Complete guide
AZ-305 Azure Solutions Architect Expert
Tap any service to see more details and official docs.
Exam breakdown
40–60
Questions
~60
Min read
700
Passing score
Identity, governance and monitoring
25–30% of the examEnterprise identity design
In AZ-305 the focus is on DESIGNING identity solutions for complex business requirements, not just configuring them.
| Scenario | Recommended solution |
|---|---|
| Organization employees | Entra ID with MFA and Conditional Access |
| External partners (B2B) | Entra ID B2B — invite as guest users |
| End consumers | Microsoft Entra External ID — customer identities (successor to B2C) |
| Apps that need to access Azure | Managed Identity — no secrets in code |
| Multiple Entra ID tenants | Azure Lighthouse or B2B cross-tenant access |
| On-premises AD + Entra ID (hybrid) | Microsoft Entra Connect for synchronization |
Governance at scale — Landing Zones
For large organizations, governance is designed with a Management Groups hierarchy, inherited policies and Landing Zones.
Management Groups
Organizes subscriptions into a hierarchical tree. Policies are inherited downward.
Azure Policy
Automatically enforces compliance rules across the whole hierarchy.
Deployment Stacks
Deploy and manage policies, roles and resources defined in Bicep or ARM as a single unit (replacement for Blueprints, retired in 2026).
Landing Zone
Base environment with identity, networking, security and governance preconfigured.
Monitoring design
Click any service to see more details
| Tool | Purpose in architecture |
|---|---|
| Log Analytics Workspace | Central repository — consolidates logs from the whole platform |
| Application Insights | APM for apps — traces, exceptions, performance, users |
| Microsoft Sentinel | SIEM/SOAR — threat detection and security investigation |
| Azure Monitor Workbooks | Customizable dashboards for NOC or executive reporting |
Managed Identity is always the first choice for authenticating apps against Azure resources. It avoids managing secrets, rotations and access. The exam favors it over Service Principals with client secrets.
Data storage solutions
20–25% of the examChoosing the right storage
| Requirement | Recommended service |
|---|---|
| Relational transactional data | Azure SQL Database or SQL Managed Instance |
| Large-scale global with low latency | Azure Cosmos DB |
| Unstructured data (files, blobs) | Azure Blob Storage |
| Data warehouse and analytics at scale | Azure Synapse Analytics |
| Session cache or hot data | Azure Cache for Redis |
| Shared files between VMs | Azure Files |
| Time series / IoT data | Azure Data Explorer or ADX |
Core databases
Click any service to see more details
Data security
Click any service to see more details
| Data type | Where to store it in Azure |
|---|---|
| Connection strings, API keys | Azure Key Vault (secrets) |
| TDE/CMK encryption keys | Azure Key Vault (keys) |
| TLS/SSL certificates | Azure Key Vault (certificates) |
| Data at rest | Azure Storage Encryption (AES-256 by default) |
| Data in transit | TLS/HTTPS — enabled by default on Azure services |
Customer-Managed Keys (CMK) give you full control over encryption but add operational complexity. If you lose the key in Key Vault, you lose access to the data. Requires careful key lifecycle management.
Business continuity
15–20% of the examRPO, RTO and SLA — the BCDR triangle
RPO
Recovery Point Objective
How much data can you lose? Maximum data loss window.
RTO
Recovery Time Objective
How long can you be down? Maximum time to recover.
SLA
Service Level Agreement
Committed availability. 99.99% = max. 52 min/year of downtime.
| Availability level | SLA | Downtime/year | How to achieve it |
|---|---|---|---|
| 99.9% | 3 nines | ~8.7 hours | Single instance in an Availability Set |
| 99.95% | 3.5 nines | ~4.4 hours | Multi-instance in an Availability Set |
| 99.99% | 4 nines | ~52 minutes | Availability Zones (multi-zone) |
| 99.999% | 5 nines | ~5 minutes | Multi-region active-active |
BCDR services
Click any service to see more details
| Pattern | RTO | RPO | Cost | Description |
|---|---|---|---|---|
| Backup & Restore | Hours | Hours | $ | Restore from backup. Slower and cheaper. |
| Pilot Light | Minutes | Minutes | $$ | Minimal DR infrastructure always running. |
| Warm Standby | Minutes | Seconds | $$$ | Scaled-down copy of the environment always running. |
| Active/Active | Seconds | Seconds | $$$$ | Both regions active, traffic distributed. |
For the exam: if the requirement is RPO in minutes and RTO in seconds → multi-region active/active. If RPO/RTO is in hours → Backup & Restore may be enough, and cheaper.
