Azure Fundamentals Interview Questions for Microsoft Azure
25 Azure Fundamentals questions with answers for microsoft azure roles — 13 easy, 9 medium, 3 hard.
About Azure Fundamentals
Start with how Azure is organised: tenants, management groups, subscriptions, resource groups and Azure Resource Manager. Learn regions and availability zones in India, the shared responsibility model, SLAs, pricing, reservations and the Well-Architected Framework, plus how companies plan migrations and landing zones. These basics appear in every Azure interview and in the AZ-900 exam.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is Microsoft Azure and which service models does it offer?
Azure is Microsoft's public cloud platform with 200+ services delivered from regions worldwide. It offers IaaS (virtual machines, disks, networks), PaaS (App Service, Azure SQL Database, Functions) and SaaS built on it (Microsoft 365, Dynamics 365). With IaaS you manage the OS and runtime; with PaaS Azure patches the platform and you manage only code and data, which cuts operations effort.
02
Explain the hierarchy of management groups, subscriptions, resource groups and resources.
A tenant (Microsoft Entra ID directory) holds a root management group. Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources such as VMs and storage accounts. Policies and RBAC assigned at a higher level are inherited downward. Subscriptions are also billing and quota boundaries, so companies often separate prod, non-prod and sandbox into different subscriptions.
03
What is a resource group and what rules apply to it?
A resource group is a logical container for resources that share a lifecycle, for example everything for one app environment. A resource belongs to exactly one group, groups cannot be nested, and deleting a group deletes everything inside it. The group has a location that stores metadata, but resources inside can live in other regions. Resources can be moved between groups for most resource types.
ARM is the deployment and management layer of Azure. Every request from the portal, CLI, PowerShell, SDKs or Bicep goes through the ARM API, which authenticates the caller, checks RBAC and Policy, and forwards the call to the resource provider. Because all tools hit the same API, you get consistent results, tagging, locks and activity logs no matter how the change was made.
05
What are regions, region pairs and availability zones?
A region is a set of datacenters in one geography, such as Central India in Pune. Availability zones are physically separate datacenter groups inside a region with independent power, cooling and network; supported regions have three. Many regions are paired with another region in the same geography for platform updates and geo-replication. Use zones for datacenter failure and a second region for regional disasters.
Microsoft runs Central India (Pune), South India (Chennai) and West India (Mumbai) as public regions, plus Jio India West and Jio India Central for specific customers. Central India supports availability zones. Indian companies pick these regions for low latency and for data residency needs such as RBI guidelines on payment data, often pairing Central India with South India for disaster recovery.
Security duties are split between Microsoft and the customer. Microsoft always owns physical datacenters, hosts and the network fabric. The customer always owns data, identities, accounts and devices. The middle layers move with the service model: in IaaS you patch the OS and configure firewalls; in PaaS Microsoft patches the OS and runtime; in SaaS you mainly manage users and data.
08
What are resource locks and when would you use them?
Locks protect resources from accidental change. CanNotDelete allows reads and updates but blocks deletion; ReadOnly allows only reads, which can break operations like listing storage keys. Locks apply to a subscription, group or resource and are inherited. Teams put CanNotDelete on production resource groups, DNS zones and ExpressRoute circuits. Only Owner or User Access Administrator roles can remove locks by default.
09
What are tags and how are they used in real projects?
Tags are name-value pairs such as env=prod, owner=payments, costcenter=CC101 applied to resources, groups and subscriptions. They help filter cost reports, automate shutdown scripts and track ownership. Tags are not inherited by default, so teams use Azure Policy with modify or append effects to inherit tags from the resource group or require them at creation. A resource can carry up to 50 tags.
10
What is the difference between CapEx and OpEx, and how does Azure change it?
CapEx is upfront spending on assets like servers and datacenters, depreciated over years. OpEx is ongoing spending on services consumed. Azure moves IT mostly to OpEx: you pay per second, hour or GB used, scale down when idle and avoid hardware refresh cycles. Reservations and savings plans add a commitment back in, but you still avoid owning physical hardware.
11
How do you create a resource group and list resources using Azure CLI?
Log in, select the subscription, create the group with tags, then list its resources in a table:
az login
az account set --subscription 'Prod-Sub'
az group create --name rg-shop-prod --location centralindia --tags env=prod owner=shop
az resource list --resource-group rg-shop-prod --output table
The --query flag with JMESPath filters output, for example --query '[].name'.
12
Tell me about a time you learned a new Azure service quickly to deliver a task.
Situation: our team needed event-driven processing and nobody had used Azure Functions. Task: I had one week to build a proof of concept. Action: I completed the Microsoft Learn module, built a blob-triggered function in a sandbox subscription, added Application Insights and shared a short demo and runbook. Result: the POC was approved, went live in three weeks and replaced a polling VM, cutting cost noticeably.
13
Why do you want to build a career in Microsoft Azure?
Situation: during my internship I saw most clients running Microsoft workloads like Windows Server, SQL Server and Active Directory. Task: I wanted skills that match that demand. Action: I cleared AZ-900, then studied AZ-104 and built labs with VNets, App Service and Bicep. Result: I can now deploy and troubleshoot real environments, and I want to grow toward an Azure architect role over the next few years.
14
How do Azure SLAs work and how do you calculate a composite SLA?
