Azure interview questions for freshers focus on core cloud concepts, the Azure resource hierarchy, compute, storage, networking, identity with Microsoft Entra ID, and basic cost and security practices. Below are 30 questions that come up often in fresher and junior cloud interviews, with short answers and a few Azure CLI commands you can run yourself.
Key takeaways
- Know the Azure hierarchy from management groups to subscriptions, resource groups and resources.
- Be able to compare Virtual Machines, App Service, Azure Functions and AKS and say when to use each.
- Understand the storage redundancy options LRS, ZRS, GRS and GZRS and what each protects against.
- Microsoft Entra ID handles identity, while Azure RBAC controls what a signed-in identity can do with resources.
- Practise with the Azure CLI on a free account, because interviewers often ask what you built.
Use these answers to revise, not to memorise. Interviewers usually follow up with a small scenario, so try each service in the portal or the CLI. If you are deciding between platforms, our AWS vs Azure vs Google Cloud comparison explains how they differ, and our AWS interview questions cover the same ideas from the AWS side.
Cloud and Azure basics
1. What is Microsoft Azure?
Azure is Microsoft's public cloud platform. It offers compute, storage, networking, databases, analytics, AI and identity services that you rent on demand and pay for based on usage.
2. What are IaaS, PaaS and SaaS? Give Azure examples.
IaaS gives you raw infrastructure that you manage, such as Azure Virtual Machines. PaaS gives you a managed platform where you deploy code, such as Azure App Service or Azure SQL Database. SaaS is finished software you simply use, such as Microsoft 365.
3. What is the shared responsibility model?
Microsoft secures the physical data centres, hardware and the underlying platform. You secure what you put on it: data, identities, access settings and, for IaaS, the operating system and applications. The more managed the service, the less you are responsible for.
4. What are regions, region pairs and availability zones?
A region is a set of data centres in one geographic area, such as Central India. Many regions are paired with another region for disaster recovery. Availability zones are physically separate locations within a region with their own power, cooling and networking, so spreading resources across zones protects you from a single data centre failure.
5. Explain the Azure resource hierarchy.
Management groups contain subscriptions. A subscription is a billing and access boundary. Resource groups inside a subscription hold related resources, such as all the parts of one application. Policies and access assigned at a higher level are inherited below.
6. What is a resource group and why does it matter?
A resource group is a logical container for resources that share a lifecycle. You can deploy, monitor, assign access to and delete them together. Deleting a resource group deletes everything in it, which is useful for test environments and dangerous in production.
7. What is Azure Resource Manager?
Azure Resource Manager (ARM) is the deployment and management layer behind the portal, CLI, PowerShell and SDKs. Every request goes through it, which is why access control, tags, locks and policies work the same way whatever tool you use.
Compute
8. When would you choose a Virtual Machine?
Choose a VM when you need full control of the operating system, have legacy software that cannot be containerised, or need specific installed agents. You are responsible for patching and scaling it.
az group create --name rg-demo --location centralindia
az vm create --resource-group rg-demo --name vm-web01 --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys9. What are Virtual Machine Scale Sets?
Scale Sets run a group of identical VMs that can scale out and in automatically based on metrics or a schedule, usually behind a load balancer.
10. What is Azure App Service?
App Service is a PaaS for hosting web apps and APIs in languages such as .NET, Java, Node.js and Python. Microsoft manages the servers. You get deployment slots, custom domains, TLS certificates and autoscale without managing an operating system.
11. What are Azure Functions?
Azure Functions is a serverless service that runs small pieces of code in response to triggers such as HTTP requests, queue messages, timers or blob uploads. On consumption-based plans you pay mainly for executions rather than idle servers.
12. What is AKS?
Azure Kubernetes Service is a managed Kubernetes service. Azure runs the control plane and you manage node pools and workloads. Choose it when you already run containers and need Kubernetes features such as rolling updates and service discovery.
13. What are deployment slots in App Service?
Slots are live copies of your app, such as staging and production, with their own URLs. You deploy to staging, test it, then swap it with production, which gives near-zero downtime and an easy rollback by swapping back.
Storage and databases
14. What services does an Azure Storage account provide?
Blob storage for objects such as images and backups, Azure Files for SMB or NFS file shares, Queue storage for simple messaging and Table storage for key-value data.
15. What are the blob access tiers?
Hot is for frequently accessed data, Cool and Cold are for data read less often with lower storage cost but higher access cost, and Archive is the cheapest for data that is rarely read and must be rehydrated before use. Check the official pricing page for current minimum storage durations.
