Top 50 Azure Interview Questions in 2026 (With Real Answers)

Top 50 Azure Interview Questions in 2026 (With Real Answers)

Azure interviews feel different from AWS and GCP loops. Azure shops are usually enterprises with an existing Microsoft footprint - Entra ID, Microsoft 365, Windows Server, SQL Server licenses - so the interview leans on identity, hybrid networking, and governance much more than "build me a serverless API."

The trap is that Azure has a lot of overlapping services and a lot of renames. Interviewers want to see you pick the right one and explain why the others are wrong for the job.

These are the 50 Azure questions that come up most often in 2026, from fundamentals to architecture.

Fundamentals and Identity (1-10)

1. Walk me through the Azure resource hierarchy.

Microsoft Entra tenant → management groups → subscriptions → resource groups → resources. The tenant is the identity boundary. Management groups organize subscriptions and carry policy and RBAC. Subscriptions are the billing, quota, and isolation boundary. Resource groups are lifecycle containers. RBAC and Azure Policy assignments at any level inherit downward.

Every tenant has a root management group, a subscription sits in exactly one management group, and the tree can be up to six levels deep (not counting the root and subscription levels).

2. When do you create a new subscription instead of a new resource group?

When you need separate billing, separate quotas, a hard security boundary, or a different policy and RBAC baseline. A common split is one subscription per workload per environment (app-prod, app-nonprod) plus platform subscriptions for identity, management, and connectivity.

Resource groups are for lifecycle: things deployed and deleted together. Don't use them to separate prod from dev - a Contributor on the subscription can touch both.

3. Explain regions, availability zones, and region pairs.

A region is a set of datacenters in a geography (eastus2, westeurope). Zone-enabled regions have at least three physically separate zones with independent power, cooling, and networking. Many regions are paired with another in the same geography, which drives geo-redundant storage targets and staggered platform updates - but newer regions aren't always paired.

Know zonal (pinned to a zone you choose, like a VM in zone 2) versus zone-redundant (the platform spreads it across zones - ZRS storage, zone-redundant App Service or SQL). Zone-redundant is usually what you want.

4. What is ARM, and where does Bicep fit?

Azure Resource Manager is the control plane. Every create, update, and delete - from the portal, CLI, Terraform, or SDK - goes through ARM's REST API. ARM templates are JSON desired-state documents. Bicep is a DSL that compiles to ARM JSON: same capabilities, readable, with modules and type checking, and immediate support for new API versions.

param location string = resourceGroup().location
param name string

resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: name
  location: location
  sku: { name: 'Standard_ZRS' }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
  }
}

Preview before you deploy:

az deployment group what-if -g rg-app-prod -f main.bicep -p name=stappprod001

5. What is Microsoft Entra ID?

Microsoft's cloud identity service - called Azure Active Directory until the 2023 rename. It holds users, groups, app registrations, service principals, and managed identities, and issues the OAuth 2.0 / OpenID Connect tokens every Azure API call is authorized with.

It is not cloud-hosted Windows Server AD: no OUs, no Group Policy, no Kerberos for your servers by default. For that you need Microsoft Entra Domain Services or your own domain controllers. Hybrid setups sync on-premises identities with Entra Connect or cloud sync.

6. Azure RBAC vs Entra roles - what's the difference?

They govern different planes. Azure RBAC controls Azure resources (Owner, Contributor, Reader, User Access Administrator, plus service-specific roles), assigned at management group, subscription, resource group, or resource scope. Entra roles control the directory (Global Administrator, User Administrator, Application Administrator).

A Global Administrator has no subscription access by default but can elevate to User Access Administrator at root scope - alert on that. Also know control plane vs data plane: Contributor on a storage account doesn't let you read blobs with Entra auth; that needs a data role like Storage Blob Data Reader.

7. System-assigned vs user-assigned managed identity?

Both are Entra identities Azure manages, with no secret to store or rotate. System-assigned lives and dies with one resource. User-assigned is a standalone resource attachable to many compute resources, and it survives their deletion.

