An independent study guide for Microsoft Certified: Azure Solutions Architect Expert · by Tony Rough
Choose the right design, and explain why.
Free to read with Kindle Unlimited. Opens Amazon in a new tab.
Free glossary of the book's terms
First edition · version 1.1 · updated October 2026 · What's changed
This independent study guide for the Microsoft Certified: Azure Solutions Architect Expert exam distils what AZ-305 really expects you to understand into the comparisons, trade-offs and traps that architecture decisions turn on. No padding, no screenshots, no memorised answers: just the reasoning you need to pick the right service, tier and topology for a set of requirements.
Fourteen chapters, each readable on its own and together covering all four AZ-305 skills areas:
Azure changes quickly. This edition reflects Microsoft's documentation as of September 2026, including recent retirements and replacements, and notes where the exam's traditional answer and today's product differ.
This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and use the same judgement in real design reviews long after exam day.
Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.
Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.
Hold Azure Administrator Associate (AZ-104), then pass AZ-305. The series covers every exam it needs:
Know which role, setting or tool does the job, and why.
Every skill area in Microsoft's AZ-305 outline (as of April 17, 2026), and the chapters that cover it.
| Skill area | Weight | Chapters |
|---|---|---|
| Design identity, governance, and monitoring solutions | 25–30% | 1, 2, 3, 4, 5 |
| Design data storage solutions | 20–25% | 3, 5, 6, 7, 8 |
| Design business continuity solutions | 15–20% | 5, 6, 7, 9, 12, 13 |
| Design infrastructure solutions | 30–35% | 2, 3, 9, 10, 11, 12, 14 |
Plus an appendix glossary of 600+ terms, each linked to Microsoft Learn, with the same terms explained free online for print readers.
Short excerpts from the book, exactly as they appear in it, so you can see how it explains things.
The opening of chapter 1 · Chapter 1: Identity and access with Microsoft Entra ID
Microsoft Entra ID (Azure AD) is the identity plane for everything else in Azure: it authenticates users, workloads and partners, and it decides who may reach which resource under what conditions. In a typical architecture it sits alongside your on-premises Active Directory, feeds identities to Microsoft 365 and your own applications, and carries the controls (Conditional Access, managed identities, governance) that the rest of the design relies on. This chapter works from the tenant and hybrid foundation outwards, through sign-in controls and application integration, to workload identities, external users and identity governance.
A comparison table · Chapter 1: Identity and access with Microsoft Entra ID · Inbound HR provisioning
In most organisations the HR system, not IT, is the authoritative source of who works there. Inbound HR provisioning turns hires, changes and leavers in that system into accounts automatically, either in on-premises AD or directly in the tenant.
| Scenario | Use |
|---|---|
| Workday to on-premises AD | Gallery app “Workday to Active Directory User Provisioning”, which writes through the Microsoft Entra Connect provisioning agent |
| Workday to cloud-only users | Gallery app “Workday to Microsoft Entra ID User Provisioning” |
| Any HR source, including a CSV export | API-driven inbound provisioning: a script posts SCIM bulk requests. The “API-driven provisioning to on-premises AD” app writes through the agent, then Entra Connect Sync takes the users to the tenant |
| Tenant to on-premises LDAP or SQL apps (outbound) | ECMA connector |
A common trap · Chapter 1: Identity and access with Microsoft Entra ID · Tenants and hybrid identity
Common trap: Using Conditional Access to block legacy authentication on Entra ID Free — the Free edition cannot use Conditional Access; turn on security defaults instead.
Want more? Amazon offers a longer free sample of the Kindle edition on its Kindle page.
Some sections of the book, free to read online:
Choosing a redundancy option for durability and availability targets, and what customer-managed account failover does.
How to pick between Azure SQL Database, Azure SQL Managed Instance and SQL Server on Azure VMs from compatibility and management requirements.
Zone redundancy, active geo-replication and failover groups for Azure SQL, with the RPO and RTO each design gives.
How private endpoints and service endpoints differ, and how to design private DNS for hybrid networks.
Choosing between Azure's global and regional, layer 4 and layer 7 load-balancing services.
The five Cosmos DB consistency levels, what each guarantees, and the latency and availability trade-offs.
System-assigned vs user-assigned managed identities, workload identity federation and when to use each.
A free week-by-week plan through the book at a 4-week or 8-week pace, with the study notes and exam skill areas for each week.
Short videos on the ideas this exam likes to trap, about five minutes each.
Plays from YouTube when you press play · Watch on YouTube
The two questions that pick the right Azure Storage redundancy option, plus the read-access trap and three more. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
How each one locks an Azure service down to your network, the on-premises trap, DNS and data exfiltration, and a five-second way to choose. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
Two questions put the four Azure load-balancing services on a grid: web or not, regional or global. Plus three exam traps. Read the write-up
Plays from YouTube when you press play · Watch on YouTube
Two separate role systems: why a subscription Owner can't reset a password, why a Global Administrator can't see a VM, and the one bridge between them. Read the write-up
Microsoft moved the retirement dates for gpt-4o and extended the deadline for Application Insights query API keys to 31 March 2027. The HTTP DDoS ruleset for Front Door Premium WAF and route maps for Azure Route Server are now generally available, and Azure Firewall application rules for IPv6 are in preview.
Three Azure features all promise "high availability" for virtual machines, but each protects against a different failure. Fault and update domains, zonal vs zone-redundant, Flexible vs Uniform scale sets, how they combine, and the exam traps.
Microsoft has confirmed that Always Encrypted with Intel SGX enclaves in Azure SQL Database retires on 31 October 2027, and that App Service support for Java 8, 11 and 17 ends on 1 September 2027. Defender for Storage can now scan individual blobs and containers on demand, and Application Gateway WAF inspects IPv6 traffic in preview.