Domain 1: Deploy and manage Active Directory Domain Services (AD DS) in on-premises and cloud environments
- AD DS is deployed by installing the role and promoting the server with Install-ADDSForest (new forest) or Install-ADDSDomainController (add a DC); DCs host a writable copy of the directory unless deployed as a Read-Only Domain Controller (RODC).
- A Read-Only Domain Controller holds a read-only replica and caches only permitted credentials (password replication policy), making it suited to branch sites with weaker physical security.
- The five FSMO roles (Schema Master, Domain Naming Master, RID Master, PDC Emulator, Infrastructure Master) hold operations that must be singular; transfer them gracefully with Move-ADDirectoryServerOperationMasterRole or seize when a holder is permanently lost.
- Group Policy applies settings by linking GPOs to sites, domains, and OUs; precedence is Local, Site, Domain, OU (LSDOU) with the last applied winning, and Enforced links and Block Inheritance change the order.
- Group-managed service accounts (gMSAs) provide automatic password management for services across multiple hosts; create the KDS root key first, then New-ADServiceAccount.
- AD DS sites and subnets steer clients to the nearest DC and control replication topology; the KCC builds connection objects and replication compresses traffic between sites.
- Azure AD Connect (now Microsoft Entra Connect) synchronizes on-premises identities to Entra ID for hybrid identity, using password hash sync, pass-through authentication, or federation, plus optional seamless SSO.
- Microsoft Entra Domain Services (Azure AD DS) provides a managed domain (LDAP, Kerberos, domain join, GPO) in Azure without you running domain controllers - useful for lift-and-shift workloads that need traditional AD.
- Protect Tier 0 assets (Domain Admins, DCs) with a privileged-access model, restricted logon rights, and secure administrative workstations; the Protected Users group hardens credentials.
- Trusts (forest, external, realm) let users in one domain access resources in another; a forest trust between two forest root domains is transitive across all their domains.
Domain 2: Manage Windows Servers and workloads in a hybrid environment
- Windows Admin Center (WAC) is a browser-based tool that manages servers, clusters, and hyper-converged infrastructure locally or through the Azure portal, replacing many legacy MMC consoles.
- Azure Arc projects on-premises and multicloud servers into Azure as Arc-enabled servers, so you can apply Azure Policy, inventory, Update Management, Microsoft Defender, and run extensions on them.
- PowerShell remoting (WinRM) runs commands on remote servers with Enter-PSSession (interactive) and Invoke-Command (fan-out to many hosts); it is the primary way to manage Server Core.
- Server Core installs Windows Server without a desktop GUI to reduce attack surface and patching; configure it with sconfig, PowerShell, or remotely via WAC/RSAT.
- Azure Automation with PowerShell DSC (or the machine configuration feature) enforces desired state on servers so configuration drift is corrected automatically.
- Just Enough Administration (JEA) constrains remote PowerShell sessions to specific cmdlets and parameters via role capability and session configuration files, limiting what an operator can do.
- Azure Monitor and Log Analytics collect performance and event data from servers (including Arc-enabled ones) for centralized monitoring, alerting, and workbooks.
- Azure Update Manager (successor to Update Management) orchestrates OS patching across Azure and Arc-enabled servers on schedules with maintenance windows.
- Windows Server event forwarding (source- or collector-initiated with wecutil/WEF) centralizes event logs from many servers to a collector for review.
- Azure Hybrid Benefit lets you apply on-premises Windows Server licenses with Software Assurance to reduce the cost of Azure VMs.
Domain 3: Manage virtual machines and containers
- Hyper-V is the Windows Server hypervisor; VMs are Generation 1 (BIOS, broad compatibility) or Generation 2 (UEFI, Secure Boot, boot from SCSI, required for shielded VMs).
- Virtual switches connect VMs to networks: External (bound to a physical NIC), Internal (host + VMs), and Private (VMs only); NIC teaming or SET provides adapter redundancy for the host.
- Checkpoints capture point-in-time VM state; standard checkpoints include memory, while production checkpoints use VSS for application-consistent, supported snapshots.
- Live Migration moves a running VM between hosts with no downtime; Storage Migration moves its files, and both underpin failover clustering with clustered VMs on Cluster Shared Volumes.
- Dynamic Memory adjusts a VM's RAM within min/max bounds based on demand, and nested virtualization exposes virtualization extensions to a VM so it can run Hyper-V or containers.
- Windows Server supports Windows containers in two isolation modes: process isolation (shares the host kernel, lighter) and Hyper-V isolation (each container in a lightweight VM, stronger isolation).
- Container images are built from a base image with a Dockerfile and stored in a registry (such as Azure Container Registry); tags identify versions.
- Shielded VMs use the Host Guardian Service and a virtual TPM to encrypt VM state and disks, protecting tenant VMs from a compromised or malicious fabric administrator.
- Azure Migrate discovers and assesses on-premises servers and migrates them to Azure VMs, providing right-sizing and dependency analysis.
- Integration services (and the guest agent) enable features like heartbeat, backup, and time sync between the host and the guest OS.
