Exam AZ-801: Configuring Windows Server Hybrid Advanced Services

Microsoft Exam AZ-801 is designed for IT professionals configuring and managing Windows Server workloads across on-premises, hybrid, and Infrastructure as a Service (IaaS) environments. This certification targets individuals who are key in integrating Windows Server with Microsoft Azure, ensuring seamless operation and administration across diverse deployment models.

Role and Responsibilities

As a Windows Server Hybrid Administrator, your core responsibilities include:

Integrating on-premises Windows Server environments with Azure services.
Managing Windows Server instances deployed within local data centers.
Administering and maintaining Windows Server IaaS workloads hosted in Azure.
Supporting workload migration and deployment from on-premises infrastructure to Azure platforms.

In this capacity, collaboration is often required with professionals in the following roles:

Azure Administrators
Microsoft 365 Administrators
Network Engineers
Enterprise Architects

Key Skills and Competencies

Candidates pursuing this certification are expected to demonstrate proficiency in deploying, securing, configuring, updating, and packaging Windows Server workloads. This includes managing these workloads across on-premises, hybrid, and cloud infrastructures. You will be responsible for implementing solutions involving:

Identity and access management
Network and storage configuration
System security and monitoring
High availability and disaster recovery planning
Infrastructure management and performance optimization

Tools and Technologies Used

To effectively carry out the duties of this role, candidates should be skilled in using a range of administrative tools and cloud-based services, including:

Windows Admin Center – for centralized server management
PowerShell – for task automation and scripting
Azure Arc – for hybrid and multicloud resource management
Azure Monitor & Azure Policy – for observability and governance
Azure Update Manager – for managing system updates
Microsoft Defender for Identity & Defender for Cloud – for threat detection and security
IaaS Virtual Machines (VMs) – for virtual server deployment and maintenance

Prerequisites and Experience

Prospective candidates should have substantial experience working with various versions of the Windows Server operating system. A solid understanding of both traditional server environments and cloud-based infrastructures is essential for success in this certification path.

Exam Details

To successfully pass the AZ-801 certification exam, candidates must achieve a minimum score of 700. The exam is available in multiple languages to support a global audience, including English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Brazilian Portuguese, Traditional Chinese, and Italian. Microsoft is committed to providing an inclusive testing experience. If you rely on assistive technologies, require additional time, or need adjustments to any aspect of the exam due to a disability or specific need, you have the option to request accommodations through Microsoft’s official process. This ensures equitable access for all candidates pursuing certification.

Course Outline

The Microsoft AZ-801 exam covers the following topics:

Topic 1: Securing Windows Server on-premises and hybrid infrastructures (25–30%)

Secure Windows Server operating system

configuring and manage exploit protection (Microsoft Documentation: Enable exploit protection)
configure and manage Windows Defender Application Control (Microsoft Documentation: Windows Defender Application Control management with Configuration Manager)
configuring and manage Windows Defender for Servers
configure and manage Windows Defender Credential Guard (Microsoft Documentation: Manage Windows Defender Credential Guard)
configure SmartScreen (Microsoft Documentation: Microsoft Defender SmartScreen)
implement operating system security by using Group Policies (Microsoft Documentation: Security policy settings)

Secure a hybrid Active Directory infrastructure

configure password policies (Microsoft Documentation: Password policy recommendations)
enable password block lists (Microsoft Documentation: Configure custom banned passwords for Azure Active Directory password protection)
manage protected users (Microsoft Documentation: Protected Users Security Group)
manage account security on a RODC (Microsoft Documentation: Read-Only DCs and the Active Directory Schema)
harden domain controllers
configure authentication policies silos (Microsoft Documentation: Authentication Policies and Authentication Policy Silos)
restrict access to domain controllers (Microsoft Documentation: Securing Domain Controllers Against Attack)
configure account security (Microsoft Documentation: What are security defaults?)
manage AD built-in administrative groups (Microsoft Documentation: Active Directory Security Groups)
manage AD delegation (Microsoft Documentation: Delegating Administration by Using OU Objects)
implement and manage Microsoft Defender for Identity (Microsoft Documentation: What is Microsoft Defender for Identity?)

