Microsoft AZ-800: Legacy Windows Server Hybrid Core Infrastructure

AZ-800: Administering Windows Server Hybrid Core Infrastructure retired on September 30, 2026, alongside AZ-801. The former Windows Server Hybrid Administrator Associate route covered managing Active Directory Domain Services, hybrid identities, Windows Server, virtual machines, containers, hybrid networking, and file services. Microsoft continues to document Windows Server administration through its current certification catalog, but AZ-800 itself should no longer be presented as available to schedule. This page preserves the technical knowledge and clearly separates the historical assessment from any active successor pathway.

Many organizations still run Windows Server in local data centers while connecting workloads to Azure, so the technical questions remain important. The central challenge is continuity: which identity system authorizes a user, where the data is stored, how administrators apply a policy consistently, and how a service recovers if either on-premises or cloud dependencies fail. The paired AZ-801 historically covered advanced security, continuity and migration, while AZ-800 emphasized core implementation and management.

Deploy and maintain AD DS across locations

Active Directory Domain Services provides domain identity and policy infrastructure for Windows environments. Domain controllers, DNS integration, replication and site topology affect authentication for users and services. A design must map physical or logical sites to network connectivity so clients can locate suitable domain controllers and replication remains efficient. An administrator who sees intermittent logons should inspect name resolution, replication health, time synchronization and connectivity before blaming user passwords alone.

Some AD DS operations have designated flexible single master operation roles, while other directory changes replicate among controllers. Moving or recovering a role requires understanding its purpose and avoiding conflicting ownership. Read-only domain controllers can be appropriate at locations with different physical security risks, but deployment still needs replication and credential handling planning. Domain and forest trusts extend authentication boundaries and should be scoped according to actual collaboration requirements rather than enabled broadly.

Service accounts and group memberships deserve careful review. A service that runs under an ordinary user account with an unrotated password may break during a routine employee offboarding action. Use appropriate managed or dedicated identities and document how the account is provisioned, authorized and recovered. Group Policy can standardize configuration, but a mislinked or overly broad policy can change thousands of machines at once. Test policy scope, precedence and rollback in a representative organizational unit before a large rollout.

Explain the relationship between AD DS and Microsoft Entra

Hybrid identity combines different directory capabilities, not two identical copies of one system. Microsoft Entra ID and AD DS use different authentication and authorization models. Synchronization tools can connect identity attributes, but a successful synchronization does not guarantee that every application requirement is met. Decide which identity source remains authoritative for each attribute, how account lifecycle changes propagate and what happens during cloud or local directory outages.

Microsoft Entra Connect Sync and Cloud Sync address synchronization scenarios with different deployment and support considerations. Document configuration, monitoring and exception handling. If a user can sign in to a local workstation but not a cloud application, check conditional access, licensing, synchronization and token-related evidence rather than changing local domain security policy at random. Hybrid troubleshooting must identify which control plane made the decision.

Password and authentication policies should support security without making emergency access impossible. Separate privileged identities, enforce strong authentication where supported and preserve break-glass procedures with appropriate monitoring. A tenant or domain compromise can affect many workloads, so backup, recovery and testing of directory services matter as much as ordinary account provisioning. A safe runbook specifies restoration order and how to verify that stale or malicious directory changes are not reintroduced during recovery.

Manage servers through controlled automation and Azure Arc

Windows Admin Center and PowerShell remoting help administrators manage servers across locations. Azure Arc can expose supported hybrid machines to Azure management capabilities, and services such as Azure Update Manager or Azure Policy can help establish visibility and governance. Connectivity to a cloud management plane does not remove local responsibility for OS configuration, application dependencies or physical failure. Design the identity, network and update permissions needed for each management operation.

PowerShell remoting needs appropriate authentication, firewall access and delegated rights. The "second hop" problem appears when a remote command needs to access another resource with the caller's identity. Avoid solving it by assigning permanent domain-admin credentials to scripts. Instead select a supported delegation or service-identity pattern and test the exact access required. Just Enough Administration can reduce the commands an operator is permitted to invoke while still enabling routine support.

Patching is a controlled change. Stage updates by server role, verify application compatibility and keep a recovery option. A domain controller, Hyper-V host and file server have different service dependencies, so one universal reboot schedule can be disruptive. Automation should capture success or failure evidence from each node and stop when preconditions are missing. A patch-management dashboard is not proof of business continuity unless the dependent services also pass post-change tests.

