Microsoft Azure interview questions

Azure: Microsoft's cloud computing platform offering 200+ services across compute, storage, networking, AI, databases, and more. Azure Resource Manager (ARM): the management layer (control plane) for all Azure resources. Every action you take — creating a VM, deploying an app — goes through ARM. ARM hierarchy: Management Groups → Subscriptions → Resource Groups → Resources Management Groups: containers for multiple subscriptions. Apply governance (policies, RBAC) at scale. Subscriptions: billing boundary + access control boundary. One subscription per team/department/environment is common. Resource Groups: logical containers for related resources in a single Azure solution. Resources in a group share lifecycle (deploy, update, delete together). Can span regions. Resources: individual services (VM, Storage Account, SQL Database, etc.). Benefits of ARM: - Declarative templates (ARM templates / Bicep): deploy same infrastructure repeatedly - Dependency management: ARM figures out the order to deploy dependent resources - Role-Based Access Control (RBAC): grant access at management group, subscription, resource group, or resource level - Tags: apply metadata to resources for organization and cost management - Resource locks: prevent accidental deletion or modification (ReadOnly lock, Delete lock) - Activity Log: audit trail of all ARM operations

Azure Active Directory (now called Microsoft Entra ID): cloud-based identity and access management service. Handles authentication and authorization for Azure resources, Microsoft 365, and custom applications. Key differences from on-premises AD DS: - Protocol: Azure AD uses OAuth 2.0, OpenID Connect, SAML — internet protocols. On-prem AD uses Kerberos, NTLM, LDAP — network protocols. - Structure: Azure AD has no OU hierarchy or Group Policy Objects. Flat structure. - Joining devices: Azure AD Join (cloud-only) vs domain join (on-prem). Hybrid Azure AD Join for both. - Communication: Azure AD over HTTPS; on-prem AD requires network connectivity (VPN/line of sight) Azure AD capabilities: - SSO: sign in once, access thousands of SaaS apps (Salesforce, ServiceNow, GitHub...) - MFA: multi-factor authentication with Authenticator app, SMS, FIDO2 keys - Conditional Access: policy-based access control ("only allow if device is compliant AND from known location") - B2B: invite external users as guests - B2C: customer-facing identity for your own apps - Privileged Identity Management (PIM): just-in-time privileged access — no permanent admin roles - Identity Protection: ML-based risk detection (compromised credentials, impossible travel) Azure AD Connect: sync on-premises AD users to Azure AD — hybrid identity. Password hash sync or pass-through auth. Tenants: each organization has a dedicated Azure AD tenant (a directory). tenant.onmicrosoft.com or custom domain.

Azure App Service: fully managed platform (PaaS) for hosting web applications, REST APIs, and mobile backends. Deploy code or containers — no server management. Supported runtimes: Node.js, .NET, Python, Java, PHP, Ruby, custom containers. App Service Plans: define the compute resources (region, OS, pricing tier). - Free/Shared: for dev/test, shared compute, no SLA - Basic (B1/B2/B3): dedicated compute, manual scale, no auto-scale, no staging slots - Standard (S1/S2/S3): auto-scale, staging deployment slots, daily backups, custom domains with SSL - Premium (P1v3/P2v3/P3v3): faster CPUs, VNet integration, more scale-out instances - Isolated (I1v2/I2v2): dedicated VNet, network isolation (ASE — App Service Environment) Key features: - Deployment Slots: staging slot for blue/green deployments. Swap staging → production with zero downtime. Slot swap = DNS pointer swap. - Auto-scaling: scale out based on CPU, memory, HTTP queue length, schedule - Custom domains + free managed SSL certificates (from App Service Certificates or Let's Encrypt) - VNet Integration: connect to private resources without public internet - Deployment: GitHub Actions, Azure DevOps, zip deploy, FTP, container registry - Monitoring: Application Insights integration — distributed tracing, performance monitoring, exceptions - Always On: keep app loaded in memory (prevent cold starts on Basic+ tiers) Web Jobs: background tasks running alongside your web app (processing queues, scheduled tasks).

