Microsoft Microsoft Azure Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Microsoft hiring for Microsoft Azure roles
Microsoft builds software, cloud and hardware products including Windows, Microsoft 365, Azure, Dynamics, GitHub, LinkedIn and Xbox. The India Development Center in Hyderabad and Bengaluru is one of its largest engineering hubs outside the US. It hires for software engineers, data scientists, data and applied scientists, and engineers working on Azure data and quality.
For Microsoft Azure roles, this Microsoft practice set focuses most on Azure Databases (7), DevOps and Infrastructure as Code (6), Azure Networking (5), Azure Storage (4). It has 1 easy, 15 medium, 14 hard questions, so you can start easy and work up to the harder ones.
Company type
Product
Headquarters
Redmond, Washington, USA
Main India offices
Hyderabad, Bengaluru, Noida, Gurugram, Pune
Microsoft Microsoft Azure interview process
Online coding assessment
Technical round 1 (DSA)
Technical round 2 (DSA or design)
Hiring manager round
AA (As Appropriate) round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for MicrosoftStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
If versioning was on, promote the previous version; if soft delete was on, undelete within the retention period. Point-in-time restore can roll back a whole container if enabled. If none were enabled, recovery may only be from backups. Going forward, enable versioning, soft delete and Azure Backup for blobs, give developers read-only roles in production and route writes only through the application identity.
A service connection stores how a pipeline authenticates to an external service, such as an Azure subscription, a container registry or Kubernetes. For Azure, the recommended type uses workload identity federation, where the pipeline exchanges an OIDC token for an Entra token with no secret to rotate. Scope it to the right subscription or resource group and restrict which pipelines may use it through approvals and checks.
04
Tell me about a time you set up monitoring that caught a problem early.
Situation: our order service had silent failures that customers reported hours later. Task: detect them first. Action: I added Application Insights availability tests and a log alert on failed dependency calls to the payment gateway, routed to Teams and on-call. Result: two weeks later the alert caught an expired partner certificate within five minutes, and we fixed it before most users noticed.
05
How do Azure SLAs work and how do you calculate a composite SLA?
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
06
Write an Azure Pipelines YAML that builds a .NET app and deploys it to App Service.
Add a default route with next hop Virtual appliance pointing to the firewall private IP, then attach it to the spoke subnet:
az network route-table create -g rg-net -n rt-spoke1
az network route-table route create -g rg-net \
--route-table-name rt-spoke1 -n default-to-fw \
--address-prefix 0.0.0.0/0 \
--next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4
az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 \
-n snet-app --route-table rt-spoke1
08
A client wants to move a SQL Server database that uses SQL Agent jobs and cross-database queries. Which Azure SQL option fits, and what are the alternatives?
Azure SQL Database is a fully managed single database or elastic pool, best for new cloud apps. SQL Managed Instance offers near 100% SQL Server compatibility including SQL Agent, cross-database queries and CLR, in a VNet, ideal for lift-and-shift. SQL Server on a VM gives full OS and instance control for unsupported features but you handle patching, HA and backups yourself, although the SQL IaaS extension helps.
09
Design identity and access for a multi-team Azure platform in a bank.
Use Entra ID groups mapped to roles per team and environment, with no direct user assignments. Make production access eligible-only through PIM with approval and MFA, and require phishing-resistant MFA and compliant devices via Conditional Access. Use managed identities and workload federation for apps and pipelines. Keep break-glass accounts excluded from policies but monitored. Run quarterly access reviews and stream logs to Sentinel.
10
How would you protect a public web application from attacks like SQL injection and DDoS?
Put Azure Front Door Premium or Application Gateway with WAF in front of the app, using the managed Default Rule Set based on OWASP plus bot protection and rate limits. Enable Azure DDoS Network Protection on the VNet for layer 3 and 4 attacks on public IPs. Lock the app so it accepts traffic only from Front Door, using access restrictions with the service tag and the Front Door ID header.
11
Write a basic Terraform configuration for a resource group and VNet with remote state.