An SLA is Microsoft's uptime commitment per service, with service credits if it is missed. When services depend on each other in series, multiply their SLAs. An App Service at 99.95% calling Azure SQL at 99.99% gives about 0.9995 x 0.9999 = 99.94%. Adding redundancy, such as a second region behind Front Door, raises the combined figure because both paths must fail together.
15
Your VMs run 24x7, but their sizes and regions change every few months. Would you buy reservations or a savings plan?
Reservations give a big discount, up to about 72% versus pay-as-you-go, when you commit to a specific VM family, region and term of one or three years. Savings plans commit to a fixed hourly spend for one or three years and apply flexibly across VM sizes, regions, App Service and Functions Premium. Use reservations for very stable workloads and savings plans when your sizes or regions change.
Azure Arc extends the Azure control plane to servers, Kubernetes clusters and data services running on-premises or in other clouds. Once connected, those machines appear as Azure resources, so you can apply Azure Policy, RBAC, tags, Defender for Cloud, Update Manager and monitoring to them. It suits hybrid companies that keep some servers in their own datacenter but want one governance model.
17
Write an Azure PowerShell command to find all VMs without an env tag.
Filter Get-AzVM output on the Tags hashtable and export the result for review:
Connect-AzAccount
Get-AzVM | Where-Object {
-not $_.Tags -or -not $_.Tags.ContainsKey('env')
} | Select-Object Name, ResourceGroupName, Location |
Export-Csv untagged-vms.csv -NoTypeInformation
For large estates, Azure Resource Graph queries are faster across many subscriptions.
18
A team accidentally deleted a production resource group. How do you prevent this in future?
First recover what is possible: soft delete or backups for storage, Key Vault, SQL and VMs. Then add CanNotDelete locks on production groups, remove Owner and Contributor rights from individual users, and grant access through Entra groups with Privileged Identity Management for just-in-time elevation. Deploy infrastructure through pipelines only, and set activity log alerts on delete operations so the team is notified instantly.
19
Your manager asks you to estimate the monthly cost of a new Azure application. How do you do it?
List every component, such as App Service plan, Azure SQL tier, storage, bandwidth and monitoring, and model them in the Azure Pricing Calculator for the right region, Central India for example. Include egress, log ingestion and backup storage, which teams often forget. Compare pay-as-you-go with reservations or savings plans, then set a budget with alerts in Cost Management once deployed.
20
Explain the 5 Rs (or 6 Rs) of cloud migration in an Azure context.
Rehost moves VMs as-is using Azure Migrate. Refactor makes small changes, such as moving a web app to App Service. Rearchitect changes the design, for example splitting into microservices on AKS. Rebuild rewrites as cloud-native. Replace swaps the app for SaaS. Some lists add Retire or Retain. Azure Migrate assessments help choose per workload based on dependencies, cost and readiness.
It is Microsoft's guidance for building quality workloads, organised into five pillars: reliability, security, cost optimization, operational excellence and performance efficiency. Each pillar has design principles, checklists and trade-offs. Azure Advisor and the Well-Architected Review tool score workloads against it. In design interviews, structure answers by pillar to show you considered failure, security and cost, not only features.
22
How do you handle a situation where a cloud bill suddenly doubled?
Situation: our monthly Azure bill jumped from about 6 lakh to 12 lakh rupees. Task: find the cause within two days. Action: I used Cost Analysis grouped by resource and meter, found a Log Analytics workspace ingesting verbose debug logs and forgotten premium disks from a test. I fixed log levels, set a daily cap, deleted orphans and added budgets with alerts. Result: costs returned to normal the next month.
23
How would you set up a landing zone for a company moving to Azure?
Follow the Cloud Adoption Framework landing zone design. Create a management group hierarchy (platform, landing zones, sandbox, decommissioned), separate subscriptions for identity, management and connectivity, and a hub-spoke or Virtual WAN network. Apply Azure Policy for allowed regions, tagging and diagnostics, and assign RBAC through Entra groups. Deploy it all as code with Bicep or Terraform so new app subscriptions can be vended consistently.
24
How do you decide between IaaS and PaaS for migrating an on-premises application?
Start with constraints. If the app needs OS-level access, custom drivers or legacy software, a lift-and-shift to VMs is fastest. If it is a standard .NET, Java or Node web app with SQL Server, App Service plus Azure SQL removes patching and gives built-in scaling. Many teams lift and shift first to meet a datacenter exit date, then modernise to PaaS in a later phase.
25
How do you design an Azure subscription strategy for a large enterprise with many business units?
Use management groups that mirror governance needs rather than the org chart, for example Platform, Corp landing zones, Online landing zones and Sandbox. Give each application or business unit its own subscriptions per environment to isolate quotas, cost and blast radius. Automate subscription vending with pre-wired networking, policy and RBAC. Keep the hierarchy shallow, ideally three or four levels, to avoid policy confusion.
Frequently asked questions
How important is Azure Fundamentals in Microsoft Azure interviews?
Start with how Azure is organised: tenants, management groups, subscriptions, resource groups and Azure Resource Manager. Learn regions and availability zones in India, the shared responsibility model, SLAs, pricing, reservations and the Well-Architected Framework, plus how companies plan migrations and landing zones. These basics appear in every Azure interview and in the AZ-900 exam.
How should I use the Azure Fundamentals sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.