AZ-802 Cheat Sheet 2026: Quick Reference for Administering Windows Server
All 7 domains as scannable tables, exactly what carried over from AZ-800/AZ-801 versus what got cut, and the cmdlets that keep showing up in scenario questions.
Quick Facts
Every domain weight and reference link below is pulled directly from Microsoft's official AZ-802 exam page and cross-checked against our 500-question AZ-802 bank, which we audit against Microsoft Learn documentation before anything goes live.
Domain 1: Deploy and Manage AD DS (20-25%)
| Concept | Area | Quick note |
|---|---|---|
| Domain controllers on-prem & in Azure | Deployment | Two separate deployment targets, tested separately |
| RODC deployment & account security | Deployment | Exclude privileged groups from the Allowed RODC Password Replication Group |
| FSMO roles | Deployment | Transfer if the DC is online; seize with ntdsutil if permanently lost |
| Domain & forest trusts | Multi-site | One-way vs. two-way vs. shortcut — direction determines who gets access to whom |
| AD DS sites & replication | Multi-site | repadmin /showrepl is the first diagnostic for a stalled sync |
| Users, groups, service accounts | Security principals | Multi-domain/multi-forest scenarios add scope complexity |
| Group Policy & preferences | Policy | Preferences add drive maps, printers, and registry items beyond classic GPO settings |
Domain 2: Manage Hybrid Workloads (10-15%)
| Concept | Area | Quick note |
|---|---|---|
| Windows Admin Center | Remote mgmt | On-premises gateway or Azure portal extension |
| PowerShell remoting, double-hop, JEA | Remote mgmt | JEA constrains a session to specific approved cmdlets |
| Remote SSH / RDP access | Remote mgmt | Alternative remote access paths beyond WinRM |
| Azure Arc onboarding | Azure services | Prerequisite before Defender for Servers, Update Manager, or Policy can manage the server |
| VM extensions on non-Azure machines | Azure services | Deployed against the Arc-enabled machine resource, not the physical box directly |
| Azure Update Manager | Azure services | Patch visibility spanning Azure VMs and Arc-enabled servers together |
| Azure Automation runbooks | Azure services | Scripted automation across the hybrid estate |
Domain 3: Manage Virtual Machines (10-15%)
| Concept | Area | Quick note |
|---|---|---|
| Enhanced Session Mode | Hyper-V | Redirects local resources (clipboard, drives) into the VM console session |
| PowerShell Direct / SSH Direct | Hyper-V | Manage a guest with no network path required |
| VM checkpoints | Hyper-V | Point-in-time only — not continuous protection |
| Hyper-V Replica | Hyper-V | Continuous asynchronous replication with planned/unplanned failover |
| NIC teaming (host & VM) | Hyper-V | Fault tolerance and bandwidth aggregation, configurable at both levels |
| GPU partitioning | Hyper-V | Shares one physical GPU across multiple VMs |
| Azure VM scale sets & availability zones | Azure VMs | Capacity and resiliency planning for Azure-hosted VMs |
| JIT access / Azure Bastion | Azure VMs | Reduces exposed RDP/SSH attack surface |
Domain 4: Implement Hybrid Networking (10-15%)
| Concept | Area | Quick note |
|---|---|---|
| DNS integration with AD DS | Name resolution | AD-integrated zones replicate through AD, not zone transfers |
| Conditional forwarding | Name resolution | Forward one namespace to a specific DNS server without duplicating the zone |
| DNSSEC | Name resolution | Cryptographic validation against spoofed responses |
| DHCP scopes & reservations | IP addressing | Reservations pin a specific client to a fixed IP |
| DHCP high availability | IP addressing | Load balance or hot standby failover mode |
Domain 5: Manage Storage and File Services (15-20%)
| Concept | Area | Quick note |
|---|---|---|
