50 Azure Interview Questions (With Answers)

Azure interviews test your understanding of cloud fundamentals, Azure-specific services, networking, security, and architecture patterns. This guide covers the 50 most common questions — with concise answers, comparisons, and real examples.

Quick reference

Core Concepts

1. What is the Azure global infrastructure?

Azure currently has 60+ regions worldwide — more than any other cloud provider.

2. What is an Azure Resource Group?

A Resource Group is a logical container for Azure resources that share the same lifecycle, permissions, and billing context.

Key properties:

• All resources must belong to exactly one Resource Group
• Resources in different regions can share one Resource Group
• Deleting a Resource Group deletes all contained resources
• RBAC and tags applied to a Resource Group cascade to child resources
• Resources can be moved between Resource Groups (Move-AzResource)

Subscription
└── Resource Group (rg-prod-eastus)
    ├── VM (vm-api-01)
    ├── Storage Account (stproddata)
    ├── Virtual Network (vnet-prod)
    └── Key Vault (kv-prod-secrets)

3. What is the Azure hierarchy?

Management Group (org-wide governance)
└── Subscription (billing unit)
    └── Resource Group (lifecycle container)
        └── Resource (VM, Storage, etc.)

4. What is the difference between Azure Regions and Availability Zones?

5. What is an Azure Subscription?

A subscription is a billing and access boundary in Azure:

• Contains resources and is billed separately
• Has limits (quotas) per service (e.g., 20 vCPUs per region for free tier)
• Linked to an Azure AD tenant for identity
• Common patterns: dev/staging/prod subscriptions, per-team subscriptions

Subscription types: Free, Pay-As-You-Go, Enterprise Agreement (EA), CSP, Visual Studio.

IAM & Security

6. What is Azure Active Directory (Azure AD / Microsoft Entra ID)?

Azure AD (now rebranded as Microsoft Entra ID) is Azure's cloud-native identity platform:

Azure AD ≠ on-premises Windows Active Directory. Azure AD is HTTP/S based (OAuth 2.0, OIDC, SAML), not LDAP/Kerberos.

7. What is Azure RBAC?

Role-Based Access Control manages who can do what on Azure resources:

Built-in roles:

• Owner — full access + can manage access
• Contributor — full access but cannot manage access
• Reader — view only
• User Access Administrator — manage access only

8. What is a Managed Identity?

A Managed Identity is an automatically managed service principal in Azure AD for an Azure resource — no credentials to manage.

# Assign system-assigned managed identity to VM
az vm identity assign --resource-group rg-prod --name vm-api

# Grant Key Vault access to the managed identity
az keyvault set-policy --name kv-prod \
  --object-id <identity-principal-id> \
  --secret-permissions get list

9. What is Azure Key Vault?

Azure Key Vault is a secrets management service for storing keys, secrets, and certificates:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://kv-prod.vault.azure.net", credential=credential)
secret = client.get_secret("db-connection-string")
print(secret.value)

10. What is Microsoft Defender for Cloud?

Defender for Cloud (formerly Azure Security Center + Azure Defender) provides:

Compute

11. What are Azure VM sizes and families?

12. What is Azure App Service?

App Service is a fully managed PaaS for hosting web apps, APIs, and mobile backends:

Multiple apps share one App Service Plan (shared compute).

13. What is the difference between Azure Functions and Azure Logic Apps?

14. What is Azure Kubernetes Service (AKS)?

AKS is managed Kubernetes on Azure:

• Azure manages the control plane (API server, etcd, scheduler) — free
• You manage node pools (VM Scale Sets)
• Supports system node pools (system components) + user node pools (workloads)
• Integration: Azure CNI, Azure AD workload identity, Azure Monitor, Azure Policy (Gatekeeper)
• Virtual Nodes — burst to Azure Container Instances serverlessly
• KEDA — event-driven autoscaling (built-in)
• Spot node pools — cost savings for fault-tolerant workloads

# Create AKS cluster
az aks create \
  --resource-group rg-prod \
  --name aks-prod \
  --node-count 3 \
  --enable-addons monitoring \
  --generate-ssh-keys

# Get credentials
az aks get-credentials --resource-group rg-prod --name aks-prod

15. What is Azure Container Apps?

Container Apps is a serverless container platform built on Kubernetes + KEDA + Dapr:

Storage

16. What are Azure Storage account types and their use cases?

17. What are Blob Storage access tiers?

Rehydration from Archive: Standard (up to 15 hrs) or High priority (under 1 hr, expensive).

