To successfully follow along and complete tasks and exercises throughout this book, you will need to first gain access to an Azure Active Directory (Azure AD) tenant. Establishing this access can be accomplished by getting a trial subscription of Microsoft 365. Advanced topics throughout this book will require an Azure AD Premium license and may require the purchase of features or services in a Microsoft Azure pay-as-you-go subscription to complete the exercises.

In addition, you will need to establish a Hyper-V lab. This can be accomplished by ensuring your desktop/laptop meets the Hyper-V system requirements, as well as completing setup and configuration for the device. The detailed steps to establish both the Microsoft 365 trial subscription and the Hyper-V lab requirements will be covered later in this chapter.

Microsoft certification exams follow a role-based approach, with a focus on areas of tech based on either your current role or a role that you would like to pursue. Two incredible resources that can be used to plan both your certification path as well as your career progression are found at the following links:

• https://aka.ms/RoleBasedCerts
• https://aka.ms/TrainCertPoster

There is a multitude of ways to prepare for any Microsoft exam and each of us approaches this differently, from hands-on learning, microlearning, and reading books to taking practice evaluations or instructor-led courses to help grow our current skillsets. I recommend the following three-step process for preparing for Microsoft exams, so let’s review the steps together.

Step 1 – Reviewing the exam skills outline

When any new Microsoft certification exams are published to the public, one of the first questions I ask myself is is this exam right for me and my career? Starting with the exam page for the exam you are pursuing, you will quickly find details at the top of the page indicating what skills and expertise you should have or want to gain. Let’s start by reviewing the details for the AZ-801 exam together by navigating to the following link: https://docs.microsoft.com/learn/certifications/exams/az-801.

This screenshot shows the details for the AZ-801 Microsoft certification exam:

Figure 1.1 – Exam AZ-801 overview page

This AZ-801 exam is a part of the requirements for the Microsoft Certified: Windows Server Hybrid Administrator Associate certification, and it requires a related AZ-800 exam to achieve the Associate certification. Note that we will focus only on the exam objectives of the AZ-801 exam.

Step 2 – Review the skills measured and practice to improve your skills

As you continue to scroll down the exam page, you will find the Skills Measured section, giving the exam participant an overall view of what high-level skills are being validated. Each objective shown in the following screenshot is weighted on a scale and, depending on the type of question, may span multiple objectives in the same question:

Figure 1.2 – Exam AZ-801 skills measured

Step 3 – Identify additional learning materials

Scrolling further down on the exam page for AZ-801, you will find an additional section that provides two ways to prepare for your exam – online (free) learning through Microsoft Learn and instructor-led (paid) learning. These two separate resources provide great value, depending on the level of effort you are willing to put forth or spend on additional professionally moderated training:

Figure 1.3 – Online versus instructor-led learning for the AZ-801 exam

The next section will provide additional details and guidance on free resources provided by Microsoft to prepare you for your exam experience, as well as any supplemental content.

Exam format and exam demo experience

Microsoft certification exams have recently released an online exam demonstration experience to be more inclusive and help reduce the anxieties of preparing for and sitting an exam. This new online experience gives the exam candidate a real-world look into the type of exam questions that appear and gives the candidate a feel for how the questions work and function. Let’s take a closer look by visiting the following URL: https://aka.ms/examdemo.

Microsoft certification exams comprise the following types of questions:

