Domain 1: Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments
- AD DS is deployed by installing the role and promoting the server with Install-ADDSForest (new forest) or Install-ADDSDomainController (add a DC); DCs host a writable copy of the directory unless deployed as a Read-Only Domain Controller (RODC).
- A Read-Only Domain Controller holds a read-only replica and caches only permitted credentials (password replication policy), making it suited to branch sites with weaker physical security.
- The five FSMO roles (Schema Master, Domain Naming Master, RID Master, PDC Emulator, Infrastructure Master) hold operations that must be singular; transfer them gracefully with Move-ADDirectoryServerOperationMasterRole or seize when a holder is permanently lost.
- Group Policy applies settings by linking GPOs to sites, domains, and OUs; precedence is Local, Site, Domain, OU (LSDOU) with the last applied winning, and Enforced links and Block Inheritance change the order.
- Group-managed service accounts (gMSAs) provide automatic password management for services across multiple hosts; create the KDS root key first, then New-ADServiceAccount.
- AD DS sites and subnets steer clients to the nearest DC and control replication topology; the KCC builds connection objects and replication compresses traffic between sites.
- Azure AD Connect (now Microsoft Entra Connect) synchronizes on-premises identities to Entra ID for hybrid identity, using password hash sync, pass-through authentication, or federation, plus optional seamless SSO.
- Microsoft Entra Domain Services (Azure AD DS) provides a managed domain (LDAP, Kerberos, domain join, GPO) in Azure without you running domain controllers - useful for lift-and-shift workloads that need traditional AD.
- Protect Tier 0 assets (Domain Admins, DCs) with a privileged-access model, restricted logon rights, and secure administrative workstations; the Protected Users group hardens credentials.
- Trusts (forest, external, realm) let users in one domain access resources in another; a forest trust between two forest root domains is transitive across all their domains.
Domain 2: Manage Windows Servers and workloads in a hybrid environment
- Windows Admin Center (WAC) is a browser-based tool that manages servers, clusters, and hyper-converged infrastructure locally or through the Azure portal, replacing many legacy MMC consoles.
- Azure Arc projects on-premises and multicloud servers into Azure as Arc-enabled servers, so you can apply Azure Policy, inventory, Update Management, Microsoft Defender, and run extensions on them.
- PowerShell remoting (WinRM) runs commands on remote servers with Enter-PSSession (interactive) and Invoke-Command (fan-out to many hosts); it is the primary way to manage Server Core.
- Server Core installs Windows Server without a desktop GUI to reduce attack surface and patching; configure it with sconfig, PowerShell, or remotely via WAC/RSAT.
- Azure Automation with PowerShell DSC (or the machine configuration feature) enforces desired state on servers so configuration drift is corrected automatically.
- Just Enough Administration (JEA) constrains remote PowerShell sessions to specific cmdlets and parameters via role capability and session configuration files, limiting what an operator can do.
- Azure Monitor and Log Analytics collect performance and event data from servers (including Arc-enabled ones) for centralized monitoring, alerting, and workbooks.
- Azure Update Manager (successor to Update Management) orchestrates OS patching across Azure and Arc-enabled servers on schedules with maintenance windows.
- Windows Server event forwarding (source- or collector-initiated with wecutil/WEF) centralizes event logs from many servers to a collector for review.
- Azure Hybrid Benefit lets you apply on-premises Windows Server licenses with Software Assurance to reduce the cost of Azure VMs.
Domain 3: Manage virtual machines and containers
- Hyper-V is the Windows Server hypervisor; VMs are Generation 1 (BIOS, broad compatibility) or Generation 2 (UEFI, Secure Boot, boot from SCSI, required for shielded VMs).
- Virtual switches connect VMs to networks: External (bound to a physical NIC), Internal (host + VMs), and Private (VMs only); NIC teaming or SET provides adapter redundancy for the host.
- Checkpoints capture point-in-time VM state; standard checkpoints include memory, while production checkpoints use VSS for application-consistent, supported snapshots.
- Live Migration moves a running VM between hosts with no downtime; Storage Migration moves its files, and both underpin failover clustering with clustered VMs on Cluster Shared Volumes.
- Dynamic Memory adjusts a VM's RAM within min/max bounds based on demand, and nested virtualization exposes virtualization extensions to a VM so it can run Hyper-V or containers.
- Windows Server supports Windows containers in two isolation modes: process isolation (shares the host kernel, lighter) and Hyper-V isolation (each container in a lightweight VM, stronger isolation).
- Container images are built from a base image with a Dockerfile and stored in a registry (such as Azure Container Registry); tags identify versions.
- Shielded VMs use the Host Guardian Service and a virtual TPM to encrypt VM state and disks, protecting tenant VMs from a compromised or malicious fabric administrator.
- Azure Migrate discovers and assesses on-premises servers and migrates them to Azure VMs, providing right-sizing and dependency analysis.
- Integration services (and the guest agent) enable features like heartbeat, backup, and time sync between the host and the guest OS.
Domain 4: Implement and manage an on-premises and hybrid networking infrastructure
- The DNS Server role resolves names using forward and reverse lookup zones; conditional forwarders send queries for specific domains to designated servers, and forwarders handle everything else.
