Microsoft AZ-305: Designing Azure Infrastructure Solutions

Microsoft AZ-305, Designing Microsoft Azure Infrastructure Solutions, is the current architecture exam for Microsoft Certified: Azure Solutions Architect Expert. The English blueprint was updated on April 17, 2026. Microsoft expects candidates to design cloud and hybrid solutions across identity, governance, monitoring, data storage, business continuity, compute, networking, and infrastructure, while translating business requirements into designs aligned with the Azure Well-Architected Framework and Cloud Adoption Framework.

The Azure Solutions Architect Expert credential is not a test of how many Azure services a candidate can name. The role is about selecting services and patterns for explicit requirements, identifying tradeoffs, and anticipating how the design will be operated. That means architecture preparation should repeatedly move from requirement to constraint to decision to consequence.

Hands-on administration is still valuable. The Azure Administrator Associate foundation exposes candidates to implementation realities in identity, storage, compute, networking, and monitoring. AZ-305 builds on that practical base by asking whether the chosen implementation is the right one for availability, security, cost, performance, governance, and organizational needs.

Architecture begins by separating requirements from preferences

A stakeholder may ask for a specific service when the real requirement is lower latency, regional resiliency, private connectivity, regulatory isolation, or simpler operations. Architects should identify the underlying need before accepting a proposed implementation. The same requirement can often be met by several Azure patterns, and the design process should make the tradeoffs visible.

For each practice scenario, write functional requirements separately from nonfunctional requirements. Add constraints such as existing licenses, staff skills, migration deadlines, data residency, recovery targets, and cost ceilings. Only then choose services. This prevents study from becoming a lookup exercise in which one keyword always maps to one product.

Identity and governance should scale beyond one subscription

Enterprise designs need management groups, subscriptions, resource organization, Microsoft Entra ID, role-based access control, policy, privileged access, and operational separation to work together. An architecture should define where teams have autonomy and where central controls apply. Over-centralization can block delivery, while weak boundaries make security and cost difficult to govern.

The identity, governance, and monitoring design material is useful for testing these relationships. Design a management hierarchy for production, nonproduction, and shared services. Decide where policy is assigned, who can delegate roles, and how emergency access is handled. Then model a new business unit joining the environment and see whether the structure scales without redesigning everything.

Monitoring architecture should produce evidence for operations and security

Azure Monitor, Log Analytics, activity logs, diagnostic settings, alerts, and related services can collect large amounts of telemetry. Architecture should start with what teams need to detect, investigate, and prove. Retention, access, cost, centralization, regional considerations, and security requirements influence the logging design.

Create four operational questions: who changed a critical resource, why application latency rose, whether a regional dependency is failing, and whether a security control is being bypassed. Identify the telemetry needed to answer each question and where it should be stored. This gives monitoring architecture a purpose beyond enabling every available diagnostic category.

Data storage design depends on access patterns and recovery requirements

Azure provides relational databases, NoSQL platforms, object storage, files, caches, analytical stores, and integration services. Selecting among them requires understanding consistency, transaction needs, query patterns, global distribution, throughput, latency, retention, security, backup, and failure behavior. A service should be chosen because its characteristics fit the data, not because it is familiar.

The AZ-305 data storage design coverage can be used to decompose one application. Separate transactional records, large media, telemetry, cacheable session data, and analytical history. Define the access and recovery requirements for each. A mixed architecture is often more appropriate than forcing every data type into one platform.

Business continuity should be derived from RTO and RPO

Zone redundancy, geo-replication, backups, active-active designs, warm standby, and restore procedures solve different failure scenarios at different costs. Architects should start with recovery time objective and recovery point objective, then choose mechanisms that can meet those targets. “Highly available” is too vague to be an architecture requirement.

Use business continuity design for AZ-305 to create a failure matrix. List component failure, zone loss, regional loss, accidental deletion, and data corruption. For each, define the expected service state, data loss tolerance, recovery process, and test method. A resilient design is credible when it has a rehearsable recovery path.

Compute architecture is a tradeoff between control and managed responsibility

Virtual machines provide broad control but create patching and operational responsibilities. Managed application platforms reduce infrastructure work but impose platform constraints. Containers provide packaging and orchestration flexibility while adding cluster or platform considerations. Serverless options can simplify event-driven workloads but introduce execution and integration characteristics that must match the design.

