AZ-800 prep, Windows Server Hybrid Administrator roadmap with ARIA
Microsoft's AZ-800 (Administering Windows Server Hybrid Core Infrastructure) is a 120-minute exam of roughly 40 to 60 items scored on a 1000-point scale with 700 to pass. It is half of the Windows Server Hybrid Administrator Associate credential (paired with AZ-801) and the exam most candidates take first because it covers the foundation: AD DS, Windows Server workloads, virtual machines, Azure Stack HCI, storage, and hybrid networking. 
ARIA runs the adaptive evaluation, builds your six-domain roadmap, and stands behind it with a pass guarantee tied to five measurable conditions.
Start your AZ-800 roadmap. About five minutes to the first signal.
TL;DR
- AZ-800 is Microsoft's hybrid administrator exam, current as of 2026: 120 minutes, approximately 40 to 60 items, 700 on a 1000-point scaled score to pass.
- The blueprint loads AD DS at 30 percent, more than any other domain. Strong AD DS is the single biggest-payoff investment for the pass.
- AZ-800 and AZ-801 together make up the Windows Server Hybrid Administrator Associate credential. Most candidates pass AZ-800 first, because the operations and security topics on AZ-801 build on the AZ-800 foundation.
- Typical roadmap is 6 to 10 weeks for working administrators, longer for candidates without recent AD DS hands-on time.
- Pass guarantee eligibility requires every milestone done, two mock exams passed, one gauntlet at 80 percent or higher, and a live readiness score of 80 or higher when you sit the exam.
What the AZ-800 exam is
AZ-800 is a scenario-driven exam that asks you to think like a hybrid administrator: someone who runs Windows Server workloads on-prem, extends them to Azure, and operates the seam between the two. The questions reward administrators who can read a hybrid environment description and pick the right action: which AD DS feature solves which problem, how to configure replication for a multi-site forest, when to use Azure File Sync versus Storage Spaces Direct, how to wire up site-to-site VPN versus ExpressRoute versus Azure Arc. The exam is dense on AD DS and unforgiving on hybrid edge cases.
Domain weights, current as of 2026
| Domain | Weight |
|---|---|
| Deploy and manage AD DS in hybrid environments | 30% |
| Manage Windows Servers and workloads in hybrid | 15% |
| Manage virtual machines and containers | 20% |
| Implement and manage Azure Stack HCI | 10% |
| Manage storage and file services | 15% |
| Implement and manage network connectivity | 10% |
The blueprint is top-heavy on AD DS by design. Microsoft built this credential around hybrid identity, and that means forests, trusts, FSMO roles, Group Policy, AD Connect synchronization, and Entra ID (formerly Azure AD) join scenarios. The 30 percent AD DS weight is the dominant swing factor in pass rate. Candidates strong on AD DS pass even with weaker coverage of Azure Stack HCI; candidates weak on AD DS rarely make up the gap from other domains.
Format and item types
The exam runs 120 minutes through Pearson VUE, online proctored or test center. Item types include standard multiple-choice, multiple-select, drag-and-drop ordering, case studies, and hot-area image clicks. Case studies are the most expensive items per minute because each one carries a multi-paragraph scenario and several linked questions. You cannot revisit case-study questions after you leave the case-study block, which is the single rule candidates most commonly mis-handle on the first attempt. Microsoft does not publish exact item counts, and the form varies, so plan time around the median of 50 items in 120 minutes (2 minutes 24 seconds per item) rather than a fixed schedule.
Where AZ-800 sits in the Microsoft track
AZ-800 is one of two exams (with AZ-801) that earn the Windows Server Hybrid Administrator Associate credential. It is also a meaningful credential on its own; recruiters and hiring managers recognize it as proof of hybrid administrator competence at the foundation layer. Candidates targeting full hybrid identity and operations expertise sit both AZ-800 and AZ-801 within six months. Candidates focused on pure Azure resource administration usually pair AZ-800 with AZ-104, because the Azure-side breadth on AZ-104 complements the on-prem-to-cloud focus of AZ-800.
How ARIA preps you for it
AZ-800 gets a medium-length, AD-DS-heavy roadmap. The setup, the phase order, and the milestone density all reflect the blueprint.
