Microsoft AZ-800: Administering Windows Server Hybrid Core Infrastructure Practice Exam
Cover all five AZ-800 skill areas — Active Directory Domain Services, hybrid management, virtual machines and containers, on-premises and hybrid networking, and storage and file services — with scenario questions, immediate feedback in Learn mode, and full timed simulation in Exam mode.
Start 24-hour free trial →AZ-800 retires September 30, 2026 — replaced by the single AZ-802 exam
Microsoft has scheduled AZ-800 and its companion AZ-801 to retire on September 30, 2026 (5:00 PM CST). Both exams are still available to schedule and sit until that date, and if you pass, the certification stays on your Microsoft transcript.
Importantly, the certification is not going away — it is being consolidated and renamed. The two-exam Windows Server Hybrid Administrator Associate is becoming the single-exam Windows Server Administrator Associate, earned by passing the new AZ-802: Administering Windows Server (general availability expected September 2026). Existing holders keep the credential under its new name. Confirm the current path on Microsoft Learn.
AZ-800 exam at a glance
- Vendor
- Microsoft (Windows Server / Azure)
- Exam code
- AZ-800 (retires September 30, 2026)
- Certification
- Microsoft Certified: Windows Server Hybrid Administrator Associate (with AZ-801)
- Level
- Associate (role-based; Windows Server + hybrid)
- Blueprint
- Skills measured as of January 21, 2026 (the current AZ-800 edition)
- Format
- Typically 40–60 questions; multiple choice, multiple response, drag-and-drop, and case studies
- Duration
- About 100–120 minutes
- Passing score
- 700 of 1000 (scaled, not a raw percentage)
- Certification path
- Two exams — AZ-800 and AZ-801 — both required for the current certification (consolidating into the single AZ-802 exam)
- Recommended experience
- Several years of hands-on Windows Server administration, plus Azure and hybrid tooling (Windows Admin Center, PowerShell, Azure Arc)
- Cost (USD)
- $165 USD per exam (associate tier; varies by region)
- Validity
- Valid one year; renewed free via an online assessment on Microsoft Learn
Source: Microsoft Learn — AZ-800 study guide (skills measured) and the Windows Server Hybrid Administrator certification page. AZ-800 retires September 30, 2026.
About the Windows Server Hybrid Administrator certification (AZ-800)
AZ-800 validates that you can administer Windows Server workloads across on-premises and hybrid environments — deploying and managing Active Directory Domain Services, running Windows Servers through Azure services like Azure Arc and Windows Admin Center, managing Hyper-V virtual machines and containers, and handling on-premises and hybrid networking and storage. It is the first of two exams (with AZ-801) for the Windows Server Hybrid Administrator Associate certification, aimed at server administrators extending traditional Windows Server skills into Azure.
AZ-800 and AZ-801 retire on September 30, 2026. They are being consolidated into a single new exam, AZ-802: Administering Windows Server, and the certification is renamed to Windows Server Administrator Associate (see the notice above). If you have already invested in AZ-800 study, the material remains directly relevant — and you can still earn the current certification by passing both exams before the retirement date. If you are new to Azure, AZ-900 Azure Fundamentals is a useful starting point, and AZ-104 Azure Administrator is the closest cloud-administration companion.
Every PowerKram practice question maps to one of the five AZ-800 skill areas and links to the specific Microsoft Learn page it was derived from, so your weak spots become a focused reading list rather than a guess.
AZ-800 skill areas and weights
Five skill areas, with Active Directory Domain Services the single heaviest at 30–35%. Microsoft published each area as a weighting range rather than an exact percentage; the ranges below are reproduced as Microsoft stated them in the current edition.
Deploy and manage domain controllers on-premises and in Azure (including RODCs and FSMO roles); configure multi-site, multi-domain, and multi-forest environments (trusts, sites, replication); create and manage users, groups, and service accounts; implement hybrid identity with Microsoft Entra Connect Sync and Cloud Sync; and manage Group Policy.
Manage Hyper-V and guest VMs (nested virtualization, checkpoints, high availability, virtual switches and NIC teaming, shielded VMs); create and manage Windows Server containers and AKS on Windows Server; and manage Windows Server VMs on Azure (storage, scale sets, availability zones, JIT access, Azure Bastion).
On-premises and hybrid name resolution (DNS with AD DS, zones and records, forwarding, DNSSEC, Azure DNS integration); IP address management (IPAM, DHCP scopes and high availability); and hybrid connectivity (Remote Access, Azure Network Adapter, site-to-site VPN, Entra Private Access and Application Proxy).
