Skip to content
Microsoft Azure
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Azure Administrator Interview Questions & Answers

40 questions for Azure Administrator interviews — 31 easy, 8 medium, 1 hard.

About the Azure Administrator role

Azure administrators build and manage subscriptions, identities, virtual networks, storage, VMs and backups for an organisation. They implement RBAC and policies, configure monitoring and alerts, and keep costs under control. The role maps to the AZ-104 certification and is in high demand at service companies, banks and global capability centres that run large Microsoft estates and migrate on-premises servers to Azure.

Entra ID and RBAC VNets and NSGs Storage accounts Azure CLI and PowerShell Backup and monitoring
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What are the Blob Storage access tiers?

Azure StorageEasy
Save to ▾
Show answer
Hot is for frequently accessed data with the highest storage cost and lowest access cost. Cool suits data kept at least 30 days and read rarely. Cold suits data kept at least 90 days. Archive is offline, cheapest, with a 180-day minimum and rehydration taking hours. Deleting or moving data early triggers an early deletion charge, so choose tiers by real access patterns.
02

What is Microsoft Entra ID?

Identity and SecurityEasy
Save to ▾
Show answer
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.
03

What is Microsoft Azure and which service models does it offer?

Azure FundamentalsEasy
Save to ▾
Show answer
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
04

What is Bicep and how does it relate to ARM templates?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Bicep is a domain-specific language for deploying Azure resources declaratively. It compiles to ARM JSON, so it supports every resource type and API version on day one, but with cleaner syntax, modules, loops, type checking and no manual dependsOn in most cases. There is no state file because ARM itself tracks the deployed resources. Bicep is Microsoft's recommended native IaC language.
05

What is the difference between an app registration and a service principal?

Identity and SecurityMedium
Save to ▾
Show answer
An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.
06

Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.

Azure FundamentalsMedium
Save to ▾
Show answer
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
07

Store and read a secret from Key Vault using Azure CLI.

Identity and SecurityEasy
Save to ▾
Show answer
Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret: az keyvault create -g rg-sec -n kv-shop-prod \ --location centralindia --enable-rbac-authorization true az keyvault secret set --vault-name kv-shop-prod \ --name SqlPassword --value 'S3cure#Pass' az keyvault secret show --vault-name kv-shop-prod \ --name SqlPassword --query value -o tsv
08

What is the difference between a service endpoint and a private endpoint?

Azure NetworkingHard
Save to ▾
Show answer
A service endpoint extends the VNet identity to a PaaS service so its firewall can allow your subnet, but the service still uses its public IP. A private endpoint puts a private IP from your subnet on a specific resource instance, so traffic never needs the public endpoint and works from peered networks and on-premises. Private endpoints are preferred for strict security but need private DNS setup.
09

Name the Azure regions available in India.

Azure FundamentalsEasy
Save to ▾
Show answer
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
10

An order system needs reliable, ordered messaging between services. Would you pick Queue Storage or Service Bus, and why?

Azure StorageMedium
Save to ▾
Show answer
Queue Storage is cheap and simple, holds millions of messages up to 64 KB each, and suits basic background work. Service Bus is an enterprise broker with queues and topics, FIFO through sessions, duplicate detection, dead-lettering, transactions and messages up to 100 MB on Premium. Choose Service Bus for ordered or business-critical messaging like orders and payments, and Storage queues for simple, high-volume job queues.
11

What is an Azure Virtual Network (VNet)?

Azure NetworkingEasy
Save to ▾
Show answer
A VNet is your private, isolated network in an Azure region, defined by one or more address spaces such as 10.10.0.0/16 and divided into subnets. Resources in a VNet communicate privately and Azure provides default routing between subnets and to the internet. VNets connect to each other with peering and to on-premises with VPN Gateway or ExpressRoute. Azure reserves five IP addresses in every subnet.
12

Tell me about a time you learned a new Azure service quickly to deliver a task.

Azure FundamentalsEasy
Save to ▾
Show answer
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
13

What is the shared responsibility model in Azure?

Azure FundamentalsEasy
Save to ▾
Show answer
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
14

Explain the hierarchy of management groups, subscriptions, resource groups and resources.

Azure FundamentalsEasy
Save to ▾
Show answer
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
15

What is a lifecycle management policy?

Azure StorageEasy
Save to ▾
Show answer
A lifecycle policy is a rule set on a storage account that automatically moves or deletes blobs based on age, last access or last modified time. For example, move logs to Cool after 30 days, to Archive after 90 days and delete after 365 days. It runs once a day and removes the need for custom cleanup scripts, which saves real money on large log or backup containers.
16

What is Azure Resource Manager (ARM)?

