Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About EY hiring for Microsoft Azure roles
EY is one of the Big Four professional services networks, offering assurance, tax, strategy and transactions, and consulting services. In India, EY GDS and EY member firms support global clients with technology consulting, data analytics, cybersecurity and risk work. It hires for analyst and consultant roles in data analytics, BI, testing, ERP and risk.
For Microsoft Azure roles, this EY practice set focuses most on Azure Fundamentals (7), Azure Databases (5), DevOps and Infrastructure as Code (5), Identity and Security (4). It has 5 easy, 22 medium, 3 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
London, United Kingdom
Main India offices
Bengaluru, Kolkata, Gurugram, Hyderabad, Kochi
EY Microsoft Azure interview process
Online assessment (aptitude + technical)
Technical interview
Managerial or case round
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for EYStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
02
Read a blob in Python using DefaultAzureCredential.
DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored:
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
url = 'https://stshopprod.blob.core.windows.net'
client = BlobServiceClient(url, credential=DefaultAzureCredential())
blob = client.get_blob_client('invoices', '2026/inv-1001.pdf')
data = blob.download_blob().readall()
print(len(data))
03
What is the difference between an app registration and a service principal?
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
04
Design a disaster recovery plan for a VM-based application in Central India.
Agree RPO and RTO with the business. Replicate VMs to South India with Azure Site Recovery, configure recovery plans that start the database first, then app and web tiers, and pre-create the network. Use Traffic Manager or Front Door for DNS failover. Back up data separately with Azure Backup in case of corruption. Run test failovers into an isolated VNet every quarter.
05
Explain the storage redundancy options LRS, ZRS, GRS and GZRS.
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
An RU is a normalised measure of the CPU, memory and IO needed for an operation. A point read of a 1 KB item costs about 1 RU, while writes and queries cost more depending on size, indexing and complexity. You pay for provisioned RU/s, autoscale RU/s or serverless consumption. Requests beyond the limit get HTTP 429 and must retry, so measure RU charge from response headers.
07
How do you find and fix slow queries in Azure SQL Database?
Open Query Performance Insight or Query Store to find the top queries by CPU, duration and IO. Check execution plans for scans, missing indexes and parameter sniffing. Review automatic tuning recommendations to create indexes or force the last good plan. Query DMVs like sys.dm_exec_query_stats and sys.dm_db_resource_stats. If resources are maxed after tuning, scale up or add read replicas.
08
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.
10
Finance wants each team to pay for its own Azure usage. How do you implement this?
Make tags like costcenter and team mandatory through Azure Policy with deny for new resources and modify to inherit from resource groups. Prefer separate subscriptions per team where possible, since subscription boundaries are the cleanest cost split. Use Cost Management views and scheduled exports grouped by tag and subscription into Power BI. Share untaggable costs like shared networking with an agreed split.
Azure Backup protects data by taking scheduled backups of VMs, SQL and SAP HANA in VMs, Azure Files, blobs, disks and on-premises servers into Recovery Services or Backup vaults, with retention policies, soft delete and immutability. Azure Site Recovery replicates whole VMs continuously to another region or from on-premises to Azure for disaster recovery, with recovery plans for orchestrated failover. Backup is for restoring data; Site Recovery is for business continuity.
12
What are resource locks and when would you use them?
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
13
How do backups and point-in-time restore work in Azure SQL Database?
Azure takes full backups weekly, differential backups every 12 to 24 hours and log backups about every 10 minutes automatically. You can restore to any point within the short-term retention period of 1 to 35 days, default 7, as a new database. Long-term retention keeps weekly, monthly or yearly full backups for up to 10 years. Backup storage can be LRS, ZRS or geo-redundant.
14
Write a Bicep file that creates a storage account with parameters.
PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
17
Explain DTU and vCore purchasing models in Azure SQL Database.
DTU bundles CPU, memory and IO into fixed Basic, Standard and Premium sizes and is simple for small apps. The vCore model lets you choose compute and storage separately, with General Purpose, Business Critical and Hyperscale tiers, provisioned or serverless compute, and Azure Hybrid Benefit for existing SQL licences. vCore is recommended for most production workloads because it is transparent and easier to compare with on-premises.