User-assigned is usually better in production: you can grant roles in IaC before the workload exists, and scale-out or blue/green instances share one identity.

az role assignment create \
  --assignee <principalId> \
  --role "Storage Blob Data Reader" \
  --scope <storage-account-resource-id>

8. How should CI/CD pipelines authenticate to Azure?

Workload identity federation (OIDC), not client secrets. You add a federated credential to an app registration or user-assigned managed identity that trusts tokens from a specific issuer and subject - say, one GitHub repo and environment. The pipeline swaps its short-lived OIDC token for an Entra token, and nothing long-lived is stored. GitHub Actions and Azure DevOps both support it, and AKS uses the same mechanism for pods. Secrets and certificates are the fallback for platforms that can't issue OIDC tokens.

9. What is Privileged Identity Management (PIM)?

Just-in-time access for Entra roles, Azure RBAC roles, and group membership. Users are eligible and activate a role for a bounded window, with MFA, justification, or approval as required. Activations are logged, and access reviews remove eligibility nobody uses.

Nobody should hold standing Global Administrator or production Owner except break-glass accounts, which are monitored and tested. PIM requires Entra ID P2 or Entra ID Governance licensing.

10. How does Conditional Access work?

It's Entra ID's sign-in policy engine: if conditions (user, app, location, device platform, device compliance, sign-in risk) then controls (block, require MFA, require a compliant device, require phishing-resistant authentication, limit the session).

Roll new policies out in report-only mode, always exclude break-glass accounts, and remember policies act at token issuance - an issued token lives until expiry unless Continuous Access Evaluation applies. It needs Entra ID P1 or higher.

Compute and Containers (11-20)

11. How do you choose between VMs, App Service, Functions, Container Apps, and AKS?

• VMs / Scale Sets - full OS control, lift-and-shift, licensed software.
• App Service - managed hosting for web apps and APIs, with slots and built-in auth.
• Functions - event-driven code with triggers and bindings.
• Container Apps - serverless containers for APIs, workers, and jobs, with scale to zero and no Kubernetes to run.
• AKS - when you need the Kubernetes API itself: operators, Helm-heavy ecosystems, a platform for many teams.

Default down the stack. Most teams that pick AKS for three services would be better off on Container Apps.

12. VM Scale Sets: Flexible vs Uniform orchestration?

Uniform creates identical instances from one model, built for large stateless fleets. Flexible treats instances as regular VMs, supports mixing sizes and Spot with regular capacity, and spreads across zones and fault domains. Microsoft recommends Flexible for new deployments. Pair either with health probes and automatic instance repairs so unhealthy instances are replaced, not just counted.

13. How do App Service deployment slots work?

A slot is a live copy of your app with its own hostname, available on Standard tier and above. Deploy to staging, warm it, smoke test, then swap. The swap warms target instances with production config before switching routing, and rollback is swapping back.

The gotcha is configuration: settings swap unless marked as deployment slot settings (sticky). A staging database connection string should be sticky; a feature flag you want to promote shouldn't. Swap with preview and percentage traffic routing give you a basic canary.

14. Compare Azure Functions hosting plans, including Flex Consumption.

• Consumption - the original serverless plan. Scale to zero, cold starts, 10-minute maximum execution, no VNet integration.
• Flex Consumption - the newer serverless plan and Microsoft's recommended default for new serverless apps. Linux only. Scales to zero and bills per use, but adds VNet integration, selectable instance memory, optional always-ready instances, and faster per-function scaling.
• Premium - pre-warmed instances, VNet, no cold starts, but a paid minimum instance count.
• Dedicated - runs on an App Service plan you already pay for.

Follow-up: Flex Consumption doesn't support deployment slots, so plan a different release strategy.

15. What are Durable Functions and when do you use them?

An extension for stateful workflows in code. An orchestrator calls activity functions, and state is checkpointed so the workflow survives restarts and can wait for days. Patterns: chaining, fan-out/fan-in, async HTTP with a status endpoint, human approval with timeouts.

