AZ-800 and AZ-801: Windows Server Hybrid Administrator Certification Guide · CloudEngineerHub
Certification11 min read5 views
AZ-800 and AZ-801: Windows Server Hybrid Administrator Certification Guide
Complete AZ-800/AZ-801 study guide: exam domains, hybrid Windows Server skills, a 7-week study plan, hands-on labs with Windows Admin Center and Azure Arc, and an exam tracker script.
A
Anuradha Kumari
Published: July 24, 2026· Last Updated: October 3, 2026·11 min read
AZ-800 and AZ-801: Windows Server Hybrid Administrator Certification Guide
Most enterprises are not "cloud companies" — they are Windows Server estates with a growing Azure footprint, which is exactly the world the Microsoft Certified: Windows Server Hybrid Administrator Associate certification (AZ-800 + AZ-801) describes. Pass both exams and you hold the only Microsoft certification that certifies Active Directory, failover clustering, storage migration, and the Azure services (Arc, Azure Migrate, Azure Site Recovery) that connect those on-premises skills to the cloud. This guide breaks down both exams, maps their domains to the daily work of a hybrid admin, and gives you a seven-week plan that ends with real hands-on skill, not just flashcards.
Visual Walkthrough
A
Anuradha Kumari
Author
Endpoint management specialist focused on Microsoft Intune, Windows Autopilot and modern EUC. Writes practical deployment, compliance and troubleshooting guides for IT teams.
The study cadence behind every AZ-104/MD-102 pass on this site.
TimelineSix-Week Certification Loop5/5
weeks 1–2
1
Weeks 1–2 · Foundations
Learn paths + concept mapping; notes as flashcards.
weeks 3–4
2
Weeks 3–4 · Labs
Hands-on in a test tenant; break and fix deliberately.
week 5
3
Week 5 · Practice tests
Timed mocks; review EVERY wrong answer to source docs.
week 6
4
Week 6 · Weak domains
Score report → targeted revision of weakest domains.
exam
5
Exam day
Rest, ID check, time-boxed flags, review marked questions.
Six-Week Certification Loop. 1. Weeks 1–2 · Foundations: Learn paths + concept mapping; notes as flashcards. — 2. Weeks 3–4 · Labs: Hands-on in a test tenant; break and fix deliberately. — 3. Week 5 · Practice tests: Timed mocks; review EVERY wrong answer to source docs. — 4. Week 6 · Weak domains: Score report → targeted revision of weakest domains. — 5. Exam day: Rest, ID check, time-boxed flags, review marked questions.
Prerequisites
Working experience administering Windows Server (2016 or newer), ideally two or more years.
Basic Active Directory Domain Services, Group Policy, DNS, DHCP, and file server knowledge.
An Azure subscription (free tier or MSDN credits) for labs: Azure Arc, Azure Site Recovery, Azure Migrate, Azure Files.
A lab: either two VMs (Hyper-V or VMware) with Windows Server 2022/2025 evaluation ISOs, or a Microsoft Learn sandbox.
Windows Admin Center installed (gateway on your workstation or a lab VM).
Overview
How the two exams fit together
AZ-800, Administering Windows Server Hybrid Core Infrastructure, covers the core operations: identity (AD DS and the Entra ID seam), hybrid onboarding, storage, compute, migration, and day-to-day administration. AZ-801, Administering Windows Server Hybrid Advanced Services, goes deeper into the advanced operations: security hardening at scale, high availability (failover clustering), disaster recovery (Storage Replica, Hyper-V Replica, Azure Site Recovery), and AD DS migration and consolidation. You must pass both; each is a separate sitting.
Exam mechanics
Each exam runs roughly 100 minutes with 40-60 items: multiple choice, drag-and-drop ordering, hot area, case studies, and occasionally lab-style tasks performed in a live UI. The passing score is 700 on a 1,000 scale. Registration cost varies by country (typically around 165 USD per exam) — check the exam page for your region. Both certifications renew annually with the free online renewal assessment, which opens six months before expiry.
AZ-800 domains
Per the official skills outline: secure Windows Server on-premises and hybrid infrastructures (25-30%), implement and manage high availability (10-15%), implement disaster recovery (10-15%), migrate servers and workloads (20-25%), monitor and troubleshoot (10-15%), and manage storage and compute (15-20%). Note how migration and security dominate — this is a hybrid-first exam, not a 2012-era server exam.
AZ-801 domains
AZ-801 focuses on: securing Windows Server on-premises and hybrid infrastructures, failover clustering and high availability, disaster recovery, migrating servers and workloads (including AD DS migration), and monitoring/troubleshooting. The heaviest hands-on topics are failover clustering, Storage Replica, AD DS migration, and Azure Site Recovery. If you can design a two-node cluster, replicate it to a second site, and explain how you would fail over and fail back, you have internalized most of AZ-801.
