Design identity, governance, and monitoring solutions Study Guide — AZ-305

Design Identity, Governance, and Monitoring Solutions – AZ-305 Study Guide

This domain accounts for 25–30% of the exam and asks you to design — not implement — identity, governance, and monitoring solutions. AZ-305 questions are scenario-based: given business and technical requirements, recommend the right Azure capability. The exam rewards knowing which tool solves which problem and applying least-privilege, defense-in-depth thinking. This is a design exam, so "recommend the most appropriate solution" is the recurring instruction.

Authentication and Identity

Hybrid identity — connect on-premises AD to Microsoft Entra ID via Microsoft Entra Connect:

• Password Hash Synchronization (PHS) — same credentials in cloud; cloud authentication survives an on-premises outage. The simplest resilient default.
• Pass-through Authentication — validates against on-premises AD in real time.
• Federation (AD FS) — full control, more infrastructure.

Authentication strengthening — recommend MFA and passwordless (Windows Hello, FIDO2, Authenticator). Deliver adaptively with Conditional Access: policies evaluate signals (user, location, device compliance, risk) and enforce require-MFA / block / require-compliant-device only when warranted.

External access — recommend Microsoft Entra External ID / B2B so partners sign in with their own identities (no passwords in your tenant).

Workload identity — recommend managed identities so Azure resources authenticate to services (Key Vault, Storage, SQL) with no stored credentials.