The catch: orchestrators are replayed from history, so their code must be deterministic - no DateTime.Now, random numbers, or direct I/O. Use the context's time API and push I/O into activities.

16. What is Azure Container Apps and how does it scale?

A serverless container platform built on Kubernetes, KEDA, Envoy, and optional Dapr - none of which you operate. Apps share an environment (VNet, logging). Each deployment creates a revision, and traffic can be split across revisions for blue/green or canary.

Scale rules can be HTTP concurrency, CPU/memory, or any KEDA scaler such as Service Bus queue length, with scale to zero for most rules. Jobs handle run-to-completion work, and workload profiles add dedicated and GPU compute.

17. Container Apps vs AKS - how do you decide?

Container Apps when you want to ship containers without touching the Kubernetes API: scale to zero, revisions, managed ingress and certificates, no node upgrades.

AKS when you need CRDs and operators, DaemonSets, custom networking or a service mesh, fine-grained node control (GPU pools, taints), or an internal platform with namespaces per team. The price is ownership: version upgrades, node image patching, add-ons, capacity. AKS Automatic reduces that, but it's still Kubernetes.

18. How do AKS node pools and upgrades work?

Every cluster has a system pool for critical pods like CoreDNS, plus user pools for workloads. Separate pools let you use different VM sizes, Spot, GPUs, or Windows nodes, steered with node selectors and taints.

Two things get upgraded: the Kubernetes version and the node OS image. Use auto-upgrade channels with planned maintenance windows, set max surge so upgrades add capacity before draining, and define PodDisruptionBudgets. Kubernetes versions leave support quickly; falling behind is a real risk.

19. How do pods in AKS get Azure credentials and IP addresses?

Identity: Microsoft Entra Workload ID. Enable the cluster's OIDC issuer, create a user-assigned managed identity with a federated credential trusting a Kubernetes service account, and annotate that service account. It replaced the deprecated pod-managed identity add-on.

Networking: Azure CNI Overlay gives pods IPs from a private overlay range, so pods don't consume VNet address space - usually the right default. Flat Azure CNI gives pods real VNet IPs but eats addresses fast. Azure CNI powered by Cilium adds an eBPF dataplane and network policy.

20. When are Spot VMs a good idea?

When the workload tolerates interruption: batch, CI agents, rendering, stateless scale-out, fault-tolerant AKS jobs. Spot is heavily discounted, but Azure can evict with very little notice (surfaced through Scheduled Events). Never run stateful or singleton workloads on Spot, and mix Spot with regular capacity so a mass eviction degrades throughput instead of taking the service down.

Storage, Data and Messaging (21-30)

21. Explain the Blob Storage access tiers.

• Hot - frequent access; highest storage cost, lowest access cost.
• Cool - infrequent access, 30-day minimum before early-deletion charges.
• Cold - rare access but online, 90-day minimum.
• Archive - offline, 180-day minimum. Reading requires rehydration, which can take hours at standard priority.

Automate moves with lifecycle management policies. The classic mistake is archiving data you might need quickly - rehydration time becomes your recovery time.

22. What storage redundancy options exist?

• LRS - three copies in one datacenter.
• ZRS - three copies across zones in one region.
• GRS / GZRS - LRS or ZRS locally, plus async replication to the paired region.
• RA-GRS / RA-GZRS - the same, with read access to the secondary.

ZRS is a sensible production default. Geo-replication is asynchronous, so there's an RPO, and failover should be tested before you rely on it.

23. What is Azure Data Lake Storage Gen2?

Blob Storage with the hierarchical namespace enabled: real directories with atomic renames and deletes, plus POSIX-style ACLs, on top of normal tiers and redundancy. Spark, Databricks, Synapse, and Fabric address it via abfss://.

Why it matters: renaming a directory in flat blob storage copies and deletes every object; with a hierarchical namespace it's a metadata operation, which makes Spark job commits fast and safe. Use RBAC for coarse access and ACLs for folder-level control.