Azure Functions: serverless compute — write event-triggered code without managing infrastructure. Supports C#, JavaScript/TypeScript, Python, Java, PowerShell, custom handlers. Triggers: HTTP, Timer (cron), Blob storage, Queue storage, Service Bus, Event Hub, Event Grid, Cosmos DB change feed, SignalR. Hosting plans: Consumption Plan: - Scale to zero — pay only for execution time and invocations - Automatic scaling — up to 200 instances - 5-minute timeout default (10 minutes max) - Cold start: first invocation takes longer (runtime initialization) - Cannot use VNet integration (unless Premium) - Best for: event-driven, sporadic workloads where cost matters most Premium Plan (Elastic Premium): - Pre-warmed instances: no cold starts - Longer timeout: unlimited - VNet integration: connect to private resources - More powerful instances (EP1/EP2/EP3) - Higher cost but consistent performance - Best for: latency-critical functions, VNet connectivity needed, long-running tasks Dedicated Plan (App Service Plan): - Run on existing App Service Plan (no serverless scaling) - Always-on, no cold starts - Best if you already have an underutilized App Service Plan Durable Functions: stateful functions. Orchestrator + Activity functions pattern for long-running workflows (saga, fan-out/fan-in, human interaction patterns). Uses Azure Storage for state. Function App vs Logic Apps: - Functions: code-first, developer-controlled - Logic Apps: low-code/no-code workflow designer, 400+ connectors

AKS (Azure Kubernetes Service): managed Kubernetes service. Azure manages the Kubernetes control plane (API server, etcd, scheduler, controller manager) — free of charge. What Azure manages: - Control plane availability (99.95% SLA with Availability Zones) - Control plane upgrades - Control plane patching and security - etcd backup and restore - API server scaling What you manage: - Worker nodes (VM scale sets — VMSS): patch OS, right-size, upgrade node pools - Kubernetes workloads: deployments, services, ingress controllers - Node pool scaling (or use Cluster Autoscaler for automatic scaling) - Persistent storage (Azure Disks, Azure Files, Azure NetApp Files) Key AKS features: - Node pools: multiple pools with different VM sizes (system pool: infra components; user pools: workloads; GPU pools: ML) - Cluster Autoscaler: automatically add/remove nodes based on pod pending state - Azure CNI: pods get IPs from VNet subnet — direct VNet routing - Azure Monitor + Container Insights: metrics, logs, dashboards out of box - Azure AD integration: RBAC for Kubernetes using Azure AD groups - Workload Identity: pods authenticate to Azure services without managing credentials (uses federated identity) - Cluster upgrades: in-place rolling upgrade of nodes with one command AKS vs App Service for containers: - AKS: full Kubernetes — microservices, complex networking, custom resource requirements, polyglot - App Service (containers): simpler container hosting, auto SSL, deployment slots, built-in monitoring — sufficient for single-container web apps

Azure Blob Storage: massively scalable object (unstructured) storage. Store text, binary, images, videos, backups, data lake data. Container hierarchy: Storage Account → Container → Blob Blob types: - Block blobs: most common — text, binary, images, video. Up to 190.7TB per blob. - Append blobs: optimized for append operations — log files, streaming data. - Page blobs: random read/write — backing store for Azure VM disks (VHDs). Access Tiers (Hot → Cold → Archive): - Hot: frequently accessed. Highest storage cost, lowest access cost. Live data, active applications. - Cool: infrequently accessed (30 days minimum). Lower storage cost, higher access cost. Backups, older data. - Cold: rarely accessed (90 days minimum). Even lower storage cost. - Archive: rarely accessed (180 days minimum). Lowest storage cost, highest access cost. Hours to rehydrate before accessing. Compliance, long-term backup. Lifecycle Management Policies: automatically transition blobs between tiers or delete them based on age. { "rules": [{ "definition": { "actions": { "baseBlob": { "tierToCool": { "daysAfterModificationGreaterThan": 30 }, "tierToArchive": { "daysAfterModificationGreaterThan": 90 }, "delete": { "daysAfterModificationGreaterThan": 365 } } } } }] } Replication options: LRS (locally redundant), ZRS (zone-redundant), GRS (geo-redundant), GZRS (geo-zone-redundant).