Infrastructure solutions
30–35% of the examNetwork design and load balancing
Click any service to see more details
| Service | Layer | Scope | When to use it |
|---|---|---|---|
| Load Balancer | L4 | Regional | TCP/UDP between VMs in the same region |
| Application Gateway | L7 | Regional | HTTP/S with WAF and URL-based routing |
| Traffic Manager | DNS | Global | Global routing across regions or endpoints |
| Azure Front Door | L7 | Global | CDN + WAF + global acceleration at L7 |
Interactive diagram — watch how traffic flows from on-premises through the hub to each spoke. Hover over each node.
Hub-Spoke pattern
The most common pattern for enterprise networks in Azure. A central VNet (hub) connects multiple workload VNets (spokes) via peering.
Hub VNet
Contains shared services: Firewall, VPN Gateway, Bastion, DNS
Spoke VNets
Each workload in its own VNet — dev, prod, HR, etc. Peered with the hub
Peering
Spokes communicate with each other ONLY through the hub (via firewall)
Compute: choosing the right service
| Requirement | Best option |
|---|---|
| Full OS control, special licensing | Azure Virtual Machines (IaaS) |
| Web app without managing servers | Azure App Service (PaaS) |
| Containerized microservices at scale | Azure Kubernetes Service |
| Event-driven functions, pay per execution | Azure Functions (Serverless) |
| Fast containers with no orchestration | Azure Container Instances |
| Cross-region high availability for VMs | Scale Sets + Availability Zones |
D4 carries the most weight (30-35%). The exam gives a business scenario and asks for the BEST architecture. Memorize when to use each compute and networking service, and the trade-offs between them.
Integration and messaging
Click any service to see more details
Messaging: choosing the right service
| Service | Model | Use case |
|---|---|---|
| Azure Service Bus | Push — queues and topics | Transactional messaging: orders, payments, delivery guarantees |
| Azure Event Hubs | Pull — partitions | Massive streaming: IoT telemetry, logs, clickstream |
| Azure Event Grid | Push — reactive pub/sub | Azure resource events: blob created, VM stopped, etc. |
| Queue Storage | Pull — simple | Simple, inexpensive queue for basic decoupling |
Integrating Generative AI into architectures
Click any service to see more details
RAG pattern — reference architecture
1. Azure AI Search — indexes and retrieves relevant documents
2. Azure OpenAI Embeddings — generates vectors for semantic search
3. Azure OpenAI GPT-4 — generates a response based on the retrieved context
4. Azure API Management — exposes the solution as a secure API
5. Azure Monitor — monitors usage, latency and response quality
Service Bus vs Event Hubs is a frequent question. Service Bus guarantees exactly-once delivery — ideal for transactions. Event Hubs is for high-frequency telemetry where some data loss can be acceptable.
Tips for exam day
AZ-305 tests design DECISIONS, not just what each service is. The question is always "what is the BEST solution for this requirement".
Cost always matters. If two solutions are technically valid, the exam usually favors the cheaper one unless there is a specific requirement.
RPO vs RTO: RPO = how much data you can lose. RTO = how long you can be down. Design the BCDR solution that meets both.
Traffic Manager = global DNS routing. Azure Front Door = CDN + WAF + L7. Load Balancer = regional L4. Application Gateway = regional L7 with WAF.
Azure SQL = relational PaaS. Cosmos DB = globally distributed NoSQL. Redis = in-memory cache. Each has its own specific use case.
Event Hubs = high-frequency streaming (IoT, logs). Service Bus = transactional messaging (orders, payments). Queue Storage = simple, cheap queue.
For system-to-system integration: Logic Apps (low-code, 400+ connectors) vs Azure Functions (custom code) vs APIM (API management).
Landing Zone = base environment with identity, networking, policies and security configured. It is the starting point for structured migration to Azure.
The exam asks you to design for the MOST RESTRICTIVE requirement: if you need 99.99% SLA, only Availability Zones or geo-redundancy guarantee it.
Managed Identity > Service Principal > Access Keys. Always prefer Managed Identity for apps to access Azure resources — there are no secrets to manage.
Want to go deeper?
This guide is a quick summary. Visit the Deep Dive section for an exhaustive walkthrough with real cases, cost analysis and architecture decisions.
Ready to practice?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Was this guide helpful?
Not ready to start yet?
Save your email so you don't have to type it again — pick up later and unlock AZ-305 with a Pro plan or individual purchase.