Store state in an Azure Storage backend with a dedicated container per environment. Blob leases provide state locking so two runs cannot write at once. Use Entra ID authentication instead of access keys, enable versioning and soft delete to recover from corruption, restrict access to the pipeline identity, and use private endpoints. Never commit state files, because they can contain secrets in plain text.
Pick a property with high cardinality that spreads requests and storage evenly and that most queries filter on, such as userId or tenantId. Each logical partition is limited to 20 GB, so avoid keys like country or status that create hot partitions. If no single property works, use a synthetic key or hierarchical partition keys. The partition key cannot be changed later without migrating data.
14
How do you create a private endpoint for a storage account?
Create the private endpoint in the app subnet for the blob sub-resource, link the private DNS zone privatelink.blob.core.windows.net to the VNet, and disable public network access on the account:
az network private-endpoint create -g rg-net -n pe-st-blob \
--vnet-name vnet-hub --subnet snet-pe \
--private-connection-resource-id <storage-id> \
--group-id blob --connection-name st-blob
Then test that the name resolves to a 10.x address.
15
Write a GitHub Actions job that logs in to Azure with OIDC.
Grant id-token write permission and use a federated credential on the app registration, so no secret is stored:
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
environment: prod
steps:
- uses: actions/checkout@v4
- uses: azure/login@v2
with:
client-id: ${{ vars.AZURE_CLIENT_ID }}
tenant-id: ${{ vars.AZURE_TENANT_ID }}
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
- run: az group list -o table
Peering connects two VNets over the Microsoft backbone with low latency, either in the same region or globally. Traffic stays private and is billed per GB. Peering is not transitive: if A peers with B and B peers with C, A cannot reach C. To route through a hub, use a network virtual appliance or Azure Firewall with user-defined routes, or use Azure Virtual WAN.
17
Your Cosmos DB requests are failing with 429 errors. What do you do?
429 means requests exceeded provisioned RU/s. Check Insights for normalized RU consumption per partition. If one partition is hot, the partition key is the problem. If usage is even, enable autoscale or raise RU/s. Reduce RU cost by using point reads instead of queries, excluding unused paths from indexing and smaller documents. SDKs retry 429s automatically, so tune retry options too.
18
What is Durable Functions and what patterns does it support?
Durable Functions is an extension that lets you write stateful workflows in code. An orchestrator function calls activity functions, and the framework checkpoints state to storage so it survives restarts. Patterns include function chaining, fan-out/fan-in, async HTTP APIs with status polling, monitors and human interaction with timeouts. Orchestrator code must be deterministic, so avoid DateTime.Now or random values inside it.
19
How do you let an App Service connect to Azure SQL using its managed identity?
Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles:
CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [app-shop-prod];
ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod];
Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.
20
How do you migrate an on-premises SQL Server database to Azure SQL Managed Instance?
Assess with Azure Migrate or the Azure SQL migration extension in Azure Data Studio to find compatibility issues and size the target. For minimal downtime, use the Managed Instance link or Log Replay Service to continuously replicate, then cut over in minutes. For smaller databases, an offline native backup to Blob Storage and RESTORE FROM URL works. Test application connectivity and performance before switching.
21
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.
23
How do you migrate 200 TB of on-premises data to Azure when the internet link is slow?
Calculate transfer time first: 200 TB over a 1 Gbps link at 70% efficiency takes almost a month. Use Azure Data Box devices shipped to your site, copy data locally and send them back for upload into the storage account. Then run AzCopy or Azure File Sync to sync the changes made after shipping. For ongoing large flows, consider ExpressRoute.
24
Write the commands to create an AKS cluster with a system and a user node pool.
Create the cluster with Azure CNI overlay and the system pool across zones, then add a user pool for apps:
az aks create -g rg-aks-prod -n aks-prod \
--network-plugin azure --network-plugin-mode overlay \
--nodepool-name system --node-count 3 --zones 1 2 3 \
--enable-managed-identity --attach-acr acrshopprod \
--generate-ssh-keys
az aks nodepool add -g rg-aks-prod --cluster-name aks-prod \
-n apps --mode User --node-count 3 --zones 1 2 3 \
--enable-cluster-autoscaler --min-count 3 --max-count 10
25
Someone changed production resources manually in the portal. How do you detect and handle drift?