Compare three hosting approaches for the same workload. Evaluate deployment frequency, scale pattern, state, network requirements, operating-system dependencies, team skill, recovery, and cost. Then choose one and write down what the organization is intentionally giving up. Architecture is stronger when the rejected alternatives and their tradeoffs are understood.

Network architecture should make traffic paths and trust boundaries explicit

Hub-and-spoke designs, virtual WAN, peering, private endpoints, load balancers, application gateways, firewalls, VPN, ExpressRoute, DNS, and routing can be combined in many ways. The challenge is not knowing that each service exists; it is building a topology that supports application flows, hybrid connectivity, security inspection, growth, and operations without creating unnecessary complexity.

The AZ-305 infrastructure design material can support a traffic-flow exercise. Draw client-to-application, application-to-data, administrator-to-management, and on-premises-to-Azure paths. Mark where DNS resolves, where traffic is inspected, and what changes during failover. If a path cannot be explained end to end, the design is not yet operationally clear.

Migration decisions should improve the target state, not simply move the source

Cloud migration can involve rehosting, replatforming, refactoring, replacing, retaining, or retiring workloads. The best choice depends on business value, technical debt, dependencies, time, risk, and target operating model. Moving every workload unchanged may meet a deadline while carrying unnecessary cost and operational burden into Azure.

Well-Architected thinking should expose tradeoffs instead of hiding them

Reliability, security, cost optimization, operational excellence, and performance efficiency can pull a design in different directions. More redundancy can increase cost. Stronger isolation can add network complexity. Aggressive performance targets can increase capacity. A good architect does not pretend those tensions disappear; the design documents which priorities dominate and why.

For every major decision in a practice scenario, state at least one benefit and one cost or constraint. If the design uses multiple regions, explain operational and data implications. If it chooses a managed platform, explain which low-level controls are intentionally surrendered. This habit prepares candidates for scenario questions where several technically valid designs exist but only one best fits the stated priorities.

Architecture should be validated through implementation evidence. A diagram cannot prove throughput, failover time, permission boundaries, or deployment behavior. Important assumptions should be tested with prototypes, load tests, recovery drills, policy checks, or limited implementations. Architects do not need to build every production component personally, but they should know which assumptions are risky enough to validate before committing to the design.

Take one architecture and choose three assumptions to test: network latency, database failover, and role delegation, for example. Build the smallest experiment that can confirm or challenge each assumption. If the result changes the design, record why. This feedback loop is one of the most practical ways to connect architecture theory with Azure reality.

Current AZ-305 preparation should retire legacy exam thinking. The old AZ-303 and AZ-304 exams retired in March 2022. Their material can still provide historical implementation and design context, but candidates should not use their objective structures as substitutes for the current blueprint. Azure services, recommended patterns, and Microsoft’s certification model have evolved substantially.

The AZ-104 to AZ-305 progression is a more useful current frame: know how Azure operates, then learn to turn business and technical requirements into defensible designs. Finish preparation with a capstone architecture that includes identity, governance, monitoring, data, compute, network, and recovery. Challenge it with failure, growth, cost pressure, and a migration constraint. If the design can adapt without losing its rationale, the architecture thinking is becoming exam-ready.

Cost should be treated as an architectural property throughout the design rather than calculated only after deployment. Data replication, cross-region traffic, high availability, premium service tiers, idle capacity, logging retention, and backup all create recurring cost. For a practice scenario, identify the major cost drivers and explain which are required by business objectives and which can be optimized. A cheaper design is not better if it misses the required service level, but an expensive design is not automatically more resilient.

Security decisions should also be visible in the architecture rather than assumed. Define public versus private endpoints, administrative access paths, identity boundaries, encryption and key ownership, secret handling, and where inspection or policy enforcement occurs. Then trace one privileged operation and one application data flow through the design. If the trust model cannot be explained in concrete terms, the security architecture is still incomplete.

Architecture documentation should record decisions, not only final diagrams. For a major choice such as database platform, network topology, or regional strategy, capture the requirement, alternatives considered, selected option, tradeoffs, and conditions that would trigger reconsideration. These decision records make later change easier because teams can tell whether an old choice is still valid or whether the assumptions behind it have changed.