MSAP study plan

Create and configure a Microsoft Entra tenant-level structure: add users, groups, and administrative units, then assign built-in roles to test least privilege.

Configure self-service password reset and multifactor authentication for a test group, then verify sign-in behavior with a conditional access policy.

Map every identity object you create to the specific exam objective it exercises and log the mapping in a tracking sheet.

Practice reading role definitions with Azure CLI so you can explain the difference between a role assignment scope and a role definition.

Build a resource hierarchy of management groups, subscriptions, and resource groups, then apply a policy that enforces allowed locations.

Create and apply resource locks, tags, and a budget alert, then demonstrate what happens when a locked resource is deleted.

Export a cost analysis view and a policy compliance report, and interpret the non-compliant resources.

Write out from memory the difference between Azure Policy, RBAC, and resource locks, using one concrete example each.

Provision a storage account and configure redundancy, access tier, and network access rules appropriate to a stated scenario.

Generate and rotate account keys and SAS tokens, then test access with each credential type using Azure CLI.

Configure blob lifecycle management rules and verify that a test blob transitions or is deleted as expected.

Compare AzCopy and Storage Explorer for a copy operation and record throughput and command differences.

Create an Azure Files share and mount it from a client, then configure a private endpoint and confirm access is restricted.

Configure blob soft delete, versioning, and an immutability policy, then test recovery of an overwritten blob.

Review your storage accounts against your Week 2 policy assignments and remediate any non-compliant settings.

Explain how managed identities remove the need to store storage keys in application configuration.

Deploy a Linux and a Windows virtual machine using Azure CLI and Bicep, then compare the parameter differences.

Attach and resize managed disks, then move a disk between VMs and record the required steps.

Configure a VM scale set with autoscale rules and trigger a scale-out event.

Create a VM availability configuration using availability zones and explain when each option applies.

Deploy an App Service plan and web app, then configure deployment slots and perform a slot swap.

Containerize a simple app with Azure Container Instances or deploy it to AKS, and document the resource requirements.

Configure VM extensions and a custom script extension, then verify the script output on the VM.

Tear down all compute resources in one command sequence and confirm no orphaned disks or public IPs remain.

Design and build a virtual network with subnets, then apply network security group rules and test allowed and denied traffic.

Configure VNet peering between two networks and verify connectivity with a ping or connection test.

Deploy a VPN gateway or an Azure Bastion host and connect to a private VM without a public IP.

Configure Azure DNS or a private DNS zone and resolve a custom name from inside the virtual network.

Set up a load balancer or Application Gateway and verify traffic distribution across two backends.

Configure Azure Monitor alerts on a metric and an activity log event, then trigger both and confirm notification.

Create a Log Analytics workspace and write two KQL queries that answer a specific operational question.

Configure diagnostic settings to route logs to the workspace and verify data arrives.

Run a timed 50-question practice set and review every wrong answer against your lab notes.

Review your weakest domain from the practice results and re-run one lab from that domain.