Step-by-Step Implementation
1. Build the skills map before the study calendar
Read both official study guides on learn.microsoft.com and mark each skill item green/amber/red based on honest experience. The amber and red items — not the calendar — drive your plan. Most experienced admins are red on Azure Site Recovery, Storage Replica, and AD DS migration; most are overconfident on DFS and DHCP failover.
2. Weeks 1-2: identity and hybrid onboarding (AZ-800 core)
Lab: deploy two domain controllers, hybrid-join the forest, and onboard servers to Azure Arc with the azcmagent CLI. Practice the exact seams the exam tests: Entra Connect vs Cloud Sync, password hash sync vs pass-through authentication, and Arc-based policy and monitoring. Know Get-ADDomainController, Move-ADDirectoryServer (operations master transfers), and the read-only domain controller read-local/write-forward model.
3. Weeks 3-4: storage, compute, and migration
Lab: deploy Storage Spaces Direct-free basics first — Storage Replica server-to-server, then Azure File Sync on a file server. Then run Azure Migrate: assess a lab VM and replicate it to Azure. The exam wants you to know when to use Azure Migrate (full server migration), Azure File Sync (file workloads), DFS Replication (branch file sync), and Storage Replica (block-level, disaster recovery). Practice server migration with the Windows Admin Center migration extension.
4. Weeks 5-6: high availability and disaster recovery (AZ-801 core)
Lab: build a two-node failover cluster with a file share witness, add a Scale-Out File Server role, then configure Hyper-V Replica to a second host and Azure Site Recovery for one VM. Study cluster quorum math (dynamic witness, node and file share majority) and cluster-aware updating. For ASR, walk the full loop: enable replication, run a test failover, then a planned failover and failback — the exam loves asking which traffic is replicated and what happens during each failover type.
5. Week 7: practice tests and gap closing
Take at least two timed practice exams. For every wrong answer, write one sentence explaining why the right answer is right — the exams reward scenario judgment over trivia. Then take the free practice assessment on learn.microsoft.com (same platform as the real exam interface) in the final three days.
6. Book both exams strategically
Schedule AZ-800 first and AZ-801 two to four weeks later. The content overlaps in security and migration, so the second exam's prep reinforces the first. Booking both immediately (with a discount bundle if your region offers it) protects the momentum.
Configuration Deep Dive
Arc onboarding is exam-critical: know that azcmagent connect requires a service principal or interactive auth, that Arc enables Azure Policy, Log Analytics, and Extensions on non-Azure servers, and that a machine in a disconnected state needs the HIMDS service and network path to Azure (443) restored.
Cluster quorum: default dynamic witness adjusts the quorum vote model automatically; the file share witness goes in your primary site's DFS namespace for stretched clusters, or in Azure for cloud witness (Set-ClusterQuorum -CloudWitness). Cloud witness with a storage account name and key is the exam-preferred answer for multi-site clusters.
Storage Replica: server-to-server for two nodes, stretch cluster for the same site pair, and cluster-to-cluster for DR. It is synchronous (zero RPO, distance-sensitive) or asynchronous. It is not DFS Replication — know the boundary: DFSR syncs folders with throttling and conflict handling; Storage Replica mirrors volumes.
AD DS migration: use Move-ADDirectoryServerOperationMasterRole for FSMO moves, intra-forest domain migration with ADMT (Password Export Server for passwords), and never trust object re-creation — SID history exists for a reason.
Azure Files identity: the exam expects you to know that Azure Files supports AD DS and Entra Kerberos authentication for FSLogix and NTFS ACLs — and that SMB channel encryption and VNet service endpoints or private endpoints secure the path.
Real-World Enterprise Scenario
A logistics company ran 180 Windows Server VMs across two sites with a single aging domain controller per site and no tested recovery path. Their hybrid admin used the exam syllabus as the remediation backlog: week 1 added a second DC per site with DNS; week 2 onboarded all servers to Azure Arc and assigned the built-in machine-configuration initiatives; week 3 implemented Storage Replica for the file servers and cloud witness for a new two-node Hyper-V cluster; week 4 ran an Azure Migrate assessment and piloted ASR for three business-critical VMs. The certification prep and the DR program were the same project — the last ASR test failover report went straight into the board pack, and the engineer passed AZ-801 the following Tuesday.
PowerShell for Windows Server Hybrid Administration
One script serves you all the way through: an exam progress tracker that also doubles as a study-block scheduler. It persists to CSV so your progress survives across sessions:
Treating it as two "Windows Server" exams. Roughly a third of each exam is Azure services: Arc, Azure Migrate, ASR, Azure Files, cloud witness. Candidates who skip the Azure labs fail on exactly these.
