Top 50 Most Asked Microsoft Azure Interview Questions

Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.

Use the AzureActivity table, filtering on successful delete operations: AzureActivity | where TimeGenerated > ago(7d) | where OperationNameValue endswith '/DELETE' | where ActivityStatusValue == 'Success' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId | order by TimeGenerated desc

The JSON policy moves blobs under logs/ to Cool after 30 days, Archive after 90 and deletes after 365: { "rules": [{ "name": "logs-tiering", "enabled": true, "type": "Lifecycle", "definition": { "filters": {"blobTypes": ["blockBlob"], "prefixMatch": ["logs/"]}, "actions": {"baseBlob": { "tierToCool": {"daysAfterModificationGreaterThan": 30}, "tierToArchive": {"daysAfterModificationGreaterThan": 90}, "delete": {"daysAfterModificationGreaterThan": 365}}} }}] }

Create the VNet, add subnets, then an NSG that allows HTTPS and attach it: az network vnet create -g rg-net -n vnet-app \ --address-prefixes 10.20.0.0/16 \ --subnet-name snet-web --subnet-prefixes 10.20.1.0/24 az network vnet subnet create -g rg-net --vnet-name vnet-app \ -n snet-db --address-prefixes 10.20.2.0/24 az network nsg create -g rg-net -n nsg-web az network nsg rule create -g rg-net --nsg-name nsg-web -n allow-https \ --priority 100 --direction Inbound --access Allow \ --protocol Tcp --destination-port-ranges 443 az network vnet subnet update -g rg-net --vnet-name vnet-app \ -n snet-web --network-security-group nsg-web

Peering must be created from each side. Allow forwarded traffic if a hub firewall routes it: az network vnet peering create -g rg-net -n hub-to-spoke1 \ --vnet-name vnet-hub --remote-vnet vnet-spoke1 \ --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit az network vnet peering create -g rg-net -n spoke1-to-hub \ --vnet-name vnet-spoke1 --remote-vnet vnet-hub \ --allow-vnet-access --allow-forwarded-traffic --use-remote-gateways

Enable the app's managed identity, then in the database, connected as an Entra admin, create a user for it and grant roles: CREATE USER [app-shop-prod] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [app-shop-prod]; ALTER ROLE db_datawriter ADD MEMBER [app-shop-prod]; Use a connection string with Authentication=Active Directory Default, so no password is stored anywhere.

Grant id-token write permission and use a federated credential on the app registration, so no secret is stored: permissions: id-token: write contents: read jobs: deploy: runs-on: ubuntu-latest environment: prod steps: - uses: actions/checkout@v4 - uses: azure/login@v2 with: client-id: ${{ vars.AZURE_CLIENT_ID }} tenant-id: ${{ vars.AZURE_TENANT_ID }} subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} - run: az group list -o table

Create the VM in an existing subnet with an empty public IP and generated SSH keys, then connect through Bastion: az vm create \ --resource-group rg-app-dev \ --name vm-api-01 \ --image Ubuntu2204 \ --size Standard_D2s_v5 \ --vnet-name vnet-dev --subnet snet-app \ --public-ip-address '' \ --admin-username azureuser \ --generate-ssh-keys \ --zone 1