AZ-305 is a design exam: you get business requirements and constraints, then pick the Azure architecture that fits them. This outline follows the skills measured published on 17 April 2026 and lists what each domain expects, in plain terms. Tick topics off as you cover them. Your ticks are saved in this browser.
This outline follows the official AZ-305 exam guide . Check it for the exact wording.
Design identity, governance and monitoring solutions 25–30% Logging and monitoring, authentication and authorization for Azure and on-premises, secrets management, and governance. Weighted 25-30%.
Logging and monitoring Authentication and identity management Authentication: Microsoft Entra ID, Conditional Access, MFA, passwordless, Entra External ID for customers and B2B guests Hybrid identity: Entra Connect Sync or Cloud Sync, password hash sync, pass-through authentication, federation, seamless SSO Identity management: managed identities, service principals, workload identity federation, Entra Domain Services Applications: app registrations, enterprise applications, consent, Application Proxy Authorization Authorizing Azure resources: Azure RBAC, custom roles, scope and inheritance, deny assignments, Privileged Identity Management Authorizing on-premises resources: Application Proxy, Entra Domain Services, Kerberos and hybrid join, Global Secure Access Secrets, certificates and keys: Key Vault vs Managed HSM, access models, soft delete and purge protection, encryption key choices Governance Structure: management groups, subscriptions, resource groups, landing zones, naming and tagging strategy Compliance: Azure Policy, initiatives, remediation, Blueprints replacement, Defender for Cloud regulatory compliance, Microsoft Purview Identity governance: access reviews, entitlement management, lifecycle workflows, PIM, guest lifecycle
Design data storage solutions 20–25% Relational, semi-structured and unstructured storage, performance and cost trade-offs, data protection, integration and analytics. Weighted 20-25%.
Relational data Choosing between Azure SQL Database, SQL Managed Instance, SQL Server on VMs and open source engines on Azure Service and compute tiers: DTU vs vCore, General Purpose, Business Critical, Hyperscale, serverless, provisioned, elastic pools Scalability: read scale-out, Hyperscale named replicas, sharding, elastic pools, Flexible Server scaling Data protection: TDE, Always Encrypted, dynamic data masking, Entra authentication, auditing, ledger, Defender for SQL Semi-structured and unstructured data Semi-structured stores: Cosmos DB APIs, consistency levels, partitioning and throughput, Table storage Unstructured stores: Blob Storage, Data Lake Storage Gen2, Azure Files, Azure NetApp Files, managed disks Balancing features, performance and cost: access tiers, redundancy options, lifecycle management, premium vs standard Protection and durability: LRS, ZRS, GRS, GZRS, soft delete, versioning, immutability, encryption, private endpoints Data integration and analysis
Design business continuity solutions 15–20% Backup, disaster recovery and high availability across compute, databases and storage, measured against RPO, RTO and SLA targets. Weighted 15-20%.
Backup and disaster recovery Meeting recovery objectives for Azure and hybrid workloads: Azure Site Recovery, Azure Backup, Azure Migrate replication Backup and recovery for compute: VM backup, MARS agent, Azure Backup Server, AKS backup Backup and recovery for databases: automated SQL backups, PITR, LTR, geo-restore, Cosmos DB continuous backup, Backup vault Backup and recovery for unstructured data: blob soft delete, versioning, point-in-time restore, operational and vaulted backup, Azure Files snapshots and backup High availability Compute: availability sets, availability zones, zone-redundant services, Virtual Machine Scale Sets, paired regions, composite SLAs Relational data: zone-redundant SQL, failover groups, geo-replication, Flexible Server HA, SQL Managed Instance failover groups Semi-structured and unstructured data: Cosmos DB multi-region and multi-write, ZRS/GZRS/RA-GRS, storage account failover, Azure Files redundancy
Design infrastructure solutions 30–35% Compute, application architecture, migrations and networking. The largest domain at 30-35%.
Compute Specifying compute components from workload requirements: sizes, scale, licensing, placement, hosts Virtual machine based solutions: VM families, Spot, scale sets, availability, Azure Virtual Desktop, dedicated hosts Container based solutions: AKS, Container Apps, Container Instances, App Service containers, Container Registry Serverless solutions: Functions hosting plans, Logic Apps, App Service, Static Web Apps Batch processing: Azure Batch, Spot capacity, HPC options, Functions and Container Apps jobs Application architecture Messaging: Service Bus queues and topics, Storage queues, Event Hubs, competing consumers, ordering and sessions Event-driven: Event Grid, Event Hubs, Service Bus, Functions triggers, choreography vs orchestration API integration: API Management tiers and policies, Logic Apps, Application Gateway vs Front Door in front of APIs Caching: Azure Managed Redis, Front Door and CDN caching, caching patterns Application configuration: App Configuration, feature flags, Key Vault references Automated deployment: Bicep, ARM templates, Azure DevOps and GitHub Actions, deployment slots, Template Specs Migrations Cloud Adoption Framework: strategy, plan, ready, migrate, landing zones, the 5 Rs Assessing servers, data and applications: Azure Migrate discovery, dependency analysis, readiness and sizing assessments Migrating to IaaS and PaaS: lift and shift, App Service Migration Assistant, Azure Migrate server and web app migration Migrating databases: Database Migration Service, Azure SQL migration extension, online vs offline, Data Migration Assistant Migrating unstructured data: Data Box family, AzCopy, Storage Mover, Azure File Sync, Import/Export Networking Internet connectivity: public IPs, NAT Gateway, Azure Firewall, Bastion, DDoS Protection On-premises connectivity: VPN Gateway, ExpressRoute, Virtual WAN, hub and spoke, peering, Private Link and DNS Optimizing performance: accelerated networking, proximity placement groups, Front Door, ExpressRoute Global Reach, CDN Optimizing security: NSGs, ASGs, Azure Firewall, WAF, private endpoints, service endpoints, network segmentation Load balancing and routing: Load Balancer, Application Gateway, Front Door, Traffic Manager, route tables and BGP