18. What is Azure Blob Storage redundancy?

19. What is Azure Data Lake Storage Gen2 (ADLS Gen2)?

ADLS Gen2 = Blob Storage + hierarchical namespace (HNS):

• Enables directory semantics (rename/move in O(1), not O(n))
• Compatible with HDFS API (Hadoop, Spark, Databricks)
• Fine-grained POSIX-style ACLs at file/directory level
• Used with Azure Synapse Analytics, Azure Databricks, HDInsight
• Tiering still available (Hot/Cool/Archive)

20. What is the difference between Azure Blob Storage and Azure Files?

Networking

21. What is an Azure Virtual Network (VNet)?

A VNet is a logically isolated network in Azure:

• You define the IP address space (CIDR) e.g. 10.0.0.0/16
• Divided into subnets (e.g. 10.0.1.0/24 for web tier)
• Resources within a VNet communicate privately by default
• Connects to on-premises via VPN Gateway or ExpressRoute
• Connects to other VNets via VNet Peering
• Default outbound internet access (can be restricted)

az network vnet create \
  --resource-group rg-prod \
  --name vnet-prod \
  --address-prefix 10.0.0.0/16 \
  --subnet-name snet-web \
  --subnet-prefix 10.0.1.0/24

22. What is the difference between NSG and Azure Firewall?

Use both: NSGs for subnet-level filtering, Azure Firewall for central egress control.

23. What is Azure Load Balancer vs Application Gateway vs Front Door?

24. What is VNet Peering?

VNet Peering connects two VNets so traffic flows over Azure backbone (private, low latency, high bandwidth):

• Local peering — same Region
• Global peering — different Regions
• Non-transitive by default (A↔B, B↔C does NOT mean A↔C)
• Use Azure Firewall or NVA for hub-spoke transitive routing
• No bandwidth limits, charged per GB transferred

25. What is Azure Private Link / Private Endpoint?

Private Endpoint = a private IP in your VNet for a PaaS service (Blob, SQL, Key Vault, etc.):

• Traffic stays on Azure backbone, never traverses public internet
• Disables public access to the service
• Works across tenants and subscriptions
• Required for compliance (PCI-DSS, HIPAA)

az network private-endpoint create \
  --resource-group rg-prod \
  --name pe-storage \
  --vnet-name vnet-prod \
  --subnet snet-private \
  --private-connection-resource-id /subscriptions/.../storageAccounts/stprod \
  --connection-name psc-storage \
  --group-id blob

Databases

26. What is Azure SQL Database vs Azure SQL Managed Instance vs SQL Server on VM?

27. What is Azure Cosmos DB?

Cosmos DB is a globally distributed, multi-model NoSQL database:

The 5 consistency levels are unique to Cosmos DB — you trade consistency for latency/throughput.

28. What is the difference between Azure Cache for Redis and Azure Cosmos DB?

29. What is Azure Synapse Analytics?

Synapse is a unified analytics platform combining:

Use Synapse for large-scale analytics and data warehousing; use Azure SQL Database for OLTP.

Azure DevOps & Pipelines

30. What is Azure DevOps?

Azure DevOps is a set of developer services:

Integrates with GitHub, Jira, Slack, ServiceNow. Free for public projects, 5 free users for private.

31. What is an Azure Pipeline?

An Azure Pipeline is a YAML-defined CI/CD workflow:

trigger:
  branches:
    include: [main]

pool:
  vmImage: ubuntu-latest

stages:
- stage: Build
  jobs:
  - job: BuildApp
    steps:
    - task: NodeTool@0
      inputs:
        versionSpec: '20.x'
    - script: npm ci && npm run build
    - task: PublishBuildArtifacts@1
      inputs:
        pathToPublish: dist

- stage: Deploy
  dependsOn: Build
  jobs:
  - deployment: DeployProd
    environment: production
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            inputs:
              appType: webApp
              appName: app-prod

Key concepts: stages (major phases), jobs (parallel units), steps (tasks/scripts), environments (approval gates), service connections (auth to Azure).