• Multiple choice questions contain multiple answer choices and have only one correct answer. These types of questions may have several varieties and may appear to you as part of a series or a set.
• Multiple choice, multiple select questions require one or more selections and indicate how many answers to select for providing the answer.
• Drag and drop questions may include text, graphics, or code. Interacting with these questions requires you to drag or move objects to target locations in the answer area. One, many, or all of the available answers may be used to successfully complete these questions.
• Build, list, reorder questions contain a list of movable actions or answer choices that must be arranged in the correct order in the answer area. Again, one, many, or all of the available answers may be used to successfully complete these questions.
• Active screen questions contain interactive screen elements such as menus, option buttons, or boxes to select. Several variations of these questions include selecting a drop-down element to complete a statement or section of code, or changing the up/down arrows to increase or decrease the answer value.
• Hot area questions contain one or multiple clickable areas where the selections represent the correct answer. Think of these questions as an interactive screen, menu, or configuration page where you actively select the correct actions.
• The preceding question types may be grouped into a case study. You will need to answer questions based on case information, which can be reviewed from the left-side menu option, and will typically contain an overview, environment details, and requirements section.
• Exhibit questions typically contain a screenshot, design document, or configuration page where you need to review and identify either a problem or a resolution to the question. Exhibit questions may also have multiple exhibit tabs, so you must select each tab to review all the presented material to correctly answer the question.
• True/false and best-answer scenario questions will really test your understanding and mastery of the exam content. These are typically delivered in a sequence with no option of navigating back to a previous question. The question will be providing you with a specific scenario, asking you whether the recommended answer appropriately solves the question or issue presented.

For an additional review of exam features, visit the following URL: https://aka.ms/ExamFeatures. The next section will cover how to best utilize Microsoft Learn for any supplemental experience in addition to this book.

Microsoft Learn combined with Microsoft Docs provides an enormous amount of free content and value to help you prepare for both the exam and your career progression.

Let’s begin by reviewing how to access Microsoft Learn and locate learning paths directed at the AZ-801 exam candidates. Accessing Microsoft Learn can be done through the following link: https://aka.ms/learn. Creating a free account can be accomplished by clicking the Sign in link, as shown in the following screenshot:

Figure 1.4 – Microsoft Learn website sign in

After selecting Sign in, you have the option of creating a new account if you do not already have one, or using an existing account as seen here:

Figure 1.5 – Creating a new Microsoft account or using an existing Microsoft account for Microsoft Learn

Selecting the following link will quickly take you to a curated Microsoft Learn learning path that covers both the AZ-800 and AZ-801 exams: https://aka.ms/AzureLearn_WindowsServerHybridAdmin.

Where and when to take the exam

The classic IT answer comes to mind when people ask where and when they should take the exam – it depends! When you feel that you have successfully mastered the skills based on the exam outline and have finished the exercises and materials in this book, it would be a good time to consider scheduling the exam. You can take the exam either at a proctored exam site near you or remotely from your home or office.

Both options have their pros and cons, depending on the comfort level of the exam candidate. There are some important preparations that need to occur from a remote proctor’s perspective before considering scheduling this exam to be taken at your home or office. Let’s review the steps together to prepare for a remote proctor.

Your device must meet the requirements of having a webcam, a microphone, speakers, and a stable internet connection (wired is preferred). You will also need to stop or disable any software that is unnecessarily running on your device (for instance, PowerToys, screen capture tools, VPN software, and other productivity tools). You will need a mobile device to complete a remote check-in process, which involves taking photos of your form of identification, as well as the surrounding area in which you will be taking the exam. Your work area and walls must be relatively free of any pictures, papers, pens, phones, and books. A word of caution – you will need to remain quiet and stay within the frame of the camera throughout the exam so as not to risk disqualification from the exam attempt.

Microsoft offers trial subscriptions for both Microsoft 365 and Microsoft Azure, and this is arguably one of the best ways to get hands-on experience with Microsoft products before implementing them in a customer or business environment. This also gives you the advantage of being more marketable and advances your career by giving you skillsets that prospective employers are seeking in an ever-evolving world.

To follow along with the labs and exercises in this book surrounding Microsoft 365 and Microsoft Azure, we must first establish a subscription to both Microsoft 365 and Microsoft Azure AD Premium to learn about the advanced enterprise-licensed features within the exam objectives. The following steps will help you create 30-day trials to help get you started:

1. Navigate to https://www.microsoft.com/microsoft-365/enterprise/compare-office-365-plans and select the Try for free option under the Office 365 E5 licensing plan, as shown in the following screenshot:

Figure 1.6 – Selecting an Office 365 E5 trial subscription

2. Complete the walk-through to either create an account or utilize a different email address to create a free trial:

Figure 1.7 – Utilizing a new or existing account to establish a free trial

3. Once you have completed all the necessary steps to create your new Microsoft 365 and Microsoft Azure tenant, you will have access to the initial Microsoft 365 services. We will need to complete additional steps for an additional license to gain all the Microsoft 365 and Microsoft Azure services necessary to follow along with this book and complete the exercises.

