Microsoft AZ-800 - Administering Windows Server Hybrid Core Infrastructure

In the Administering Windows Server Hybrid Core Infrastructure materials (hybrid security and IaaS management), Just-In-Time (JIT) VM access from Microsoft Defender for Cloud is the prescribed way to require approval-based, time-bound Remote Desktop access to Azure VMs. The guide explains that JIT “locks down inbound traffic to management ports (for example, TCP/3389) and opens them only on request, for a limited time and only from approved source IPs.” Administrators request access; upon approval, Defender for Cloud creates a temporary NSG rule that expires automatically—you specify the maximum allowed window (e.g., 2 hours) and the ports. This matches the requirement: “Ensure that server administ rators request approval before they can establish a Remote Desktop connection to an Azure virtual machine. If the request is approved, the connection must be established within two hours.” Alternatives don’t meet this: PIM governs Azure roles, not VM RDP port exposure; Azure Bastion provides secure RDP/SSH over TLS without public IPs but doesn’t provide approval/time-boxed gating; the Remote Desktop extension is for classic Cloud Services and not for policy-driven approval windows. JIT is the least-privilege, policy-enforced solution aligned with the exam’s hybrid security objectives.

In the Administering Windows Server Hybrid Core Infrastructure guidance for extending AD DS into Azure, Microsoft states that when you place a domain controller in an Azure virtual network you must run DNS on that domain controller and point the VNet to that DNS server: “Domain controllers in Azure IaaS should host the AD-integrated DNS zone, and the virtual network’s DNS server setting must reference those DC/DNS IPs so Azure VMs use AD DNS rat her than the Azure-provided resolver.” The materials also emphasize that Azure’s default DNS cannot host or manage AD DS zones, so custom DNS is required for domain-joined workloads. Therefore, to meet the requirement you (1) install the DNS Server role on DC3 so it can host the corp.fabrikam.com AD-integrated zone (F), and (2) configure the DNS Servers setting on Vnet1 to the IP of DC3 (and any additional DCs), ensuring all Azure VMs in Vnet1 resolve the domain via AD DNS (D). Creating a public Azure DNS zone or a Private DNS zone with the same AD name is not appropriate for AD-integrated name resolution. This design also supports the security requirement of preventing domain controllers from relying on Internet-facing resolvers.

In Administering Windows Server Hybrid Core Infrastructure , Microsoft states that high availability for DHCP on Windows Server is achieved by using DHCP failover rather than the legacy split-scope (80/20) model. The guidan ce explains that DHCP failover “ synchronizes lease data between two DHCP servers and can be configured in Load Balance or Hot Standby mode on a per-scope basis,” and that you enable it on each DHCP scope to create a partner relationship that automatically replicates scope configuration and active leases. This meets the requirement to keep address assignment available if one DHCP server is down.

The same materials further note that DHCP broadcasts do not traverse routers; therefore, when the partner server i s reachable across a routed boundary (another site/subnet) , you must configure the router as a DHCP relay (IP helper) to forward DHCPDISCOVER messages to the remote DHCP server(s). The text emphasizes: “When clients and DHCP servers are on different subnet s, configure a relay agent on the router to forward requests to the DHCP server IP addresses.”

Applying this to Fabrikam: create DHCP failover between DHCP1 (Scope1) and DHCP2 (Scope2) ( E ) and configure the routers in New York and Seattle as DHCP relays th at forward to both DHCP servers ( B ). You do not use Failover Clustering for DHCP here, and you do not create extra 25% scopes; those are split-scope practices superseded by DHCP failover.

The exam content for Group Policy processing stresses User Group Policy loopback processing for session hosts (RDS/AVD): “In environments like Remote Desktop Session Host (or Azure Virtual Desktop), enable loopback processing on the OU that contains the session host computers so that user settings from that GPO apply when users log on to those computers, regardless of the user’s own OU.” The requirement states: “Apply GPO4 to the Azure Virtual Desktop session hosts. Ensure that Azure Virtual D esktop user sessions lock after being idle for 10 minutes. Users must be able to control the lockout time manually from their client computer.” The idle-lock is a user configuration setting that must apply when users sign in to the session hosts, not to their personal devices. Therefore, enable loopback processing (Merge/Replace) in GPO4, which is linked to the VirtualDesktops OU containing the session hosts. Using security filtering or Enforced cannot make user settings in GPO4 override the user’s own OU without loopback. Loopback ensures the AVD hosts impose the 10-minute lock for sessions, while leaving users free to set their own client device policies independently—fulfilling least-impact design.

The Administering Windows Server Hybrid Core Infrastructure materials explain that Azure AD Password Protection for on-premises AD uses two components : the DC agent and the proxy service . The DC agent is installed on every domain controller because it “ intercepts password set/change operations locally on the DC and evaluates them against the forbidden-password policy .” The guidance further states that to ensure consistent enforcement “ the DC agent should be deployed to all DCs in the forest, since password changes may occur on any DC .” The proxy service is installed on member servers (not necessarily DCs) and “ relays policy downloads and telemetry to Azure AD on behalf of DCs ,” which satisfies envi ronments where “ domain controllers must not directly contact Internet endpoints .” Finally, configuration of the global and custom banned password lists is performed in Azure AD , where administrators “ define tenant-wide custom banned terms; DCs obtain the p olicy via the proxy and cache it for local enforcement .”