24. Azure SQL Database vs SQL Managed Instance vs SQL Server on a VM?

• Azure SQL Database - managed database (single or elastic pool) for new cloud apps. No SQL Agent (use elastic jobs) and limited instance-level features.
• SQL Managed Instance - a managed SQL Server instance with near-full compatibility: SQL Agent, cross-database queries, CLR, Service Broker, linked servers. Lives in a dedicated subnet in your VNet. The default lift-and-shift target.
• SQL Server on a VM - full OS and engine control when neither PaaS option fits.

Ask what the app depends on. SQL Agent jobs and cross-database queries point to Managed Instance.

25. How do Azure SQL purchasing models and tiers work?

DTU bundles compute, memory, and IO; vCore lets you size compute and storage separately and apply Azure Hybrid Benefit. vCore is the recommended model.

vCore tiers: General Purpose (remote storage, cost-effective), Business Critical (local SSD, built-in readable replica, lowest latency), and Hyperscale (distributed storage for very large databases, fast scaling and restores). General Purpose also offers serverless compute that autoscales and can auto-pause - good for dev, but the resume delay hurts latency-sensitive production.

26. Explain Cosmos DB's consistency levels.

Strongest to weakest:

1. Strong - linearizable reads; not available with multi-region writes.
2. Bounded staleness - reads lag by at most K versions or T time.
3. Session - the default. A client reads its own writes, in order.
4. Consistent prefix - never out of order, but possibly stale.
5. Eventual - no ordering guarantee; lowest latency and cost.

Stronger levels cost more RUs per read and add latency across regions. Session fits most user-facing apps. Clients can relax the account default per request.

27. How do you choose a Cosmos DB partition key?

A good key has high cardinality, spreads writes evenly, and matches your most common query filter so reads stay in one partition. tenantId or userId is common; status or country usually creates hot partitions.

Know the limits: a logical partition (one key value) caps at 20 GB, and a physical partition serves at most 10,000 RU/s. The key can't be changed in place - you migrate to a new container. Hierarchical partition keys (e.g. tenantId then userId) let a large tenant exceed 20 GB.

28. Service Bus vs Event Grid vs Event Hubs?

The classic Azure messaging question: messages, events, streams.

• Service Bus - enterprise broker. Queues and topics, peek-lock, dead-letter queues, sessions, duplicate detection, transactions. For commands where every message matters ("process order 123").
• Event Grid - push-based event routing. Lightweight notifications ("blob created") filtered and delivered to Functions, webhooks, or queues, with retries and dead-lettering. Supports CloudEvents; namespaces add pull delivery and MQTT.
• Event Hubs - high-throughput streaming. Partitioned, retained for replay, many independent readers, Kafka-compatible endpoint. For telemetry, clickstreams, logs.

They compose: Event Grid triggers a Function when a file lands, the Function enqueues work on Service Bus, telemetry flows through Event Hubs.

29. How does Service Bus handle failures and ordering?

With peek-lock, a receiver locks a message, processes it, and completes it. If it crashes, the lock expires and the message is redelivered. Past the max delivery count, it goes to the dead-letter queue - which needs alerting and a replay process, or it fills silently.

Ordering isn't guaranteed across competing consumers. For FIFO per entity, use sessions keyed on something like orderId. Delivery is at-least-once, so handlers must be idempotent.

30. How do Event Hubs partitions and consumer groups work?

Events with the same partition key land in the same partition, where order is preserved. Each consumer group is an independent view of the stream with its own checkpoints, so analytics and archiving read at their own pace. Partition count caps parallelism - one active reader per partition per group - so size it for peak consumption. Capture writes the stream to Blob or Data Lake automatically.

Networking, Security and Governance (31-40)

31. How do VNets, peering, and hub-and-spoke work?

A VNet is a regional private network split into subnets. Peering connects VNets over the Microsoft backbone, including cross-region, but it's non-transitive: A peered to B and B to C doesn't let A reach C without a firewall or router in B plus user-defined routes.

Hence hub-and-spoke: the hub holds shared services (Azure Firewall, gateways, DNS resolvers, Bastion), spokes peer to it, and UDRs force traffic through the firewall. Virtual WAN is the Microsoft-managed version. Plan address space early - overlapping CIDRs block peering.

