Microsoft Azure Interview Questions and Answers

Microsoft Entra ID, formerly Azure AD, is a cloud identity provider using modern protocols such as OAuth 2.0, OpenID Connect, and SAML. On-premises Active Directory Domain Services is an LDAP-based directory with Kerberos and Group Policy for domain-joined machines.

Key differences:

• Entra ID is multi-tenant, internet-facing, and managed by Microsoft; AD DS runs on your own domain controllers.
• Entra ID has no OU hierarchy or Group Policy; it uses administrative units, RBAC, and Conditional Access.
• Devices can be Entra joined, hybrid joined, or registered rather than domain joined.
• Entra Connect or Cloud Sync replicates on-premises identities to the cloud.

Use Entra ID for SaaS apps, single sign-on, and MFA. Use AD DS for legacy applications that require Kerberos, LDAP, or domain joins. Many enterprises run both in a hybrid identity model.

ARM templates are the native JSON declarative language for Azure Resource Manager. Bicep is a domain-specific language that transpiles to ARM JSON.

Advantages of Bicep:

• Concise, readable syntax with no mandatory boilerplate.
• First-class modules, loops, conditions, and type checking.
• Tooling: VS Code extension, IntelliSense, and the bicep CLI.
• Idempotent deployments and what-if analysis, same as ARM.

param location string = resourceGroup().location
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'stapp${uniqueString(resourceGroup().id)}'
  location: location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
}

Both use the same deployment engine, so you can decompile ARM to Bicep with az bicep decompile. Prefer Bicep for new work, and use ARM when you must generate JSON programmatically or consume existing templates.

Both can host code, but they optimise for different workloads.

Azure Functions is serverless and event-driven:

• Consumption or Premium plans scale to zero and bill per execution.
• Triggers and bindings cover HTTP, timers, queues, blobs, Event Grid, and Service Bus.
• Best for short, discrete tasks such as image processing, queue workers, scheduled jobs, and webhooks.
• Limits include maximum execution duration, cold starts on Consumption, and statelessness by default.

App Service is a fully managed web host:

• Runs long-lived web apps, REST APIs, and background workers in containers or native runtimes.
• Always on, with custom domains, deployment slots, autoscale, and VNet integration.
• Predictable pricing per plan with no per-execution billing.

Choose Functions for event-driven glue and spiky traffic. Choose App Service for conventional web APIs, long-running requests, or when you need deployment slots.

Blob Storage offers tiers that trade storage cost against access cost and latency.

• Hot: frequent access, highest storage cost, lowest access cost.
• Cool: infrequent access, minimum 30-day storage, lower storage cost, higher access cost.
• Cold: rarely accessed, minimum 90 days, lower still.
• Archive: offline, minimum 180 days, lowest storage cost, hours to rehydrate before reading.

Set a tier at upload or move blobs later with lifecycle management policies.

{
  "rules": [{
    "name": "archive-old",
    "type": "Lifecycle",
    "definition": {
      "filters": {"blobTypes": ["blockBlob"], "prefixMatch": ["logs/"]},
      "actions": {"baseBlob": {
        "tierToCool": {"daysAfterModificationGreaterThan": 30},
        "tierToArchive": {"daysAfterModificationGreaterThan": 180}
      }}
    }
  }]
}

Early deletion before the minimum age incurs charges, so model the access pattern before choosing a tier.

A Virtual Network, or VNet, is an isolated private network in a region with its own address space. You divide it into subnets and control traffic with network security groups (NSGs).

• NSGs contain inbound and outbound rules with priority, source and destination, port, and protocol. Lower numbers win, and the first match applies.
• Rules can allow or deny. Default rules allow VNet-to-VNet and Azure Load Balancer traffic and deny the rest.
• NSGs can attach to subnets, network interfaces, or both, and both are evaluated.
• Traffic between subnets can be forced through an appliance using user-defined routes.

az network nsg rule create -g rg-app --nsg-name nsg-web \
  --name allow-https --priority 100 --access Allow \
  --protocol Tcp --destination-port-ranges 443

Use service tags and application security groups to keep rules readable, and Azure Firewall for centralised egress control.