Domain: Design Identity, Governance & Monitoring Solutions
25–30% of the exam. Skills outline as of April 17, 2026.
Domain Progress
Topics
| Topic | Covers | Tips | Practice |
|---|---|---|---|
| Azure Monitor & Agents | Azure Monitor Agent · Data collection rules · Azure Arc · VM insights | Quiz | |
| Log Analytics Workspace Design | Single vs multiple workspaces · Access modes · Table plans · Retention | Quiz | |
| Log Routing (Diagnostic Settings) | Destinations · Limits · Streaming to SIEM · Policy at scale | Quiz | |
| Alerts & Notifications | Metric · Log search · Activity log · Service Health · Action groups | Quiz | |
| Defender for Cloud & Sentinel | CSPM · Workload protection · Regulatory compliance · SIEM | Quiz | |
| Entra ID Licensing | Free · P1 · P2 · ID Governance · Entra Suite | Quiz | |
| Hybrid Identity | Password hash sync · Pass-through auth · Federation · Cloud Sync | Quiz | |
| Conditional Access & Identity Protection | Signals · Grant controls · Sign-in risk · User risk · Authentication strengths | Quiz | |
| External Identities | B2B collaboration · External ID (CIAM) · Azure AD B2C status | Quiz | |
| Managed Identities & App Identity | System-assigned · User-assigned · Service principals · Workload identity federation | Quiz | |
| Access to On-Premises Resources | Application Proxy · Entra Private Access · Entra Domain Services · Kerberos | Quiz | |
| RBAC, ABAC & Lighthouse | Scopes · Built-in & custom roles · Conditions · Cross-tenant management | Quiz | |
| Privileged Identity Management | Eligible vs active · Activation settings · Approval · Access reviews of roles | Quiz | |
| Key Vault & Managed HSM | Standard vs Premium · Managed HSM · Cloud HSM · RBAC · Soft delete · Purge protection | Quiz | |
| Hierarchy, Tags & Locks | Management groups · Subscriptions · Resource groups · Tagging · Locks · Landing zones | Quiz | |
| Azure Policy & Compliance | Effects · Initiatives · Remediation · Exemptions · Compliance | Quiz | |
| Identity Governance | Entitlement management · Access packages · Access reviews · Lifecycle workflows | Quiz | |
| Top domain traps (below) | Highest-yield rules |
Top Domain Traps
“Conditional Access license” → P1; risk-based CA and PIM = P2. Trap: Picking P1 for risk policies is the classic trap.
“Collect VM logs” → Azure Monitor Agent + DCR. Trap: MMA is retired.
“Resource logs” → Need a diagnostic setting; external SIEM = Event Hubs.
“Default workspace design” → One Log Analytics workspace; split only for residency/tenant/security needs.
“App needs secrets with no stored credentials” → Managed identity + Key Vault (RBAC model).
“Sign-in must work if on-prem is down” → Password hash sync; enforce on-prem policies = PTA.
“New customer-facing sign-up” → Entra External ID. Trap: Azure AD B2C is closed to new customers.
“Policy vs RBAC vs Lock” → Policy = WHAT, RBAC = WHO, Lock = can't delete/change.
“Fix existing non-compliant resources” → Remediation task (modify / deployIfNotExists need a managed identity).
“Tags inherited from resource group?” → Not by default; use Modify policy.
“Remote access to on-prem web app without VPN” → Entra application proxy; non-web = Entra Private Access.
“Just-in-time admin with approval” → PIM eligible assignment.
⚠️ Retirement Watch
Older question banks may still use these. If a current replacement is offered as an option, pick the replacement. The full list is on the Retirement Timeline page.
| Retired / retiring | Date | Exam answer now |
|---|---|---|
| Log Analytics agent (MMA/OMS) | Aug 31, 2024 (uploads may stop after Mar 2, 2026) | Azure Monitor Agent + DCRs |
| Azure AD B2C for new customers | May 1, 2025 | Microsoft Entra External ID |
| Azure AD B2C P2 | Mar 15, 2026 | — |
| Legacy ID Protection risk policies | Oct 1, 2026 | Risk conditions in Conditional Access |
| Key Vault access policies as default | API 2026-02-01 | Azure RBAC permission model |
| Azure Blueprints | Jan 31, 2027 | Deployment Stacks + Template Specs + Policy |
| Sentinel in the Azure portal | Mar 31, 2027 | Microsoft Defender portal |
| Azure Dedicated HSM | Full support until Jul 31, 2028; no new onboardings | Azure Cloud HSM or Managed HSM |
Progress is saved in this browser only (localStorage). Clearing site data resets it.
Original study notes based on the public Microsoft skills outline and Microsoft Learn documentation. Not affiliated with Microsoft; not actual exam content.