We will also need to access an Azure AD Premium license for all the advanced identity and security features that we are reviewing in the exam objectives and in this book. We will navigate to https://www.microsoft.com/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing:

Figure 1.8 – Signing up for Enterprise Mobility + Security E5

4. As we are adding this license to the Microsoft 365 E5 services we just set up, you will want to use the same email address that you used to establish the Office 365 E5 subscription in the following example:

Figure 1.9 – Signing up for Enterprise Mobility + Security E5, continued

We now have all the Microsoft 365 and Microsoft Azure services necessary to follow along with this book and complete the exercises. The next section will provide steps to build out a local Hyper-V lab so that we have everything we need for our hands-on experience and exam preparation based on the exam objectives.

Hyper-V can be enabled in numerous ways on a Windows 10/11 operating system. With Hyper-V features built into Windows, this becomes an easy task to complete with only minor configuration changes needed. We will be running Hyper-V inside of a nested virtualization environment, and deeper details on this approach can be found at https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization.

For the most straightforward and repeatable approach, we will be using instructions that help you enable Hyper-V using the Windows PowerShell method. Let’s begin the configuration using the following steps:

1. We must first validate that the device we are using meets the following hardware requirements:
   • The operating system must be running either Windows 10 or Windows 11 Enterprise, Pro, or Education versions; Windows Server (version 2012 R2 or later) can also be used
   • The installed 64-bit processor (either AMD or Intel) supports Second Level Address Translation (SLAT)
   • The installed CPU supports the VM Monitor Mode Extension (called VT-x on Intel-based CPUs)
   • A minimum of 4 GB of memory installed

Important note

Virtual machines share memory with the Hyper-V host computing environment, so you will need enough memory to handle the workload for these labs. We recommend at least 8 GB of memory to successfully complete the lab exercises in this book.

• The following configurations will need to be enabled in the system BIOS (each manufacturer will have a slightly different way to enter the boot/BIOS configuration menus, so it is best to search for and identify configuration instructions pertaining to your specific device model):
  • A feature called Virtualization Technology (each motherboard manufacturer may have a different label for this, e.g., Intel ® Virtualization Technology or Intel VT-d where appropriate)
  • A feature called Hardware Enforced Data Execution Prevention

2. Once the above requirements are met, we can continue with the setup of the intended device by opening Windows PowerShell as an administrator. This can be done by opening the Windows start menu, typing PowerShell, and then right-clicking on the entry and selecting Run as Administrator. You may need to select Yes to accept the user account control popup to continue.
3. Enter the systeminfo command and hit Enter to run the command:
   • At the bottom of the returned result set, if you receive the message shown in Figure 1.10 saying A hypervisor has been detected. Features required for Hyper-V will not be displayed, then you already have Hyper-V installed and can skip to Step 6 to continue network switch configuration for our Hyper-V lab:

Figure 1.10 – Hyper-V requirements indicating that a hypervisor has been detected

• At the bottom of the result set returned, if you receive a list of four requirements as shown in Figure 1.11, confirm that all requirements result in a Yes response validating that all requirements for Hyper-V have been met on this device:

Figure 1.11 – Hyper-V requirements indicating that a hypervisor has not been detected

4. Reusing the already open administrative Windows PowerShell, enter the following command to enable the Hyper-V components on your device:

   Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

Important – when using Windows Server for your Hyper-V lab

If you choose to use Window Server as your operating system for this Hyper-V lab environment, you can utilize the following command to install both Hyper-V and the Hyper-V Management Console for use on Windows Server:

Install-WindowsFeature -Name Hyper-V -IncludeManagementTools

5. When you are prompted to reboot the device, please choose Yes. Note that you may be required to reboot the device multiple times to complete the setup and configuration.
6. If this is the first time you have installed Hyper-V on this device, you can proceed to Step 7:
   • If you are unsure or have an existing virtual switch configured, reuse the already open administrative Windows PowerShell and enter the following command:

     Get-VMSwitch

   • Carefully review the results returned, per Figure 1.12, to determine whether any of the existing virtual switches have a SwitchType value of External:

Figure 1.12 – Running the Get-VMSwitch PowerShell command to determine the existing virtual switches

• Capture the name of the existing virtual switch that has a SwitchType value of External – we will use this later in multiple important configuration changes in Step 9 that are specific to your configuration. Please skip to Step 9 to continue our configuration.