32. NSG vs Azure Firewall?

NSGs are free, distributed, stateful L3/L4 allow/deny rules on subnets or NICs, using IPs, ports, service tags, and application security groups. Azure Firewall is a managed central firewall adding FQDN-based egress filtering, threat intelligence, DNAT, and central logging; Premium adds TLS inspection and IDPS.

They're layers: NSGs for segmentation, Firewall in the hub for egress and spoke-to-spoke. Classic follow-up: "Restrict a VM's outbound traffic to *.github.com" - NSGs can't filter by FQDN, so route egress through Azure Firewall with an application rule.

33. Private Endpoint vs Service Endpoint?

• Service Endpoint - lets a subnet reach a PaaS service over the backbone. The service keeps its public endpoint; its firewall just allows your subnet. Free, but no private IP and no access from on-premises.
• Private Endpoint (Private Link) - a private IP in your subnet mapped to one specific resource. You can disable public access entirely, and it works from peered VNets and on-premises. Billed per endpoint and per GB.

The part people fail on is DNS. Clients must resolve mystorage.blob.core.windows.net to the private IP, which needs a private DNS zone (privatelink.blob.core.windows.net) linked to the right VNets, plus forwarding for on-premises (often Azure DNS Private Resolver). Most "private endpoint doesn't work" tickets are DNS.

34. Front Door vs Application Gateway vs Load Balancer vs Traffic Manager?

A common combination is Front Door in front of regional App Service, Container Apps, or Application Gateway, with origins locked so only Front Door can reach them. Traffic Manager failover is bounded by DNS TTLs and client caching, so it moves traffic more slowly than Front Door.

35. ExpressRoute vs Site-to-Site VPN?

VPN Gateway runs IPsec over the internet: quick, encrypted, cheaper, with variable latency. ExpressRoute is a private circuit through a provider (or ExpressRoute Direct): predictable latency, higher bandwidth, no public internet. Private peering reaches VNets; Microsoft peering reaches Microsoft public services.

Two follow-ups: ExpressRoute is not encrypted by default (use MACsec on Direct, or IPsec over the circuit), and one circuit is a single point of failure - add a second circuit or a VPN backup.

36. How do you use Key Vault correctly?

• Use the Azure RBAC permission model, not legacy access policies.
• Access it with managed identities, never a secret that unlocks the vault.
• Soft delete is always on; enable purge protection in production (irreversible once on).
• Use private endpoints and disable public access for sensitive vaults.
• One vault per app per environment to limit blast radius.

App Service and Functions can reference secrets in app settings with @Microsoft.KeyVault(SecretUri=...). Better still, remove the secret by using Entra auth to the target service.

37. What does Azure Policy do, and what are the main effects?

It evaluates resource properties at create/update time and in periodic compliance scans. Policies group into initiatives and are assigned at management group, subscription, or resource group scope. Key effects:

• Deny - block non-compliant requests.
• Audit / AuditIfNotExists - report only.
• Modify / Append - change the request, like adding a required tag.
• DeployIfNotExists - deploy a related resource (diagnostic settings, backup). Needs a managed identity on the assignment, and existing resources need a remediation task.
• DenyAction - block actions such as delete.

RBAC decides who can act; Policy decides what the result may look like, whoever you are. Roll Deny out as Audit first, and use time-limited exemptions.

38. What is Microsoft Defender for Cloud?

Microsoft's posture management and workload protection platform. CSPM assesses configuration against benchmarks with a secure score and recommendations - foundational CSPM is free, and the paid Defender CSPM plan adds attack path analysis and agentless scanning. Workload protection plans (Servers, Containers, Storage, SQL, Key Vault, and more) add threat detection and vulnerability assessment. It can also cover AWS and GCP. The hard part is ownership of recommendations and routing alerts to your SIEM.

