Microsoft Azure Interview Questions for 3 Years Experience
40 questions with answers for candidates with 3 years of experience — 7 easy, 26 medium, 7 hard.
What interviewers expect: 3 years experience
At three years, you are expected to design and automate. Expect scenario questions on hub-spoke networks, CI/CD pipelines, AKS operations, high availability across zones, cost optimisation and governance with Azure Policy. Interviewers probe trade-offs, such as Bicep versus Terraform or AKS versus Container Apps, and how you mentor juniors. Bring one strong design example.
This set is weighted towards Azure Compute (9), Identity and Security (8), Azure Fundamentals (7), Azure Storage (4).
Network and HA design CI/CD and IaC modules AKS and containers Cost and governance
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
An application on a VM must access a storage account without any keys. How do you set it up?
Enable a system-assigned or user-assigned managed identity on the VM. Assign the identity the least role needed, such as Storage Blob Data Reader on the specific container. In code, use DefaultAzureCredential or ManagedIdentityCredential from the Azure SDK. Then disable shared key access on the account. The token is fetched from the local metadata endpoint and rotated automatically by Azure.
02
How do you configure autoscale for an App Service plan?
In the plan's Scale out settings, choose rules-based autoscale or automatic scaling. A typical rule set: scale out by 1 instance when average CPU exceeds 70% for 10 minutes, scale in by 1 when below 30% for 10 minutes, minimum 2 and maximum 10 instances. Always pair scale-out with a scale-in rule and a cool-down period so the plan does not flap between sizes.
03
Your company is choosing between Bicep and Terraform for its Azure estate. What would you recommend?
Bicep is Azure-only, needs no state file, supports new resource features immediately and has native what-if previews. Terraform works across many clouds and SaaS providers, has a huge module ecosystem, and keeps a state file that must be stored securely, for example in a Blob Storage backend with locking. Choose Bicep for Azure-only teams and Terraform for multi-cloud or existing Terraform skills.
04
What is the difference between the activity log and resource logs?
The activity log records control-plane operations at subscription level, such as who created, updated or deleted a resource, and service health events. It is kept for 90 days unless exported. Resource logs record data-plane activity inside a resource, such as Key Vault secret reads or SQL audit events, and must be enabled with diagnostic settings to send them to Log Analytics, Storage or Event Hubs.
05
How do you design an Azure subscription strategy for a large enterprise with many business units?
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
06
What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
07
How do you give an external auditor read-only access to your Azure environment for two weeks?
Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.
Series are optimised for workload type: B for burstable low-cost, D for general purpose, E for memory heavy like SQL Server, F for compute intensive, L for storage throughput, N for GPU and M for very large memory such as SAP HANA. Start from CPU, memory, disk IOPS and network needs, test with real load, then right-size using Azure Advisor recommendations after a few weeks of metrics.
09
What is Azure App Service and what does an App Service plan define?
App Service is a PaaS for hosting web apps, REST APIs and mobile back ends in .NET, Java, Node, Python or PHP, or as containers, on Windows or Linux. The App Service plan defines the region, VM size, instance count and pricing tier such as Basic, Standard, Premium v3 or Isolated v2. All apps in a plan share its compute, so a noisy app can starve others.
10
You need to run a nightly 3-hour data processing job cheaply. Which compute would you choose?
Avoid the old Consumption plan because of its execution timeout. Good options are Azure Batch or a VM Scale Set using Spot VMs with checkpointing, Container Apps jobs that run on a schedule and stop afterwards, or Durable Functions breaking work into short activities. The key is paying only while the job runs and tolerating restarts. Store input and output in Blob Storage so any worker can resume.
11
Your pipeline takes 40 minutes. How do you speed it up?
Profile which stages are slow. Cache dependencies like NuGet or npm packages, run unit tests and linting in parallel jobs, and split slow integration tests to run only on main or nightly. Use self-hosted or Managed DevOps Pools agents with warm caches for big builds, build container images with layer caching, and deploy only changed services in a monorepo using path filters.
12
Tell me about a time you fixed a networking issue under pressure.
Situation: after a firewall change, payment APIs in our spoke could not reach a partner endpoint. Task: restore traffic quickly. Action: I used Network Watcher next hop and firewall logs in Log Analytics, found the new rule collection had higher priority and denied the partner FQDN, and added an explicit allow. Result: service recovered in 25 minutes, and we added pipeline-based firewall rule reviews.
13
How do you keep up with security changes in Azure?
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
Slots are live copies of an app with their own hostname, available from the Standard tier. You deploy to a staging slot, warm it up and test, then swap it with production. The swap redirects traffic with near-zero downtime and can be reversed by swapping back. Slot-specific settings, such as a staging database connection string, stay with the slot instead of moving during the swap.
15
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
16
What is Azure Files and when would you use Azure File Sync?
Azure Files provides fully managed SMB and NFS shares that VMs and on-premises machines can mount, useful for lift-and-shift of apps expecting a file server. Azure File Sync installs an agent on Windows Servers to sync shares to Azure Files and use cloud tiering, keeping hot files locally and old files in the cloud. It helps branch offices share data without large local storage.
17
Write a basic Terraform configuration for a resource group and VNet with remote state.
Follow the Cloud Adoption Framework landing zone design. Create a management group hierarchy (platform, landing zones, sandbox, decommissioned), separate subscriptions for identity, management and connectivity, and a hub-spoke or Virtual WAN network. Apply Azure Policy for allowed regions, tagging and diagnostics, and assign RBAC through Entra groups. Deploy it all as code with Bicep or Terraform so new app subscriptions can be vended consistently.
19
What is the difference between an app registration and a service principal?
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
20
What is a Shared Access Signature (SAS) and what types exist?
