proposed relational tables with a JSON column for flexible attributes. Result: we adopted the hybrid, and reporting stayed fast.

Infrastructure as Code defines resources in versioned files, such as Bicep, ARM JSON or Terraform, instead of clicking in the portal. It makes environments repeatable, reviewable through pull requests and quick to rebuild after failure. Drift between dev, test and prod drops because all are deployed from the same templates with different parameters. It also documents the setup and enables automated policy checks before deployment.

Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.

Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.

Situation: our team created test environments by hand, taking two days each. Task: make it self-service. Action: I wrote Bicep modules for the app, database and networking and a pipeline with parameters for environment name, plus an auto-delete tag cleaned up nightly by an Automation runbook. Result: environments took 20 minutes, and idle test cost dropped by about 30%.

Azure Monitor is the unified monitoring platform for Azure and hybrid resources. It collects metrics, which are numeric time series stored for 93 days, and logs, which are records stored in Log Analytics workspaces and queried with KQL. Sources include platform metrics, activity logs, resource logs through diagnostic settings, VM guest data through the Azure Monitor Agent and app telemetry from Application Insights.

A Log Analytics workspace is the store for log data in Azure Monitor, organised into tables like AzureActivity, Heartbeat and AppRequests. You query it with KQL, set retention per table up to 12 years with long-term retention, and control access with workspace or resource-context RBAC. Most organisations use a central workspace per region or environment to simplify querying and Sentinel, with table plans to manage cost.

Application Insights is the APM feature of Azure Monitor. It collects requests, dependencies, exceptions, traces and custom events from apps through OpenTelemetry-based SDKs or auto-instrumentation in App Service, Functions and AKS. Features include the application map, live metrics, failure and performance analysis, availability tests and distributed tracing. Workspace-based resources store data in Log Analytics so you can join it with infrastructure logs.

Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.

Cost Management analyses and controls Azure spending. Cost analysis shows cost by service, resource group, tag or meter with forecasts. Budgets send alerts at thresholds such as 80% and 100% of actual or forecast spend and can trigger automation. Exports send daily cost data to Storage for reporting in Power BI. It also shows reservation utilisation and supports FinOps practices like showback and chargeback to teams.

Service Health shows the health of Azure services in your regions: service issues happening now, planned maintenance, health advisories and security advisories, plus retirement notices. Resource Health shows if a specific resource, such as a VM, is available and why not. Set activity log alerts on Service Health so the team gets notified for incidents affecting their subscriptions and regions, instead of finding out from users.

In Cost Management, choose Budgets, set the scope to the subscription or a resource group, a monthly amount and alert conditions such as 50%, 80% and 100% of actual cost and 100% of forecast. Add email recipients and an action group that can notify Teams or run an automation. Budgets do not stop spending on their own, so pair them with automation or policy if needed.

Situation: during a release night, CPU, disk and payment error alerts fired together. Task: decide what to handle first. Action: I ranked by customer impact, so payment failures came first, checked Service Health for a platform issue, assigned disk and CPU checks to a teammate and kept a running update in the incident channel. Result: payments recovered quickly and we tuned the noisy CPU alerts afterwards.