CertifyDeckCargando contenido…
The official Microsoft Certified: Azure Solutions Architect Expert syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Design solutions for logging and monitoring
Azure Monitor logs live in Log Analytics workspaces and are queried with KQL. Start with a single workspace and add more only for data residency, ownership, billing or different retention needs. The activity log is collected automatically, resource logs need a diagnostic setting, and table plans balance cost against retention and query needs.
Design a Log Analytics workspace architecture ↗Azure Monitor Logs ↗
Diagnostic settings route resource logs, platform metrics and the activity log to a Log Analytics workspace, a storage account, Event Hubs or a partner solution. Data export rules copy workspace tables, transformations filter data before it is stored, and Azure Monitor pipeline processes data at remote or hybrid sites.
Diagnostic settings in Azure Monitor ↗What is Azure Monitor pipeline? ↗
Azure Monitor covers every layer: Application Insights for applications, VM insights and Azure Monitor Agent for machines (including hybrid ones through Azure Arc), managed Prometheus and Grafana for Kubernetes, and Connection monitor for the network. Metric, log search, activity log and Service Health alerts cover different signals, and workbooks serve reporting.
Design authentication and authorization solutions
Hybrid environments have three sign-in methods: password hash synchronization (simplest), pass-through authentication (validates against on-premises Active Directory) and federation (needed for requirements Entra does not cover natively). Enabling password hash synchronization as a backup is recommended. Phishing-resistant passwordless methods, Conditional Access and managed identities complete the design.
Authentication for Microsoft Entra hybrid identity solutions ↗Microsoft Entra authentication overview ↗
Cloud Sync synchronizes Active Directory with Entra ID through lightweight agents and supports disconnected forests, while Domain Services provides managed LDAP, Kerberos and domain join for legacy apps. External ID covers B2B collaboration and customers in an external tenant, and ID Governance manages the lifecycle with entitlements, reviews and workflows.
Overview of Microsoft Entra Domain Services ↗Microsoft Entra External ID overview ↗
Azure RBAC grants access through role assignments (security principal, role definition and scope) that are inherited down the management group, subscription, resource group and resource hierarchy, with additive permissions. ABAC conditions refine access and PIM adds just-in-time activation. Key Vault separates the control plane from the data plane.
What is Azure role-based access control (Azure RBAC)? ↗What is Privileged Identity Management? ↗
Microsoft Entra application proxy publishes on-premises web apps through an outbound-only connector with preauthentication and Conditional Access, and uses Kerberos Constrained Delegation for integrated SSO. Private Access tunnels private resources by FQDN or IP through Quick Access or per-app access. Cloud Kerberos trust gives SSO to Active Directory resources.
Publish on-premises apps with Microsoft Entra application proxy ↗Learn about Microsoft Entra Private Access ↗
Azure Key Vault centralizes secrets, keys and certificates; use one vault per application and environment, managed identities and least-privilege Azure RBAC. Turn on soft-delete and purge protection. For a customer-owned root of trust and single tenancy choose Managed HSM; certificates from partner CAs renew automatically.
Secure your Azure Key Vault ↗Overview of key management in Azure ↗
Design governance
Use a flat management group hierarchy that groups subscriptions by policy needs, with separate platform subscriptions. Resource groups hold resources that share a lifecycle. Tags are not inherited: enforce or inherit them with Azure Policy (modify effect), and never put sensitive values in them.
Management groups - Cloud Adoption Framework ↗Policy definitions for tagging resources ↗
Azure Policy evaluates resources and applies effects such as audit, deny or deployIfNotExists; start with audit, use initiatives and remediation tasks for existing resources, and expiring exemptions for exceptions. Defender for Cloud shows regulatory compliance per control; Blueprints migrates to deployment stacks and template specs.
Overview of Azure Policy ↗Regulatory compliance in Defender for Cloud ↗
Microsoft Entra ID Governance covers the identity and access lifecycle: entitlement management uses access packages with approval and expiry, access reviews recertify access, lifecycle workflows automate joiners and leavers, and PIM gives just-in-time privileged access with MFA and approval.
Microsoft Entra ID Governance ↗What is entitlement management? ↗