32. What is the difference between Azure DevOps and GitHub Actions?

Monitoring & Management

33. What is Azure Monitor?

Azure Monitor is the unified monitoring platform for Azure:

34. What is Application Insights?

Application Insights is an APM (Application Performance Monitoring) service:

• Auto-collects: request rates, response times, failure rates, dependency calls
• Distributed tracing with correlation IDs across services
• Live Metrics — real-time stream
• Availability tests — ping tests from global PoPs
• Smart detection — anomaly detection (spike in failures, unusual latency)
• SDKs for .NET, Java, Node.js, Python, JavaScript

from applicationinsights import TelemetryClient
tc = TelemetryClient('<instrumentation_key>')
tc.track_event('UserSignup', {'plan': 'pro'})
tc.track_metric('OrderValue', 99.99)
tc.flush()

35. What is Azure Policy?

Azure Policy enforces organizational standards and compliance at scale:

Built-in initiatives: CIS Azure Benchmark, NIST SP 800-53, PCI-DSS, Azure Security Benchmark.

AI & Machine Learning

36. What is Azure OpenAI Service?

Azure OpenAI provides access to OpenAI models (GPT-4o, GPT-4, o1, DALL-E, Whisper, text-embedding) via Azure infrastructure:

from openai import AzureOpenAI

client = AzureOpenAI(
    azure_endpoint="https://my-resource.openai.azure.com",
    api_key="<azure-api-key>",
    api_version="2024-10-21"
)
response = client.chat.completions.create(
    model="gpt-4o",  # deployment name
    messages=[{"role": "user", "content": "Explain Azure RBAC"}]
)

37. What is Azure Machine Learning?

Azure ML is an enterprise-grade ML platform:

Architecture & Best Practices

38. What is the Azure Well-Architected Framework?

Five pillars for cloud-native design:

39. What is a Hub-Spoke network topology in Azure?

Hub-Spoke is the most common Azure network architecture:

                  ┌──────────────────┐
                  │   Hub VNet       │
                  │  Azure Firewall  │
                  │  VPN/ExpressRoute│
                  │  Shared Services │
                  └────────┬─────────┘
                           │ VNet Peering (non-transitive)
              ┌────────────┼─────────────┐
              │            │             │
        ┌─────▼────┐ ┌─────▼────┐ ┌─────▼────┐
        │ Spoke 1  │ │ Spoke 2  │ │ Spoke 3  │
        │ (Dev)    │ │ (Staging)│ │ (Prod)   │
        └──────────┘ └──────────┘ └──────────┘

Hub contains shared services (firewall, DNS, VPN gateway). Spokes route internet egress through the hub. Traffic between spokes goes via hub firewall (hairpinning).

Azure Virtual WAN automates this pattern at scale.

40. What is Azure Landing Zone?

A Landing Zone is a pre-configured Azure environment that implements enterprise best practices:

• Management Group hierarchy
• Policy assignments (Azure Policy Initiatives)
• RBAC roles
• Hub network (connectivity subscription)
• Log Analytics workspace
• Azure Defender enabled

Deployed via Enterprise-Scale Landing Zone (Bicep/Terraform templates). Platform team manages hub; application teams manage spoke subscriptions.

Additional Questions

41. What is Azure ExpressRoute?

ExpressRoute is a private, dedicated circuit between on-premises and Azure:

ExpressRoute doesn't traverse the public internet — required for financial services and healthcare.

42. What is Azure Service Bus vs Azure Event Hub vs Azure Event Grid?

43. What is Azure Logic Apps?

Logic Apps is a visual workflow orchestration service:

• 400+ connectors: Office 365, Salesforce, SAP, Oracle, Twitter, SQL, Blob
• Built-in connectors: HTTP, schedule, condition, loops, variables, scope
• Stateful workflows with checkpointing (Standard plan)
• Integration Service Environment (ISE) — VNet-injected for secure integration
• Trigger types: HTTP request, schedule, connector events (new email, new row)

Pricing: Consumption (per action) or Standard (per app, vCores).