The CAT evaluation surfaces gaps across all six domains. I open every cert with a CAT adaptive test. For AZ-800, the evaluation samples AD DS more heavily than the smaller domains because the exam does. A 25-question CAT typically allocates six to eight items to AD DS, three to four each to Virtual Machines and Windows Server workloads, and two each to the remaining three domains. That domain-by-domain read decides which phase your roadmap opens with.
The roadmap opens with AD DS, every time. AD DS at 30 percent is the largest single point swing on the exam, and most other domains assume comfort with AD DS concepts (Group Policy, replication, sites, trusts). The first two phases live in AD DS for almost every candidate, regardless of evaluation level on the smaller domains. Strong-AD-DS candidates get a shorter validation phase there before moving on; weak-AD-DS candidates get a four-milestone foundation phase first. See the roadmap overview for how phases, milestones, and tasks fit together.
Practice sessions train hybrid scenario reading. AZ-800 writes scenarios that combine on-prem and Azure elements in the same prompt. The drill is being able to parse a four-paragraph hybrid environment and pick the action that fits all stated constraints (which often rule out the first answer that looks technically reasonable). I build practice sessions around that pattern from the second milestone onward, because the AZ-800 scenario rhythm is unique to this exam.
The error backlog tags concept versus scenario reading. Every wrong answer goes into a backlog with a tag. Did you miss a question because you did not know how Group Policy Loopback works, or because you misread the case study and applied the right concept to the wrong sub-question? The two failure modes get different remediation. Concept misses come back as targeted micro-sessions within 24 hours. Scenario-reading misses come back as full case-study drills, because the only way to fix that pattern is to repeat the case-study rhythm under similar pressure.
The gauntlet rehearses the case-study time pressure. The gauntlet is a long-form exam-conditions session at 120 minutes that loads case studies front and back. I unlock the gauntlet at 80 percent readiness because below that, the gauntlet produces noisy data on whether your case-study reading is the bottleneck. Above 80, it surfaces the exact moment in the timeline where reading speed drops and item accuracy follows. See the gauntlet docs for the unlock rules.
Readiness gates the demo test and the gauntlet. The demo test is locked until 60 percent readiness. The gauntlet is locked at 80 percent. Both reflect the point at which the next session type produces signal instead of noise. See readiness and decay for how the score moves and why it drops if you go quiet.
Common pitfalls on AZ-800
These are the topics that quietly cost the most points.
Confusing AD DS replication, sites, and trust topology. The single richest distractor category on AZ-800. Forest trusts versus external trusts versus realm trusts. Inter-site versus intra-site replication. Universal Group Membership Caching. Read-only domain controllers. The exam writes case studies that depend on picking the correct trust type or replication pattern for a stated topology. I drill these specifically in the first AD DS milestone because the discrimination matters across the whole exam.
Group Policy edge cases. Loopback processing in merge versus replace mode. Block inheritance with enforced exceptions. Slow-link processing. Preference items versus policy settings. Most administrators know Group Policy well enough to make it work day-to-day, but AZ-800 tests the edge cases that decide which of three plausible answers is the only one that holds under the stated conditions. The drill is the discrimination, not the basics.
Hybrid identity with Entra ID Connect. Synchronization rules, password hash sync versus pass-through authentication versus federation, source anchor selection, filtering. The exam tests scenarios where the wrong sync configuration would either expose unintended objects, break SSO, or fail compliance constraints. Candidates from an on-prem-only background underweight this and lose 5 to 8 points on the day; candidates from a cloud-first background overweight Entra ID Connect and underweight the on-prem fundamentals.
Azure Stack HCI sizing and licensing. The smallest domain at 10 percent, but the exam pulls about five items from it every time. Cluster sizing rules, storage pool design, S2D versus Storage Replica, licensing models, lifecycle management. Most candidates have less direct Azure Stack HCI exposure than AD DS, so the exam concepts feel less reflexive. I cover the domain proportionally in the second half of the roadmap.
Storage migration tools and versions. Storage Migration Service, DFS-R, Azure File Sync, Storage Spaces Direct. Candidates often confuse which tool fits which migration pattern, especially when the scenario describes Windows Server 2012 R2 source systems or non-domain-joined endpoints. The exam tests this directly. I run a dedicated discrimination drill inside the storage milestone.
