Medium Microsoft Azure Interview Questions

Filter Get-AzVM output on the Tags hashtable and export the result for review: Connect-AzAccount Get-AzVM | Where-Object { -not $_.Tags -or -not $_.Tags.ContainsKey('env') } | Select-Object Name, ResourceGroupName, Location | Export-Csv untagged-vms.csv -NoTypeInformation For large estates, Azure Resource Graph queries are faster across many subscriptions.

Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion: az vm create \ --resource-group rg-app-dev \ --name vm-api-01 \ --image Ubuntu2204 \ --size Standard_D2s_v5 \ --vnet-name vnet-dev --subnet snet-app \ --public-ip-address '' \ --admin-username azureuser \ --generate-ssh-keys \ --zone 1

The v2 model uses decorators in function_app.py, so no function.json is needed: import azure.functions as func app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION) @app.route(route='hello', methods=['GET']) def hello(req: func.HttpRequest) -> func.HttpResponse: name = req.params.get('name', 'world') return func.HttpResponse(f'Hello, {name}', status_code=200) Callers pass the function key in the code query parameter or x-functions-key header.

The JSON policy moves blobs under logs/ to Cool after 30 days, Archive after 90 and deletes after 365: { "rules": [{ "name": "logs-tiering", "enabled": true, "type": "Lifecycle", "definition": { "filters": {"blobTypes": ["blockBlob"], "prefixMatch": ["logs/"]}, "actions": {"baseBlob": { "tierToCool": {"daysAfterModificationGreaterThan": 30}, "tierToArchive": {"daysAfterModificationGreaterThan": 90}, "delete": {"daysAfterModificationGreaterThan": 365}}} }}] }

DefaultAzureCredential uses a managed identity in Azure and your CLI login locally, so no keys are stored: from azure.identity import DefaultAzureCredential from azure.storage.blob import BlobServiceClient url = 'https://stshopprod.blob.core.windows.net' client = BlobServiceClient(url, credential=DefaultAzureCredential()) blob = client.get_blob_client('invoices', '2026/inv-1001.pdf') data = blob.download_blob().readall() print(len(data))

Log in with Entra ID, then create a short-lived read-only SAS signed with your identity: az storage blob generate-sas \ --account-name stshopprod --container-name invoices \ --name inv-1001.pdf --permissions r \ --expiry 2026-11-12T18:00Z --https-only \ --auth-mode login --as-user --full-uri The caller needs a role that allows generating user delegation keys.

Create the VNet, add subnets, then an NSG that allows HTTPS and attach it: az network vnet create -g rg-net -n vnet-app \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-web --subnet-prefixes 10.20.1.0/24 az network vnet subnet create -g rg-net --vnet-name vnet-app \ -n snet-db --address-prefixes 10.20.2.0/24 az network nsg create -g rg-net -n nsg-web az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \ --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 az network vnet subnet update -g rg-net --vnet-name vnet-app \ -n snet-web --network-security-group nsg-web

Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it: az network vnet peering create -g rg-net -n hub-to-spoke1 \ --vnet-name vnet-hub --remote-vnet vnet-spoke1 \ --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit az network vnet peering create -g rg-net -n spoke1-to-hub \ --vnet-name vnet-spoke1 --remote-vnet vnet-hub \ --allow-vnet-access --allow-forwarded-traffic --use-remote-gateways

Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it: az role definition list --name 'Virtual Machine Contributor' > vm-op.json # edit: Name 'VM Operator', Actions: # Microsoft.Compute/virtualMachines/read # Microsoft.Compute/virtualMachines/start/action # Microsoft.Compute/virtualMachines/restart/action # Microsoft.Compute/virtualMachines/deallocate/action az role definition create --role-definition vm-op.json

Create the logical server with an Entra admin group and no SQL logins, then the database: az sql server create -g rg-data -n sql-shop-prod -l centralindia \ --enable-ad-only-auth \ --external-admin-principal-type Group \ --external-admin-name grp-sql-admins \ --external-admin-sid <group-object-id> az sql db create -g rg-data -s sql-shop-prod -n shopdb \ --edition GeneralPurpose --family Gen5 --capacity 2 \ --zone-redundant true --backup-storage-redundancy Zone

Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.

Filter on the partition key so the query hits one partition and stays cheap: SELECT c.id, c.orderDate, c.total FROM c WHERE c.customerId = @customerId AND c.total > 5000 ORDER BY c.orderDate DESC ORDER BY on orderDate needs a range index, which the default indexing policy includes. Check the RU charge in the response headers.

Parameters keep the template reusable across environments: param location string = resourceGroup().location @minLength(3) @maxLength(24) param name string @allowed(['Standard_LRS', 'Standard_ZRS']) param sku string = 'Standard_ZRS' resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = { name: name location: location sku: { name: sku } kind: 'StorageV2' properties: { minimumTlsVersion: 'TLS1_2' allowBlobPublicAccess: false supportsHttpsTrafficOnly: true } } output blobEndpoint string = st.properties.primaryEndpoints.blob

Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table

Configure the azurerm backend and provider, then resources: terraform { backend "azurerm" { resource_group_name = "rg-tfstate" storage_account_name = "sttfstateprod" container_name = "state" key = "network.tfstate" use_azuread_auth = true } } provider "azurerm" { features {} } resource "azurerm_resource_group" "net" { name = "rg-net-prod" location = "centralindia" } resource "azurerm_virtual_network" "hub" { name = "vnet-hub" location = azurerm_resource_group.net.location resource_group_name = azurerm_resource_group.net.name address_space = ["10.0.0.0/16"] }

Query the requests table, summarise duration and sort: requests | where timestamp > ago(1d) | summarize count(), avgDuration = avg(duration), p95 = percentile(duration, 95) by name | top 10 by p95 desc In a workspace-based resource, the table is AppRequests with TimeGenerated and DurationMs columns instead.

Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc

Query the Perf table collected by the Azure Monitor Agent, or InsightsMetrics with VM Insights: Perf | where TimeGenerated > ago(1h) | where ObjectName == 'Processor' and CounterName == '% Processor Time' | where InstanceName == '_Total' | summarize avgCpu = avg(CounterValue) by Computer | where avgCpu > 80 | order by avgCpu desc

Unattached disks keep billing, so this is a common cost check: Resources | where type =~ 'microsoft.compute/disks' | where properties.diskState =~ 'Unattached' | project name, resourceGroup, subscriptionId, sku = sku.name, sizeGb = properties.diskSizeGB Run it with az graph query -q or in the Resource Graph Explorer.