Azure Interview Questions for a Microsoft 365 Estate

An Azure interview for a role supporting a Microsoft 365 estate is a different interview from one for a cloud platform engineer. Virtual machine sizing and Kubernetes topology are rarely the job. Identity, integration and operational judgement are.

These questions reflect that, and each includes what a strong answer contains.

Identity

Explain the difference between delegated and application permissions.

The single most useful question in this list, because it is the distinction most often misunderstood by people who have shipped something.

Strong answer: delegated permissions have the application act on behalf of a signed-in user, and effective access is the intersection of the permission and what the user can already do. Application permissions have the application act as itself with no user, and access is exactly what the permission grants, tenant-wide.

Follow-up: when is an application permission the wrong choice? Answer: in an interactive application serving a signed-in user, because the user's own access stops constraining anything and your code becomes the only security boundary.

What is a managed identity and when can you not use one?

Strong answer: a service principal whose credentials Azure creates and rotates, usable by an Azure resource, removing stored secrets entirely. Cannot be used from outside Azure — a workload elsewhere needs a different mechanism such as workload identity federation. Distinguishes system-assigned from user-assigned and knows why you would choose the latter.

An application stopped working overnight with no deployment. What do you check?

Strong answer, in order: credential expiry, because it is the most common cause and produces exactly this shape of failure; then a conditional access policy change; then consent revoked or a permission changed; then certificate rotation somewhere in the chain; then a service health event. Reaches for the sign-in logs early rather than reasoning about what ought to have happened.

What it reveals: whether they have operated something, or only built it.

How would you audit what an application can do in the tenant?

Strong answer: the enterprise application's permissions blade — granted permissions, whether they are delegated or application, and who consented. Adds that consent granted years ago persists, and that periodic review is the control. A strong candidate mentions that application permissions warrant a much higher bar of review than delegated ones.

Integration

Logic Apps or Power Automate?

Strong answer: decides on ownership and operations rather than features. Logic Apps when an engineering team owns it, it must be in source control and deployed by a pipeline, it needs Azure Monitor alerting, it needs virtual network integration, or it must run indefinitely regardless of who is employed. Power Automate when the process is business-owned, human-triggered and should be changeable by the people who understand it.

Follow-up: what breaks in a personal flow when its owner leaves? Answer: the connections authenticate as that account, so it stops.

How do you make an integration resilient?

Strong answer: retry with exponential backoff and jitter, set per action rather than left at default; idempotency on anything that writes, because retrying a create that actually succeeded produces duplicates; a dead-letter destination for what cannot be processed; explicit failure handling rather than a failure path threaded through every branch; and alerting that is not somebody noticing.

Where do secrets live?

Strong answer: Key Vault, accessed via managed identity, so nothing is stored in configuration. Mentions rotation as a process rather than an event, and that the interesting question is what happens when a secret rotates while a workload holds a cached one.

Operations and cost

How do you approach an Azure bill that has grown unexpectedly?

Strong answer: cost analysis by resource group and by tag to find where rather than guessing; then the usual causes — something left running after a test, storage tier or retention, egress, a log workspace ingesting more than intended, or a retry loop. Notes that tagging has to exist beforehand for this to be a five-minute job rather than a two-day one.

What is your approach to naming and tagging?

An unglamorous question that predicts a lot. A strong answer has an actual convention, applies it through policy rather than hope, and can explain what the tags are used for — cost attribution, ownership, lifecycle. Someone who says it does not matter has not had to work out who owns an orphaned resource.

How do you deploy infrastructure?

Strong answer: declaratively, from source control, through a pipeline, with separate environments. Bicep, Terraform or ARM — the tool matters less than that portal clicking is not the answer. Notes that drift is real and that something has to detect it.

Judgement

When would you tell someone not to use Azure for something?

Strong answer: when it already works elsewhere and there is no benefit to moving, when the data cannot leave a jurisdiction or a network, when the operational maturity to run it is not present, or when the cost at the intended scale does not stand up. Willingness to answer this at all is the signal.

Describe an outage you were part of and what changed afterwards.

What you want is a specific incident, a specific cause, and a specific change — a monitor added, a process altered, a dependency removed. An answer with no change afterwards describes an organisation that does not learn, or a candidate who did not.

Common mistakes candidates make

• Confusing delegated and application permissions. The clearest single discriminator available.
• Naming services instead of describing decisions. Interviewers want the reasoning, not the catalogue.
• No operational stories. Building is half the job; the other half is what happens at 3am.
• Treating cost as someone else's problem. In cloud work it is an engineering property.
• Claiming certainty about limits and prices. Saying "I would check the current documentation" is a better answer than a confidently wrong number.

Frequently asked questions

How much Azure is expected in a Microsoft 365 role?

Identity deeply, integration well, and enough of storage, monitoring and networking to hold a conversation. Compute and container orchestration are usually a different job.

Do certifications help?

They demonstrate coverage and pass filters. They do not substitute for being able to answer the overnight-failure question convincingly.

What should a candidate ask?

How infrastructure is deployed, whether managed identity is used or secrets are still in configuration, who owns identity, and what the last incident was. Those four answers describe the role better than the advert does.

What is the most common gap?

The identity model. Many candidates can deploy resources and cannot explain what an application is actually allowed to do once deployed — which is the part that matters most in a Microsoft 365 estate.

Preparing well

If you are preparing, spend the time on identity. Register an application, grant it a delegated permission and an application permission, and observe the difference in what it can reach. That exercise answers half the questions here, and it is the half that most interviews get stuck on.