Administering Windows Server Hybrid Core Infrastructure (AZ-800)

Most Windows Server teams now run identity, networking, and storage across both on-premises data centers and Azure, but skills often lag the infrastructure. That gap shows up as risky identity sync decisions, Group Policy surprises, and network changes made without a plan.

Role fit: This intermediate course suits systems administrators, Windows Server administrators, and IT operations staff with 2–3 years of Windows Server experience. Team Leads can assign it to admins who own AD DS, Hyper-V, DNS/DHCP, file services, or Azure-connected workloads.

Time investment: Plan for about 39 hours across 37 skills. Spreading it over several weeks works well, with the identity, virtualization, networking, and storage blocks taken in order.

Risk and compliance: The course covers security trade-offs IT Directors care about:

• Azure AD DS authenticating over LDAP rather than LDAPS
• Policies that forbid syncing passwords over the public internet
• Shielded VMs for highly regulated industries

Change-management notes: Instructors flag where production caution matters:

• IPAM deployment is high-touch and affects critical networking and Group Policy
• Group Policy preferences can behave unexpectedly
• DFS in a single site needs testing before rollout

How CBT Nuggets supports the outcome: Virtual labs let admins practice domain controller installs and configuration safely. Microsoft retired the AZ-800 exam and the Windows Server Hybrid Administrator Associate path on 30 September 2026, so the course is assigned today for the hybrid administration skills themselves.

IT teams complete this training to run Windows Server confidently across on-premises data centers and Azure, without trial-and-error in production.

Real-world scenarios covered in the course:

• Hybrid identity done right: Team members learn when Azure AD DS is the right fit (a cloud-hosted domain controller for Azure VMs and apps, not a way to push Group Policy to field laptops). They also learn to weigh security constraints such as unsecured LDAP traffic or policies that block password sync over the public internet before choosing Entra Connect or Cloud Sync.
• Fewer self-inflicted outages: Instructors show where deployments go wrong. Examples include Group Policy Preferences that behave unexpectedly, DFS replication conflicts when shares sit in the same site or subnet, and IPAM rollouts that touch critical networking and GPO infrastructure. Your team plans and tests before changing production.
• Faster remote troubleshooting: Practitioners use PowerShell Remoting, PowerShell Direct, SSH to non-Windows systems, and Azure Bastion to reach servers without exposing public IP addresses.
• Resilient virtualization and storage: Teams learn when production checkpoints make sense and when to avoid checkpoints, how to use Hyper-V Replica and clustering, why shielded VMs suit highly regulated industries, and how to extend file services with Azure File Sync.

The result for IT Directors is a team that can design, deploy, and support hybrid infrastructure with fewer escalations and less reliance on outside help.

Knowledge

• How Active Directory forests, domains, trusts, sites, and replication fit together, including when to deploy read-only domain controllers, FSMO roles, and domain controllers in Azure
• How AD DS, Azure AD (Microsoft Entra ID), and Azure AD DS integrate, including the security trade-offs behind each option, such as unsecured LDAP and password-sync restrictions
• How Group Policy and Group Policy Preferences process, where preferences behave unexpectedly, and how item-level targeting narrows scope
• Hyper-V capabilities including checkpoints, Replica, clustering, shielded VMs for regulated industries, and Windows containers
• Hybrid networking options: hybrid DNS, DHCP, IPAM, classic VPNs to Azure, Network Policy Server, and advanced options such as Azure Network Adapter and Azure Extended Network
• Storage fundamentals across disks, volumes, file shares, BranchCache, DFS, and Azure File Sync

Ability

• Install and configure domain controllers, create trust relationships, and manage users, groups, and computer joins
• Configure Microsoft Entra Connect Sync and Cloud Sync to synchronize on-premises identities with the cloud
• Troubleshoot Group Policy by isolating computer-side and user-side settings
• Administer servers remotely with PowerShell remoting, PowerShell Direct, SSH, RDP, and Azure Bastion
• Deploy and manage Azure VMs running Windows Server, and plan IPAM rollouts that touch critical DNS and DHCP infrastructure
• Deploy Azure File Sync and DFS with proper site awareness, and script file share tasks with PowerShell