Detect drift by running Bicep what-if or terraform plan on a schedule and failing the run on unexpected differences, and by alerting on activity log write events from users rather than pipeline identities. Decide whether the manual change was a valid hotfix; if so, add it to code, otherwise redeploy to restore. Then reduce write access in production to the pipeline identity plus PIM break-glass.
26
You run a SaaS app with 300 small tenant databases whose usage peaks at different times. How do you host them cost-effectively?
An elastic pool shares a set of resources, in eDTUs or vCores, among many Azure SQL databases on one logical server. It suits SaaS apps with a database per tenant, where individual usage peaks at different times. Instead of sizing each database for its peak, you size the pool for combined usage and set per-database min and max limits. Too many busy databases at once will contend for resources.
27
Generate a user delegation SAS for one blob with Azure CLI.
Log in with Entra ID, then create a short-lived read-only SAS signed with your identity:
az storage blob generate-sas \
--account-name stshopprod --container-name invoices \
--name inv-1001.pdf --permissions r \
--expiry 2026-11-12T18:00Z --https-only \
--auth-mode login --as-user --full-uri
The caller needs a role that allows generating user delegation keys.
Use Entra ID integration with Kubernetes RBAC and disable local accounts. Make the API server private or restrict authorized IP ranges. Run workloads with Workload ID instead of secrets, keep secrets in Key Vault through the CSI driver, and apply Azure Policy for Kubernetes to block privileged pods. Enable Defender for Containers, use network policies, scan images in ACR and route egress through Azure Firewall.
29
Create an Azure SQL Database with Entra-only authentication using Azure CLI.
Create the logical server with an Entra admin group and no SQL logins, then the database:
az sql server create -g rg-data -n sql-shop-prod -l centralindia \
--enable-ad-only-auth \
--external-admin-principal-type Group \
--external-admin-name grp-sql-admins \
--external-admin-sid <group-object-id>
az sql db create -g rg-data -s sql-shop-prod -n shopdb \
--edition GeneralPurpose --family Gen5 --capacity 2 \
--zone-redundant true --backup-storage-redundancy Zone
30
Which Network Watcher tools do you use to troubleshoot connectivity?
IP flow verify tells you if an NSG rule allows or denies a specific packet and which rule matched. Next hop shows where routing sends traffic. Connection troubleshoot tests reachability from a VM to an endpoint. Effective security rules and effective routes show the combined result on a NIC. VNet flow logs record traffic for analysis with Traffic Analytics. Packet capture records traffic on a VM.
Tips to crack the Microsoft Microsoft Azure interview
Practise DSA on linked lists, trees and graphs, and be ready to write clean, compilable code with edge cases handled.
Learn basic Azure data services such as Azure SQL, Synapse and Data Factory if you are applying for data roles.
Prepare examples showing a growth mindset, which Microsoft highlights as a core part of its culture.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Microsoft interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Microsoft Microsoft Azure interview?
Candidates usually go through 5 stages: Online coding assessment; Technical round 1 (DSA); Technical round 2 (DSA or design); Hiring manager round; AA (As Appropriate) round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Microsoft Microsoft Azure interview?
This practice set leans on Azure Databases (7), DevOps and Infrastructure as Code (6), Azure Networking (5), Azure Storage (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Microsoft interviewers ask you to walk through real work.
Are these the exact questions asked at Microsoft?
No. These are curated practice questions that match the skills and difficulty usually tested in product interviews like Microsoft's. They are not a leaked or verified list of past questions.
Where does Microsoft hire Microsoft Azure professionals in India?
Microsoft has large teams in Hyderabad, Bengaluru, Noida, Gurugram, Pune. Openings and locations change often, so check the Microsoft careers page and filter by city and experience.