AZ-802 · Domain 2 of 7

AZ-802 Domain 2: Manage Windows Server instances and workloads in a hybrid environment

Managing Windows Server from anywhere: Windows Admin Center on-premises and in the Azure portal, PowerShell remoting with JEA and double-hop fixes, SSH and Remote Desktop, plus Azure Arc, VM extensions, Update Manager and Automation runbooks.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
8–10 hrs

About 11 min read Reviewed October 2026

Overview

Domain 2 is about how administrators reach and control servers, wherever they run. Microsoft lists two functional groups. The first covers remote management: deploying Windows Admin Center on-premises and in the Azure portal, PowerShell remoting including the second-hop problem and Just Enough Administration, OpenSSH Server, and Remote Desktop access.

The second group brings Azure management to servers outside Azure. It covers onboarding machines as Azure Arc-enabled servers, applying configuration through Azure Arc, installing Azure services through VM extensions on non-Azure machines, patching with Azure Update Manager, and creating and running Azure Automation runbooks. The skill being tested is choosing the right channel: a local tool, a delegated PowerShell endpoint, or an Azure control plane that treats an on-premises server like an Azure resource.

How it's tested

Expect scenarios with a mix of on-premises, Azure and other-cloud servers and a requirement such as patching from one console, giving junior staff limited rights, or running a script across many machines. Answers differ in where the tool runs, what identity it uses, and whether the server must be Arc-enabled first.

  • Pick the management plane

    A server location and task are given, and you choose Windows Admin Center, PowerShell remoting, SSH or an Azure Arc capability.

  • Limit administrative rights

    Operators need a small set of commands, and you design a JEA role capability and session configuration.

  • Onboard then operate

    A non-Azure server needs an Azure service, and you identify Arc onboarding as the prerequisite before extensions, policies or update schedules.

Reasoning it through

Help desk staff must restart a print spooler service on fifty file servers without being local administrators. Adding them to Administrators breaks least privilege, and Remote Desktop gives far too much access. A JEA endpoint with a role capability that exposes only Restart-Service for the Spooler service, mapped to a help desk group and running under a virtual account, meets the requirement. Staff connect with Enter-PSSession and the ConfigurationName parameter.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

2.1 Configure remote management for Windows Server instances in a hybrid environmentWindows Admin Center, PowerShell remoting with double-hop and JEA, SSH and remote desktop.
What it means
This group covers installing Windows Admin Center as a gateway on-premises and using Windows Admin Center in the Azure portal for Azure VMs and Arc-enabled servers, configuring PowerShell remoting and solving the second-hop credential problem, building JEA endpoints, enabling OpenSSH Server on Windows Server, and configuring Remote Desktop access securely.
What to understand
Windows Admin Center in the Azure portal runs as an extension and uses Azure RBAC, with the Windows Admin Center Administrator Login role controlling sign-in, so no on-premises gateway is required. PowerShell remoting uses WinRM over HTTP 5985 or HTTPS 5986. The double-hop problem appears when a remote session tries to reach a third server; resource-based Kerberos constrained delegation is the preferred fix, while CredSSP sends reusable credentials. JEA uses a role capability file (.psrc) and session configuration file (.pssc) registered with Register-PSSessionConfiguration. OpenSSH Server is an optional feature using port 22. Remote Desktop should require Network Level Authentication.
How it shows up
Expect questions on fixing access denied errors in nested sessions, building a JEA endpoint and choosing between gateway and portal Windows Admin Center.
Common confusion
Choosing CredSSP as the default double-hop fix; it works but exposes credentials, so resource-based constrained delegation is preferred.
2.2 Manage Windows Server instances and workloads by using Azure services in a hybrid environmentAzure Arc-enabled servers, Arc configuration, VM extensions, Update Manager and Automation runbooks.
What it means
This group covers installing the Connected Machine agent to project on-premises or multicloud servers into Azure, applying configuration through Azure Policy and machine configuration, deploying extensions such as Azure Monitor Agent or Defender for Servers to non-Azure machines, scheduling and assessing updates with Azure Update Manager, and writing Automation runbooks that run in Azure or on a Hybrid Runbook Worker.
What to understand
Arc onboarding installs the azcmagent, which creates a resource with a system-assigned managed identity. At-scale onboarding uses a service principal and a generated script. Machine configuration audits or applies settings inside the OS through Azure Policy. Extensions are installed through Arc the same way as on Azure VMs. Azure Update Manager assesses and patches both Azure VMs and Arc-enabled servers without needing a Log Analytics workspace, using maintenance configurations for schedules. Runbooks run in Azure sandboxes by default; reaching on-premises resources needs an extension-based Hybrid Runbook Worker on an Arc-enabled server.
How it shows up
Expect a scenario that asks what must exist before patching, monitoring or scripting a server outside Azure.
Common confusion
Assuming Update Manager needs the Log Analytics agent; it uses Azure-native assessment, and the old agent is retired.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Windows Admin Center gateway