Memorizing cmdlets instead of scenarios. Questions are scenario-first ("a site loses power, what happens to the cluster?"). Learn quorum behavior and failover semantics; the cmdlet is secondary.
Ignoring case studies. AZ-800/801 case studies give you a company profile plus 6-10 questions. Budget time: skim the business needs once, then answer — do not re-read everything per question.
Letting the lab rot. Reading about Storage Replica without running it produces false confidence. Every domain in this guide has a ≤2-hour lab; run them.
Booking 801 immediately after 800. The overlap helps, but two weeks of separation lets the security and clustering content consolidate.
Visual Walkthrough
The branch-by-branch path from "not joined" to a healthy PRT.
Device sync scope includes this OU? Sync health green?
3
Fix connectivity or scope
Allow device endpoints or widen the sync OU.
4
Re-run join
Task completes; dsregcmd flips AzureAdJoined to YES.
Hybrid Join Debug — dsregcmd Tells All. Gate: dsregcmd /status says? — Joined, no PRT: Validate SCP — Joined, no PRT: Cloud auth reachable — Joined, no PRT: Event 304/305 — Joined, no PRT: PRT acquired — Not joined: Check auto-join task — Not joined: AD Connect state — Not joined: Fix connectivity or scope — Not joined: Re-run join
Common Errors
azcmagent connect fails with "tenant does not allow subscription" — the SPN or interactive identity lacks the Azure Connected Machine Onboarding role, or the tenant restricts Arc. Assign the role at the right resource-group scope.
Set-ClusterQuorum : Unable to create the cloud witness resource — the storage account name/key pair is wrong or the account blocks shared key access. Re-run Set-ClusterQuorum -CloudWitness -AccountName <name> -AccessKey <key>.
Move-ADDirectoryServerOperationMasterRole : Access is denied — FSMO transfers require Domain Admin and the Flexible Single Master Operations role transfer must target a writable DC; check that you are not pointing at an RODC.
Test-SRTopology : The source and destination must be on different volumes — Storage Replica mirrors whole volumes, not folders; provision a separate data volume per replication pair.
Azure Migrate appliance "cannot connect to vCenter" — the appliance needs network access to vCenter on 443 and a read-only vCenter account; re-run the appliance configuration manager and re-validate credentials.
Best Practices
Anchor study to the official skills outline; do not buy a course that skips Arc or ASR.
One lab per domain minimum — the hybrid topics are lab-verifiable skills, not trivia.
Use the free Microsoft practice assessment as your final gate before booking.
Study the boundary between technologies: DFSR vs Storage Replica, Azure Migrate vs ASR, Entra Connect vs Cloud Sync.
Renew on schedule: the certification renews annually online for free; calendar the six-month window.
Track domains with data (the tracker script above) — book the exam when every domain averages ≥80.
Security Considerations
AZ-800's largest single domain is security, and it mirrors real hardening: credential Guard and LSASS protection, SMB signing and encryption, local administrator password management (Windows LAPS — now built into Windows Server), privileged access tiering, and BitLocker with a recovery key escrow plan. Lab these specifically: deploy Windows LAPS policy via GPO, verify Get-LapsDiagnostics output, and enforce SMB signing at the server level. The exam assumes you know that hardening applied without an escrow and recovery path is an outage waiting to happen.
FAQ
Do I need AZ-104 before AZ-800/801?
No. AZ-800/801 is a standalone associate certification with no prerequisites. If your role is primarily Azure infrastructure, AZ-104 may serve you better; if your estate is Windows Server-first, this path is the better fit.
How long should I study?
Seven weeks at 6-8 hours per week is a realistic plan for an admin with day-to-day Windows Server experience; double it if you have no Azure hands-on yet.
Are the exams retiring?
No — AZ-800/801 remain the current Windows Server hybrid path. Always verify exam status on the official certification page before booking, as Microsoft retires exams periodically.
What replaces MCSA?
This certification. The retired MCSA 2016 era has no direct rebadge — you take AZ-800 and AZ-801 like everyone else.
Is the renewal exam free?
Yes. The online renewal assessment is free, taken from learn.microsoft.com within the six-month window before expiry.
Conclusion
AZ-800 and AZ-801 reward engineers who actually operate hybrid estates: identity seams, clustering, replication, migration, and the Arc-enabled bridge into Azure governance. Build the lab, map the domains honestly, use the tracker script to gate your readiness at 80+ per domain, and treat each exam topic as something you could demonstrate on a whiteboard and in a console. Do that, and the certification is a byproduct of becoming genuinely dangerous in a hybrid datacenter.
Comments
0No comments yet — be the first to share your thoughts.