Configure and manage Azure Files and Azure File Sync (shares, permissions, DFS migration); Windows Server file shares (FSRM, BranchCache, DFS, SMB over QUIC and SMB options); and Windows Server storage (disks and volumes, Storage Spaces, Storage Replica, data deduplication, iSCSI).
Configure remote management (Windows Admin Center on-premises and in Azure, PowerShell remoting, Just Enough Administration, SSH and RDP); and manage servers and workloads with Azure services (Azure Arc, Azure Machine Configuration, Azure Update Manager, Azure Automation runbooks).
Source: Microsoft Learn — AZ-800 study guide (skills measured, as of January 21, 2026). Microsoft published weightings as ranges; Active Directory Domain Services is the heaviest area.
Who AZ-800 is for
The Windows Server Hybrid Administrator certification is aimed at server administrators bridging on-premises and cloud:
- Windows Server administrators extending traditional AD DS, DNS, DHCP, Hyper-V, and file-services skills into Azure.
- Systems and infrastructure administrators managing hybrid environments with Azure Arc, Windows Admin Center, and PowerShell.
- IT professionals responsible for identity, storage, and networking across on-premises datacenters and Azure.
- Experienced practitioners with several years of hands-on Windows Server administration.
AZ-800 is not an entry point — Microsoft expects real Windows Server experience. If you are new to Azure, AZ-900 Azure Fundamentals is a good precursor, and AZ-104 Azure Administrator is the closest cloud-administration companion. Remember AZ-800 retires September 30, 2026 and consolidates into AZ-802. For the roles this credential supports — with skills, tools, and salary ranges — see the IT Administrator career path.
What this AZ-800 practice exam delivers
Learn mode
Get the correct answer, the reasoning, and a direct link to the exact Microsoft Learn page each question was derived from — immediately after each question. Built for the configuration and troubleshooting scenarios AZ-800 tests across AD DS, Hyper-V, networking, and storage.
Exam mode
A timed run in the AZ-800 shape — roughly 40 to 60 questions in about 100 to 120 minutes, including case studies — so you build pacing for the exam’s scenario-heavy format.
Source-linked explanations
Every answer cites the exact Microsoft Learn documentation page it was built from — so you can verify Windows Server and hybrid behavior, not just memorize.
Score by skill area
Results break down by the five AZ-800 areas — AD DS, hybrid management, VMs and containers, networking, and storage — so practice tells you exactly which area to revisit.
Sample AZ-800 practice questions
Ten free questions across the five AZ-800 skill areas, with full explanations and source links to the Microsoft Learn pages each is derived from. The complete bank is available with the 24-hour trial.
A branch office has poor physical security but needs local authentication. You want a domain controller there that holds no writable copy of credentials and cannot propagate changes back to the forest.
Which type of domain controller should you deploy?
- A read-only domain controller (RODC)
- A writable global catalog server
- A standalone workgroup server
- An Azure Arc-enabled server
Show answer & explanation
Correct: A — a read-only domain controller (RODC). An RODC holds a read-only copy of AD DS, does not store most credentials by default, and cannot push changes back to writable DCs — exactly the low-trust branch scenario described.
Why not the others: a writable global catalog (B) stores credentials and replicates both ways, the opposite of what is needed; a workgroup server (C) is not domain-joined; an Azure Arc-enabled server (D) is a management projection, not a domain controller.
Source: Microsoft Learn — Active Directory Domain Services → Further reading: PowerKram — AZ-801 Windows Server Hybrid Advanced →You must synchronize on-premises Active Directory identities to Microsoft Entra ID so users can sign in to Microsoft 365 with the same credentials, using a lightweight agent-based approach.
Which technology should you implement?
- Azure Update Manager
- Windows Admin Center
- DFS Replication
- Microsoft Entra Connect (or Entra Cloud Sync)
Show answer & explanation
Correct: D — Microsoft Entra Connect (or Entra Cloud Sync). Entra Connect Sync and the lighter agent-based Cloud Sync synchronize on-premises AD identities to Microsoft Entra ID for shared sign-in — exactly the hybrid-identity requirement described.
Why not the others: Azure Update Manager (A) patches servers; Windows Admin Center (B) is a management console; DFS Replication (C) replicates files, not identities.
Source: Microsoft Learn — What is Microsoft Entra Connect? → Further reading: PowerKram — AZ-104 Azure Administrator →You need to apply a consistent set of security and configuration settings — password policy, drive mappings, and desktop restrictions — to all computers in a specific organizational unit.
Which AD DS feature should you use?
- A read-only domain controller
- An FSMO role transfer
- Group Policy
- An AD DS site link
Show answer & explanation
Correct: C — Group Policy. Group Policy applies centralized configuration and security settings (including preferences like drive mappings) to users and computers scoped by organizational unit — exactly the requirement described.