7. Next, we will determine the network adapter for the device that you will utilize for connecting to the internet. Reusing the already open administrative Windows PowerShell, enter the following command and review the results returned in Figure 1.13:

   (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name

Issuing the previous Get-NetAdapter command will present the results shown in Figure 1.13:

Figure 1.13 – Running a PowerShell command to determine a network adapter connected to the internet

The results in your open Windows PowerShell instance should successfully identify the name of the current network interface you are using for your internet connection on this device. Verify that this is the interface that you want to use for this lab setup.

Optional – If you intend to use another network interface for this internet connection, enter the following command in Windows PowerShell and review the results returned in Figure 1.14:

Figure 1.14 – Running a PowerShell command to determine a network adapter connected to the internet

In the preceding instance, NetAdapterName was identified as Ethernet 12, but we may want to use Ethernet 14 instead. In this case, we will update the following command to be used later in Step 9:

New-VMSwitch -Name AZ801PacktLabExternal -AllowManagementOS $true -NetAdapterName Ethernet 14

8. Visit https://www.microsoft.com/evalcenter/evaluate-windows-server-2022-preview to download an evaluation copy of Windows Server 2022. The following steps will help you ensure that the newly downloaded evaluation software is safely unblocked for use on your system:
   • Once the ISO file has finished downloading, you will need to rename the ISO to Server2022.iso for our scripted lab deployment.
   • Locate and right-click on the newly downloaded file and select Properties. In the properties, click the General tab near the bottom. There is a security section where you will select the checkbox for Unblock. Select OK to continue:

Figure 1.15 – Unblocking a recently downloaded ISO image file for use in our lab

• Copy the downloaded file into C:\AZ801PacktLab\iso.

9. Use PowerShell to create a demo VM:
   • We will be utilizing the following PowerShell script to automatically build out all required network, disk, and virtual machine requirements for our AZ-801 local Hyper-V lab (this script is also located at https://github.com/cgill/Books/blob/main/AZ-801/CH1/CH1-BuildHVLab.ps1 for a copy-paste approach):

mkdir C:\AZ801PacktLab
Set-Location C:\AZ801PacktLab
$VMName='AZ801PacktLab-DC-01','AZ801PacktLab-HV-01','AZ801PacktLab-HV-02','AZ801PacktLab-FS-01'
$VMExternalSwitch='AZ801PacktLabExternal'
$VMInternalSwitch='AZ801PacktLabInternal'
$VMIso='c:\AZ801PacktLab\iso\Server2022.iso'
New-VMSwitch -Name $VMExternalSwitch -AllowManagementOS $true -NetAdapterName (Get-NetAdapter | Where-Object {$_.Status -eq "Up" -and !$_.Virtual}).Name
New-VMSwitch -name $VMInternalSwitch -SwitchType Internal
Foreach ($VM in $VMName) {
    New-VM -Name $VM -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath ".\VMs\$VM.vhdx" -Path .\VMData -NewVHDSizeBytes 40GB -Generation 2 -Switch $VMInternalSwitch
    if($VM -match '-HV-') {
        Set-VMProcessor -VMName $VM -ExposeVirtualizationExtensions $true
        Set-VMMemory -VMName $VM -DynamicMemoryEnabled $false
        Get-VMNetworkAdapter -VMName $VM | Set-VMNetworkAdapter -MacAddressSpoofing On
    }
    Add-VMScsiController -VMName $VM
    Add-VMDvdDrive -Path $VMIso -VMName $VM -ControllerNumber 1 -ControllerLocation 0
    $VMDvd = Get-VMDvdDrive -VMName $VM
    Set-VMFirmware -VMName $VM -FirstBootDevice $VMDvd
    Set-VMKeyProtector -NewLocalKeyProtector -VMName $VM
    Enable-VMTPM -VMName $VM
}

Hyper-V switch management and pre-existing virtual switches

Please note that if you have already been using Hyper-V on the device where you intend to build our lab environment, you will want to consider either removing your existing Hyper-V external switch or making the necessary script adjustments for the existing virtual switch name in your configuration.