18
Your storage costs are growing fast because of old logs. What do you do?
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
It is Microsoft's guidance for building quality workloads, organised into five pillars: reliability, security, cost optimization, operational excellence and performance efficiency. Each pillar has design principles, checklists and trade-offs. Azure Advisor and the Well-Architected Review tool score workloads against it. In design interviews, structure answers by pillar to show you considered failure, security and cost, not only features.
20
How do you handle a situation where a cloud bill suddenly doubled?
Situation: our monthly Azure bill jumped from about 6 lakh to 12 lakh rupees. Task: find the cause within two days. Action: I used Cost Analysis grouped by resource and meter, found a Log Analytics workspace ingesting verbose debug logs and forgotten premium disks from a test. I fixed log levels, set a daily cap, deleted orphans and added budgets with alerts. Result: costs returned to normal the next month.
21
A developer ran a DELETE without a WHERE clause on production. How do you recover?
Stop further writes if possible and note the exact time of the mistake. Use point-in-time restore to create a new copy of the database from a minute before the delete. Then copy the missing rows back into production with INSERT SELECT across databases or a data export, rather than replacing the whole database, which would lose later legitimate changes. Afterwards restrict direct write access in production.
22
Deploy a Bicep file and preview changes with Azure CLI.
Run what-if first, then deploy with a parameters file:
az deployment group what-if \
--resource-group rg-shop-dev \
--template-file main.bicep \
--parameters main.dev.bicepparam
az deployment group create \
--resource-group rg-shop-dev \
--template-file main.bicep \
--parameters main.dev.bicepparam
Use az deployment sub create for subscription-scope templates.
23
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
24
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
25
Write the commands to create an AKS cluster with a system and a user node pool.
Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps:
az aks create -g rg-aks-prod -n aks-prod \
--network-plugin azure --network-plugin-mode overlay \
--nodepool-name system --node-count 3 --zones 1 2 3 \
--enable-managed-identity --attach-acr acrshopprod \
--generate-ssh-keys
az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \
-n apps --mode User --node-count 3 --zones 1 2 3 \
--enable-cluster-autoscaler --min-count 3 --max-count 10
Incremental mode, the default, adds or updates resources in the template and leaves others untouched. Complete mode deletes resources in the resource group that are not in the template, which is risky. Deployments can target resource group, subscription, management group or tenant scope; for example, policies and resource groups are created at subscription scope. Deployment stacks now offer safer managed cleanup than complete mode.
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
28
Someone changed production resources manually in the portal. How do you detect and handle drift?
Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.
29
Users report the website on App Service is slow every morning at 9 AM. How do you investigate?
Check Application Insights for response times, failed requests and dependency calls around 9 AM, and App Service plan metrics for CPU, memory and instance count. A morning spike often means traffic surge with autoscale reacting too slowly, cold start after idle, or a slow SQL query under load. Fixes include scheduled scale-out before 9 AM, Always On, a higher tier, caching with Redis or query tuning.
30
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
Tips to crack the EY Microsoft Azure interview
Practise explaining a data project in business terms, focusing on the problem, approach and recommendation for the client.
Revise Excel, SQL and Power BI, which appear frequently in EY analytics and consulting job descriptions.
Read about EY's service lines and its focus on technology, AI and sustainability consulting for fit questions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; EY interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the EY Microsoft Azure interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial or case round; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the EY Microsoft Azure interview?
This practice set leans on Azure Fundamentals (7), Azure Databases (5), DevOps and Infrastructure as Code (5), Identity and Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most EY interviewers ask you to walk through real work.
Are these the exact questions asked at EY?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like EY's. They are not a leaked or verified list of past questions.
Where does EY hire Microsoft Azure professionals in India?
EY has large teams in Bengaluru, Kolkata, Gurugram, Hyderabad, Kochi. Openings and locations change often, so check the EY careers page and filter by city and experience.