39. What is an Azure landing zone?

The Cloud Adoption Framework's reference architecture for a governed estate, separating the platform from application landing zones:

• A management group hierarchy with a platform branch (identity, management, connectivity) and a landing zones branch (typically "corp" and "online"), plus sandbox and decommissioned groups.
• Policy at each level: allowed regions, diagnostics to a central workspace, no public endpoints in corp.
• Hub-and-spoke or Virtual WAN networking owned by the platform team.
• Subscription vending - automation that hands a team a subscription already wired into networking, policy, and RBAC.

Microsoft publishes Bicep and Terraform implementations built on Azure Verified Modules.

40. What is the Azure Well-Architected Framework?

Design guidance in five pillars: Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency, with assessments and per-service guides. The interview angle is trade-offs: multi-region improves reliability and costs more; private endpoints improve security and add DNS complexity; serverless saves money at low volume and adds cold starts. Naming the pillar you're trading against is what makes it a design discussion.

DevOps, Observability, Cost, AI and Architecture (41-50)

41. Bicep vs Terraform for Azure?

Bicep: Azure-only, no state file (Azure is the source of truth), immediate support for new APIs, what-if previews, and deployment stacks to manage a set of resources' lifecycle, including deleting removed resources and blocking out-of-band changes.

Terraform: multi-cloud and multi-provider (Entra, GitHub, Cloudflare in one codebase), a mature module ecosystem, explicit plans. The cost is state - keep it in an Azure Storage backend with locking, versioning, and tight access, because it can contain secrets. azapi reaches any ARM API when azurerm lags.

Either is fine. Mixing portal click-ops with IaC on the same resources is not.

42. Azure DevOps vs GitHub Actions?

Azure DevOps bundles Boards, Repos, Pipelines, Test Plans, and Artifacts and is entrenched in many enterprises; its multi-stage YAML pipelines with environments and approvals work well. GitHub Actions is where Microsoft's new developer investment is concentrated and is the usual default for new projects already on GitHub. Either way, use OIDC:

permissions:
  id-token: write
  contents: read
steps:
  - uses: azure/login@v2
    with:
      client-id: ${{ vars.AZURE_CLIENT_ID }}
      tenant-id: ${{ vars.AZURE_TENANT_ID }}
      subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
  - run: az deployment group create -g rg-app-prod -f main.bicep

Scope the federated credential to a protected environment so only approved runs deploy to production.

43. How do Azure Monitor, Log Analytics, and Application Insights fit together?

Azure Monitor is the umbrella: metrics, logs, alerts, action groups, workbooks. Log Analytics workspaces store logs, queried with KQL. Application Insights is the APM layer (requests, dependencies, exceptions, distributed tracing), workspace-based, and instrumented with the Azure Monitor OpenTelemetry distro.

Resource logs go nowhere until you create diagnostic settings (enforce with Policy), and VM logs need the Azure Monitor Agent with data collection rules. Error rate and p95:

AppRequests
| where TimeGenerated > ago(1h)
| summarize requests = count(),
            failures = countif(Success == false),
            p95_ms = percentile(DurationMs, 95)
  by bin(TimeGenerated, 5m), Name
| extend failure_rate = round(100.0 * failures / requests, 2)

Watch ingestion volume - verbose logging is a common surprise bill.

44. How do you control and reduce Azure costs?

Visibility first: Cost Management with enforced tags (owner, environment, cost center), budgets, and exports. Budgets alert; they don't stop spending unless you wire automation. Then the levers:

• Right-size and shut down - Azure Advisor, auto-shutdown for dev VMs, scale-to-zero platforms.
• Commitments - Reservations (specific resource types, 1 or 3 years) and the Azure savings plan for compute (a flexible hourly commitment).
• Azure Hybrid Benefit - reuse Windows Server and SQL Server licenses.
• Spot and Dev/Test pricing for interruptible and non-production work.
• Hygiene - lifecycle policies, log ingestion limits, unattached disks, idle gateways.

Commit only after right-sizing, or you lock in waste for years.