Azure SQL Database: fully managed PaaS relational database — SQL Server engine without managing OS or SQL Server installation. Deployment options: Single Database: one database with its own compute/storage resources. DTU or vCore model. Elastic Pool: multiple databases sharing compute resources. Cost-efficient when databases have variable, unpredictable usage patterns (SaaS multi-tenant — each tenant has their own DB). SQL Managed Instance: near 100% SQL Server compatibility (Agent, CLR, linked servers, SSAS). Best for migrating on-premises SQL Server workloads with minimal code changes. SQL on Azure VM (IaaS): - Full OS and SQL Server access - Any SQL Server version and edition - You manage patching, backups, HA - Use when: specific SQL Server features not in SQL Database/MI, SQL Server Agent jobs, CLR, linked servers, specific OS config Azure SQL Database advantages: - Built-in HA (99.99% SLA) - Automatic backups (7-35 day retention, point-in-time restore) - Automatic patching and updates - Intelligent performance: Query Performance Insights, automatic index recommendations, automatic tuning - Advanced Threat Protection: detects SQL injection, unusual access patterns - Elastic scale: serverless tier — auto-pauses when idle, billing stops Purchasing models: - DTU (Database Transaction Unit): bundled CPU/memory/I/O. Simple but opaque. - vCore: choose CPU cores and memory separately. Transparent. Allows Azure Hybrid Benefit (use existing SQL Server licenses). Business Critical tier: replica-based HA with readable secondary (replaces traditional AlwaysOn).

Azure Cosmos DB: globally distributed, multi-model database service. Single-digit millisecond read/write latency at any scale, anywhere in the world. 99.999% availability SLA. APIs (multiple data models on same engine): - Core (SQL): document model, JSON, SQL-like query language — most popular - MongoDB API: use existing MongoDB drivers without code changes - Cassandra API: wide-column, CQL syntax - Gremlin API: graph database - Table API: Azure Table Storage compatible Global Distribution: replicate data to any Azure region with one click. Multi-region writes: writes accepted in any region, automatic conflict resolution. 5 Consistency Levels (strongest to weakest): 1. Strong: reads always see the latest committed write. Highest latency, no global distribution for writes. 2. Bounded Staleness: reads lag behind writes by K versions or T time. Predictable staleness. 3. Session (default): within a session, reads always see your own writes. Outside sessions — consistent prefix. 4. Consistent Prefix: reads never see out-of-order writes. No guarantees on how stale. 5. Eventual: lowest latency. Replicas converge eventually. Best for non-critical data (view counts, likes). Partition Key: critical design decision. Distributes data across logical partitions. Choose a key with high cardinality (many distinct values) to avoid hot partitions. Request Units (RUs): normalized unit of throughput (combines CPU, I/O, memory). Provision RU/s or use serverless (per-request billing). Indexing: all fields indexed by default (unlike DynamoDB). Customize with indexing policy. Use case: global SaaS, IoT telemetry, real-time personalization, gaming leaderboards.

Azure Virtual Network (VNet): isolated private network in Azure. Resources within a VNet communicate privately. You control IP address ranges, subnets, routing, security. Key concepts: - Address Space: CIDR range for VNet (e.g., 10.0.0.0/16) - Subnets: subdivide address space. Resources in same subnet can communicate freely. - Network Security Groups (NSG): stateful firewall — inbound/outbound rules at subnet or NIC level - User Defined Routes (UDR): customize routing behavior (send traffic through NVA — Network Virtual Appliance — for inspection) - Service Endpoints: extend VNet private address space to Azure services (reach Azure Storage, SQL Database via private routing, not public internet) - Private Endpoints: create a private IP for a specific Azure resource in your VNet (e.g., Azure SQL gets 10.0.1.5 in your subnet) VNet Peering: - Low-latency, private connection between two VNets using Azure backbone (no internet, no gateways) - Traffic is private and encrypted - Resources in peered VNets can communicate as if in same VNet - Non-transitive: if VNet A peers with B and B peers with C, A cannot reach C through B (unless you configure hub-spoke or Azure Virtual WAN) Types: - VNet Peering: same region - Global VNet Peering: across regions (e.g., East India ↔ South India) Hub-Spoke topology: central hub VNet (shared services: VPN, firewall, DNS) peered with multiple spoke VNets (app, dev, prod). Traffic flows through hub — centralized inspection. Standard enterprise pattern in Azure. Azure Firewall / NVA: can be deployed in hub VNet to inspect all inter-spoke traffic.

