AZ-305 Course Notes

AZ-305 identity decisions start with the tenant and governance hierarchy, not with individual role assignments. A landing zone should separate platform, shared services, and workload subscriptions under management groups so Azure Policy and selected RBAC assignments inherit consistently. Resource-group RBAC can be right for one application team, but enterprise governance belongs higher in the hierarchy when allowed locations, tagging rules, and monitoring baselines must apply across many subscriptions.

Hybrid identity architecture usually asks how users authenticate while the organization still depends on on-premises Active Directory. Password Hash Synchronization is the simplest cloud authentication strategy because Microsoft Entra ID can validate sign-ins without contacting on-premises federation servers. It reduces dependency on AD FS availability, but it still requires careful synchronization health monitoring and a clear decision about which identity attributes are authoritative on-premises.

Key Vault architecture is about reducing where secrets, keys, and certificates live. Centralizing them in Key Vault lets applications retrieve sensitive material at runtime instead of storing it in configuration files, deployment pipelines, or code. The architect tradeoff is latency and dependency on a managed service versus the much higher risk of distributed secrets and inconsistent rotation practices.

Relational database selection starts with platform fit. Azure SQL Database is the clean PaaS choice for modern single databases and elastic scale patterns, while SQL Managed Instance is better when migration compatibility, instance-level features, SQL Agent, cross-database behavior, or near-lift-and-shift SQL Server migration matters. SQL on Azure VMs gives the most control, but AZ-305 usually expects the architect to choose PaaS unless the workload needs operating system or SQL Server instance control that PaaS cannot provide.

Business continuity design begins by classifying workloads by business impact, not by picking a recovery service first. A low-RTO payment system may justify active-active or warm standby investment, while an internal reporting workload may only need backup and documented restore steps. RTO and RPO translate business tolerance into architecture choices, and the cost rises sharply as tolerated downtime and data loss approach zero.

Compute selection should start with workload shape, not a favorite Azure service. B-series VMs fit bursty low-cost workloads, D-series fits balanced general-purpose needs, and compute-optimized sizes fit CPU-heavy processing. App Service is a strong default for managed web apps, while App Service Environment is justified when isolation, network control, or dedicated hosting boundaries outweigh the cost and management overhead.