A SAS is a signed URL token granting limited access to storage for a set time and permissions, such as read-only for one blob for one hour. A user delegation SAS is signed with Entra ID credentials and is the most secure. A service SAS and an account SAS are signed with the account key. Always use HTTPS, short expiry and stored access policies so tokens can be revoked.
21
Write a GitHub Actions job that logs in to Azure with OIDC.
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored:
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
environment: prod
steps:
- uses: actions/checkout@v4
- uses: azure/login@v2
with:
client-id: ${{ vars.AZURE_CLIENT_ID }}
tenant-id: ${{ vars.AZURE_TENANT_ID }}
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
- run: az group list -o table
Flex Consumption is the recommended serverless plan: it scales to zero, bills per execution and memory, supports VNet integration and always-ready instances. The older Consumption plan scales to zero with a default 5-minute timeout. Premium keeps pre-warmed instances to avoid cold starts and supports long runs. Dedicated runs on an App Service plan. Container Apps hosting runs functions as containers. Choose by cold start tolerance, networking and run duration.
Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.
24
How do you migrate an on-premises SQL Server database to Azure SQL Managed Instance?
Assess with Azure Migrate or the Azure SQL migration extension in Azure Data Studio to find compatibility issues and size the target. For minimal downtime, use the Managed Instance link or Log Replay Service to continuously replicate, then cut over in minutes. For smaller databases, an offline native backup to Blob Storage and RESTORE FROM URL works. Test application connectivity and performance before switching.
25
Your secure score in Defender for Cloud is low. How do you improve it?
Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.
Spot VMs use spare Azure capacity at discounts that can reach about 90%, but Azure can evict them with 30 seconds notice when it needs capacity or the price passes your limit. Use them for interruptible work such as batch rendering, CI build agents, test environments and big data jobs with checkpointing. Never use them for stateful production databases or anything that cannot tolerate sudden loss.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
28
Tell me about a time you pushed back on a request that broke security rules.
Situation: a project manager asked me to give a vendor Owner access to production to speed up a fix. Task: unblock the vendor without breaking policy. Action: I explained the risk, then created a time-bound PIM eligible Contributor role on just one resource group with approval, and paired with the vendor during the change. Result: the fix shipped the same day and the audit had no findings.
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
30
A VM is not reachable over RDP. Walk through your troubleshooting.
Check the VM is running and passed boot diagnostics via the serial console or screenshot. Use Network Watcher IP flow verify and effective security rules to see if an NSG blocks port 3389. Check the route table, any firewall and whether the VM has a public IP or you should use Bastion. Inside the OS, use Run Command to check the RDP service and Windows firewall. Reset the configuration if needed.
31
What is the difference between an availability set and an availability zone?
An availability set spreads VMs across fault domains (separate racks, power and switches) and update domains (rebooted at different times) inside one datacenter, giving a 99.95% SLA. Availability zones place VMs in physically separate datacenters within a region, giving 99.99%. Zones protect against a full datacenter outage; availability sets only protect against rack and maintenance failures. New designs prefer zones where the region supports them.
Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.
33
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
34
What are RPO and RTO and how do they guide Azure designs?
RPO, recovery point objective, is the maximum acceptable data loss measured in time. RTO, recovery time objective, is how long recovery may take. A daily backup gives an RPO of up to 24 hours. Site Recovery gives an RPO of seconds to minutes and an RTO of minutes to hours. SQL failover groups give an RPO of seconds. Lower RPO and RTO cost more, so agree targets per application.
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
36
What is the Hyperscale tier of Azure SQL Database?
Hyperscale separates compute from a distributed, log-based storage layer, so databases can grow up to 128 TB with fast backups through snapshots and quick restores regardless of size. You can add up to four high-availability replicas and named replicas for read scale-out. Scaling compute takes minutes. It suits large OLTP and mixed workloads, and its pricing is now competitive with General Purpose.
37
Write an Azure PowerShell command to find all VMs without an env tag.
Filter Get-AzVM output on the Tags hashtable and export the result for review:
Connect-AzAccount
Get-AzVM | Where-Object {
-not $_.Tags -or -not $_.Tags.ContainsKey('env')
} | Select-Object Name, ResourceGroupName, Location |
Export-Csv untagged-vms.csv -NoTypeInformation
For large estates, Azure Resource Graph queries are faster across many subscriptions.
38
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
39
How do you decide between IaaS and PaaS for migrating an on-premises application?
Start with constraints. If the app needs OS-level access, custom drivers or legacy software, a lift-and-shift to VMs is fastest. If it is a standard .NET, Java or Node web app with SQL Server, App Service plus Azure SQL removes patching and gives built-in scaling. Many teams lift and shift first to meet a datacenter exit date, then modernise to PaaS in a later phase.
40
Write a KQL query to find who deleted resources in the last 7 days.
Use the AzureActivity table, filtering on successful delete operations:
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith '/DELETE'
| where ActivityStatusValue == 'Success'
| project TimeGenerated, Caller, OperationNameValue,
ResourceGroup, _ResourceId
| order by TimeGenerated desc
Frequently asked questions
What is asked in Microsoft Azure interviews for 3 years of experience?
At three years, you are expected to design and automate. Expect scenario questions on hub-spoke networks, CI/CD pipelines, AKS operations, high availability across zones, cost optimisation and governance with Azure Policy. Interviewers probe trade-offs, such as Bicep versus Terraform or AKS versus Container Apps, and how you mentor juniors. Bring one strong design example.
How many questions should I practise before a Microsoft Azure interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 3 years of experience?
Focus first on Network and HA design, CI/CD and IaC modules, AKS and containers, Cost and governance.