    Self-hosted browser-based management tool on a server or PC.

    Remember
    Needs its own certificate and access control.
    Tested as
    On-premises management questions.
    Trap
    Assuming it needs Azure.

  • Windows Admin Center in the Azure portal

    Extension that runs Windows Admin Center for Azure VMs and Arc servers.

    Remember
    Access controlled with Azure RBAC.
    Tested as
    Hybrid management questions.
    Trap
    Opening inbound ports from the internet to reach it.

  • PowerShell double hop

    A remote session cannot pass credentials to a third server by default.

    Remember
    Resource-based Kerberos constrained delegation is the preferred fix.
    Tested as
    Remoting failure questions.
    Trap
    Enabling CredSSP everywhere.

  • Just Enough Administration

    Constrained PowerShell endpoints with limited commands.

    Remember
    Role capability files plus a session configuration.
    Tested as
    Least-privilege questions.
    Trap
    Adding operators to local Administrators instead.

  • JEA virtual account

    Temporary privileged identity used to run JEA commands.

    Remember
    Users never hold the admin rights themselves.
    Tested as
    Endpoint design questions.
    Trap
    Confusing it with a gMSA, which is needed for network resources.

  • OpenSSH Server

    Optional Windows feature for SSH access.

    Remember
    Port 22, supports key-based auth and PowerShell over SSH.
    Tested as
    Cross-platform management questions.
    Trap
    Thinking SSH requires WinRM.

  • Azure Connected Machine agent

    Agent that onboards a server to Azure Arc.

    Remember
    Creates a resource with a managed identity.
    Tested as
    Arc onboarding questions.
    Trap
    Installing extensions before onboarding.

  • Machine configuration

    Azure Policy feature that audits or applies OS settings.

    Remember
    Works on Azure VMs and Arc servers.
    Tested as
    Configuration drift questions.
    Trap
    Using Group Policy for non-domain servers in other clouds.

  • Azure Update Manager

    Azure service for update assessment and scheduled patching.

    Remember
    Uses maintenance configurations.
    Tested as
    Patching questions.
    Trap
    Requiring the legacy Log Analytics agent.

  • Hybrid Runbook Worker

    Arc-enabled or Azure machine that runs Automation runbooks locally.

    Remember
    Extension-based model is current.
    Tested as
    On-premises automation questions.
    Trap
    Expecting Azure sandboxes to reach private servers.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Remote management tools

ConceptMeaningKey differenceCommon trap
Windows Admin Center Browser GUI for servers and clusters Gateway or Azure portal deployment Assuming it replaces PowerShell skills
PowerShell remoting WinRM-based scripting sessions Scales to many servers Ignoring the double-hop limit
SSH Encrypted shell over port 22 Works across Windows and Linux Forgetting to install the optional feature
Remote Desktop Full interactive desktop Highest privilege exposure Using it where JEA would do

Double-hop solutions

ConceptMeaningKey differenceCommon trap
Resource-based KCD Target resource allows delegation from the first server No credential exposure, set on the target Configuring it on the client
CredSSP Sends credentials to the remote server Simple but risky Choosing it when security is a requirement
JEA with RunAsCredential or gMSA Endpoint runs as an account with network access Avoids passing user credentials Expecting a virtual account to reach network shares

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. CredSSP as the fix

    What candidates pick
    Enable CredSSP on client and server for nested remoting.
    Why it looks right
    It is quick and well documented.
    Why it's wrong
    CredSSP delegates reusable credentials to the remote server; resource-based Kerberos constrained delegation solves it without exposing them.

    Clue to watch for The requirement mentions minimizing credential exposure.