45. How do you use Azure OpenAI in Microsoft Foundry?

Azure OpenAI hosts OpenAI models (chat, embeddings, image, audio) on Azure, managed through Microsoft Foundry (formerly Azure AI Foundry) - Microsoft's platform for models, agents, evaluation, and safety tooling, which also offers other providers' models. You deploy a model under a deployment name and call it with Entra auth (a managed identity with the "Cognitive Services OpenAI User" role) rather than keys.

Interviewers probe: deployment types (pay-per-token standard, with regional, global, or data-zone processing, vs provisioned throughput for predictable latency, plus batch); quotas in tokens per minute per region and model, so handle 429s with backoff and spread load behind a gateway like API Management; data handling (prompts aren't used to train the models, and content filters are on by default); and private endpoints for enterprise networks.

46. How would you build a RAG system on Azure with AI Search?

Ingest documents from Blob, SharePoint, or a database, chunk them, embed them with an Azure OpenAI embedding model, and index chunks plus vectors in Azure AI Search (formerly Azure Cognitive Search). Integrated vectorization can do the chunking and embedding for you.

At query time, run hybrid search - BM25 keyword plus vector, fused with Reciprocal Rank Fusion - then the semantic ranker to rerank. Pass the top chunks with sources to the model and require citations.

Production-grade means security trimming (filter on group or ACL fields so users only retrieve what they're allowed to see), an evaluation set for retrieval and answer quality, and incremental indexing. Most bad RAG answers are retrieval problems, not model problems.

47. Design a highly available web app across two regions.

• Front Door with WAF as the global entry, health-probing both regions.
• Per region: App Service or Container Apps on zone-redundant plans, origins locked to Front Door.
• Data: Azure SQL failover groups (a listener that follows the primary), or Cosmos DB multi-region - multi-region writes only if the app handles conflicts.
• Uploads in GZRS storage; secrets in Key Vault via managed identities.
• Everything in IaC, so the second region is the same code with different parameters.

Then discuss active-active vs active-passive, the RPO implied by async replication, and how often you rehearse failover. An untested DR plan is a hypothesis.

48. A security review says your PaaS app must have no public endpoints. How do you do it?

• Put backing services (SQL, Storage, Key Vault, Cosmos, Service Bus) behind private endpoints with public network access disabled.
• Create and link the private DNS zones, with forwarding for on-premises clients.
• Give the app outbound reach via VNet integration (App Service, Functions Flex Consumption or Premium) or by deploying into a VNet (Container Apps, AKS).
• Inbound: internal apps get a private endpoint exposed through Application Gateway; public apps sit behind Front Door Premium with Private Link to the origin.
• Route egress through Azure Firewall and enforce it all with Azure Policy so nobody regresses it.

Be honest about cost: every private endpoint is a billed resource and a DNS record that has to be right.

49. Your Azure bill jumped 40% this month. How do you investigate?

Cost Management cost analysis, grouped by service, then resource group and resource, against last month. Usual suspects: Log Analytics ingestion from newly verbose logging, data transfer (cross-region or internet egress), scaling that never scaled back (no scale-in rule, Cosmos throughput set high, Premium SKUs left on after a test), and untagged new resources. Fix the cause, then add anomaly alerts, per-subscription budgets, and tag enforcement.

50. What's the most common Azure architecture mistake?

Treating identity and networking as afterthoughts: one shared subscription where everyone is Owner, secrets in app settings instead of managed identities, PaaS on public endpoints "for now," and overlapping address space that blocks peering and hybrid connectivity later. All cheap on day one and expensive to retrofit under production traffic - which is why landing zones, PIM, private endpoints, and IP planning dominate senior Azure interviews.

Final thoughts

Azure interviews in 2026 reward people who understand the control plane: how the hierarchy, Entra ID, RBAC, and Policy fit together, and how traffic and DNS actually flow through a private network. Service trivia is the warmup. The depth shows when you can explain why you'd pick Container Apps over AKS, Service Bus over Event Grid, or a private endpoint over a service endpoint - and what each choice costs.

If you want to test yourself first, gitGood has free Azure practice questions at gitgood.dev/questions/category/azure. Work through them, then come back to the answers above where you were shakiest.