Identify and remediate Windows Server security issues by using Azure services

monitor on-premises servers and Azure IaaS VMs by using Sentinel
identify and remediate security issues on-premises servers and Azure IaaS VMs by using Microsoft Defender for Cloud (Microsoft Documentation: Microsoft Defender for Cloud, Security best practices for IaaS workloads in Azure)

Secure Windows Server networking

manage Windows Defender Firewall (Microsoft Documentation: Best practices for configuring Windows Defender Firewall)
implement domain isolation(Microsoft Documentation: Domain Isolation Policy Design)
implement connection security rules (Microsoft Documentation: Configure the Rules to Require Encryption)

Secure Windows Server storage

manage Windows BitLocker Drive Encryption (BitLocker) (Microsoft Documentation: BitLocker)
manage and recover encrypted volumes (Microsoft Documentation: Back up and restore encrypted Azure virtual machines)
enable storage encryption by using Azure Disk Encryption (Microsoft Documentation: Overview of managed disk encryption options)
manage disk encryption keys for IaaS virtual machines

Topic 2: Implementing and managing Windows Server high availability (10–15%)

Implement a Windows Server failover cluster

implement a failover cluster on-premises, hybrid, or cloud-only (Microsoft Documentation: Connecting Windows Server to Azure hybrid services)
create a Windows failover cluster (Microsoft Documentation: Create a failover cluster)
stretch cluster across datacenter or Azure regions (Microsoft Documentation: Stretched clusters overview)
configure storage for failover clustering (Microsoft Documentation: Create a failover cluster)
modify quorum options (Microsoft Documentation: Configure and manage quorum)
configure network adapters for failover clustering (Microsoft Documentation: Create a failover cluster)
configuring cluster workload options
configure cluster sets (Microsoft Documentation: Deploy a cluster set)
configure Scale-Out File Servers (Microsoft Documentation: Scale-Out File Server for application data overview)
create an Azure witness (Microsoft Documentation: Deploy a Cloud Witness for a Failover Cluster)
configure a floating IP address for the cluster (Microsoft Documentation: Guest clustering in a virtual network)
implement load balancing for the failover cluster (Microsoft Documentation: Configure Azure Load Balancer for an FCI VNN)

Manage failover clustering

implement cluster-aware updating (Microsoft Documentation: Cluster-Aware Updating overview)
recover a failed cluster node (Microsoft Documentation: Recover from failover cluster instance failure)
upgrade a node to Windows Server 2022 (Microsoft Documentation: Install, upgrade, or migrate to Windows Server)
failover workloads between nodes (Microsoft Documentation: Use Cluster Shared Volumes in a failover cluster)
install Windows updates on cluster nodes
manage failover clusters using Windows Admin Center (Microsoft Documentation: Manage Failover Clusters with Windows Admin Center)

Implement and manage Storage Spaces Direct

create a failover cluster using Storage Spaces Direct (Microsoft Documentation: Storage Spaces Direct overview)
upgrade a Storage Spaces Direct node (Microsoft Documentation: Upgrade a Storage Spaces Direct cluster to Windows Server 2019)
implement networking for Storage Spaces Direct (Microsoft Documentation: Deploy Storage Spaces Direct)
configure Storage Spaces Direct (Microsoft Documentation: Deploy Storage Spaces Direct)

Topic 3: Implementing disaster recovery (10–15%)

Manage backup and recovery for Windows Server

back up and restore files and folders to Azure Recovery Services vault (Microsoft Documentation: Recover files from Azure virtual machine backup)
install and manage Azure Backup Server (Microsoft Documentation: Install and upgrade Azure Backup Server)
back up and recover using Azure Backup Server
manage backups in Azure Recovery Services vault (Microsoft Documentation: Create and configure a Recovery Services vault)
create a backup policy (Microsoft Documentation: Manage Azure VM backups with Azure Backup service)
configure backup for Azure Virtual Machines using the built-in backup agent (Microsoft Documentation: Back up an Azure VM from the VM settings)
recover a VM using temporary snapshots (Microsoft Documentation: How to restore Azure VM data in Azure portal)
recover VMs to new Azure Virtual Machines
restore a VM

Implement disaster recovery by using Azure Site Recovery

configure Azure Site Recovery networking (Microsoft Documentation: About networking in Azure VM disaster recovery)
configuring Site Recovery for on-premises VMs (Microsoft Documentation: Set up disaster recovery to Azure for on-premises VMware VMs – Classic)
configure a recovery plan (Microsoft Documentation: Create and customize recovery plans)
configure Site Recovery for Azure VMs (Microsoft Documentation: Set up disaster recovery to a secondary Azure region for an Azure VM)
implement VM replication to a secondary datacenter or Azure region
configure Azure Site Recovery policies (Microsoft Documentation: Set up disaster recovery for Azure VMs)

Protect virtual machines by using Hyper-V replicas

configure Hyper-V hosts for replication
manage Hyper-V replica servers (Microsoft Documentation: Set up Hyper-V Replica)
configure VM replication (Microsoft Documentation: Set up Hyper-V Replica)
perform a failover (Microsoft Documentation: Create a failover cluster)

Topic 4: Migrating servers and workloads (20–25%)

Migrate on-premises storage to on-premises servers or Azure

transfer data and share
cut over to a new server by using Storage Migration Service (Microsoft Documentation: Storage Migration Service overview)
use Storage Migration Service to migrate to Azure VMs (Microsoft Documentation: Use Storage Migration Service to migrate a server)
migrate to Azure file shares (Microsoft Documentation: Migrate to Azure file shares)