Azure FundamentalsEasy
Save to ▾
Show answer
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
17

Assign a role to a group at resource group scope with Azure CLI.

Identity and SecurityEasy
Save to ▾
Show answer
Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.
18

What services does an Azure Storage account provide?

Azure StorageEasy
Save to ▾
Show answer
A general-purpose v2 storage account offers Blob Storage for objects, Azure Files for SMB and NFS file shares, Queue Storage for simple messaging and Table Storage for key-value NoSQL data. Data Lake Storage Gen2 is Blob Storage with hierarchical namespace enabled for analytics. Each account has a globally unique name that forms endpoints like name.blob.core.windows.net, and settings such as redundancy and network rules apply account-wide.
19

Why do you want to build a career in Microsoft Azure?

Azure FundamentalsEasy
Save to ▾
Show answer
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
20

Tell me about a time you reduced cloud storage cost.

Azure StorageEasy
Save to ▾
Show answer
Situation: our analytics team kept every raw file in the Hot tier with GRS, costing about 3 lakh rupees a month. Task: reduce cost without breaking reports. Action: I analysed access logs, moved files older than 60 days to Cool and older than a year to Archive with lifecycle rules, and switched scratch containers to LRS. Result: storage cost fell by around 45% with no complaints from users.
21

How do you create a resource group and list resources using Azure CLI?

Azure FundamentalsEasy
Save to ▾
Show answer
Log in, select the subscription, create the group with tags, then list its resources in a table: az login az account set --subscription 'Prod-Sub' az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop az resource list --resource-group rg-shop-prod --output table The --query flag with JMESPath filters output, for example --query '[].name'.
22

What is Azure Cosmos DB and which APIs does it support?

Azure DatabasesEasy
Save to ▾
Show answer
Cosmos DB is a fully managed, globally distributed NoSQL database with single-digit millisecond latency and SLAs for availability, throughput and latency. It supports the native NoSQL API, MongoDB (RU and vCore), Apache Cassandra, Gremlin graph and Table APIs, and PostgreSQL through Citus. It also offers integrated vector search, used for AI and retrieval-augmented generation apps.
23

Explain the storage redundancy options LRS, ZRS, GRS and GZRS.

Azure StorageEasy
Save to ▾
Show answer
LRS keeps three copies in one datacenter. ZRS keeps three copies across three availability zones in the region. GRS adds asynchronous replication to the paired region, where data is stored with LRS. GZRS combines ZRS in the primary with geo replication. RA-GRS and RA-GZRS also let you read from the secondary endpoint. Pick ZRS for zone resilience and GZRS for critical data needing regional DR.
24

How do you keep up with security changes in Azure?

Identity and SecurityEasy
Save to ▾
Show answer
Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.
25

What are tags and how are they used in real projects?

Azure FundamentalsEasy
Save to ▾
Show answer
Tags are name-value pairs such as env=prod, owner=payments, costcenter=CC101 applied to resources, groups and subscriptions. They help filter cost reports, automate shutdown scripts and track ownership. Tags are not inherited by default, so teams use Azure Policy with modify or append effects to inherit tags from the resource group or require them at creation. A resource can carry up to 50 tags.
26

What are Azure Advisor recommendations?

Monitoring, Cost and GovernanceEasy
Save to ▾
Show answer
Azure Advisor analyses your resource configuration and usage and gives free recommendations in five categories: reliability, security, performance, cost and operational excellence. Examples include resizing underused VMs, buying reservations, enabling zone redundancy and adding backups. It provides an Advisor score per category. Review it weekly, suppress items that are not relevant, and use its alerts to notify owners of new cost recommendations.
27

Why would you use Azure Cache for Redis?

Azure DatabasesEasy
Save to ▾
Show answer
Redis is an in-memory key-value store used for caching frequent database reads, storing user sessions, rate limiting, leaderboards and pub/sub. Caching a product catalogue can cut database load and bring latency from tens of milliseconds to around one. Use the cache-aside pattern with sensible TTLs. Microsoft now steers new deployments to Azure Managed Redis, which is based on Redis Enterprise.
28

Upload a folder to Blob Storage with AzCopy using Entra ID login.

Azure StorageEasy
Save to ▾
Show answer
Log in with AzCopy and copy recursively; the user needs the Storage Blob Data Contributor role: azcopy login --tenant-id <tenant-guid> azcopy copy './reports' \ 'https://stshopprod.blob.core.windows.net/reports' \ --recursive --overwrite ifSourceNewer AzCopy runs transfers in parallel and can resume failed jobs with azcopy jobs resume.
29

Generate a user delegation SAS for one blob with Azure CLI.

