AZ-802 Tests Hybrid Windows Server Judgment — Not On-Premises AD DS Alone
AZ-802 replaced AZ-800 and AZ-801, retired on 30 September 2026, as the single exam for Windows Server Administrator Associate. Expect scenarios mixing AD DS, Hyper-V, Azure Arc, Azure Files and Azure Monitor.
Check Your Readiness →Most candidates understand Administering Windows Server (AZ-802) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Seven domains merge the former AZ-800 administration and AZ-801 advanced topics. Scenarios state a constraint such as least privilege, a branch with poor physical security or users without VPN, and the answer is the feature built for it. 120 minutes; question count not published; general availability date unconfirmed.
Deploy a writable domain controller at the branch
Deploy a Read-Only Domain Controller with a password replication policy that caches only branch users. A stolen RODC exposes far fewer credential hashes, and it never accepts writes, which are referred to a writable DC.
Publish SMB on port 445 through the perimeter firewall
Configure SMB over QUIC, which carries SMB over UDP 443 with TLS 1.3 and needs a server certificate. It gives VPN-less access without opening 445, a port many ISPs and security teams block.
Add the help desk group to local Administrators
Create a Just Enough Administration endpoint: a role capability file listing permitted cmdlets and a session configuration that uses a temporary virtual account. Operators run only those commands and never hold administrator rights themselves.
Enable CredSSP on every client and server
Configure resource-based Kerberos constrained delegation on the target. It solves the double hop without sending reusable credentials to the intermediate server, which CredSSP does and a minimise-credential-exposure requirement rules out.
Replicate volumes between offices with Storage Replica
Storage Replica is one-way and the destination is not accessible during replication. Azure File Sync, with one cloud endpoint per sync group, centralises data in Azure Files, and cloud tiering keeps only hot files on each server.
Seizure is for a holder that will never return; a recovering holder needs a transfer or a wait. Know the split: schema master and domain naming master are forest-wide, while PDC emulator, RID master and infrastructure master exist once per domain.
Password Settings Objects apply only to users and global security groups, and the lowest precedence value wins when several apply. To give one department stricter rules, put its users in a global group and target the PSO at that group.
Processing runs local, site, domain, OU, and the last applied setting wins, so OU links override domain links. Only an Enforced link reverses that and also defeats Block Inheritance. Preferences set values users can change; policy settings lock them.
A server in a data center or another cloud appears in Azure only after the Connected Machine agent onboards it. Then Azure Monitor Agent, machine configuration and Azure Update Manager work; run azcmagent check before blaming extensions for errors.
With the AD Recycle Bin enabled, Restore-ADObject returns the object online with all attributes and no downtime. Without it, restore in DSRM and mark objects authoritative with ntdsutil; a nonauthoritative restore lets partners replicate the deletion back.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
Test your AD DS, Azure Arc and file services decisions against AZ-802 hybrid scenarios.