16. Explain LRS, ZRS, GRS and GZRS.
| Option | Copies kept | Protects against |
|---|---|---|
| LRS | Three copies in one data centre | Disk or server failure |
| ZRS | Three copies across availability zones | Loss of one data centre in a region |
| GRS | LRS plus a copy in the paired region | Loss of a whole region |
| GZRS | ZRS plus a copy in the paired region | Zone failure and region failure |
17. What is the difference between Azure SQL Database and Cosmos DB?
Azure SQL Database is a managed relational database based on SQL Server, suited to structured data with joins and transactions. Cosmos DB is a globally distributed NoSQL database with several APIs, suited to flexible schemas and very low latency reads across regions.
18. What is a SAS token?
A shared access signature is a signed URL that grants limited, time-bound access to storage, such as read access to one blob for one hour, without sharing the account key.
Networking
19. What is a Virtual Network?
A VNet is your private network in Azure, divided into subnets. Resources in it talk to each other privately, and you control traffic in and out with network security groups, route tables and gateways.
20. What is a Network Security Group?
An NSG is a set of allow and deny rules based on source, destination, port and protocol. You attach it to a subnet or a network interface. Rules are processed by priority, lowest number first.
az network nsg rule create --resource-group rg-demo --nsg-name nsg-web --name allow-https --priority 100 --direction Inbound --access Allow --protocol Tcp --destination-port-ranges 44321. What is VNet peering?
Peering connects two VNets so their resources communicate over the Microsoft backbone using private IP addresses. Peering is not transitive by default, so A peered to B and B peered to C does not connect A to C.
22. Azure Load Balancer vs Application Gateway vs Front Door?
Load Balancer works at layer 4 (TCP and UDP) within a region. Application Gateway works at layer 7 (HTTP) within a region and supports path-based routing and a web application firewall. Front Door is a global layer 7 entry point that routes users to the nearest healthy backend.
23. What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway connects your office network to Azure over an encrypted tunnel across the public internet. ExpressRoute is a private connection through a connectivity provider that does not travel over the public internet and offers more predictable performance.
Identity, security and governance
24. What is Microsoft Entra ID?
Microsoft Entra ID, formerly called Azure Active Directory, is Microsoft's cloud identity service. It handles users, groups, sign-in, multi-factor authentication and single sign-on for Azure, Microsoft 365 and thousands of other applications.
25. What is Azure RBAC?
Role-based access control assigns a role, such as Reader, Contributor or Owner, to a user, group or identity at a scope, such as a subscription or resource group. Follow least privilege and assign roles to groups rather than individuals.
26. What is a managed identity?
A managed identity is an identity in Entra ID that Azure creates for a resource such as a VM or Function App. The resource can then get tokens to access Key Vault or Storage without any secret in code or configuration.
27. What is Azure Key Vault?
Key Vault securely stores secrets, keys and certificates. Applications read them at runtime, usually through a managed identity, so passwords and connection strings stay out of source code.
28. What is Azure Policy and how is it different from RBAC?
RBAC decides who can act. Azure Policy decides what is allowed, whoever does it, for example only allowing resources in Indian regions or requiring a cost-centre tag. Policies can deny, audit or fix non-compliant resources.
Monitoring and cost
29. What is Azure Monitor?
Azure Monitor collects metrics and logs from resources and applications. Log Analytics lets you query logs with KQL, Application Insights tracks application performance, and alerts notify you when a threshold is crossed.
30. How do you control costs in Azure?
Use Cost Management budgets and alerts, tag resources by project and owner, shut down or delete test resources, right-size VMs, choose the right storage tier, and consider reservations or savings plans for steady workloads. Check the official pricing calculator before quoting any figure.
How to prepare
- Create a free account and deploy one small app on App Service with a database and Key Vault.
- Draw the hierarchy from management group down to resource on paper and explain it aloud.
- Learn twenty Azure CLI commands well instead of skimming two hundred.
- Revise the certification path in our cloud articles if you plan to take AZ-900 or AZ-104.
Frequently asked questions
Is AZ-900 enough to get an Azure job?
On its own it rarely is. AZ-900 shows you understand cloud basics, but employers also want hands-on skills, so pair it with projects and, later, a role-based certification such as AZ-104. Check Microsoft Learn for current exam details.
Which Azure services should a fresher learn first?
Start with resource groups, Virtual Machines, Virtual Networks and NSGs, Storage accounts, App Service, Entra ID and RBAC, and Azure Monitor. These appear in almost every interview.
Are Azure interview questions different from AWS interview questions?
The concepts are the same, such as compute, storage, networking and identity, but the service names and some details differ. If you know one cloud well, learning the other takes a few weeks.
Do Azure interviews include scenario questions?
Yes. Expect questions such as how you would make a web app highly available, how you would store a database password safely, or why a VM cannot be reached on port 443.
Explore more cloud guides in our cloud computing section.
