AZ-305 Exam Preparation Guide
Practical architecture notes and a focused study plan for the Microsoft AZ-305: Designing Microsoft Azure Infrastructure Solutions exam.
Recommended use: open the supporting video in a new tab, read this guide once end-to-end, then use the domain checklists, decision tables, supporting links and labs as a revision tracker.
Supporting AZ-305 video
This lesson from the Mike in the Cloud channel explains how to choose Azure storage services from architecture requirements rather than product names.
Watch How to Design Azure Storage Solutions for the AZ-305 Exam on YouTube
1. Executive summary
Scope of this guide: this is a study and readiness guide built from the current Microsoft skills outline and a compressed 340-question study deck. It extracts reusable architecture knowledge and decision rules; it is not a question dump.
- AZ-305 is a design exam. Expect competing requirements such as lowest cost, least administration, highest compatibility, private access, low latency and automatic failover.
- Identify hard constraints before optimising. Protocol, compatibility, failure scope, data residency, RPO, RTO and private connectivity can remove otherwise attractive options.
- Prefer the most managed Azure service that still meets the requirements. PaaS normally wins when the question asks for minimal administration.
- Match the service to the responsibility. Monitoring observes, policy enforces resource standards, RBAC authorises actions, and routing establishes connectivity.
- A resilient design must cover every dependency. Multi-zone compute with single-zone data is still a single point of failure.
- Check the current official study guide before booking because Microsoft updates objectives and product terminology.
2. Exam blueprint and weighting
Microsoft lists four objective domains for the English-language exam, updated on 17 April 2026.
| Item | What to know |
|---|---|
| Exam | AZ-305: Designing Microsoft Azure Infrastructure Solutions |
| Certification | Microsoft Certified: Azure Solutions Architect Expert |
| Audience | Solution architects who translate business requirements into secure, resilient and maintainable Azure designs. |
| Prerequisite working knowledge | Azure administration, development and DevOps, plus networking, virtualisation, identity, security, business continuity, data platforms and governance. |
| Pass score | 700 or greater. |
| Main preparation tools | Official study guide, Microsoft Learn paths, architecture case studies, hands-on validation, free Practice Assessment and Exam Sandbox. |
| Domain | Weight | Revision focus |
|---|---|---|
| Design identity, governance and monitoring solutions | 25-30% | Identity boundaries, authorisation scope, policy, compliance, secrets, monitoring data and routing. |
| Design data storage solutions | 20-25% | Choose the correct data service, tier, scale model, durability, protection and integration pattern. |
| Design business continuity solutions | 15-20% | Map failure scope and RPO/RTO to high availability, backup, replication and disaster recovery. |
| Design infrastructure solutions | 30-35% | Compute, application architecture, messaging, migration, networking, routing and load balancing. |
The biggest preparation point: infrastructure is the largest domain, but identity/governance/monitoring is close behind. Together they can account for 55-65% of the exam.
Supporting links
Official AZ-305 study guideCurrent skills measured, objective domains and update notes.AZ-305 exam pageExam details, practice assessment and scheduling.Azure Solutions Architect ExpertCertification requirements and renewal information.AZ-305 courseInstructor-led course outline and case-study topics.
3. Preparation strategy
3.1 The architecture sequence
Use this sequence on almost every scenario question:
- Identify the workload shape: web/API, background job, event-driven code, batch/HPC, database, file workload, stream, desktop or infrastructure service.
- Mark the hard constraints: protocol, OS/runtime, compatibility, location, private-only access, data residency, RPO/RTO, latency, isolation and compliance.
- Identify the service responsibility: identity, compute, storage, integration, routing, security, monitoring, backup or governance.
- Choose the most managed service that still satisfies the constraints.
- Apply the failure scope: instance/host, availability zone, region or global.
- Optimise cost only after the mandatory requirements are met.
