MSAP common mistakes
MSAP · Understand the traps and how to avoid them.
When a question says a user must be blocked from signing in but must keep all existing permissions and mailbox access, candidates delete the user object or remove role assignments instead of blocking sign-in on the account.
The word 'remove' or 'revoke' in the stem pulls attention toward deletion and role removal, and the difference between a disabled account and a deleted account is easy to blur under time pressure. The exam expects you to know that blocking sign-in preserves the object, its data, and its assignments while deleting the object destroys the identity and orphans the mailbox.
What to do instead
Drill the distinction: block sign-in for a temporary or reversible suspension, delete for permanent removal. Read the stem for preservation cues such as 'retain mailbox', 'keep group memberships', or 'restore later'. When you see those cues, choose the accountEnabled=false path via Microsoft Entra ID, not deletion.
Candidates assign roles at the subscription scope when the requirement is limited to a single resource group or resource, or they pick a broad built-in role such as Owner or Contributor when a narrowly scoped role is required.
Subscription-scope assignments are the first option seen in the portal and feel 'safe' because they obviously grant access. The exam tests least privilege and scope inheritance, so a technically working but over-broad assignment is the wrong answer even though it satisfies the functional need.
What to do instead
For every access-control question, identify the narrowest scope that satisfies the requirement, then the least-privileged built-in role that covers the needed actions. Remember assignments inherit downward from management group to subscription to resource group to resource, so assign at the highest level only when access must span everything beneath it.
When asked to give an external partner or automated process access, candidates create a user account in the tenant or share credentials instead of using guest invitations or app registrations with service principals and federated credentials.
Creating a user is the familiar path from on-premises thinking, and the exam's phrasing about 'a partner consultant' or 'a CI pipeline' does not always use the words 'guest' or 'service principal'. Candidates also confuse app registrations with enterprise applications.
What to do instead
Map identity type to scenario: humans outside the organization get guest invitations (B2B), workloads and pipelines get app registrations plus service principals, and cross-tenant automation gets federated credentials instead of stored secrets. Memorize that the app registration is the definition and the enterprise application is the tenant-local instance used for assignment and consent.
Candidates choose a storage redundancy option that does not meet a stated durability or read-availability requirement, for example selecting LRS when the stem requires survival of a regional datacenter failure, or standard when the stem requires reads from a secondary region during an outage.
LRS, ZRS, GRS, GZRS, and their read-access variants differ along two independent axes, region scope and read access to the secondary, and the names are similar enough to blur. Candidates also forget that read access to the secondary requires the RA prefix and that failover changes which endpoint is primary.
What to do instead
Build a two-axis table before the exam: within one datacenter (LRS), across availability zones in one region (ZRS), across paired regions (GRS/GZRS), and add RA only when reads from the secondary are required. Then check the stem for 'zone failure', 'region failure', and 'read while primary is unavailable' and match each phrase to an axis.
Candidates configure a lifecycle management rule or an access tier change that does not actually move blobs as intended, for example expecting a rule to delete snapshots or versions when the rule only targets base blobs, or expecting an archive-tier blob to be readable immediately.
Lifecycle rules look simple in the portal but have subtle predicates: prefix filters, blob type filters including snapshots and versions, and the fact that archive rehydration is an hours-long operation that changes the blob's tier only after completion. Candidates also forget that a blob in archive cannot be read or copied until rehydrated.
What to do instead
When a question involves lifecycle rules, check three things explicitly: which blob types the rule targets, whether the condition is based on modification time or last access time, and whether the action is tier change or deletion. For archive questions, remember rehydration is asynchronous and prioritized rehydration costs more and is faster.
Candidates pick the wrong tool for moving data, for example choosing AzCopy for a one-time scheduled migration that should use Azure Storage Mover or Azure Data Box, or choosing Import/Export for a small dataset that AzCopy handles over the network.
All of these tools move data into storage, so the functional descriptions overlap and the differentiators are volume, network constraints, and whether the job is one-time or recurring. Stems often bury the deciding constraint in a subordinate clause about bandwidth or offline transfer.
What to do instead
Anchor on the constraint: online and scriptable means AzCopy; large-scale online with scheduling and bandwidth control means Storage Mover; offline or bandwidth-starved means Data Box; file protocol migration with metadata preservation means Azure File Sync or Storage Migration Service. Extract the constraint phrase first, then choose the tool.
Candidates deploy a virtual machine without meeting an availability requirement, for example placing two VMs in the same availability set when the stem requires protection from a datacenter failure, or using an availability set when the requirement calls for zone-level resilience.
