Chapter 1 of 4 · Microsoft AZ-305
Design identity, governance, and monitoring solutions
Logging and monitoring design, authentication and authorization, Key Vault and governance.
- 6topics
- 29 minfast track
- 2diagrams and exhibits
- 25–30%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Logging, Log Routing and Monitoring SolutionsAZ-305 monitoring design: Azure Monitor and Log Analytics, table plans and retention, routing logs with diagnostic settings and…Diagram5 min
- 2Authentication and Identity Management SolutionsAZ-305 identity design: choose Microsoft Entra ID, hybrid sign in options, Entra External ID for partners and customers, managed…Diagram5 min
- 3Authorizing Access to Azure and On Premises ResourcesAZ-305 authorization design: Azure RBAC scopes, Privileged Identity Management, and Application Proxy or Private Access for on…5 min
- 4Secrets, Certificates and Keys with Key VaultAZ-305 secrets design: choose Key Vault Standard, Premium or Managed HSM, use soft delete and purge protection, RBAC access, and…5 min
- 5Management Groups, Subscriptions and TaggingAZ-305 governance structure: management groups, subscriptions, landing zone layout, tag strategy and deployment stacks replacing…5 min
- 6Compliance and Identity GovernanceAZ-305 compliance design: Azure Policy effects and initiatives, Defender for Cloud and Purview, and Entra entitlement management…4 min
About this chapter
What this chapter covers
AZ-305 is a design exam: you are given a business situation and must recommend the right Azure service or architecture. This domain is worth 25 to 30 percent of the exam. It covers designing logging and monitoring, authentication and authorization, secrets management, and governance (management groups, policy and compliance).
You are rarely asked how to click through a setting. You are asked which service meets the requirement with the least complexity, cost and risk.
How the topics fit together
- Logging, log routing and monitoring solutions covers Azure Monitor, Log Analytics, Event Hubs and Application Insights.
- Authentication and identity management solutions covers Entra ID, External ID and managed identities.
- Authorizing access to Azure and on premises resources covers Azure RBAC, PIM, Application Proxy and Private Access.
- Secrets, certificates and keys with Key Vault covers vault tiers, soft delete and the access model.
- Management groups, subscriptions and tagging covers structure and landing zones.
- Compliance and identity governance covers Azure Policy, Purview, entitlement management and access reviews.
A design question usually has one decisive phrase, such as "without managing secrets", "least privilege" or "must be retained for seven years". Find that phrase first.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.