Azure interview questions with answer outlines

Fifteen common Azure interview questions

1. Explain management groups, subscriptions, resource groups and resources.
2. When would you use VMs, App Service, Functions, Container Apps or AKS?
3. What storage options does Azure offer, and when would you use each?
4. Azure SQL Database versus SQL Managed Instance versus SQL on a VM?
5. What is a virtual network, and how do NSGs work?
6. Private endpoints versus service endpoints?
7. What is Microsoft Entra ID, and how does Azure RBAC work?
8. What are managed identities?
9. Availability sets versus availability zones?
10. How do Azure Load Balancer, Application Gateway and Front Door differ?
11. How do you monitor applications on Azure?
12. How do you manage secrets?
13. How would you deploy infrastructure repeatably?
14. How do you control Azure costs?
15. Design a highly available web application on Azure.

Compute choices

Identity and access

Microsoft Entra ID (formerly Azure Active Directory) is the identity platform for users, groups and applications. Azure RBAC assigns roles — built-in such as Reader, Contributor and Owner, or custom — to identities at a scope: management group, subscription, resource group or resource, inherited downwards. Managed identities give Azure resources an identity to access other resources without storing credentials, which is the preferred way to connect an app to Key Vault or a database. Use Privileged Identity Management for just-in-time admin access.

Networking and load balancing

• VNets and subnets isolate resources; network security groups filter traffic by rules on IP, port and protocol.
• Private endpoints give a PaaS service a private IP in your VNet; service endpoints route traffic to the service over the Azure backbone while the service keeps a public endpoint.
• Load Balancer works at layer 4 within a region; Application Gateway is a regional layer-7 balancer with an optional web application firewall; Front Door is a global layer-7 entry point with CDN and routing across regions.

Availability and monitoring

Availability sets spread VMs across fault and update domains in one datacentre; availability zones place resources in physically separate datacentres within a region for higher resilience; paired regions support disaster recovery. Azure Monitor collects metrics and logs, Log Analytics queries them with KQL, and Application Insights adds application performance monitoring. A highly available web app might use Front Door, App Service or Container Apps across zones (or two regions), Azure SQL with zone redundancy and geo-replication, Key Vault, and Monitor alerts.

Infrastructure as code and cost

Deploy repeatably with Bicep or ARM templates, or Terraform for multi-cloud teams, through CI/CD pipelines in Azure DevOps or GitHub Actions. Control cost with right-sizing, autoscaling, reservations and savings plans for steady workloads, spot VMs for interruptible work, auto-shutdown for development resources, tags for chargeback and Cost Management budgets with alerts. See Terraform interview questions.

Practising

Interviewers follow up on the most specific thing you say, so rehearse the second question as well as the first. CoPilot Interview, a free AI interview assistant, runs Azure mock interviews with follow-ups and produces a report of likely next-round questions. Prepare one architecture you've built on Azure as a two-minute diagram walkthrough. See also cloud engineer interview questions and .NET interview questions.

Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.

Frequently asked questions

What are the most common Azure interview questions?

The resource hierarchy, compute options, storage and databases, VNets and NSGs, private endpoints, Entra ID and RBAC, managed identities, availability zones, load balancing services, monitoring, secrets, infrastructure as code and cost control.

What is a managed identity in Azure?

An identity Azure creates for a resource, such as an App Service, so it can authenticate to other Azure services like Key Vault without storing credentials in code or configuration.

What is the difference between Application Gateway and Front Door?

Application Gateway is a regional layer-7 load balancer with an optional WAF. Front Door is a global layer-7 entry point that routes users to the best region and includes CDN capabilities.

Availability set or availability zone?

Availability sets protect against rack and maintenance failures within one datacentre; availability zones protect against a whole datacentre failing by spreading resources across separate locations in a region.