DP-300 Study Guide: A Domain-by-Domain Plan to Pass the Azure Database Administrator Exam

Who DP-300 Is Actually For

DP-300 targets database administrators who already manage cloud and on-premises databases day to day — not developers who occasionally write queries. Microsoft's audience profile names four specific technologies you should have hands-on experience with: Azure SQL Database, Azure SQL Managed Instance, SQL Server on Azure Virtual Machines (both Windows and Linux), and SQL Server on-premises.

There is no enforced prerequisite exam. That said, the exam assumes you can already read and write T-SQL for administrative tasks (not application development), and that you have opinions about migration strategy and backup design formed from actually doing the work — the scenario questions punish memorized theory without that context.

It also pairs with an adjacent role, not a linear ladder: Microsoft frames DP-300 candidates as working alongside data engineers, solution architects, and developers on the operational side of a data platform, while DP-203-style engineering work covers the pipeline-building side.

Domain 1 — Plan and Implement Data Platform Resources (15–20%)

This domain covers choosing and deploying the right Azure SQL offering, configuring it for scale, and planning migrations — the "get the platform standing up correctly" work that everything else depends on.

Choosing Between Azure SQL Database, Managed Instance, and SQL Server on Azure VMs

Expect scenario questions that describe a workload's constraints (cross-database queries, SQL Agent dependency, instance-level features, full OS control) and ask which offering fits. A fast mental filter: need full SQL Server surface area and OS access → VM; need near-full instance-level compatibility without OS management → Managed Instance; need a single database with the least management overhead → Azure SQL Database. The exam also expects you to recognize when Azure Arc-enabled SQL Server or Azure SQL Database in Microsoft Fabric fits a hybrid or analytics-adjacent scenario — both are newer additions candidates studying from older material tend to skip.

Migration Strategy: Where Candidates Get Tripped Up

The domain distinguishes online migration (source stays available, minimal downtime, more moving parts) from offline migration (source goes down, simpler to execute). Questions often describe a business constraint — "cannot tolerate more than a few minutes of downtime" versus "a maintenance window is available" — and expect you to pick the matching strategy rather than defaulting to whichever tool you're more familiar with. Also know Managed Instance database copy/move as its own distinct migration mechanism, separate from a full Data Migration Assistant or Database Migration Service project.

Domain 2 — Implement a Secure Environment (20–25%)

Tied for the largest domain on the exam. It spans authentication and authorization, encryption at rest and in transit, and compliance controls — and it's the domain where candidates with only on-premises SQL Server experience most often lose points, because several of its features have no on-premises equivalent.

Entra ID Authentication vs. SQL Authentication

Know how to configure Microsoft Entra ID authentication for Azure SQL Database, Managed Instance, and SQL Server specifically, plus how to create users from Entra identities and apply least-privilege at the database and object level. A common exam trap: a scenario describes an "Entra ID-only" authentication requirement, and the wrong-answer choices leave a SQL-authentication admin account enabled — know that Entra-only authentication disables SQL logins entirely at the server or Managed Instance level.

Always Encrypted vs. Always Encrypted with VBS Enclaves

Standard Always Encrypted keeps sensitive column data encrypted client-side, but that also blocks most server-side operations (pattern matching, range comparisons) on that column. Always Encrypted with secure enclaves (using virtualization-based security, VBS) allows those richer operations to run inside a protected enclave on the server without ever exposing plaintext to the database engine itself. Exam scenarios that mention needing to run range queries or LIKE searches against encrypted columns are pointing at the enclave variant, not standard Always Encrypted.

Domain 3 — Monitor, Configure, and Optimize Database Resources (20–25%)

This domain tests performance work end to end: establishing a baseline, finding the bottleneck, and configuring the database to perform better going forward.

Query Store, DMVs, and Execution Plans

You need to know when each monitoring tool is the right one to reach for: Query Store for tracking query performance and plan regressions over time, dynamic management views (DMVs) for point-in-time diagnostics like current blocking sessions or wait statistics, and execution plans for understanding why a specific query is slow. A frequent scenario pattern describes intermittent slow queries after a deployment — that points at Query Store's plan-forcing capability to pin the previously good plan, not a fresh index rebuild.