Why not the others: an RODC (A) is a DC type; an FSMO role transfer (B) moves operations-master roles between DCs; a site link (D) controls replication topology. None applies configuration policy to an OU.
Source: Microsoft Learn — Active Directory Domain Services →You want to manage on-premises Windows Servers with Azure capabilities — Azure Policy, Update Manager, and Machine Configuration — without migrating them to Azure.
Which technology projects these servers into Azure for management?
- Azure Arc-enabled servers
- Hyper-V nested virtualization
- Azure File Sync
- DHCP failover
Show answer & explanation
Correct: A — Azure Arc-enabled servers. Azure Arc projects on-premises (and multicloud) servers into Azure via the Connected Machine agent, so you can apply Azure Policy, Update Manager, Machine Configuration, and monitoring without migrating them — exactly the requirement.
Why not the others: nested virtualization (B) runs Hyper-V inside a VM; Azure File Sync (C) syncs file shares; DHCP failover (D) provides IP-lease resilience. None brings Azure management to on-premises servers.
Source: Microsoft Learn — Azure Arc-enabled servers → Further reading: PowerKram — AZ-801 Windows Server Hybrid Advanced →You want a browser-based, GUI console to manage multiple Windows Servers — on-premises and in Azure — including roles, certificates, and PowerShell, without installing heavy tools on each machine.
Which tool should you use?
- Remote Desktop only
- Azure Bastion
- Windows Admin Center
- System Center Configuration Manager
Show answer & explanation
Correct: C — Windows Admin Center. Windows Admin Center is the browser-based management console for Windows Servers on-premises and in Azure, surfacing roles, certificates, events, and an integrated PowerShell console from one place — exactly the requirement.
Why not the others: Remote Desktop (A) connects to one server’s desktop at a time; Azure Bastion (B) provides secure RDP/SSH to Azure VMs; Configuration Manager (D) is a heavier enterprise management suite, not the lightweight console described.
Source: Microsoft Learn — Windows Admin Center →On a Hyper-V host, you must run a guest VM that itself needs to host Hyper-V — for example to run containers with Hyper-V isolation inside the VM.
Which Hyper-V feature must you enable?
- Enhanced session mode
- Nested virtualization
- Dynamic memory
- A checkpoint
Show answer & explanation
Correct: B — nested virtualization. Nested virtualization exposes the virtualization extensions to a guest VM so it can run its own Hyper-V hypervisor — required to host VMs or Hyper-V-isolated containers inside a VM, exactly as described.
Why not the others: enhanced session mode (A) improves the VM console experience; dynamic memory (C) adjusts RAM allocation; a checkpoint (D) captures VM state. None enables a guest to run Hyper-V.
Source: Microsoft Learn — Hyper-V on Windows Server →You are preparing a Windows Server host to build and run Windows Server container images for a packaged application.
Which container runtime should you install and configure on the host?
- The DHCP Server role
- The Remote Access role
- The File Server Resource Manager
- The Container host role with a container runtime
Show answer & explanation
Correct: D — the container host role with a container runtime. To build and run Windows Server containers, you prepare the host with container support and a container runtime, then pull or build images and run instances — exactly the container-host preparation AZ-800 tests.
Why not the others: the DHCP role (A) assigns IP addresses; the Remote Access role (B) handles VPN and routing; FSRM (C) manages file-server quotas and screening. None is a container runtime.
Source: Microsoft Learn — Containers on Windows → Further reading: PowerKram — AZ-104 Azure Administrator →You must centrally plan, track, and audit the IP address space and DNS/DHCP infrastructure across many Windows Servers in a large environment.
Which Windows Server feature provides this?
- BranchCache
- IP Address Management (IPAM)
- Storage Replica
- Just Enough Administration (JEA)
Show answer & explanation
Correct: B — IP Address Management (IPAM). IPAM centrally discovers, plans, tracks, and audits IP address space along with the DNS and DHCP servers that manage it, across the enterprise — exactly the requirement described.
Why not the others: BranchCache (A) caches content at branch offices; Storage Replica (C) replicates volumes; JEA (D) constrains administrative PowerShell sessions. None manages IP address space.
Source: Microsoft Learn — IP Address Management (IPAM) →A Windows Server DNS server should resolve names for an external partner domain by sending only those specific queries directly to the partner’s DNS servers, while resolving everything else normally.
Which DNS configuration should you use?
- A reverse lookup zone
- DNSSEC signing
- Conditional forwarding
- A DHCP scope option
Show answer & explanation
Correct: C — conditional forwarding. A conditional forwarder sends queries for a specific domain to designated DNS servers while all other queries follow normal resolution — exactly the partner-domain scenario described.