Now that we have created all of the necessary virtual machines, we will need to install the Windows Server 2022 operating system on all of our virtual machines. Let’s begin the configuration using the following steps:

1. Install Windows Server 2022 on the VM:
   • Open the Windows Start menu and search for Hyper-V Manager, then select Open. You will be presented with a list of virtual machines that we have previously created via a script.
   • Connect to one of our four virtual machines by right-clicking and selecting Connect…, as displayed in the following screenshot:

Figure 1.16 – Selecting a virtual machine to start in Hyper-V Manager

• From the Virtual Machine Connection window, we can either select the Start button in the center of the screen or select the green Start button in the taskbar at the top of the screen:

Figure 1.17 – Starting a virtual machine inside of the Virtual Machine Connection console

2. Ensure that you press a key inside Virtual Machine Connection to begin the operating system’s installation quickly after the virtual machine boots. If you do not receive a Microsoft Server Operating System Setup screen, you will need to reset the VM and attempt to boot into the DVD again to begin the installation.
3. In Microsoft Server Operating System Setup, select Next to continue:

Figure 1.18 – Starting the Microsoft Server 2022 operating system setup

4. On the following page, select Install Now:

Figure 1.19 – Continuing the Windows Server 2022 operating system installation

5. In Activate Microsoft Server Operating System Setup, select I don’t have a product key to continue our installation as shown in the following screenshot. Please note that these evaluation virtual machines will have 180 days before they are no longer licensed under the evaluation period:

Figure 1.20 – Selecting to use an evaluation version in the Windows Server 2022 installation

6. On the Select the operating system you want to install screen, change your selection to Windows Server 2022 Datacenter (Desktop Experience), and select Next to continue:

Figure 1.21 – Selecting to install the Windows Server 2022 Datacenter (Desktop Experience)

7. On the Applicable notices and license terms page, select I accept… and then select Next to continue:

Figure 1.22 – Accepting the Microsoft Software license terms

8. On the Which type of installation do you want? page, select Custom: Install Microsoft Server Operating System only (advanced) as shown in the following screenshot:

Figure 1.23 – Selecting Custom: Install Microsoft Server Operating System only (advanced)

9. Select Next on the Where do you want to install the operating system? page:

Figure 1.24 – Installing the operating system on the available disk

10. Monitor the Status page to confirm that the installation succeeds:

Figure 1.25 – Installing Microsoft Server Operating System

11. After the virtual machine reboots a few times, you will return to the Customize settings screen and be prompted for an administrator passcode. We recommend you use Packtaz801guiderocks as a passcode for all your lab virtual machines. You may also create your own passcode for these lab machines; just be sure to record the passcode in a password keeper for later use in the lab exercises:

Figure 1.26 – Setting a new password for the administrator account

12. When prompted to adjust the display configuration, choose an appropriate resolution for your virtual machine, and then select Connect, as shown in the following screenshot:

Figure 1.27 – Adjusting the display configuration of the virtual machine

13. Power down the virtual machine.
14. Repeat the preceding steps for each of the four virtual machines within Hyper-V Manager to complete the lab setup.

This concludes the initial Hyper-V lab setup for use throughout the rest of the book and will position you for success throughout all the lab exercises. There will be some additional steps needed throughout the following chapters in this book, and these steps will be detailed in the technical requirements at the beginning of each chapter.

This is a very broad and deep exam covering the administration, design, and security surrounding on-premises workloads, hybrid workloads and services, and cloud-native applications and infrastructure. This book will cover the specific objectives of the exam guide and outline, while reinforcing hands-on skills in addition to reading and general exercises.

The objectives covered in the AZ-801 exam are listed in the following table:

Table 1.1 – Overall exam objectives

A more complete exam skills outline that covers these objectives in greater detail can be found at https://aka.ms/az-801examguide. Taking and reviewing this comprehensive exam skills outline allows you to review areas of comfort, while also helping to identify and highlight areas of improvement prior to you sitting the exam.

