Securing Windows Server in On-Premises and Hybrid Infrastructures
Core concepts
Security for AZ-801 starts with identity and tiering. Understand the tier model (Tier 0 domain controllers and identity systems, Tier 1 servers and applications, Tier 2 user workstations), Protected Users group, credential guard, and Local Administrator Password Solution (LAPS). Know how Windows Defender Firewall profiles interact with Group Policy, and how to use connection security rules and IPsec. For hybrid, focus on Microsoft Entra Connect (password hash sync, pass-through authentication, federation), hybrid Microsoft Entra join, and Conditional Access enforcement. Also know BitLocker, Credential Guard, Device Guard/AppLocker, Windows Defender Application Control, and Just Enough Administration (JEA).
Traps to watch
Questions often blur authentication methods: password hash sync does not require an on-premises agent at sign-in, while pass-through authentication does. Remember hybrid Entra join requires device write-back and a configured service connection point. Protected Users blocks NTLM, Digest, and CredSSP, so it can break legacy apps. LAPS stores passwords in AD (or Entra) and requires schema extension and permissions. Do not confuse firewall rules with connection security rules.
Worked example
A company needs on-premises sign-in to continue if the internet fails. Rule of thumb: choose pass-through authentication with a supported agent pool, not password hash sync alone, because PTA validates against on-premises AD but depends on agent availability. If agents are all offline, sign-in fails; size the pool for redundancy. Always verify with Conditional Access and hybrid join prerequisites.
Exam approach
Map each requirement to the identity, device, data, or network control, then eliminate options that add unneeded infrastructure.