Azure DevOps: suite of developer tools for planning, developing, delivering, and monitoring software. Five services: 1. Azure Boards: agile project management. Backlogs, sprints, Kanban boards, epics, user stories, tasks. Integrates with GitHub, Jira. 2. Azure Repos: Git repositories (unlimited private repos) or TFVC (legacy). Branch policies: require PR reviews, linked work items, build validation before merge. 3. Azure Pipelines: CI/CD pipelines as code (YAML). Build any language on Windows, Linux, macOS agents. Deploy to Azure, AWS, GCP, on-prem. Free tier: 1,800 minutes/month. trigger: branches: include: [main] stages: - stage: Build jobs: - job: BuildAndTest steps: - task: NodeTool@0 inputs: { versionSpec: '20.x' } - script: npm ci && npm test 4. Azure Test Plans: manual and automated test case management. Track test coverage, manage test suites. 5. Azure Artifacts: package management — publish and consume NuGet, npm, Maven, pip, Universal packages. Upstream sources: proxy public registries (npm registry, PyPI) and cache packages privately. Integration: Azure Pipelines triggers on Azure Repos commits → builds artifact → stores in Azure Artifacts → deploys to AKS using Helm → updates Azure Boards work item status. GitHub vs Azure DevOps: - GitHub: better for open-source, community, GitHub Actions, Copilot integration - Azure DevOps: better for enterprise Windows/.NET shops, Boards is more mature for enterprise agile, tight integration with Microsoft ecosystem

Azure Monitor: comprehensive observability platform collecting metrics, logs, and traces from Azure resources, applications, and on-premises systems. Components: Metrics: time-series numerical data. Built-in metrics from every Azure resource (VM CPU, App Service requests, SQL DTU). Near-real-time, 93 days retention. Alert rules trigger on metric thresholds. Logs (Log Analytics): store and query log data using Kusto Query Language (KQL). Log Analytics workspace is the central repository. Rich query capability. // KQL example: find all 500 errors in last 24h requests | where timestamp > ago(24h) and resultCode == "500" | summarize count() by name, bin(timestamp, 1h) | render timechart Alerts: fire on metric thresholds, log query results, activity log events. Actions: email, SMS, webhook, ITSM, Azure Action Group. Application Insights (APM): automatic instrumentation of application telemetry — request rates, response times, failure rates, dependency calls, exceptions, page views, custom events. Smart Detection: automatically detects anomalies in request duration, failure rate using ML — notifies before users complain. Application Map: visual graph of app components and their dependencies. Color-coded by failure rate and latency. Live Metrics: real-time streaming of performance metrics from your running application. Distributed Tracing: end-to-end transaction correlation across microservices using trace IDs. View full call chain in Transaction Search. Workspace-based App Insights: App Insights data stored in Log Analytics workspace — query alongside other logs with KQL.

Azure Key Vault: centralized cloud service for storing and accessing secrets, encryption keys, and certificates. Three types of secrets: 1. Secrets: connection strings, passwords, API keys, any string value 2. Keys: cryptographic keys (RSA, EC) for encrypt/decrypt, sign/verify. Can be hardware-backed (HSM — FIPS 140-2 Level 2/3) 3. Certificates: TLS/SSL certificates with auto-renewal Tiers: - Standard: software-protected keys - Premium: hardware-protected keys (HSM) — required for PCI DSS, HIPAA compliance Access model: RBAC (recommended) or Access Policies. Grant specific roles (Key Vault Secrets User, Key Vault Crypto Officer) to identities. Managed Identity (the right way to access Key Vault from Azure services): // No credentials stored anywhere — Azure handles auth automatically const credential = new DefaultAzureCredential(); const client = new SecretClient('https://myvault.vault.azure.net', credential); const secret = await client.getSecret('db-connection-string'); This works because: 1. Your App Service/AKS pod has a Managed Identity (system-assigned or user-assigned) 2. You grant that identity Key Vault Secrets User role 3. DefaultAzureCredential fetches token automatically from Azure IMDS — no secrets in code Soft Delete and Purge Protection: deleted secrets retained for 7-90 days. Purge Protection prevents permanent deletion during retention period — required for GDPR/compliance. Versioning: each update creates a new version. Reference specific version or always get latest. Roll back by pointing to previous version. App Service integration: reference Key Vault secrets directly as App Settings using @Microsoft.KeyVault() syntax — secret value injected as environment variable at startup.