This exam is intended for cloud and data center management administrators and engineers, enterprise architects, Microsoft 365 administrators, network engineers, and anyone seeking to gain additional working knowledge with Windows Server operating systems and managing on-premises, hybrid, and cloud workloads with administrative tools.

Every business has a customized set of goals to achieve, no matter the size or business strategy, and they are all vying to create their cloud transformation vision to achieve their initiatives with minimal disruption to the current business model. Building and translating the organization’s existing digital estate and goals into a cloud adoption framework takes time and must involve every aspect of the business, including processes, procedures, current management frameworks, upskilling, operational support, and most importantly – your business culture.

In the following section, we will learn about current cloud trends. We will define each of the on-premises, hybrid, and cloud-native infrastructure models, and will discuss key factors in determining an organization’s path to the cloud.

Identifying current hybrid cloud trends

In an ever-expanding digital world for businesses, cloud adoption has blossomed over the past few years and is showing no signs of slowing down; new and creative trends in utilization appear almost overnight. Businesses have hundreds or thousands of servers, applications, and digital resources and most organizations are combining their use of both private and public clouds to embrace a multi-cloud approach with this increasing cloud acceleration. Let’s define what each of the infrastructure types brings to the business, and debate whether there is a one-size-fits-all approach to cloud transformation and adoption.

Defining on-premises infrastructure

The term on-premises infrastructure refers to the use of the business’ own software, hardware, technology, and data that is traditionally set up and running within the four walls of the organization. This approach allows for complete control over the infrastructure, from setup to management, architecture, and security.

Defining hybrid infrastructure

The term hybrid infrastructure refers to the integration of a mixed computing environment, comprising an on-premises data center (or private cloud), private cloud services, and a public cloud. Arguably the most important component of this infrastructure is a resilient connection to both the hybrid cloud’s private and public cloud computing environments.

Defining cloud-native infrastructure

The term cloud-native refers to the packaging of application code and dependencies into containers, deploying these applications as microservices or APIs, and managing them by utilizing DevOps practices, processes, and tools for a reliable and secure approach at scale. This typically includes a cloud-provided Platform-as-a-Service (PaaS), Software-as-a-Service (Saas), Infrastructure-as-a-Service (IaaS), Databases-as-a-Service (DbaaS), and even Container-as-a-Service (CaaS).

On-premises versus hybrid versus cloud-native – is there a one size fits all?

This cloud menu approach allows businesses to consciously harness the power and agility of each of these computing components and determine when and where it assists them in their transformation while taking advantage of investments in the existing data center architecture. For businesses to be successful, they must successfully assess their current digital estate, not only for existing workloads but for optimizing cost control and management. This must also include what’s called the 5Rs approach: rehost, refactor, rearchitect, rebuild, and replace.

While this is not a new digital paradigm shift, interest continues to grow in finding advancements to provide ample operational scale, decrease deployment and management speed, and increase the overall resiliency and efficiency of any business workloads running in the cloud.

No, there is no one-size-fits-all approach for cloud services. Instituting a Crawl > Walk > Run approach that’s customized to your business needs will help to identify the right overall benefits, migration speed, priorities, and selection of services. This measurable approach will ultimately help you choose the correct approach to select services that meet you and your business where you are in your transformation efforts.

In this chapter, we covered the details of the AZ-801 Microsoft certification exam and included strategies to review the overall objectives and plan for success. We learned how the exam functions and flows, as well as learning how to prepare for the exam depending on your choice of exam location. We also worked to set up a Microsoft 365 E5 license and advanced Azure Active Directory Premium licensing for our Azure tenant lab. We then established a local Hyper-V lab on a device of our choice and established Windows Server 2022 virtual machines for use throughout the exercises in this book. Finally, we completed a cursory review of the state of the cloud and how these services help your business thrive.

In the next chapter, we will be learning about security for on-premises and hybrid infrastructures. We will start with securing the Windows Server operating system and will investigate a best practice approach to enhance the security posture of your devices utilizing the available Microsoft tools and controls, consistent with the AZ-801 exam objectives.