3.2 Translate requirement words into design choices
| Requirement phrase | Translate it into |
|---|---|
| Minimum administrative effort | Prefer managed/PaaS services, native integration, autoscale and policy over custom scripts or self-managed VMs. |
| Minimum code change | Look for managed identity, Key Vault references, automatic instrumentation, deployment slots or a highly compatible migration target. |
| No public endpoint | Private Endpoint/Private Link, private DNS and public network access disabled where supported. |
| Survive a zone failure | Use zonal spread or a zone-redundant service. |
| Survive a region failure | Use a second region plus service-specific replication/failover and a global routing strategy. |
| Automatic failover | Both the data/compute layer and the routing layer must support health-based failover. |
| Highest compatibility | Move toward IaaS or a compatible managed service such as SQL Managed Instance. |
| Elastic or unpredictable demand | Scale out, autoscale, serverless or elastic pools depending on workload shape. |
| Deny invalid deployment | Azure Policy; RBAC controls who can attempt an action. |
| Periodic access recertification | Microsoft Entra ID Governance access reviews. |
| Temporary privileged administration | Microsoft Entra Privileged Identity Management. |
3.3 Current terminology to use
- Use Microsoft Entra ID for the service formerly called Azure Active Directory.
- Use Microsoft Entra Connect Sync for the product formerly called Azure AD Connect; compare it with Cloud Sync when topology matters.
- Use Azure Virtual Desktop rather than Windows Virtual Desktop.
- Design new global HTTP solutions with Azure Front Door Standard or Premium, not the classic tier.
- Prefer Azure RBAC for new Key Vault authorisation designs.
- Use Deployment Stacks, Template Specs, Bicep, Azure Policy and RBAC for new governance/deployment designs rather than Azure Blueprints.
- Evaluate Azure Managed Redis for new cache designs while still learning Redis and cache-aside concepts.
4. Domain 1 - Design identity, governance and monitoring solutions
Weighting: 25-30%
4.1 Core knowledge
| Area | You need to know |
|---|---|
| Identity architecture | Tenant boundaries, hybrid identity, external identities, managed identities, service principals and application publishing. |
| Authentication and authorisation | Conditional Access, MFA, Identity Protection, Azure RBAC, Entra roles, Key Vault access and data-plane roles. |
| Identity governance | PIM, access reviews and entitlement management for privileged, guest and time-limited access. |
| Resource governance | Management groups, subscriptions, resource groups, tags, Azure Policy, initiatives, remediation and locks. |
| Monitoring architecture | Metrics, logs, diagnostic settings, Activity Log, Log Analytics, Application Insights, action groups and data retention. |
4.2 Decision rules and exam traps
- Every Azure role assignment is principal + role definition + scope. Apply least privilege at the narrowest useful scope.
- Entra roles manage directory capabilities; Azure RBAC manages Azure resources. Data-plane services can have their own Azure RBAC roles.
- Managed identities remove stored credentials; they do not automatically grant access. The identity still needs the correct role at the correct scope.
- Policy evaluates resource properties. RBAC authorises callers. Locks protect control-plane operations. Do not use one as a substitute for another.
- Diagnostic settings route supported resource logs and metrics to Log Analytics, Storage or Event Hubs.
- Use metrics for fast numeric alerting, Log Analytics/KQL for detailed correlation, Application Insights for application performance, and Sentinel for SIEM/SOAR.
Supporting links
Identity, governance and monitoring pathOfficial AZ-305 learning path.Azure RBAC overviewRoles, assignments and scope.Azure Policy overviewCompliance, effects and remediation.Managed identitiesCredential-free identities for Azure resources.Azure Monitor overviewMetrics, logs, traces and alerts.Application InsightsApplication performance monitoring and distributed tracing.
5. Domain 2 - Design data storage solutions
Weighting: 20-25%
5.1 Start with data shape and access pattern
| Workload shape | First services to compare |
|---|---|
| Relational OLTP and SQL semantics | Azure SQL Database, Azure SQL Managed Instance and SQL Server on Azure VMs. |
| Globally distributed NoSQL/JSON with predictable low latency | Azure Cosmos DB. |
| Object data, backups, media and logs | Azure Blob Storage. |
| Analytics lake with directory semantics and ACLs | Azure Data Lake Storage Gen2. |
| Managed SMB/NFS shares | Azure Files; consider Azure NetApp Files for demanding enterprise file workloads. |
| Analytical warehouse, lakehouse or Spark | Compare Azure Synapse Analytics, Azure Databricks and Microsoft Fabric according to the scenario. |
| High-throughput telemetry | Event Hubs for ingestion, then Data Explorer, Stream Analytics, Synapse, Databricks or Fabric for processing and analysis. |
5.2 High-yield decision rules
- Choose SQL Database for managed database-level PaaS, Managed Instance for high SQL Server compatibility with reduced administration, and SQL Server on VM for full OS/instance control.