Automatic Tuning and Intelligent Query Processing (IQP)

Database automatic tuning (automatic plan correction, automatic index management) is Azure SQL Database's built-in response to regressions and missing indexes, and the exam expects you to know it can be enabled per-database rather than requiring manual intervention every time. Separately, know that intelligent query processing features (like approximate query processing or memory grant feedback) are engine-level optimizations you identify use cases for, not something you manually configure query-by-query.

Domain 4 — Configure and Manage Automation of Tasks (15–20%)

The smallest domain by weight, but often underprepared for because it spans three distinct automation surfaces: SQL Server Agent, infrastructure-as-code deployment, and Azure-native elastic jobs.

SQL Server Agent Jobs vs. Elastic Jobs

SQL Server Agent jobs run against a single instance (SQL Server on a VM, or Managed Instance) and are the direct on-premises-style automation you may already know. Elastic jobs exist specifically because Azure SQL Database (the single-database, serverless-adjacent tier) has no SQL Server Agent — elastic jobs are how you run a T-SQL script across one database or a whole elastic pool on a schedule. A scenario naming plain Azure SQL Database and asking "how do you schedule a recurring maintenance script" is asking about elastic jobs, not Agent jobs. Also expect at least one question on automating deployment itself, via ARM/Bicep templates, Azure PowerShell, or Azure CLI, rather than automating what runs after deployment.

Domain 5 — Plan and Configure a High Availability and Disaster Recovery Environment (20–25%)

Tied for the largest domain on the exam alongside security, and the one most candidates from a pure on-premises background need to spend the most new study time on.

Matching HA/DR Options to RPO and RTO

Nearly every HA/DR scenario question is really an RPO/RTO word problem: how much data loss is acceptable (Recovery Point Objective) and how fast must the system come back (Recovery Time Objective). Tight RTO with near-zero RPO points toward synchronous replication options; a looser RTO with an acceptable recovery window opens up backup-and-restore-based strategies instead. Read the numbers in the scenario before you read the answer choices.

Always On Availability Groups vs. Failover Groups vs. Active Geo-Replication

These three get confused constantly because they solve overlapping problems at different layers. Always On availability groups (on Managed Instance or Azure VMs) protect a group of databases at the instance/VM level, often within a region. Active geo-replication is an Azure SQL Database feature that maintains readable secondary replicas, typically for cross-region DR of individual databases. Failover groups sit on top of either geo-replication or availability groups to add automatic, application-transparent failover with a stable listener endpoint. If a scenario emphasizes "the application connection string must not change after failover," that's pointing at failover groups specifically, not geo-replication alone. Also know backup and restore fundamentals cold: point-in-time restore, long-term retention configuration, and performing both backup and restore via T-SQL and via native tools, since this sub-area is tested independently of the replication topics above.

What Changed in the April 2026 DP-300 Update

Per Microsoft's own change log, the skills-measured revision published April 24, 2026 made minor updates inside two existing skill areas rather than adding or removing a domain: "Configure database authentication and authorization" (under Implement a secure environment) and "Automate deployment of database resources" (under Configure and manage automation of tasks). Domain-level weightings were unaffected. If you studied from material older than April 2026, re-check those two sub-areas specifically rather than assuming the whole guide is stale.

The Three Mistakes That Sink First-Time DP-300 Candidates

• • Treating HA/DR as a memorization exercise instead of an RPO/RTO exercise. Candidates who memorize feature lists without practicing matching them to stated recovery objectives get the trap answers that name a technically-real feature that doesn't fit the stated numbers.
• • Underestimating the security domain because "I already know SQL Server security." On-premises SQL Server security knowledge doesn't cover Entra-only authentication, Always Encrypted with enclaves, or Azure-specific firewall and private-link configuration — all of which have real weight here.
• • Skipping elastic jobs because Agent jobs feel more familiar. Elastic jobs exist to solve a problem SQL Server Agent literally cannot (Azure SQL Database has no Agent), so a candidate who only studies Agent jobs will misread any question that specifies plain Azure SQL Database as the target.

Frequently Asked Questions About DP-300