Why not the others: a reverse lookup zone (A) maps IPs to names; DNSSEC (B) signs records for integrity; a DHCP scope option (D) hands out client settings. None targets one domain’s resolution to specific servers.
Source: Microsoft Learn — Windows Server DNS → Further reading: PowerKram — AZ-700 Azure Network Engineer →A company wants to keep frequently used files cached on local Windows file servers while tiering the full dataset to the cloud, centralizing storage in Azure and reducing on-premises capacity.
Which technology should you implement?
- Storage Spaces Direct
- Azure File Sync
- iSCSI target server
- Data deduplication
Show answer & explanation
Correct: B — Azure File Sync. Azure File Sync centralizes file shares in Azure Files while cloud tiering keeps only frequently accessed files on the local server, reducing on-premises capacity — exactly the caching-and-tiering requirement described.
Why not the others: Storage Spaces Direct (A) pools local disks for hyperconverged storage; an iSCSI target (C) presents block storage; data deduplication (D) reduces redundant data on a volume. None tiers files to the cloud.
Source: Microsoft Learn — Azure File Sync planning →Keep going: study & career resources
AZ-800 is the first half of the Windows Server Hybrid Administrator certification. Its companion completes the pair, and the IT-administrator career track shows where these hybrid server skills lead.
Deep dive: AZ-800 format, the AZ-802 consolidation, renewal, and study path
Exam format and scoring
AZ-800 delivers roughly 40 to 60 questions in about 100 to 120 minutes, with a passing score of 700 out of 1000 (scaled). It includes multiple choice, multiple response, drag-and-drop, and one or more case studies. It is a hands-on administration exam: expect scenarios about configuring AD DS, Hyper-V, DNS and DHCP, and hybrid tooling. There is no penalty for wrong answers. See the AZ-801 companion exam →
The AZ-802 consolidation
AZ-800 and AZ-801 retire on September 30, 2026. Microsoft is consolidating the two-exam path into a single new exam, AZ-802: Administering Windows Server, and renaming the certification from Windows Server Hybrid Administrator Associate to Windows Server Administrator Associate. The certification itself is not going away, and current holders keep it under the new name. If you are close to finishing the AZ-800/AZ-801 pair, you can still earn the current certification before the retirement date; if you are starting fresh, watch for AZ-802 general availability. See the AZ-104 Administrator path →
The five skill areas
Active Directory Domain Services is the heaviest area (domain controllers, multi-forest design, users and groups, hybrid identity with Entra Connect, and Group Policy). The rest cover virtual machines and containers (Hyper-V and Windows containers), on-premises and hybrid networking (DNS, DHCP/IPAM, Remote Access), storage and file services (Azure Files and File Sync, DFS, Storage Spaces), and hybrid management (Windows Admin Center, Azure Arc, PowerShell remoting). Knowing which tool fits a hybrid scenario is the core AZ-800 skill. See the AZ-700 Azure Network path →
Realistic study path
Most candidates come to AZ-800 with real Windows Server experience and need four to eight weeks of focused study per exam. Work through the official Microsoft Learn AZ-800 learning path, build labs (a domain with an RODC, Entra Connect sync, a Hyper-V host with nested virtualization, Azure File Sync), then drill scenario questions in PowerKram’s Learn mode and finish with timed Exam-mode runs. Spend the most time on AD DS, since it is by far the heaviest area. See the AZ-900 Azure Fundamentals path →
Cost, renewal, and scheduling
List price is $165 USD per exam (associate tier; regional pricing varies), and the current certification requires both AZ-800 and AZ-801. The certification is valid for one year and is renewed free through an online assessment on Microsoft Learn during the six months before it expires. The exam is delivered through Pearson VUE at a test center or online with a proctor. Windows Server Hybrid Administrator certification page →
Career outlook and next steps
AZ-800 validates hybrid Windows Server administration skills that map to systems-administrator and infrastructure-administrator roles. It pairs with AZ-801 to complete the current certification, and complements AZ-104 (Azure Administrator) and AZ-700 (Azure Network Engineer) for administrators broadening into cloud. As the path consolidates into AZ-802, the underlying skills remain in demand across hybrid datacenters. Career Hub — IT Administrator →
Microsoft AZ-800 (Windows Server Hybrid Administrator) exam FAQ
Is AZ-800 retiring, and what replaces it?
What are the AZ-800 skill areas and weights?
How many exams does the certification require?
What is the AZ-800 passing score and format?
Does the certification expire?
Start your free 24-hour AZ-800 practice trial
Full access to the question bank, both study modes, source-linked explanations, and score-by-skill-area. No credit card required.
Start free trial →