Migrate on-premises servers to Azure

deploy and configure Azure Migrate appliance (Microsoft Documentation: Set up an appliance for servers in a VMware environment)
migrate VM workloads to Azure IaaS (Microsoft Documentation: Migrate VMware VMs to Azure (agentless))
migrate physical workloads to Azure IaaS (Microsoft Documentation: Migrate machines as physical servers to Azure)
migrating by using Azure Migrate

Migrate workloads from previous versions to Windows Server 2022

migrating IIS (Microsoft Documentation: Migrate a Web Site from IIS 6.0 to IIS 7 or above)
migrate Hyper-V hosts (Microsoft Documentation: Migrate Hyper-V VMs to Azure)
migrate RDS host servers (Microsoft Documentation: Migrate your Remote Desktop Services deployment to Windows Server 2016)
migrating DHCP (Microsoft Documentation: Dynamic Host Configuration Protocol (DHCP))
migrating print servers

Migrate IIS workloads to Azure

migrate IIS workloads to Azure Web Apps (Microsoft Documentation: Migrate an on-premises web application to Azure App Service)
migrating IIS workloads to containers

Migrate an AD DS infrastructure to Windows Server 2022 AD DS

migrating AD DS objects, including users, groups and Group Policies, using AD Migration Tool (Microsoft Documentation: Administer Group Policy in an Azure Active Directory Domain Services managed domain)
migrate to a new Active Directory forest (Microsoft Documentation: Support information for ADMT and PES)
upgrade an existing forest (Microsoft Documentation: Upgrade Domain Controllers to Windows Server 2016)

Topic 5: Monitoring and troubleshooting Windows Server environments (20–25%)

Monitor Windows Server by using Windows Server tools and Azure services

monitor Windows Server by using Performance Monitor (Microsoft Documentation: Set up Performance Counters in Windows Performance Monitor)
create and configure Data Collector Sets (Microsoft Documentation: Creating a Data Collector for Business Central Performance Counters)
monitor servers and configure alerts by using Windows Admin Center (Microsoft Documentation: Monitor servers and configure alerts with Azure Monitor from Windows Admin Center)
monitor by using System Insights (Microsoft Documentation: System Insights overview)
manage event logs (Microsoft Documentation: Collect Windows event log data sources with Log Analytics agent)
deploy Azure Monitor Agents
collect performance counters to Azure (Microsoft Documentation: Collect Windows and Linux performance data sources with Log Analytics agent)
create alerts (Microsoft Documentation: Overview of alerts in Microsoft Azure)
monitor Azure VMs by using Azure diagnostics extension (Microsoft Documentation: Azure Diagnostics extension overview)
monitor Azure VMs performance by using VM insights (Microsoft Documentation: Overview of VM insights)

Troubleshoot Windows Server on-premises and hybrid networking

troubleshooting hybrid network connectivity (Microsoft Documentation: Azure App Service Hybrid Connections)
troubleshooting on-premises connectivity (Microsoft Documentation: Troubleshoot on-premises network connections)

Troubleshoot Windows Server virtual machines in Azure

troubleshooting deployment failures (Microsoft Documentation: Troubleshoot common Azure deployment errors with Azure Resource Manager)
troubleshoot booting failures (Microsoft Documentation: Troubleshoot Windows VM OS boot failure)
troubleshooting VM performance issues (Microsoft Documentation: Troubleshoot Azure virtual machine performance on Linux or Windows)
troubleshoot VM extension issues (Microsoft Documentation: Troubleshoot Azure Backup failure: Issues with the agent or extension)
troubleshooting disk encryption issues (Microsoft Documentation: Azure Disk Encryption troubleshooting guide)
troubleshoot storage (Microsoft Documentation: Monitor, diagnose, and troubleshoot Microsoft Azure Storage)
troubleshooting VM connection issues

Troubleshoot Active Directory

restore objects from AD recycle bin (Microsoft Documentation: Advanced AD DS Management Using Active Directory Administrative Center)
recover Active Directory database using Directory Services Restore Mode (Microsoft Documentation: Restoring an Active Directory Server)
recover SYSVOL (Microsoft Documentation: How to rebuild the SYSVOL tree and its content in a domain)
troubleshoot Active Directory replication (Microsoft Documentation: Troubleshooting Active Directory Replication Problems)
troubleshooting hybrid authentication issues (Microsoft Documentation: Troubleshoot hybrid Azure AD-joined devices)
troubleshoot on-premises Active Directory (Microsoft Documentation: Troubleshoot object synchronization with Azure AD Connect sync)

Microsoft AZ-801 Exam FAQs

Click here for FAQs!