Given Fabrikam’s requirement to prevent DCs from accessing the Internet, the proxy must run on non-DC servers ( VM1 and VM2 ). To guarantee enforcement wherever a password is changed, the DC agent must be on all domain controllers . The custom banned password list is configured in the Azure AD tenant and then distributed to on-premises DCs via the proxy.

The exam materials explain that to add a new domain controller to an existing AD DS forest in Azure, you deploy a Windows Server IaaS VM and then promote it: “To extend on-premises AD DS into Azure, provision a Windows Server VM in Azure and run AD DS to create an additional domain controll er for the existing domain.” Conversely, Azure Active Directory Domain Services (Azure AD DS) provides a managed domain that is separate from and not writable by your on-premises administrators —you “do not get domain admin rights or access to DCs” —so it cannot be used to add a DC (dc3.corp.fabrikam.com) to the existing corp.fabrikam.com forest. Azure AD Application Proxy and Azure AD administrative units are unrelated to deploying DCs. Therefore, the correct implementation is to deploy an Azure virtual machine in Vnet1, install AD DS/DNS, and promote it to become DC3 in the existing domain.

< Step 1: Install the Remote Access role.

Step 2: Import the AD FS certificate to Server2.

Step 3: Run the Web Application Proxy Configuration Wizard.

In Administering Windows Server Hybrid Core Infrastructure , the Web Application Proxy (WAP) component is documented as a role service of the Remote Access role and is deployed on an edge or perimeter server to publish AD FS and other web apps. The guide states that before configuring WAP, you must install the Remote Access role with the Web Application Proxy role service on the proxy server. It further explains that WAP must establish trust with the existing AD FS farm by using the AD FS service communications certificate: “Import the federation service SSL certificate (with private key) on the proxy server and place it in the local computer’s personal store.” After the certificate is present, you run the Web Application Proxy Configuration Wizard to “specify the Federation Service name, provide AD FS credentials, and complete the trust and configuration.” The materials also clarify that you do not install the AD FS role on the proxy and Microsoft Application Request Routing (ARR) is not required for WAP. The AD FS Configuration Wizard applies to federation servers, not proxies. Therefore, the minimal and correct sequence on Server2 is: Install Remote Access (WAP) → Import the AD FS cert → Run the Web Application Proxy Configuration Wizard, which configures the trust and enables publishing of the AD FS endpoint.

In the Administering Windows Server Hybrid Core Infrastructure guidance for name resolution with Azure Private DNS, Microsoft describes the split-horizon scenario where you host contoso.com both as a Public DNS zone and as an Azure Private DNS zone linked to a virtual network. The documentation explains that Azure Private DNS “is resolvable only from within the VNet” and that the special Azure DNS virtual IP 168.63.129.16 is the target used by workloads inside the VNet to resolve private zone records. For hybrid resolution from on-premises, the guidance states that you deploy a DNS forwarder/proxy VM in the VNet (a Windows Server DNS role is acceptable) and configure it with a conditional forwarder for the private zone that forwards to 168.63.129.16. Then, on the on-premises DNS servers, you create a conditional forwarder for the same zone that points to the DNS forwarder VM in Azure across the Site-to-Site VPN. This pattern ensures on-premises queries for contoso.com resolve the private zone records via Azure, while public Internet clients continue to use the public DNS zone. Consequently:

On VNet1, VM1 (DNS server) must forward contoso.com queries to 168.63.129.16.

On the on-premises DNS, configure a conditional forwarder for contoso.com to VM1. Setting VNet DNS to the Azure-provided IP is unnecessary (it’s the default for Azure VMs) and forwarding to the public zone would bypass the private zone, which is not desired.

In Administering Windows Server Hybrid Core Infrastructure , the operations that affect forest-wide naming contexts are tied to specific FSMO roles. The material explains that AD DS contains five FSMO roles— Schema Master, Domain Naming Mast er, RID Master, PDC Emulator, and Infrastructure Master —and each governs a unique set of authoritative changes. The course notes state:

“ The Domain Naming Master is responsible for all changes to the forest namespace. This includes adding and removing doma ins and application directory partitions (also called application naming contexts) . Because these operations change the forest-wide naming structure, the Domain Naming Master must be online and reachable to perform them.”

It further emphasizes:

“Creation o r deletion of application partitions is a forest-scoped operation. Only the Domain Naming Master can process these updates to ensure single-master consistency of the forest’s name context metadata.”

By contrast, the Schema Master controls schema updates, t he RID Master allocates RID pools, the PDC Emulator provides time sync and password update precedence, and the Infrastructure Master maintains cross-domain reference updates. None of these roles can substitute for the Do main Naming Master when creating app lication partitions. Therefore, if DC1 (which holds the Domain naming master role) fails, you cannot create new application partitions until that role holder is restored or the role is transferred/seized to another domain controller.