Availability sets and availability zones both sound like 'high availability' and the portal presents them adjacently. Candidates also forget that availability sets protect against hardware faults and maintenance within a datacenter, while zones protect against a whole datacenter failure, and that a VM can belong to only one or the other.
What to do instead
Decide by failure domain: rack-level faults mean availability set with fault domains and update domains; datacenter-level failure means availability zones with each VM in a different zone. If the stem mentions a 99.99% SLA or 'survive a zone outage', zones are required; if it mentions planned maintenance within a datacenter, an availability set is enough.
Candidates choose the wrong scaling mechanism, for example configuring autoscale on a virtual machine scale set when the requirement is to scale a single VM, or using a scale set when the requirement is to resize a single long-running VM.
Autoscale, scale sets, and VM resizing all address capacity, and the exam mixes requirements about cost optimization, variable load, and stateful workloads. Candidates also forget that scale sets are the supported path for autoscale and that a standalone VM cannot autoscale.
What to do instead
Ask whether the workload is stateless and horizontally scalable. If yes, choose a scale set with autoscale rules based on metrics or schedule. If the workload is a single stateful VM, choose manual resizing and stop at the deallocated state to avoid compute charges. If the requirement is cost reduction during idle periods, consider auto-shutdown or scheduled scaling.
Candidates build a network security group rule that does not achieve the intended effect because they forget that NSG rules are stateful, that both inbound and outbound directions must be considered, or that the default rules allow virtual network traffic and deny internet inbound but allow internet outbound.
NSG evaluation order by priority, the stateful return-traffic behavior, and the default rules are not intuitive, and questions often describe a symptom rather than naming the control. Candidates also confuse NSGs with Azure Firewall and with service endpoints.
What to do instead
For any connectivity question, enumerate the path: source, destination, port, direction, and the NSGs on both the subnet and the NIC. Remember lower priority numbers win, return traffic for an allowed flow is automatically permitted, and the default rules cannot be deleted but can be overridden by higher-priority custom rules. Distinguish NSG (layer 3/4 filtering) from Azure Firewall (centralized, FQDN-aware) and from private endpoints (private IP for a PaaS service).
Candidates misconfigure name resolution or hybrid connectivity, for example creating a private endpoint but leaving DNS resolving to the public IP, or peering virtual networks and assuming name resolution and transitive routing work automatically.
Private endpoints require matching private DNS zones linked to the virtual network, and peering is non-transitive by design, so both settings silently fail to deliver the expected behavior while looking correctly configured. Candidates also forget that a VPN gateway and an ExpressRoute circuit serve different connectivity needs and that gateway transit must be enabled for peered networks to use a shared gateway.
What to do instead
For private endpoint questions, always pair the endpoint with a private DNS zone for the service and a virtual network link, and verify the NIC receives a private IP. For peering questions, remember peering is non-transitive, so enable gateway transit and use gatewayed peering or a hub-and-spoke topology with Azure Firewall or a route server when transit is required.
Candidates configure monitoring that does not satisfy the requirement, for example using activity logs to answer a question about application performance, or metric alerts when the requirement is to query and correlate events across resources.
Activity logs, resource metrics, diagnostic settings, and Log Analytics each answer a different question, and the portal presents them together. Candidates also forget that platform metrics are retained for a limited period and that long-term retention or cross-resource querying requires routing to a Log Analytics workspace via diagnostic settings.
What to do instead
Map the question to the signal: control-plane operations on resources mean activity log; numeric time-series health means metrics and metric alerts; application traces and multi-resource correlation mean Log Analytics with diagnostic settings; and distributed transaction tracing means Application Insights. When the stem mentions retention beyond the platform window or querying across resources, the answer involves a workspace.
Candidates choose the wrong recovery mechanism, for example relying on geo-redundant storage alone to recover a deleted VM, or using Azure Backup when the requirement is a full region failover of an entire application stack.
Backup, replication, and site recovery all sound like disaster recovery, and the exam distinguishes item-level restore from orchestrated regional failover. Candidates also forget that soft delete and backup retention policies protect against deletion and corruption, not against a region-wide outage.
What to do instead
Match the scenario: accidental deletion or corruption means backup with soft delete and retention; regional outage of infrastructure means Azure Site Recovery with replication and a recovery plan; data durability across regions means geo-redundant storage. If the stem mentions an RTO or RPO target, choose the mechanism that can meet it and state the replication or backup frequency accordingly.