Azure StorageMedium
Save to ▾
Show answer
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity: az storage blob generate-sas \ --account-name stshopprod --container-name invoices \ --name inv-1001.pdf --permissions r \ --expiry 2026-11-12T18:00Z --https-only \ --auth-mode login --as-user --full-uri The caller needs a role that allows generating user delegation keys.
30

What are resource locks and when would you use them?

Azure FundamentalsEasy
Save to ▾
Show answer
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
31

What is a Network Security Group (NSG)?

Azure NetworkingEasy
Save to ▾
Show answer
An NSG is a stateful packet filter with allow and deny rules on source, destination, port and protocol, processed by priority from 100 to 4096, lower number first. It attaches to a subnet, a NIC or both, and both must allow the traffic. Default rules allow VNet-to-VNet and outbound internet traffic and deny other inbound traffic. Service tags and application security groups simplify rules.
32

Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?

Azure FundamentalsMedium
Save to ▾
Show answer
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
33

Your storage costs are growing fast because of old logs. What do you do?

Azure StorageMedium
Save to ▾
Show answer
Use Storage insights and Cost Analysis to find which containers and tiers drive cost. Enable last access tracking and apply lifecycle rules that move logs to Cool, then Cold or Archive, and delete after the retention period required by policy. Check for unnecessary GRS replication on non-critical data and leftover snapshots. Compress logs before upload and stop verbose logging at the source.
34

What is Azure Policy and how is it different from RBAC?

Identity and SecurityEasy
Save to ▾
Show answer
RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.
35

What is a resource group and what rules apply to it?

Azure FundamentalsEasy
Save to ▾
Show answer
A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.
36

What is Azure Key Vault and what can it store?

Identity and SecurityEasy
Save to ▾
Show answer
Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.
37

What is the difference between a VPN Gateway and ExpressRoute?

Azure NetworkingMedium
Save to ▾
Show answer
A VPN Gateway creates encrypted IPsec tunnels over the public internet, for site-to-site or point-to-site connections, and is quick and cheap to set up. ExpressRoute is a private dedicated connection through a connectivity provider with predictable latency and bandwidth up to 100 Gbps, but it does not encrypt by default. Many companies use ExpressRoute as primary and a VPN as backup.
38

What is the difference between CapEx and OpEx, and how does Azure change it?

Azure FundamentalsEasy
Save to ▾
Show answer
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
39

What is VNet peering and is it transitive?

Azure NetworkingMedium
Save to ▾
Show answer
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
40

What are the main services in Azure DevOps?

DevOps and Infrastructure as CodeEasy
Save to ▾
Show answer
Azure Boards tracks work items, sprints and backlogs. Azure Repos hosts Git repositories with branch policies. Azure Pipelines runs CI/CD on Microsoft-hosted or self-hosted agents. Azure Test Plans manages manual and exploratory testing. Azure Artifacts hosts NuGet, npm, Maven and Python feeds. Many Indian service companies still run client projects on Azure DevOps, while product companies often use GitHub Actions.

Frequently asked questions

What does a Azure Administrator do?

Azure administrators build and manage subscriptions, identities, virtual networks, storage, VMs and backups for an organisation. They implement RBAC and policies, configure monitoring and alerts, and keep costs under control. The role maps to the AZ-104 certification and is in high demand at service companies, banks and global capability centres that run large Microsoft estates and migrate on-premises servers to Azure.

Which skills are tested in a Azure Administrator interview?

Expect questions on Entra ID and RBAC, VNets and NSGs, Storage accounts, Azure CLI and PowerShell, Backup and monitoring. Most rounds also ask you to explain a project and solve one practical problem live.

How do I prepare for a Azure Administrator interview?

Revise Azure Fundamentals, Azure Networking, Azure Storage, Identity and Security first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.

Topic sheets for this role

Azure Fundamentals questionsAzure Networking questionsAzure Storage questionsIdentity and Security questions

Other roles

Azure Cloud Support AssociateAzure DeveloperAzure DevOps EngineerAzure Security EngineerAzure Solutions Architect

More ways to practise

Company-wise Microsoft Azure questionsExperience-wise Microsoft Azure questionsRole-wise Microsoft Azure questionsCity-wise Microsoft Azure questionsMost asked Microsoft Azure questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsMicrosoft Azure mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsMicrosoft Azure topic sheets