Written to the AZ-802 outline published June 22, 2026All seven domains, 245 questions, every option explainedThe objective-level diff against AZ-800 and AZ-801Every fact linked to Microsoft LearnPDF + EPUB, updates included
Know exactly what AZ-802 asks — and what it quietly dropped
An independent study guide for Microsoft's Administering Windows Server exam: 245 practice questions that explain every option, mapped section by section to the official outline — and a chapter that lists, objective by objective, what AZ-802 took from AZ-800 and AZ-801 and what it left behind. For Windows Server admins, including everyone whose AZ-800 or AZ-801 preparation just became half-obsolete.
All sales are final. Download starts right after payment.Get the guide · $47
540 pagestext in proportion to exam weights
245 questionswith a reason for every wrong option
7 of 7 domainscovered, see the map below
Four study plansthree weeks, eight weeks, and a path each from AZ-800 and AZ-801
Coverage map official domain → weight → our material
Exam domain (official outline)
Weight
Chapter pages
Questions
Traps
Deploy and manage AD DS
20–25%
42
42
46
Manage Windows Server instances and workloads in a hybrid environment
10–15%
28
23
28
Manage virtual machines
10–15%
26
23
31
Implement and manage an on-premises and hybrid networking infrastructure
10–15%
25
23
28
Manage storage and file services
15–20%
38
33
42
Secure Windows Server infrastructure
10–15%
30
23
31
Monitor and troubleshoot Windows Server environments
15–20%
34
33
45
Final mock exam (all seven domains)
mixed
0
45
0
Total
100%
223
245
251
Outline version: skills measured as of 2026-06-22. Guide version 2026.10. You get every future revision at no cost.
Look inside before you buy
Real pages from the document, exactly as you get them.
Coverage map: every domain, its official weight, and how many pages and questions it gets
Cheat sheet, chapter 1: the whole domain on one page
Teaching page: how it behaves, where it breaks, and a trap box for the belief that sounds right
What changed from AZ-800 and AZ-801 — the change log Microsoft did not publish
Practice questions, in the four formats the exam uses
An answer page: every option explained, with the Microsoft Learn page that proves it
Lab: break the Group Policy precedence ladder, then diagnose it
A question, exactly as it appears in the guide
Not a preview. This is question 6.22 with its full explanation, so you can judge the depth before paying.
Q 6.22 · Secure Windows Server infrastructuredifficulty 3 / 5
SRV-WEB01 is a web front end in contoso.com. It must access a back-end service on SRV-APP03 in the trusted forest fabrikam.local, impersonating the user who signed in to the website. The Fabrikam administrators are willing to allow this but are not willing to hand out rights in their domain to Contoso staff. What do you configure, and where?
AHave the Fabrikam administrators set the Trusted-to-Authenticate-for-Delegation bit on the SRV-APP03 computer account so that protocol transition is permitted.
BUnconstrained delegation on SRV-WEB01, which is the only form that crosses a forest boundary.
CClassic Kerberos constrained delegation on the SRV-WEB01 computer account in contoso.com, listing the back-end service.
DResource-based constrained delegation, set by the Fabrikam administrators on the SRV-APP03 account using the PrincipalsAllowedToDelegateToAccount parameter.
DCorrect. Resource-based constrained delegation lets you delegate when the front-end service and the resource service are not in the same domain, and it shifts the decision from the delegating-from domain administrator to the resource owner. The service administrator configures it by specifying the domain accounts of the front-end services that can impersonate users, on the account object of the resource service, using Set-ADComputer, Set-ADServiceAccount or Set-ADUser with PrincipalsAllowedToDelegateToAccount. The cross-forest case is documented separately: Microsoft's comparison of the options for making the second hop lists resource-based Kerberos constrained delegation as working "across domains and forests" (https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/ps-remoting-second-hop).
AIncorrect. Resource-based constrained delegation cannot use the Trusted-to-Authenticate-for-Delegation bit that previously controlled protocol transition. The KDC always allows protocol transition when performing resource-based constrained delegation, as though the bit were set, which is why the two well-known SIDs S-1-18-1 and S-1-18-2 exist for the resource owner to tell how the client authenticated.
BIncorrect. Wrong, and it is the option the whole feature exists to avoid. Unconstrained delegation lets the front end act for the user against any service anywhere, which is the attack surface constrained delegation was designed to close — and Credential Guard, on by default from Windows Server 2025 on domain-joined member servers, breaks applications that require it.
CIncorrect. Wrong for a cross-domain scenario. Classic constrained delegation requires domain admin privileges to configure a domain account for a service and restricts the account to a single domain — which is precisely the limitation resource-based constrained delegation was introduced to remove. The same comparison page states of classic constrained delegation that it is "Limited to one domain" and "Can't cross domains or forests" (https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/ps-remoting-second-hop).
Tests
Manage AD delegation: resource-based constrained delegation across domains
You have never administered Windows Server. This guide assumes you know what a domain controller is; it will not teach you that.
You want a simulator with drag-and-drop and hotspot items. This is a book: PDF and EPUB, read offline.
You want a pass guarantee. Nobody honest can give one. We give you the outline, the questions and the reasons.
How this was made
Drafts were written with AI from Microsoft's published skills outline and the Windows Server and Azure documentation on Microsoft Learn. Every question was then solved by a second reviewer who did not see the answer key and who opened the source link to confirm it supports the answer. Questions that failed either check were held back for rewriting and are not in the guide. The change-log chapter was built by reading the AZ-802, AZ-800 and AZ-801 outlines side by side and comparing them objective by objective. Nothing here reproduces a real exam item.
Microsoft LearnWindows Server documentationAzure documentationAZ-802 skills outline 2026-06-22AZ-800 and AZ-801 skills outlines, for the diff
Questions people ask before buying
What is actually different about AZ-802 compared with AZ-800 and AZ-801?
AZ-802 replaces both. Three whole AZ-801 domains are gone: high availability and failover clustering, disaster recovery, and migration. Hybrid identity, containers and the network connectivity subgroup are gone from AZ-800. Security arrives from AZ-801 at a third of its old weight. Microsoft published no change log for this outline, so one chapter of this guide is that change log, built by comparing the three published outlines objective by objective.
How is this different from the free Microsoft practice assessment?
The assessment linked from the AZ-802 study guide page is still the AZ-800 one — the page was built from AZ-800 and the link was not repointed. It covers five of the seven domains, says nothing about security or about monitoring and troubleshooting, and still asks about topics that left the exam. Microsoft published six free learning paths in early October 2026; they teach the material, and this guide tests you on it.
Is there really no refund?
Yes. The files are delivered the moment you pay, so the sale is final. That is why a whole question is shown on this page, not a snippet.
Will I get updates when Microsoft changes the outline?
Yes. This outline has no change log and no version date yet, which means the first revision is a question of when, not if. When it changes we revise the guide and email you a link to the new version at no cost.
Is this an official Microsoft course?
No. It is an independent publication, not affiliated with or approved by Microsoft.
All sales are final. Download starts right after payment.Get the guide