| Azure Files & Azure File Sync | Cloud storage | Sync + tiering; the supported path for migrating a DFS namespace to Azure |
| Windows Server file shares / FSRM | On-prem storage | Quotas, file screening, and storage reports |
| DFS Namespaces | On-prem storage | Keeps a UNC path stable during a storage migration |
| SMB over QUIC | On-prem storage | SMB access over the internet without a VPN |
| Storage Spaces / Storage Spaces Direct | Disks & volumes | Pooled, locally redundant storage across cluster nodes |
| Storage Replica | Disks & volumes | Site-to-site synchronous or asynchronous volume replication |
| BitLocker | Disks & volumes | Encryption at rest; recovery via key or recovery password |
Domain 6: Secure Windows Server Infrastructure (10-15%)
| Concept | Area | Quick note |
|---|---|---|
| Exploit protection | OS hardening | Per-application mitigation settings against memory-corruption exploits |
| Credential Guard | OS hardening | VBS-isolated derived credentials — blocks pass-the-hash even with local admin |
| Windows LAPS | OS hardening | Randomizes and rotates local Administrator passwords per machine |
| Defender for Servers | OS hardening | Extends to on-premises servers once Azure Arc–enabled |
| Entra Password Protection for AD DS | AD DS security | Blocks weak and organization-banned passwords on-premises |
| Protected Users group | AD DS security | Restricts credential caching for high-value accounts |
| Domain controller hardening | AD DS security | Restrict access, tier admin accounts, harden authentication protocols |
Domain 7: Monitor and Troubleshoot Windows Server (15-20%)
| Concept | Area | Quick note |
|---|---|---|
| Performance Monitor / data collector sets | On-prem monitoring | Classic local performance counters and logging |
| Windows Admin Center alerts | On-prem monitoring | Lightweight built-in alerting UI |
| System Insights | On-prem monitoring | ML-based forecasting for future resource exhaustion |
| Azure Monitor data collection rules | Azure monitoring | Defines exactly what telemetry gets collected |
| VM Insights | Azure monitoring | Works for Arc-enabled servers, not just Azure VMs |
| AD Recycle Bin / DSRM | AD recovery | Object-level restore vs. full database recovery mode |
| Kerberos & secure channel troubleshooting | Troubleshooting | New emphasis in AZ-802 not spelled out as explicitly in AZ-801 |
Cross-referencing while you study?
Drill each domain above with MSCertQuiz's 500-question AZ-802 bank — 40 questions free to start.
Start Free AZ-802 PracticeWhat Actually Carried Over From AZ-800/AZ-801
Comparing the official AZ-802 study guide against the AZ-800 and AZ-801 study guides directly (checked August 4, 2026), AZ-802 is not a straight merge of both exams — it's a narrower subset. Here's what made it in:
| What carried over | Source domain | Now lives in |
|---|---|---|
| AD DS deployment, trusts, replication, GPOs | AZ-800 domain 1 | AZ-802 domain 1 |
| Remote management, Azure Arc, Update Manager, runbooks | AZ-800 domain 2 | AZ-802 domain 2 |
| Hyper-V VM management, Azure VM basics | AZ-800 domain 3 | AZ-802 domain 3 |
| DNS, conditional forwarding, DNSSEC, DHCP | AZ-800 domain 4 (minus IPAM/VPN) | AZ-802 domain 4 |
| Azure Files/Sync, DFS, FSRM, Storage Spaces, Storage Replica | AZ-800 domain 5 | AZ-802 domain 5 |
| OS hardening, AD DS security, Defender for Servers, BitLocker | AZ-801 domains 1 & 4-5 (minus ADE/NSGs) | AZ-802 domain 6 |
| Performance/Azure Monitor, AD recovery, troubleshooting | AZ-801 domain 5 | AZ-802 domain 7 |
What Got Dropped From AZ-802 Entirely
These topics are in the AZ-800 and/or AZ-801 skills-measured lists but do notappear anywhere in AZ-802's skills-at-a-glance. If you're transitioning from the old two-exam path, this is the material you can skip.
