AZ-802 study guide · 2026

The 7 AZ-802 domains, explained

7 domains and 18 official functional groups. Deploy and manage AD DS carries the most weight at 20–25%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
Not published
Time
120 minutes
Passing score
700 / 1000
Outline
AZ-802 study guide, skills measured (Microsoft Learn page updated October 19, 2026; current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 20–25%
  2. 2 10–15%
  3. 3 10–15%
  4. 4 10–15%
  5. 5 15–20%
  6. 6 10–15%
  7. 7 15–20%
  1. 1 Deploy and manage AD DS
  2. 2 Manage Windows Server instances and workloads in a hybrid environment
  3. 3 Manage virtual machines
  4. 4 Implement and manage an on-premises and hybrid networking infrastructure
  5. 5 Manage storage and file services
  6. 6 Secure Windows Server infrastructure
  7. 7 Monitor and troubleshoot Windows Server environments

All 7 domains

18 official functional groups 67–85 hrs suggested study

  1. Domain 01 20–25%

    Deploy and manage AD DS

    The heaviest AZ-802 skill area: deploying writable and read-only domain controllers on-premises and in Azure, FSMO roles, trusts, sites and replication, users, groups and service accounts, and Group Policy.

    Inside this domain

    • Deploy and manage AD DS domain controllers
    • Configure and manage multi-site, multi-domain, and multi-forest environments
    • Create and manage AD DS security principals
    • Manage Windows Server by using domain-based Group Policies

    Watch for Seize too early

    Functional groups
    4
    Questions est.
    ~11
    Study time est.
    14–18 hrs
  2. Domain 02 10–15%

    Manage Windows Server instances and workloads in a hybrid environment

    Managing Windows Server from anywhere: Windows Admin Center on-premises and in the Azure portal, PowerShell remoting with JEA and double-hop fixes, SSH and Remote Desktop, plus Azure Arc, VM extensions, Update Manager and Automation runbooks.

    Inside this domain

    • Configure remote management for Windows Server instances in a hybrid environment
    • Manage Windows Server instances and workloads by using Azure services in a hybrid environment

    Watch for CredSSP as the fix

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    8–10 hrs
  3. Domain 03 10–15%

    Manage virtual machines

    Running Windows Server workloads as virtual machines: Hyper-V host and guest configuration from memory to GPU partitioning, checkpoints, virtual switches and Replica, plus storage, sizing, availability, JIT access, Bastion and networking for Azure VMs.

    Inside this domain

    • Manage Hyper-V and guest VM
    • Manage Windows Server VMs in Azure

    Watch for Checkpoint as backup

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    8–10 hrs
  4. Domain 04 10–15%

    Implement and manage an on-premises and hybrid networking infrastructure

    Name resolution and IP addressing for Windows Server networks: AD-integrated DNS zones and records, forwarders and conditional forwarders, hybrid resolution with Azure, DNS policies and DNSSEC, plus DHCP scopes, reservations, failover and troubleshooting.

    Inside this domain

    • Implement on-premises and hybrid name resolution
    • Manage IP addressing in on-premises and hybrid scenarios

    Watch for Wire server from on-premises

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    7–9 hrs
  5. Domain 05 15–20%

    Manage storage and file services

    File and storage services across on-premises and Azure: Azure file shares and File Sync, migrating DFS and file servers, share access, FSRM, DFS and SMB over QUIC, plus disks, Storage Spaces, Storage Spaces Direct, Storage Replica, deduplication, iSCSI and BitLocker.

    Inside this domain

    • Configure and manage Azure Files
    • Configure and manage Windows Server file shares
    • Configure Windows Server storage

    Watch for Storage Replica as multi-site file share

    Functional groups
    3
    Questions est.
    ~9
    Study time est.
    12–15 hrs
  6. Domain 06 10–15%

    Secure Windows Server infrastructure

    Hardening Windows Server and Active Directory: exploit protection, App Control for Business, Credential Guard, SmartScreen, OSConfig baselines, Windows LAPS, Defender for Servers and firewall rules, plus password policies, Entra Password Protection, Protected Users and domain controller hardening.

    Inside this domain

    • Secure Windows Server operating system
    • Secure AD DS

    Watch for PSO on an OU

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    8–10 hrs
  7. Domain 07 15–20%

    Monitor and troubleshoot Windows Server environments

    Monitoring and fixing Windows Server: Performance Monitor, data collector sets, Windows Admin Center alerts, System Insights, event logs, Azure Monitor data collection rules and VM Insights, then troubleshooting connectivity, updates, time, storage, Arc extensions and Active Directory.

    Inside this domain

    • Monitor by using Windows Server tools and Azure services
    • Troubleshoot Windows Server issues
    • Troubleshoot Active Directory

    Watch for DSRM for a deleted user

    Functional groups
    3
    Questions est.
    ~9
    Study time est.
    10–13 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 67–85 hrs of study.

  1. 1 Deploy and manage AD DS 20–25% · 14–18 hrs
  2. 5 Manage storage and file services 15–20% · 12–15 hrs
  3. 7 Monitor and troubleshoot Windows Server environments 15–20% · 10–13 hrs
  4. 2 Manage Windows Server instances and workloads in a hybrid environment 10–15% · 8–10 hrs
  5. 3 Manage virtual machines 10–15% · 8–10 hrs
  6. 4 Implement and manage an on-premises and hybrid networking infrastructure 10–15% · 7–9 hrs
  7. 6 Secure Windows Server infrastructure 10–15% · 8–10 hrs

Try one

Practice questionDomain 1: Deploy and manage AD DS

Contoso runs a web application on four load-balanced Windows Server 2025 servers in one domain. The application pool uses a domain user account whose password never expires. Security requires automatic password rotation with no service downtime. What should you implement first?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Seize too early

    Clue The holder is down for maintenance or patching.

  • Domain 2

    CredSSP as the fix

    Clue The requirement mentions minimizing credential exposure.

  • Domain 3

    Checkpoint as backup

    Clue The requirement is long-term recovery or retention.

  • Domain 4

    Wire server from on-premises

    Clue Clients are on-premises over VPN or ExpressRoute.

  • Domain 5

    Storage Replica as multi-site file share

    Clue Users in both locations write to the data.

  • Domain 6

    PSO on an OU

    Clue Different password rules for one department.

  • Domain 7

    DSRM for a deleted user

    Clue The Recycle Bin is enabled in the forest.

Other Cloud Computing certifications

Study guides for exams that overlap with AZ-802.

Practise what you read

AZ-802 domains: common questions

How many domains are in the AZ-802 exam?

AZ-802 has 7 domains with 18 official functional groups between them: Deploy and manage AD DS, Manage Windows Server instances and workloads in a hybrid environment, Manage virtual machines, Implement and manage an on-premises and hybrid networking infrastructure, Manage storage and file services, Secure Windows Server infrastructure and Monitor and troubleshoot Windows Server environments.

Which AZ-802 domain carries the most weight?

Deploy and manage AD DS is the heaviest at 20–25%, followed by Manage storage and file services (15–20%). The lightest is Secure Windows Server infrastructure (10–15%). Weights come from Microsoft's official outline.

What is the AZ-802 exam format?

Questions: Not published. Time allowed: 120 minutes. Passing score: 700 / 1000.

How long should I study for AZ-802?

Our planning estimate is 67–85 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Deploy and manage AD DS, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows AZ-802 study guide, skills measured (Microsoft Learn page updated October 19, 2026; current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (AZ-802 study guide, skills measured (Microsoft Learn page updated October 19, 2026; current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.