  2. Extension before Arc

    What candidates pick
    Install Azure Monitor Agent directly from the portal on an on-premises server.
    Why it looks right
    Extensions are familiar from Azure VMs.
    Why it's wrong
    Non-Azure servers appear in Azure only after Connected Machine agent onboarding.

    Clue to watch for The server sits in a data center or another cloud.

  3. Admins for operators

    What candidates pick
    Add operators to the local Administrators group.
    Why it looks right
    It guarantees the command works.
    Why it's wrong
    This grants far more than needed; JEA exposes only the listed cmdlets and parameters.

    Clue to watch for Words such as only, limited or least privilege.

  4. Log Analytics for patching

    What candidates pick
    Deploy the Log Analytics agent to enable patch assessment.
    Why it looks right
    Older Update Management required it.
    Why it's wrong
    Azure Update Manager assesses Azure VMs and Arc servers natively; the legacy agent is retired.

    Clue to watch for The task says to use Azure Update Manager.

  5. Cloud sandbox reaching on-premises

    What candidates pick
    Run the runbook in Azure to restart an on-premises service.
    Why it looks right
    Runbooks run in Azure by default.
    Why it's wrong
    Azure sandboxes cannot reach private networks; a Hybrid Runbook Worker runs the job locally.

    Clue to watch for The target is behind a firewall in a data center.

Answer framework

Use these steps to pick a management path for a server in a hybrid environment.

  1. Locate the server: on-premises, Azure VM, or another cloud, and note whether it is domain-joined, reachable over the network and already Arc-enabled.
  2. Define the task and the identity that performs it, including whether operators need full or limited rights.
  3. For interactive work choose Windows Admin Center, SSH or Remote Desktop, preferring the portal version when servers are Azure resources.
  4. For scripted or delegated work use PowerShell remoting, add JEA for least privilege, and solve double hop with resource-based delegation.
  5. For fleet tasks onboard to Azure Arc, then use extensions, machine configuration, Update Manager or Hybrid Runbook Workers so one process covers every location.

Practice question

You manage 200 Windows Server 2022 servers in an on-premises data center. You must assess and install monthly updates on a schedule from the Azure portal with minimal infrastructure. What should you do first on each server?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with remote management on two lab servers. Install a Windows Admin Center gateway, then connect to a server with Enter-PSSession and try to reach a share on a third server to see the double-hop failure. Fix it with resource-based Kerberos constrained delegation using Set-ADComputer and the PrincipalsAllowedToDelegateToAccount parameter. Build a JEA endpoint that exposes one or two cmdlets and connect as a non-admin user to confirm the restriction. Add OpenSSH Server and connect from another machine.

For the Azure half, use a free or trial subscription and onboard one lab server to Azure Arc. Open it in the portal and compare the available blades with those of an Azure VM. Deploy Azure Monitor Agent as an extension, run an update assessment in Azure Update Manager and create a maintenance configuration. Finally, create an Automation account, write a short PowerShell runbook and run it on the Arc server as a Hybrid Runbook Worker. Keep notes on which feature requires which prerequisite.

FAQ

What share of AZ-802 does Domain 2, hybrid server management, carry?

Manage Windows Server instances and workloads in a hybrid environment is weighted at 10–15%. Expect about five to eight questions, though Microsoft does not publish exact counts.

Do I need an Azure subscription to study this domain?

It helps a great deal. Arc onboarding, Update Manager and runbooks are easier to understand after doing them once. A trial or pay-as-you-go subscription with one lab server is usually enough.

Is Windows Admin Center in the Azure portal different from the gateway version?

Yes. The portal version runs as an extension on the target machine and uses Azure RBAC for access, so no separate gateway server or inbound internet exposure is required.

What is the double-hop problem?

When you are remoted into server B and try to access server C, Kerberos does not forward your credentials by default, so the second connection fails. Resource-based constrained delegation is the secure fix.

Does Azure Arc replace Group Policy?

No. Group Policy still manages domain-joined servers. Arc machine configuration adds Azure Policy-based auditing and settings, which helps for servers outside the domain or in other clouds.

Which runbook types should I know?

Know PowerShell runbooks and where they run: Azure sandboxes for cloud resources and Hybrid Runbook Workers for on-premises or private resources. Python runbooks exist but Windows Server scenarios lean on PowerShell.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

Test whether you can pick the right management path, from JEA endpoints to Azure Arc and Update Manager, with AZ-802 practice questions.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going