44. What is Azure Bicep?

Bicep is a domain-specific language (DSL) that transpiles to ARM JSON templates:

param location string = resourceGroup().location
param storageAccountName string

resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
  }
}

output storageId string = storage.id

Bicep vs Terraform:

• Bicep: Azure-only, first-class ARM support, free, no state file
• Terraform: Multi-cloud, large ecosystem, state management required

45. What is Azure Active Directory B2C?

Azure AD B2C is a customer identity solution for external-facing apps:

• Supports email/password, social login (Google, Facebook, Apple, GitHub)
• Custom user flows (sign-up, sign-in, password reset, profile edit)
• Custom policies (Identity Experience Framework) for advanced scenarios
• Scales to hundreds of millions of users
• Separate tenant from corporate Azure AD
• Integration: OIDC, SAML, OAuth 2.0
• Free tier: 50,000 MAU/month

46. What is Azure Cost Management?

Azure Cost Management + Billing provides:

Cost optimisation strategies:

• Reserved Instances — 1–3 year commitment, up to 72% savings
• Azure Hybrid Benefit — reuse Windows Server / SQL Server licenses
• Azure Spot VMs — up to 90% savings for interruptible workloads
• Dev/test subscriptions — discounted rates for non-production
• Auto-shutdown — stop VMs outside business hours

47. What is Azure Site Recovery (ASR)?

ASR is a disaster recovery and migration service:

• Replicates VMs (Azure, VMware, Hyper-V, physical) to a target Azure Region
• RPO: typically 30 seconds for Azure VMs
• RTO: typically <2 hours
• Test failover: non-disruptive DR drills in isolated VNet
• Failover + failback supported
• Used for both DR and lift-and-shift migration

48. What is Azure Arc?

Azure Arc extends Azure management to non-Azure environments:

49. What is the difference between SLA, SLO, and RPO/RTO in Azure context?

Composite SLA: if App Service = 99.95% AND SQL = 99.99%, combined = 99.95% × 99.99% ≈ 99.94%.

50. What is the Azure Shared Responsibility Model for different service types?

The higher you move up the stack (IaaS → PaaS → SaaS), the less you manage.

Common mistakes

Azure vs AWS vs GCP

6 FAQ

Q: What Azure certification should I study for first? A: AZ-900 (Azure Fundamentals) for non-technical roles; AZ-104 (Azure Administrator) or AZ-204 (Azure Developer) for technical roles. Solutions architects: AZ-305.

Q: What is the difference between Azure AD and on-premises Active Directory? A: Azure AD is cloud-native (OAuth 2.0, OIDC, SAML — no LDAP/Kerberos). On-prem AD uses Kerberos/LDAP. Azure AD Connect syncs on-prem identities to Azure AD. Azure AD DS provides managed domain services (LDAP, Kerberos) in the cloud.

Q: Is Cosmos DB free? A: There's a free tier (1,000 RU/s + 25 GB per account), and a serverless mode where you pay only for RUs consumed. No continuous free tier beyond the free account limits.

Q: When should I use Azure Functions vs App Service? A: Use Azure Functions for event-driven, short-lived tasks (HTTP trigger, queue consumer, timer). Use App Service for long-running web apps and APIs that need persistent connections, WebSockets, or predictable latency.

Q: What is the difference between Azure DevOps and GitHub? A: GitHub is the developer platform (code, PRs, Issues, Actions CI/CD). Azure DevOps is a broader suite (Boards, Repos, Pipelines, Artifacts, Test Plans). Both are Microsoft products and integrate with each other. New projects often choose GitHub; large enterprises with existing Azure DevOps stay there.

Q: How do Azure Reserved Instances work? A: You commit to using a specific VM family and region for 1 or 3 years, paying upfront or monthly. You save up to 72% vs pay-as-you-go. Reservations are flexible — they apply to matching VM sizes in the same family. Best for stable workloads running >80% of the time.