Exam Policies

Microsoft’s certification exam policies provide critical details about the exam process, covering delivery methods, candidate conduct, and the rules to be followed during the assessment or at authorized testing centers. These policies are designed to maintain consistency and fairness across all exam experiences, ensuring that every candidate is evaluated in an equitable testing environment.

Retake Policy

Candidates who do not pass the exam on their first attempt are required to wait a minimum of 24 hours before scheduling a retake. During this waiting period, candidates can log into their certification dashboard to reschedule the exam. If a second attempt is unsuccessful, the mandatory waiting period increases to 14 days. This 14-day waiting period also applies between the third and fourth, as well as the fourth and fifth, attempts. Furthermore, candidates are limited to five exam attempts within a 12-month period, starting from their initial attempt.

Rescheduling and Cancellation Policy

Microsoft provides flexibility for candidates who need to reschedule or cancel their exam appointments. There is no fee for rescheduling or canceling an exam if done at least six business days before the scheduled date. However, changes made within five business days of the exam will incur a rescheduling or cancellation fee. In the event of a no-show or failure to reschedule at least 24 hours in advance, the entire exam fee will be forfeited. Microsoft may, under certain circumstances, such as accessibility or emergency situations, waive these fees temporarily.

Microsoft AZ-801 Exam Study Guide

1. Understand the Exam Objectives

To effectively prepare for the AZ-801 exam, it is crucial to thoroughly understand the exam objectives. These objectives outline the key skills and knowledge areas that the exam will test, providing a clear framework for study and preparation. The exam focuses on a range of topics related to configuring and managing Windows Server Hybrid Advanced Services, including integrating on-premises environments with Azure, managing workloads in both cloud and on-premises settings, and ensuring the efficient operation of these services.

By reviewing the exam objectives, candidates can prioritize their study efforts, ensuring they cover the essential areas such as identity and security management, system monitoring, high availability, and disaster recovery. Understanding these objectives not only helps in targeting the right resources but also boosts confidence, ensuring candidates are well-prepared to meet the exam’s demands and achieve certification.

2. Use the Official Microsoft Learning Path

Following the Microsoft Learning Path is an essential strategy for effective preparation for the AZ-801 exam. The learning path is a structured and comprehensive guide that provides detailed courses, tutorials, and hands-on labs designed to help candidates acquire the necessary skills and knowledge. This pathway covers all the critical aspects of configuring and managing Windows Server Hybrid Advanced Services, ensuring that you are well-equipped to handle the exam objectives. By following the Microsoft Learning Path, candidates gain a step-by-step approach to mastering topics such as Azure integration, server management, identity and security solutions, and disaster recovery. This learning method not only helps in building practical skills but also reinforces theoretical knowledge, offering a well-rounded preparation experience. Adhering to this structured approach ensures that candidates stay on track and are fully prepared for the exam. However, the modules include:

3. Take Reference from Microsoft Documentation

Referring to Microsoft Docs is a vital part of preparing for the AZ-801 exam, as it offers in-depth, official technical documentation directly from Microsoft. These resources provide comprehensive explanations, real-world use cases, and up-to-date information on the technologies covered in the exam, including Windows Server, Azure services, and hybrid infrastructure. Microsoft Docs allows candidates to dive deeper into specific features, configurations, and best practices that may not be fully covered in training courses. It’s particularly valuable for clarifying complex topics, exploring advanced scenarios, and staying informed about recent updates or changes in the platform. Leveraging this authoritative source ensures candidates build a solid, practical understanding of key concepts and are better equipped to handle both theoretical questions and real-world tasks during the exam and in professional environments.

4. Join Study Groups

Joining study groups can significantly enhance your preparation for the AZ-801 exam through collaborative learning. Engaging with a community of peers allows you to exchange knowledge, clarify complex topics, and gain different perspectives on key concepts. Study groups often foster discussion around real-world scenarios, share valuable resources, and provide moral support throughout the exam journey. Interacting with others who are preparing for the same certification can help identify gaps in your understanding and reinforce learning through group problem-solving and shared experiences. Whether through online forums, social media groups, or dedicated platforms, participating in a study group creates a supportive learning environment that can improve retention and boost your confidence as you prepare for the AZ-801 exam.

5. Take AZ-801 Practice Tests

Taking AZ-801 practice tests is a crucial step in evaluating your readiness for the certification exam. These practice assessments simulate the format and difficulty level of the actual test, helping you become familiar with the types of questions you may encounter. By completing practice tests, you can identify your strengths and pinpoint areas that need further improvement. They also help improve time management skills, build confidence, and reduce exam-day anxiety. Regularly testing your knowledge allows you to track your progress and adjust your study plan accordingly. Incorporating practice exams into your preparation strategy ensures a more focused and effective approach, increasing your chances of success on the AZ-801 certification exam.