AZ-305 Course Notes

AZ-305 identity decisions start with the tenant and governance hierarchy, not with individual role assignments. A landing zone should separate platform, shared services, and workload subscriptions under management groups so Azure Policy and selected RBAC assignments inherit consistently. Resource-group RBAC can be right for one application team, but enterprise governance belongs higher in the hierarchy when allowed locations, tagging rules, and monitoring baselines must apply across many subscriptions.

• Designing one flat subscription model when the requirement needs management group inheritance and landing-zone governance.

• Use management groups for inherited enterprise governance and subscriptions for workload ownership boundaries.

Hybrid identity architecture usually asks how users authenticate while the organization still depends on on-premises Active Directory. Password Hash Synchronization is the simplest cloud authentication strategy because Microsoft Entra ID can validate sign-ins without contacting on-premises federation servers. It reduces dependency on AD FS availability, but it still requires careful synchronization health monitoring and a clear decision about which identity attributes are authoritative on-premises.

• Choosing federation by habit when Password Hash Synchronization would meet the authentication requirement with less infrastructure dependency.

• Password Hash Synchronization is usually the lower-complexity hybrid sign-in choice compared with federation.

Key Vault architecture is about reducing where secrets, keys, and certificates live. Centralizing them in Key Vault lets applications retrieve sensitive material at runtime instead of storing it in configuration files, deployment pipelines, or code. The architect tradeoff is latency and dependency on a managed service versus the much higher risk of distributed secrets and inconsistent rotation practices.

• Choosing Premium Key Vault for every secret scenario instead of reserving it for HSM-protected key requirements.

• Standard Key Vault fits most secrets, keys, and certificates; Premium is the HSM-backed key clue.

Relational database selection starts with platform fit. Azure SQL Database is the clean PaaS choice for modern single databases and elastic scale patterns, while SQL Managed Instance is better when migration compatibility, instance-level features, SQL Agent, cross-database behavior, or near-lift-and-shift SQL Server migration matters. SQL on Azure VMs gives the most control, but AZ-305 usually expects the architect to choose PaaS unless the workload needs operating system or SQL Server instance control that PaaS cannot provide.

• Choosing SQL Managed Instance for every relational workload when Azure SQL Database is the cleaner PaaS option for modern single databases.

• Use Azure SQL Database for modern managed relational PaaS; use SQL Managed Instance for broader SQL Server compatibility.

Business continuity design begins by classifying workloads by business impact, not by picking a recovery service first. A low-RTO payment system may justify active-active or warm standby investment, while an internal reporting workload may only need backup and documented restore steps. RTO and RPO translate business tolerance into architecture choices, and the cost rises sharply as tolerated downtime and data loss approach zero.

• Starting with Site Recovery before classifying the workload by RTO, RPO, and business impact.

• Translate business impact into RTO and RPO before selecting services.

Compute selection should start with workload shape, not a favorite Azure service. B-series VMs fit bursty low-cost workloads, D-series fits balanced general-purpose needs, and compute-optimized sizes fit CPU-heavy processing. App Service is a strong default for managed web apps, while App Service Environment is justified when isolation, network control, or dedicated hosting boundaries outweigh the cost and management overhead.

• Choosing AKS when Container Apps would satisfy serverless container scaling without cluster operations.

• Use App Service for managed web apps; use App Service Environment when isolation and network control justify the cost.