Administer Hyper-V, virtual machines and containers

Hyper-V resource allocation includes CPU, memory, virtual disks, switching, checkpoints and host capacity. Administrators need to know where virtual machine state lives and what a checkpoint can and cannot guarantee. A checkpoint is not a complete backup strategy; keeping old checkpoints indefinitely can create storage and performance problems. For a critical workload, test application-consistent recovery through an approved backup method instead of relying on a saved VM state.

Nested virtualization, GPU partitioning and other specialized capabilities may be important for specific workloads, but they create host and guest requirements that must be validated. Virtual switch and NIC teaming choices affect traffic separation and resilience. An intermittent network problem may be caused by a host virtual switch setting even when the guest operating system appears correctly configured. Collect evidence at both layers and compare the expected path with effective forwarding.

Windows Server containers add image and runtime management. They are useful for particular application deployment patterns but have operating-system compatibility and networking constraints. A container sharing a kernel is not equivalent to a fully isolated VM. Review image updates, secrets, port mappings and resource limits before moving a workload. As with virtual machines, operational design must address monitoring, logging and recovery as well as successful initial execution.

Build reliable DNS, DHCP and hybrid network services

Windows DNS is central to AD DS and many application dependencies. Conditional forwarding, DNS zones, private name resolution and DNSSEC solve different requirements. A hybrid application may query local DNS for a name that should resolve through Azure Private DNS or a forwarding service. Incorrect forwarders can cause intermittent failures that resemble application authentication problems. Map the request path and confirm the authoritative source rather than simply adding extra DNS servers.

DHCP and IP Address Management help allocate and track network addresses. Reservations, scopes, exclusions and lease behavior need monitoring as networks grow. DHCP high availability can reduce outage risk but must be configured and tested for the actual site topology. A subnet running out of addresses may cause new clients to fail while existing clients continue functioning. That symptom differs from a routing failure and should prompt capacity and lease analysis before firewall changes.

Hybrid connectivity may involve VPN, remote access, proxy or other supported services. When a remote branch loses connectivity, examine routing, DNS, authentication and tunnel health independently. A successful tunnel establishment is not proof that all required subnets and ports are reachable. Document permitted administrative paths and avoid opening management services directly to the internet to work around an outage.

Directory services can appear available while users receive inconsistent authorization. Imagine a branch domain controller still accepting logons after its replication path fails. A recent group-membership change at headquarters may not reach the branch promptly, producing confusing file-access denials. Examine replication events, site configuration, DNS, time synchronization and the controller chosen for authentication before resetting credentials. Adding another controller is not a repair for a failed network dependency. A recovery test should include an account whose membership has actually changed.

A file-service migration also requires more than copying bytes. The new storage location must preserve permissions, service identities, name resolution and application paths. Test representative user groups, large files and workloads that keep files open. Define a freeze window, a source of authoritative writes and a rollback trigger before cutover. If the old share remains writable after migration, clients can silently create diverging versions of business records. These cases explain why historical AZ-800 knowledge remains useful even though its registration pathway is retired.

Protect file services and document the retirement transition

Windows file shares rely on SMB behavior, identity, permissions and storage capacity. Azure File Sync, Azure Files and other cloud-integrated patterns can extend or modernize a file environment when chosen appropriately. Distinguish share permissions from NTFS permissions and review effective access. An administrator may see a user denied access because of a restrictive ACL even when the share itself appears open. File Server Resource Manager can help with quotas and screening, but overrestrictive rules can interrupt important applications.

Backups and replication serve different purposes. A synchronized corrupted document can spread its damaged state to other copies, so recovery points and retention are important. Test restoration with actual user permissions and application data. Server Message Block over QUIC may support certain remote access scenarios, but requires supported clients, certificates and policy choices. Avoid assuming one transport mode is universally suitable for legacy clients.

Microsoft retired AZ-800 and AZ-801 on September 30, 2026. Its current AZ-802: Administering Windows Server exam supports the new Microsoft Certified: Windows Server Administrator Associate route; it is a distinct current assessment, not another date for sitting AZ-800. The technical topics remain valuable for people maintaining hybrid infrastructure. Use controlled labs to test identity synchronization, group policy, Hyper-V networking, DNS, DHCP and file restoration, then verify each decision against modern product guidance. A historical exam resource earns its value by teaching sound operations without giving misleading registration directions.