| Category | What’s excluded |
|---|---|
| Hybrid identity sync | Entra Connect Sync/Cloud Sync, Entra Domain Services join, Connect Health, staged rollout |
| Containers | Windows Server container hosts, WSL containers, container networking, AKS on Windows Server |
| Guarded fabric & shielded VMs | Moving secure VMs between Hyper-V hosts |
| On-prem network connectivity extras | IPAM, Remote Access role, Web Application Proxy, site-to-site VPN, Entra Private Access/App Proxy |
| File services extras | BranchCache |
| Identity threat protection | Authentication policy silos, NTLM auditing, Microsoft Defender for Identity integration |
| Failover clustering & high availability | The entire AZ-801 clustering domain — stretch clusters, cluster-aware updating, Scale-Out File Servers, Azure witness |
| Disaster recovery | Azure Backup, Azure Site Recovery, DR-specific Hyper-V Replica configuration |
| Server migration tooling | Storage Migration Service, Azure Migrate, IIS/RDS/print/DHCP server migration, AD forest restructuring |
PowerShell Cmdlet and Portal Path Quick Reference
The exam scores end results, not method — but knowing the cmdlet name saves time in scenario questions that ask "which command" directly.
| Cmdlet | Task | Portal / alternative |
|---|---|---|
| Move-ADDirectoryServerOperationMasterRole -Force | Seize an FSMO role | ntdsutil roles seize (equivalent) |
| repadmin /showrepl | Check AD replication status | Windows Admin Center has limited AD visibility |
| azcmagent connect | Onboard a server to Azure Arc | Azure portal → Servers - Azure Arc → Add |
| Register-PSSessionConfiguration -Path <RoleCapabilities> | Publish a JEA endpoint | PowerShell-only; no portal equivalent |
| Get-LapsADPassword / Get-LapsAADPassword | Retrieve a rotated local admin password | Entra ID device view (cloud) or GPMC (on-prem) |
| New-SRPartnership | Configure Storage Replica between two servers | Windows Admin Center → Storage Replica |
| Enable-VMReplication | Set up Hyper-V Replica for a VM | Hyper-V Manager → Enable Replication wizard |
| Add-DhcpServerv4Failover | Configure DHCP failover | DHCP console → Configure Failover |
AZ-802 FAQ
Is AZ-802 just AZ-800 and AZ-801 merged together?
No — it's narrower. AZ-802 drops entire domains that existed in AZ-800/AZ-801: hybrid identity sync (Entra Connect), containers/AKS, failover clustering, disaster recovery (Azure Backup/Site Recovery), and server migration tooling. It carries over AD DS, hybrid management, VMs, networking, storage, security, and monitoring, but at reduced depth per domain.
If I studied AZ-801's clustering domain, is that wasted for AZ-802?
For the exam itself, yes — failover clustering, stretch clusters, and Scale-Out File Servers aren't in AZ-802's skills-measured list. Storage Spaces Direct still appears, but only as a storage feature, not wrapped in the clustering domain's configuration detail.
Can I print this AZ-802 cheat sheet?
Yes — every table here is plain HTML, so a browser print or "print to PDF" renders cleanly.
Where do I find the cmdlets for AZ-802 in one place?
The PowerShell cmdlet table above covers the operations that show up most often in scenario questions: FSMO seizure, Azure Arc onboarding, JEA endpoints, LAPS retrieval, Storage Replica, Hyper-V Replica, and DHCP failover.
MSCertQuiz sells practice-exam access for AZ-802 and other Microsoft certifications; this cheat sheet is written by the same team that builds those questions.
Keep Studying
The 8-week plan behind this quick reference.
Scenario questions with full rationale, grouped by domain.
What changed when Microsoft opened the AZ-802 beta.
Full exam details and the complete 500-question practice bank.
Reviewed the cheat sheet? Now drill it.
Start with 40 free AZ-802 questions covering every domain above.
Start Free AZ-802 Practice