- For Cosmos DB, partition-key choice is the main scale decision. Also understand consistency, multi-region writes, autoscale/serverless and analytical store.
- Storage redundancy maps to failure scope: LRS for local copies, ZRS across zones, GRS across regions, GZRS for zone-resilient primary plus regional replication, and RA variants for secondary reads.
- Use immutable storage for write-once retention. Soft delete, versioning and point-in-time restore protect recoverability but are not the same as immutability.
- Private Endpoint provides a private IP in the VNet. A service endpoint secures a service’s public endpoint to selected VNets/subnets.
- Prefer Microsoft Entra authentication and data-plane RBAC. Use a narrowly scoped, time-limited SAS when delegation is required; avoid account keys when a narrower option works.
Supporting links
Data storage solutions pathOfficial AZ-305 learning path.Azure data-store choicesArchitecture guidance for choosing a data store.Azure SQL optionsDatabase, Managed Instance and SQL Server on VM.Cosmos DB partitioningPartition keys and horizontal scale.Storage redundancyLRS, ZRS, GRS and GZRS options.Private endpoints for StoragePrivate access and DNS considerations.
6. Domain 3 - Design business continuity solutions
Weighting: 15-20%
6.1 Begin with the recovery requirement
| Term | Architecture question |
|---|---|
| RPO | How much data loss, measured in time, is acceptable? |
| RTO | How long can the service be unavailable? |
| Availability SLA | How much uptime is required, and which supported configuration provides it? |
| Failure domain | Must the design survive an instance, rack, zone, region, control-plane or dependency failure? |
| Blast radius | How many users and services can one failure or configuration mistake affect? |
6.2 Do not mix up HA, backup and DR
| Requirement | Primary mechanism | What it does not automatically provide |
|---|---|---|
| Keep running through instance or zone failure | High availability, replicas, zones and load balancing. | Historical recovery points or regional DR. |
| Recover deleted, corrupted or ransomware-affected data | Backup with appropriate retention and protection. | Instant application failover. |
| Recover in another region or site | Replication plus disaster recovery, Site Recovery or database-native geo-replication. | Long-term backup retention. |
| Prevent a compromised production admin deleting backups | Soft delete, immutability and Multi-user Authorization with Resource Guard. | Ordinary least-privilege RBAC may not provide the required separation of duties. |
6.3 Exam traps and decision rules
- Availability zones protect against datacentre/zone failure inside one region. They do not provide regional disaster recovery.
- Regional resilience needs a second region, data replication and traffic/failover design. Check that every dependency supports the same recovery objective.
- Use service-native continuity where it is stronger: SQL failover groups/geo-replication, Cosmos DB multi-region, Storage geo-redundancy and App Service multi-region deployment.
- Azure Backup protects recovery points. Azure Site Recovery replicates and orchestrates supported workloads. Recovery plans order multi-tier failover steps.
- Test failover is part of proving the design; a written DR plan without validation is not enough.
Supporting links
Business continuity pathOfficial AZ-305 learning path.Azure reliability guidanceReliability concepts and service guidance.Availability zonesZonal and zone-redundant architecture.Azure Backup architectureVaults, policies and protected workloads.Azure Site RecoveryReplication, failover and recovery plans.
7. Domain 4 - Design infrastructure solutions
Weighting: 30-35%
7.1 Compute selection
| Requirement | Service to compare first |
|---|---|
| Full OS control, custom agents or legacy server | Azure Virtual Machines. |
| Elastic fleet of similar VMs | Virtual Machine Scale Sets. |
| Managed web/API runtime | Azure App Service. |
| Event-driven code | Azure Functions. |
| Low-code workflow and connectors | Azure Logic Apps. |
| Kubernetes APIs and orchestration | Azure Kubernetes Service. |
| Managed containers without Kubernetes administration | Azure Container Apps. |
| Simple isolated container instance or job | Azure Container Instances. |
| Massively parallel batch workloads | Azure Batch. |
| Scheduler-centred HPC environment | Azure CycleCloud. |
7.2 Messaging and integration
- Service Bus: enterprise commands and messages needing queues/topics, sessions, ordering, transactions or dead-lettering.