Hybrid networking glue. Azure Arc, site-to-site VPN, ExpressRoute, Azure Network Adapter, BGP-over-VPN, DNS forwarding configurations. The 10 percent networking domain rewards administrators who understand the routing implications of each connection type, not just the configuration steps. The pitfall here is conflating the cost-and-bandwidth trade-offs with the technical capability trade-offs. I build the networking milestone around scenario decisions, not configuration recall.
Common Questions
Is AZ-800 enough on its own, or do I need AZ-801 too?
Both are required for the full Windows Server Hybrid Administrator Associate credential. AZ-800 covers core hybrid administration: AD DS, Windows Server workloads, virtual machines, Azure Stack HCI, storage, and network connectivity. AZ-801 covers operations: security, high availability, disaster recovery, migration, and monitoring. Most candidates pass AZ-800 first because it is the foundation layer and AZ-801 builds on it directly.
Do I need on-prem Windows Server experience to pass AZ-800?
Microsoft positions AZ-800 as a role-based exam for administrators who already manage Windows Server workloads in hybrid environments. The blueprint assumes hands-on familiarity with AD DS, Group Policy, PowerShell remoting, and basic networking. Candidates without that background can still pass with adequate prep, but the AD DS domain at 30 percent weight is hard to fake, and the exam writes scenarios that reward real on-prem reflexes.
How does AZ-800 score and how many questions does it have?
The exam runs 120 minutes with approximately 40 to 60 items, mixing multiple-choice, case studies, and drag-and-drop questions. A pass is 700 on a 1000-point scaled score, with item difficulty and weighting factored in, not a raw percentage. Microsoft does not publish exact item counts because the form varies, but the scaled-score model means missing a few hard items in your weakest domain hurts less than missing easier items across the blueprint.
How long should I expect to study for AZ-800?
At 30 minutes a day, plan on 10 to 14 weeks. At 45 minutes a day, 8 to 10 weeks. At 60 minutes a day, 6 to 8 weeks. Candidates with daily AD DS and Windows Server work compress those timelines significantly; candidates who have not touched Group Policy in years should add 4 weeks. The 30 percent AD DS weight makes that domain the largest swing factor in total prep time.
AZ-800 vs AZ-104, which one should I take first?
If you come from an on-prem Windows Server background and are bridging to Azure, AZ-800 fits your existing skill set more cleanly. If you come from a cloud-first background and need to validate Azure administration broadly, AZ-104 is the better first exam. Most administrators in hybrid shops take both within a year, in either order. The AD DS framing on AZ-800 has no equivalent on AZ-104, and the Azure resource breadth on AZ-104 has no equivalent on AZ-800.
What readiness score unlocks the gauntlet for AZ-800?
Eighty. Below 80 readiness, the gauntlet stays locked. The gauntlet is a long-form exam-conditions session that mirrors the AZ-800 case-study density and the time-pressure rhythm of the 120-minute clock. Below 80 it produces noisy data; above 80 it surfaces the case-study reading slips that still cost points under fatigue.
Where do I see whether I am eligible for the pass guarantee?
On the dashboard, once all five conditions hold. The check runs after every milestone validation, and the eligibility flag flips automatically. Read the full breakdown of the conditions on the pass guarantee page, and the adaptive cert prep explained article for the structural reasoning behind the design.
Start your AZ-800 roadmap
The cheapest possible signal is a 15 to 25 question CAT evaluation against the AZ-800 blueprint. The output is a domain-by-domain skill estimate across the six domains, a roadmap that always opens with AD DS but tightens or expands the phase based on your evaluation level, and your day-one task. If the evaluation lands you Novice on AD DS, the roadmap opens with three foundation milestones in AD DS before touching the rest. If you are already Competent there, the roadmap moves into Windows Server workloads and hybrid identity sooner.
Either way, the measurement is more useful than another month of unmeasured study. Open the AZ-800 onboarding flow and start the evaluation. From there, practice sessions take over the daily cadence, and I pick the next task every time you reopen the app.