AZ-802 Windows Server Hybrid Administrator cheat sheet

Azure Arc-enabled servers onboard on-premises Windows Server machines as connected machine resources; the Azure Connected Machine agent is required and outbound 443 to Arc endpoints must be allowed.

Azure Automanage machine best practices applies a curated set of services (backup, monitoring, update management, change tracking) to Arc-enabled servers and Azure VMs; profiles can be customized per machine.

Azure Update Manager replaces the legacy Update Management solution in Azure Automation; Arc-enabled servers are managed through the same update configuration as Azure VMs.

Windows Admin Center is browser-based and gateway-hosted; it manages Windows Server 2016 and later, failover clusters, and Azure services such as Azure Backup and Azure File Sync.

Azure Migrate discovery of physical or VMware servers uses a lightweight appliance; dependency analysis uses Service Map agents to group servers by network communication.

Desired State Configuration on hybrid servers can be delivered through Azure Automation State Configuration or machine configuration (Azure Policy guest configuration) for auditing and drift correction.

Windows Server 2025 and 2022 can register with Azure Arc during installation (Arc-enabled setup) so the machine is projected into Azure at first boot.

Hybrid activation: Azure Arc-enabled servers and Azure VMs can use Azure Arc ESU and Azure verification for extended security updates; on-premises activation requires MAK, KMS, or AD-based activation.

Microsoft Entra Connect Sync supports password hash synchronization, pass-through authentication, and federation with AD FS; seamless SSO can be layered on PHS or PTA.

Password writeback requires Entra Connect and permits self-service password reset from the cloud to write the new password back to on-premises AD.

Microsoft Entra Connect cloud sync is a lightweight agent-based alternative to Entra Connect for multi-forest and disconnected scenarios; it does not support all advanced features such as device writeback.

Group writeback (Microsoft Entra ID to AD) requires Entra Connect and is used to project cloud security groups into on-premises AD as distribution groups for hybrid authorization.

Windows LAPS stores local administrator passwords in AD (AD LAPS) or Microsoft Entra ID (Azure LAPS); Entra ID LAPS requires the Microsoft Entra ID built-in role or a custom role with the appropriate permissions.

Kerberos constrained delegation and resource-based constrained delegation control service-to-service impersonation; protocol transition allows non-Kerberos authentication to obtain Kerberos tickets.

Microsoft Entra Domain Services provides managed domain services (LDAP, Kerberos, NTLM, Group Policy) without deploying domain controllers; it syncs one-way from Microsoft Entra ID.

Privileged Identity Management provides just-in-time role activation with approval, MFA, and time-bound assignments for Microsoft Entra roles and Azure resources.

Azure VPN Gateway site-to-site uses IPsec/IKE; policy-based vs route-based selection matters: route-based is required for point-to-site coexistence, ExpressRoute coexistence, and VNet-to-VNet.

Azure ExpressRoute provides private connectivity through a connectivity provider; ExpressRoute Global Reach connects on-premises sites through the Microsoft backbone.

Azure DNS Private Resolver enables hybrid DNS resolution between on-premises and Azure without deploying DNS forwarder VMs; it includes inbound and outbound endpoints.

Azure Private Endpoint maps a PaaS service to a private IP in a subnet; Private Link service and private endpoint DNS zones must be configured for name resolution.

Windows Server DNS conditional forwarders or stub zones direct queries for specific namespaces to authoritative servers across hybrid links.

IP address management in hybrid networks requires avoiding overlapping RFC1918 ranges; Azure reserves five addresses per subnet (first four and last).

Azure Network Watcher tools include connection troubleshoot, IP flow verify, next hop, packet capture, and topology; connection monitor tracks reachability over time.

Windows Server 2025 supports NAT over Hyper-V and SMB over QUIC; SMB over QUIC requires TCP 443 and certificates and is used for secure file access over untrusted networks.

Azure File Sync uses a Storage Sync Service, sync groups, cloud endpoints (Azure file share), and server endpoints (local paths); cloud tiering offloads cold files while leaving reparse points.

Azure File Sync requires the Azure File Sync agent on each server, supports Windows Server 2012 R2 and later, and a server can belong to only one sync group per server endpoint path.

Azure file shares support SMB 3.x and NFS; identity-based SMB access uses on-premises AD DS or Microsoft Entra Domain Services for Kerberos authentication.

Storage Replica provides block-level replication for volume-to-volume, server-to-server, stretch cluster, and cluster-to-cluster scenarios; log volumes are required and must be separate from data volumes.

SMB share permissions combine with NTFS permissions; the effective permission is the most restrictive of share and NTFS unless access-based enumeration or explicit settings change visibility.

Windows Server Backup and Azure Backup (MARS agent or MABS/DPM) differ: MARS backs up files and system state directly to a Recovery Services vault; MABS supports application-consistent workloads.

Azure Backup for on-premises servers uses the Microsoft Azure Recovery Services (MARS) agent; encryption passphrase is required and must be stored securely for data recovery.

Deduplication and Data Deduplication on Windows Server support optimization of general purpose file servers and VDI; deduplication is not supported on volumes hosting the Azure File Sync agent's cloud tiering files in all configurations.

Hyper-V nested virtualization is required for running Hyper-V inside an Azure VM; the VM size must support nested virtualization.

Generation 2 VMs support UEFI, PXE boot, and Secure Boot; generation 1 VMs use BIOS and are needed for some legacy guests.

Checkpoints: standard checkpoints capture disk and memory state; production checkpoints use VSS for application-consistent snapshots.

Live migration requires shared storage or storage migration; Credential Security Support Provider (CredSSP) or Kerberos constrained delegation must be configured for constrained delegation scenarios.

Failover clustering quorum options include node majority, disk witness, file share witness, and cloud witness; cloud witness uses an Azure storage account.

Azure Arc-enabled VMware vSphere and Azure Arc-enabled SCVMM allow VM lifecycle operations from Azure, including start, stop, resize, and template-based deployment.

Azure Stack HCI is a hyperconverged cluster OS; it uses Storage Spaces Direct and can be managed through Windows Admin Center or Azure Arc.

Shielded VMs use a Host Guardian Service (HGS) to attest hosts; shielding modes include Shielded and Encryption Supported, and vTPM is required for shielded mode.

Azure Monitor Agent (AMA) replaces the legacy Log Analytics agent; data collection rules define which events, performance counters, and logs are collected.

Azure Monitor for VMs (VM insights) uses the Dependency Map and performance views; it requires AMA and a data collection rule.

Microsoft Defender for Cloud provides secure score, regulatory compliance, and adaptive application controls; Defender for Servers plans include endpoint protection and vulnerability assessment.

Windows Defender Firewall profiles are Domain, Private, and Public; rules can be scoped by profile, protocol, port, and program, and IPsec connection security rules can require authentication.

BitLocker recovery keys can be escrowed to AD DS or Microsoft Entra ID; Entra ID escrow requires the device to be Microsoft Entra joined or hybrid joined.

Windows Server Update Services (WSUS) can be replaced or supplemented by Azure Update Manager; WSUS remains supported for on-premises patching and approval workflows.

Audit policy categories include account logon, logon/logoff, object access, policy change, and system; advanced audit policy provides granular subcategory control.

Security baselines can be applied through Azure Policy guest configuration or Microsoft Defender for Cloud recommendations; drift is detected by periodic machine configuration evaluation.