- Event Grid: event notification and routing - “something happened.”
- Event Hubs: high-volume partitioned telemetry and event streams.
- Queue Storage: simple, durable, low-cost work backlog.
- API Management: publish, protect, transform, version and govern APIs; it is not a general load balancer.
- App Configuration: central settings and feature flags. Store secrets, keys and certificates in Key Vault.
7.3 Networking and routing
| Service | Scope | Choose when |
|---|---|---|
| Azure Front Door Standard/Premium | Global Layer 7 HTTP/HTTPS edge | Global web routing, acceleration, health-based failover, WAF and path/host routing. |
| Traffic Manager | Global DNS-based | DNS routing by priority, performance, weighted, geographic or other supported profiles. |
| Application Gateway | Regional Layer 7 | Regional HTTP routing, TLS termination and WAF. |
| Azure Load Balancer | Regional Layer 4 | TCP/UDP load balancing for VMs, scale sets and network appliances. |
| Gateway Load Balancer | Transparent service insertion | Scale third-party network virtual appliances in the traffic path. |
7.4 Migration decision rules
- Use Azure Migrate to discover, assess and right-size servers and databases, then choose the appropriate migration tool.
- Rehost to VMs for maximum compatibility; modernise to App Service, Container Apps or AKS when the application and operating model justify it.
- SQL Managed Instance is often the migration target when high SQL Server compatibility and lower administration are both required.
- Use Data Box when the dataset is very large and bandwidth is insufficient, AzCopy for command-line transfers, Storage Mover for supported managed migrations, and File Sync for ongoing hybrid caching rather than one-time migration.
- ExpressRoute provides private provider connectivity; VPN uses encrypted internet connectivity. Virtual WAN is the managed transit option for many branches and connections.
Supporting links
Infrastructure solutions pathOfficial AZ-305 learning path.Choose an Azure compute serviceCompute decision guidance.Messaging services comparisonService Bus, Event Grid and Event Hubs guidance.Load-balancing optionsGlobal and regional routing comparison.Azure Migrate overviewDiscovery, assessment and migration.Cloud Adoption FrameworkStrategy, plan, ready, adopt and govern guidance.
8. Reusable architecture patterns
| Scenario | Reusable design pattern |
|---|---|
| Global internet web app with WAF | Front Door Standard/Premium to regional App Service, AKS or Application Gateway backends, then private data services. |
| Partner access reviewed regularly | External identity/B2B, enterprise app or group assignment, and recurring access review or entitlement management. |
| Azure workload needs a secret without stored credentials | Managed identity to Key Vault using Azure RBAC. |
| Private PaaS reachable from on-premises | VPN/ExpressRoute to VNet, Private Endpoint and Private DNS, with public network access disabled. |
| Global low-latency NoSQL | Cosmos DB multi-region with deliberate write-region, consistency and partition-key choices. |
| Enterprise command workflow | Producer to Service Bus queue/topic, then Functions, worker or Logic Apps, with a durable downstream store. |
| VM continuity | Zone-spread HA plus Azure Backup for recovery points and Site Recovery or another cross-region mechanism for DR. |
9. Practical lab checklist
Use small labs to prove the decision rules rather than trying to build one enormous environment.
- Build a management-group/subscription/resource-group hierarchy and test policy inheritance, remediation and RBAC scope.
- Give a managed identity access to a Key Vault secret using Azure RBAC; remove the assignment and confirm the failure mode.
- Route resource logs with diagnostic settings, query them in Log Analytics and create an alert with an action group.
- Compare SQL Database, Managed Instance and SQL VM against a sample compatibility and operations checklist.
- Create a storage account with ZRS, lifecycle management, soft delete and a private endpoint; confirm private DNS resolution.
- Model RPO/RTO for a three-tier app and select separate HA, backup and DR mechanisms for every dependency.
