Hands-on Labs

Concept notes tell you why a service exists. Labs prove that you can operate it. Every module note has an embedded hands-on lab; this page collects the larger labs that deliberately combine multiple modules. Complete each exercise in the stated order and record the evidence requested in Verify.

Safety first

• Use a separate training subscription where possible. Azure resources can incur charges.
• Read Clean up before you create anything. Delete the resource group when finished unless the lab says otherwise.
• Do not paste real passwords, access keys, tokens, or production identifiers into this vault, a repository, or a pipeline log.
• A permission error is useful evidence. Do not work around it with a broad production role.

Start here

1. AZ-104 · Foundation, resource hierarchy, and least privilege
2. AZ-104 · Integrated administration challenge
3. AZ-104 · Identity and governance controls
4. AZ-104 · Private networking diagnosis
5. AZ-104 · Backup and recovery
6. AZ-104 · Azure Files identity-based access
7. AZ-400 · Protected YAML pipeline
8. AZ-400 · Azure Pipelines controlled delivery
9. AZ-400 · Observability and feedback
10. AZ-400 · DevSecOps gate and remediation
11. AZ-400 · Azure DevOps least access and secure files
12. AZ-400 · End-to-end delivery challenge
13. AZ-104 · ARM/Bicep change control
14. AZ-104 · Container sizing and scaling
15. AZ-104 · App Service backup and restore
16. AZ-400 · Git LFS and recovery
17. AZ-400 · Feature-flag rollout and rollback
18. AZ-400 · Database-safe release
19. AZ-104 · Entra user and group lifecycle
20. AZ-400 · Release notes from Git history
21. AZ-400 · Defender DevOps and GHAS triage
22. AZ-400 · Teams delivery notifications
23. AZ-104 · Governance change safety
24. AZ-104 · Safe SSPR rollout
25. AZ-104 · Storage delegated access and key rotation
26. AZ-104 · Blob recovery, versions, and lifecycle
27. AZ-104 · Blob replication and customer-managed encryption
28. AZ-104 · Storage account and Azure Files configuration
29. AZ-104 · VNet addressing, routes, and effective rules
30. AZ-104 · Private DNS and Bastion administration
31. AZ-104 · Internal Load Balancer health diagnosis
32. AZ-104 · VM lifecycle, disks, encryption, and moves
33. AZ-104 · ACR and Container Apps revisions
34. AZ-104 · Bicep deploy, preview, and rollback
35. AZ-104 · App Service plan, TLS, and network boundaries
36. AZ-104 · Monitor signals, logs, alerts, and Insights
37. AZ-104 · Recovery Services vault policy and reports
38. AZ-104 · Site Recovery drill and failover decision
39. AZ-400 · Repository protections, permissions, and tags
40. AZ-400 · Git recovery, removal, and repository scale
41. AZ-400 · GitHub Flow, Issues, Projects, and Azure Boards
42. AZ-400 · Flow, quality, security, delivery, and operations metrics
43. AZ-400 · Docs, release/API publication, and signed webhooks
44. AZ-400 · DevOps identities, permissions, OIDC, and Key Vault
45. AZ-400 · GHAS scans and remediation
46. AZ-400 · DevOps telemetry, alerts, indicators, and tracing
47. AZ-400 · Package promotion and immutable build evidence
48. AZ-400 · Reusable YAML, agents, and GitHub integration
49. AZ-400 · Ordered, resilient release paths
50. AZ-400 · IaC desired state and pipeline maintenance

Embedded module labs

Treat the Hands-on section in every module as a required lab, not optional reading. Its small scope lets you practise a single concept before using it in a cross-module scenario. The repository check scripts/verify-learning-content.sh prevents a module from being added without one.

Lab loop

Every lab follows the same sequence:

Learn → Do → Verify → Break → Fix → Clean up.

The “Break” step uses a safe, reversible misconfiguration. It is how you learn to diagnose rather than merely repeat a click path.

Evidence standard

Do not mark a lab complete until you can show all three:

1. The intended Azure state in the portal or CLI.
2. The command or deployment definition that produced it.
3. A short explanation of why the deliberate failure happened and how the fix changed effective behavior.

Use the lab evidence record template to retain scrubbed evidence for the full Learn → Do → Verify → Break → Fix → Clean up loop.

Related

Azure from Zero · Objective coverage audit