Domain 4: Implement and manage an on-premises and hybrid networking infrastructure
- The DNS Server role resolves names using forward and reverse lookup zones; conditional forwarders send queries for specific domains to designated servers, and forwarders handle everything else.
- DNS zones can be primary, secondary, or Active Directory-integrated (stored in AD, multi-master, secured with secure dynamic updates); DNSSEC signs zones to prevent spoofing.
- The DHCP Server role leases IP configuration from scopes; DHCP failover (hot standby or load sharing) keeps leases available if one server fails, and reservations pin an address to a MAC.
- IP Address Management (IPAM) centrally discovers and manages DHCP and DNS servers and tracks IP address space across the enterprise.
- Name resolution records matter: A/AAAA map names to addresses, PTR handle reverse lookups, CNAME are aliases, and SRV locate services such as domain controllers.
- Network Policy Server (NPS) provides RADIUS authentication and policy for VPN, wireless, and 802.1X access.
- Hybrid connectivity to Azure uses site-to-site VPN or ExpressRoute; the Azure Network Adapter (via Windows Admin Center) creates a point-to-site connection from a server to an Azure VNet.
- Azure Extended Network stretches an on-premises subnet into Azure so migrated servers keep their IP addresses during hybrid migrations.
- NIC teaming aggregates multiple network adapters for bandwidth and fault tolerance; Switch Embedded Teaming (SET) integrates teaming with the Hyper-V virtual switch.
- DNS policies and round robin influence which records are returned, supporting traffic management and split-brain DNS scenarios.
Domain 5: Manage storage and file services
- Storage Spaces pools physical disks into virtual disks with resiliency (mirror, parity); Storage Spaces Direct (S2D) builds hyper-converged, highly available storage from local disks across cluster nodes.
- DFS Namespaces present a single logical folder path over shares on multiple servers, and DFS Replication keeps folder targets synchronized for availability and branch-office scenarios.
- File Server Resource Manager (FSRM) applies quotas, file screens, and storage reports; NTFS and share permissions combine so the most restrictive effective permission wins.
- Data Deduplication reclaims disk space by storing unique chunks once, ideal for file servers, VDI, and backup volumes.
- Storage Replica performs block-level, synchronous or asynchronous replication of volumes between servers or clusters for disaster recovery.
- Azure File Sync centralizes file shares in Azure Files while caching hot data on-premises through cloud tiering, so servers keep a local cache and offload cold files to the cloud.
- iSCSI Target Server presents block storage over the network, and Storage Migration Service inventories and migrates file servers (including their identities and shares) to new servers or Azure.
- ReFS is optimized for large data sets and resiliency (integrity streams, block cloning), while NTFS remains the general-purpose file system with the broadest feature support.
- BranchCache and Work Folders optimize file access for branch and remote users, and access-based enumeration hides folders a user cannot access.
- Failover clustering with a Scale-Out File Server (SOFS) provides continuously available SMB shares for application data such as Hyper-V and SQL Server.
AZ-800 exam tips
- Study by the five skills-measured areas: AD DS, hybrid server management, VMs/containers, on-prem and hybrid networking, and storage/file services - the domains map directly.
- Know the hybrid tools cold: Windows Admin Center for GUI management, Azure Arc for projecting servers into Azure, Azure File Sync and Azure Extended Network for hybrid storage/networking.
- For AD DS, memorize the five FSMO roles, GPO precedence (LSDOU), RODC behavior, and hybrid identity options in Entra Connect (PHS vs PTA vs federation).
- Distinguish the storage features by purpose: Storage Spaces Direct (HCI), DFS (namespace + replication), FSRM (quotas/screens), Data Dedup (space), Storage Replica (DR), Azure File Sync (cloud tiering).
- Remember container isolation modes (process vs Hyper-V), Hyper-V VM generations, and checkpoint types (standard vs production) - these are common single-best-answer questions.
Study guide FAQ
What does AZ-800 cover and how does it fit the certification?
AZ-800 validates administering core Windows Server workloads in on-premises and hybrid environments: AD DS, hybrid server management (Windows Admin Center, Azure Arc), virtual machines and containers, on-premises and hybrid networking, and storage and file services. It is one of two exams - with AZ-801 - required for the Windows Server Hybrid Administrator Associate certification.
Is AZ-800 being retired?
Yes. Microsoft has announced that the AZ-800 exam retires on September 30, 2026. It is still current until then, and the passing score is 700 on a 1000-point scale. Check Microsoft Learn for the latest schedule and any replacement path before you book.
How much of the exam is hybrid versus purely on-premises?
The exam is explicitly hybrid: alongside classic Windows Server skills (AD DS, DNS/DHCP, Hyper-V, Storage Spaces, DFS) you must know the Azure hybrid tooling - Windows Admin Center, Azure Arc-enabled servers, Azure File Sync, Azure Extended Network, and Entra Connect for hybrid identity.
Does the exam include case studies and different question formats?
Microsoft role-based exams mix multiple-choice, multiple-response, and scenario questions, and may include case studies. CertGrid's practice focuses on single- and multiple-answer questions with detailed explanations so you can drill the concepts and commands the exam tests.