- Deploy a small App Service or container workload and compare scale-up, scale-out, autoscale and deployment slots/revisions.
- Build a Service Bus queue and Event Grid subscription so the difference between commands and events becomes concrete.
- Diagram Front Door, Traffic Manager, Application Gateway and Load Balancer scenarios and explain the layer and scope of each.
- Run an Azure Migrate assessment walkthrough or case study and justify rehost, replatform or refactor decisions.
Supporting links
AZ-305 prerequisites pathRefresh the Azure platform foundations used by the exam.Azure Architecture CenterReference architectures, technology choices and design patterns.Well-Architected FrameworkReliability, security, cost, operations and performance guidance.Practice AssessmentFree Microsoft certification practice assessments.
10. Exam-day strategy
- Read the final sentence first when a scenario is long; it often reveals the exact design decision being tested.
- Separate mandatory requirements from preferences. A lower-cost option is wrong if it breaks compatibility, private access or recovery objectives.
- Identify the failure scope before choosing a resilience feature.
- Eliminate options that solve the wrong responsibility: observability instead of enforcement, filtering instead of connectivity, or backup instead of failover.
- Prefer native, managed capabilities when the question asks for minimal administration or code change.
- Mark uncertain questions and return later. Do not spend disproportionate time on one product detail.
- Use Microsoft Learn during the exam for narrow confirmation, not broad learning; searching and navigating consumes exam time.
Supporting links
Exam duration and experienceQuestion formats, timing, breaks and Microsoft Learn access.Exam SandboxExplore the certification exam interface.Prepare for an examMicrosoft guidance on study and readiness.
11. Final readiness checklist
| Readiness item | Target before booking |
|---|---|
| Official objectives | You can explain every bullet in the current skills list and give one architecture example. |
| Requirement translation | You can turn cost, compatibility, latency, administration, privacy and resilience wording into design constraints. |
| Service comparisons | You can explain the high-yield comparisons below without notes. |
| Failure design | You can separate HA, backup and DR and map each to RPO, RTO and failure scope. |
| Architecture evidence | You have completed the labs above or equivalent case studies and can defend the trade-offs. |
| Practice Assessment | You have used the official assessment diagnostically, revised weak domains and retested. |
| Exam Sandbox | You understand the interface, review screen, case studies and question interactions. |
High-yield comparisons to memorise: Entra roles vs Azure RBAC vs data-plane roles; Policy vs RBAC vs locks; managed identity vs service principal; metrics vs logs vs traces; SQL Database vs Managed Instance vs SQL VM; Blob vs Files vs Data Lake; LRS/ZRS/GRS/GZRS; Private Endpoint vs service endpoint; HA vs backup vs DR; App Service vs Functions vs Container Apps vs AKS vs VMs; Service Bus vs Event Grid vs Event Hubs vs Queue Storage; Front Door vs Traffic Manager vs Application Gateway vs Load Balancer; VPN vs ExpressRoute; rehost vs replatform vs refactor.
12. Useful official links and reference library
Use these links as the reference library for the guide. Check the official study guide and exam page before booking because exam objectives, service names and retirement timelines can change.
AZ-305 exam and preparation
Official AZ-305 study guideCurrent objectives and change log.AZ-305 exam pageExam details, practice assessment and scheduling.Solutions Architect ExpertCertification requirements.AZ-305T00 courseOfficial course overview.Mike in the Cloud AZ-305 playlistMore AZ-305 architecture lessons.
Domain learning paths
PrerequisitesAzure architecture foundations.Identity, governance and monitoringAuthentication, governance and observability design.Data storageRelational, non-relational and integration design.Business continuityHigh availability, backup and disaster recovery.InfrastructureCompute, applications, networking and migrations.
Architecture references
Azure Architecture CenterReference architectures and design patterns.Well-Architected FrameworkFive pillars and workload guidance.Cloud Adoption FrameworkEnterprise cloud adoption guidance.Azure reliabilityService-specific reliability guidance.Azure security documentationIdentity, network and data security guidance.
This guide is for exam preparation and revision. Always check the latest Microsoft Learn study guide before booking the exam because objective domains, Azure services and exam policies can change.