ExamSprintLab

AZ-802 study plan: pass in 4 weeks

Updated September 29, 2026

Four weeks is realistic for AZ-802 if you already administer Windows Server and study 8–10 hours a week. Cover the seven domains in an order that builds a lab as you go: AD DS first, because every later exercise needs a domain; then remote management, Azure Arc and virtual machines; then DNS, DHCP and storage; and finally security and troubleshooting, which reuse everything before them. Without Windows Server experience, plan on eight weeks or more.

Before you start

  • Read the official study guide once, end to end. It lists every objective across the seven domains.
  • Build a lab: a Hyper-V host (or a machine that supports nested virtualization) with evaluation copies of Windows Server, plus a pay-as-you-go Azure subscription with a budget alert. Two domain controllers, two member servers and a client VM are enough.
  • Do each task once in the GUI and once in PowerShell. The exam shows cmdlets.
  • There is no official practice assessment yet. Take the sample questions cold as a baseline instead.

Week 1: AD DS (20–25%)

Goal: build and run a forest you would trust in production.

  • Domain controllers: promote DCs locally and in an Azure VM, deploy an RODC, configure its Password Replication Policy, and transfer and seize FSMO roles.
  • Multi-site and multi-forest: sites, subnets and site links, replication schedules and costs, and forest, external and shortcut trusts with selective authentication.
  • Security principals: users, groups and group scopes, managing them across domains, and choosing between standalone, group and delegated managed service accounts.
  • Group Policy: linking and processing order, enforcement and blocked inheritance, security and WMI filtering, loopback processing, the central store and Group Policy preferences with item-level targeting.

Lab: a forest with two sites, a gMSA used by a service on a member server, an RODC in the branch site with a restricted replication policy, and a GPO filtered to one security group.

Week 2: hybrid management (10–15%) and virtual machines (10–15%)

Goal: manage every server from one place and run VMs properly.

  • Remote management: Windows Admin Center on-premises and in the Azure portal, PowerShell remoting and the second-hop problem, Just Enough Administration, SSH and Remote Desktop.
  • Azure Arc: onboard servers with the Connected Machine agent, apply machine configuration through Azure Policy, deploy VM extensions, patch with Azure Update Manager, and run Azure Automation runbooks, including on a Hybrid Runbook Worker.
  • Hyper-V: Enhanced Session Mode, PowerShell Direct and SSH Direct, nested virtualization, dynamic memory, integration services, Discrete Device Assignment and GPU partitioning, checkpoints, virtual disks, virtual switches, NIC teaming and Hyper-V Replica.
  • Azure VMs: disks, resizing and scale sets, availability sets and zones, just-in-time access and Azure Bastion, and VM network settings.

Lab: Arc-enable a lab server, apply an update schedule, and deploy the Azure Monitor Agent as an extension. Replicate one Hyper-V VM to a second host and run a test failover.

Week 3: networking (10–15%) and storage (15–20%)

Goal: name resolution, addressing and files that keep working.

  • DNS: AD-integrated zones and replication scope, records, forwarders and conditional forwarders, hybrid resolution with Azure DNS Private Resolver, DNS policies and DNSSEC.
  • DHCP: scopes, options, reservations, failover in load-balance and hot-standby mode, and troubleshooting addressing in hybrid networks.
  • Azure Files and File Sync: share permissions, identity-based access, sync groups, cloud tiering, monitoring and migrating from DFS Replication.
  • Windows file services: share and NTFS permissions, FSRM quotas and file screens, DFS Namespaces and Replication, SMB over QUIC and SMB settings.
  • Storage stack: disks and volumes, Storage Spaces and Storage Spaces Direct, Storage Replica, Data Deduplication, SMB Direct, Storage QoS, NTFS versus ReFS, iSCSI and BitLocker.

Lab: a DHCP failover pair, a conditional forwarder to an Azure private zone through a resolver, a DFS namespace with two targets, and a file server syncing to Azure Files with cloud tiering on.

Week 4: security (10–15%), monitoring and troubleshooting (15–20%), and review

Goal: harden what you built, then break it and fix it.

  • OS security: exploit protection, App Control for Business, Credential Guard, SmartScreen, security baselines with OSConfig, Windows LAPS, Defender for Servers, and Windows Firewall with connection security rules.
  • AD DS security: password policies and fine-grained password policies, Entra Password Protection, Protected Users, DC hardening and access restrictions, delegation, and authentication protocols.
  • Monitoring: Performance Monitor and data collector sets, Windows Admin Center alerts, System Insights, event logs, data collection rules, Azure Monitor alerts and VM insights.
  • Troubleshooting: connectivity, name resolution, Windows Update, the Time service, performance, extensions, encryption, storage, and Active Directory: the Recycle Bin, DSRM, SYSVOL, replication, Kerberos and secure channels.

Review: take the free 20-question practice test mid-week. Spend the remaining days on the lowest-scoring domain, using its guide in this section.

If you studied for AZ-800 or AZ-801

Skip what you know and cut what AZ-802 dropped: containers, migration, clustering, Azure Backup and Site Recovery, and Entra Connect. Former AZ-800 candidates should spend the saved time on security and AD troubleshooting; former AZ-801 candidates on Hyper-V, DNS, DHCP and file services. AZ-802 vs AZ-800 and AZ-801 lists the differences.

How to know you are ready

  • You can say which FSMO role a symptom points to, and how to move or seize it.
  • You can explain the second-hop problem and name two ways to solve it.
  • You can pick the right tool for a hybrid task: Windows Admin Center, Arc, Update Manager or a runbook.
  • You can recover a deleted user with and without the AD Recycle Bin.
  • You score 80% or more on realistic practice questions twice in a row, on different question sets.

Then book it. See the exam format for the mechanics and the exam day guide for the day itself.