- DNS zones can be primary, secondary, or Active Directory-integrated (stored in AD, multi-master, secured with secure dynamic updates); DNSSEC signs zones to prevent spoofing.
- The DHCP Server role leases IP configuration from scopes; DHCP failover (hot standby or load sharing) keeps leases available if one server fails, and reservations pin an address to a MAC.
- IP Address Management (IPAM) centrally discovers and manages DHCP and DNS servers and tracks IP address space across the enterprise.
- Name resolution records matter: A/AAAA map names to addresses, PTR handle reverse lookups, CNAME are aliases, and SRV locate services such as domain controllers.
- Network Policy Server (NPS) provides RADIUS authentication and policy for VPN, wireless, and 802.1X access.
- Hybrid connectivity to Azure uses site-to-site VPN or ExpressRoute; the Azure Network Adapter (via Windows Admin Center) creates a point-to-site connection from a server to an Azure VNet.
- Azure Extended Network stretches an on-premises subnet into Azure so migrated servers keep their IP addresses during hybrid migrations.
- NIC teaming aggregates multiple network adapters for bandwidth and fault tolerance; Switch Embedded Teaming (SET) integrates teaming with the Hyper-V virtual switch.
- DNS policies and round robin influence which records are returned, supporting traffic management and split-brain DNS scenarios.
Domain 5: Manage storage and file services
- Storage Spaces pools physical disks into virtual disks with resiliency (mirror, parity); Storage Spaces Direct (S2D) builds hyper-converged, highly available storage from local disks across cluster nodes.
- DFS Namespaces present a single logical folder path over shares on multiple servers, and DFS Replication keeps folder targets synchronized for availability and branch-office scenarios.
- File Server Resource Manager (FSRM) applies quotas, file screens, and storage reports; NTFS and share permissions combine so the most restrictive effective permission wins.
- Data Deduplication reclaims disk space by storing unique chunks once, ideal for file servers, VDI, and backup volumes.
- Storage Replica performs block-level, synchronous or asynchronous replication of volumes between servers or clusters for disaster recovery.
- Azure File Sync centralizes file shares in Azure Files while caching hot data on-premises through cloud tiering, so servers keep a local cache and offload cold files to the cloud.
- iSCSI Target Server presents block storage over the network, and Storage Migration Service inventories and migrates file servers (including their identities and shares) to new servers or Azure.
- ReFS is optimized for large data sets and resiliency (integrity streams, block cloning), while NTFS remains the general-purpose file system with the broadest feature support.
- BranchCache and Work Folders optimize file access for branch and remote users, and access-based enumeration hides folders a user cannot access.
- Failover clustering with a Scale-Out File Server (SOFS) provides continuously available SMB shares for application data such as Hyper-V and SQL Server.
AZ-800 exam tips
- Study by the five skills-measured areas: AD DS, hybrid server management, VMs/containers, on-prem and hybrid networking, and storage/file services - the domains map directly.
- Know the hybrid tools cold: Windows Admin Center for GUI management, Azure Arc for projecting servers into Azure, Azure File Sync and Azure Extended Network for hybrid storage/networking.
- For AD DS, memorize the five FSMO roles, GPO precedence (LSDOU), RODC behavior, and hybrid identity options in Entra Connect (PHS vs PTA vs federation).
- Distinguish the storage features by purpose: Storage Spaces Direct (HCI), DFS (namespace + replication), FSRM (quotas/screens), Data Dedup (space), Storage Replica (DR), Azure File Sync (cloud tiering).
- Remember container isolation modes (process vs Hyper-V), Hyper-V VM generations, and checkpoint types (standard vs production) - these are common single-best-answer questions.
Study guide FAQ
What does AZ-800 cover and how does it fit the certification?
AZ-800 validates administering core Windows Server workloads in on-premises and hybrid environments: AD DS, hybrid server management (Windows Admin Center, Azure Arc), virtual machines and containers, on-premises and hybrid networking, and storage and file services. It is one of two exams - with AZ-801 - required for the Windows Server Hybrid Administrator Associate certification.
Is AZ-800 being retired?
Yes. Microsoft has announced that the AZ-800 exam retires on September 30, 2026. It is still current until then, and the passing score is 700 on a 1000-point scale. Check Microsoft Learn for the latest schedule and any replacement path before you book.
How much of the exam is hybrid versus purely on-premises?
The exam is explicitly hybrid: alongside classic Windows Server skills (AD DS, DNS/DHCP, Hyper-V, Storage Spaces, DFS) you must know the Azure hybrid tooling - Windows Admin Center, Azure Arc-enabled servers, Azure File Sync, Azure Extended Network, and Entra Connect for hybrid identity.
Does the exam include case studies and different question formats?
Microsoft role-based exams mix multiple-choice, multiple-response, and scenario questions, and may include case studies. CertGrid's practice focuses on single- and multiple-answer questions with detailed explanations so you can drill the concepts and commands the exam tests.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Microsoft Learn - Exam AZ-800 study guideBlueprint revised January 21, 2026 · link and content verified 8 September 20265 skills areas: Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments (30-35%); Manage Windows Servers and workloads in a hybrid environment (10-15%); Manage virtual machines and containers (15-20%); Implement and manage an on-premises and hybrid networking infrastructure (15-20%); Manage storage and file services (15-20%). Pass mark 700.