AZ-720 Exam Guide: What the Retired Azure Connectivity Exam Covered and How to Use Its Blueprint
AZ-720, Troubleshooting Microsoft Azure Connectivity, validated the ability of Azure support engineers to diagnose networking and connectivity faults across hybrid environments, virtual machines, platform services, security controls, routing, and VPNs. Microsoft retired the exam and its associated Azure Support Engineer for Connectivity Specialty certification on July 31, 2023, so candidates cannot use this guide to schedule a current AZ-720 attempt. It remains useful for understanding the historical skill set, mapping older study plans to practical Azure support work, and deciding whether a current Microsoft credential is a better target.
Is AZ-720 still available?
No. Microsoft retired Exam AZ-720 on July 31, 2023, at 11:59 PM Central Standard Time. The associated Microsoft Certified: Azure Support Engineer for Connectivity Specialty certification was also retired. Do not spend time looking for a new AZ-720 appointment or assume that an unofficial practice site can provide a valid route to certification.
The retirement notice is the first decision point for anyone researching this exam. A page may still appear in search results, and Microsoft Learn retains the historical study guide and training modules, but retained documentation does not mean that the examination is open for registration. Microsoft’s study guide explicitly identifies the retirement date: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-720.
The certification could remain on a learner’s Microsoft transcript after retirement. That is different from earning it now. Microsoft’s community announcement states that passing AZ-720 on or before July 31, 2023 earned the specialty certification, which was active for one year, and that a previously earned certification remained on the learner’s transcript after retirement: https://techcommunity.microsoft.com/discussions/skills-hub-discussions/microsoft-certified-azure-support-engineer-for-connectivity-specialty-to-be-reti/3868492.
What should a current candidate do instead?
Treat AZ-720 as a skills reference rather than a schedulable exam. If your objective is a current Microsoft certification, check Microsoft’s current certification catalogue and select an active credential whose role and skills match your work. The official AZ-720 study guide is still valuable for identifying connectivity topics, but it should not be treated as a current exam contract.
If you already hold the retired specialty, verify its status in your Microsoft Learn profile and preserve any transcript evidence you need. The historical renewal page also warns that the renewal assessment and related certification are retired: https://learn.microsoft.com/en-us/credentials/certifications/azure-support-engineer-for-connectivity-specialty/renew/.
What did AZ-720 validate?
AZ-720 was designed for support engineers with subject matter expertise in advanced troubleshooting methods for Azure networking and connectivity issues. The role extended beyond basic virtual-network configuration: candidates needed to diagnose failures in hybrid environments, IaaS and PaaS services, access control, business continuity, and virtual-machine connectivity using available tools.
The official study guide describes the audience as candidates for the Azure Support Engineer for Connectivity Specialty. Its emphasis was diagnostic reasoning: identify the failing layer, select evidence, isolate the cause, and choose a service-specific resolution. That makes the blueprint useful for support engineers, network engineers, cloud administrators, and operations practitioners even though the exam itself is retired.
Microsoft’s associated learning path classified the content as Intermediate and assigned the job roles Administrator, Network Engineer, and Support Engineer. It contained 9 modules and covered Azure services including Azure Backup, Azure Bastion, Azure Content Delivery Network, Azure ExpressRoute, Azure Load Balancer, Azure Virtual Machines, Azure Virtual Network, and Azure Virtual WAN: https://learn.microsoft.com/en-us/training/paths/azure-support-engineer-for-connectivity-specialty/.
Which baseline skills were expected?
The associated Microsoft Learn path listed understanding of the OSI model, Azure CLI, PowerShell, and Cloud Shell command execution as prerequisites. These are not optional study decorations. They support the investigation method: reason from symptoms to network layers, inspect Azure resources, run commands, and compare observed behavior with the intended configuration.
The modules also assumed practical familiarity with the Azure portal, Remote Desktop, Azure Bastion, client and server management concepts, and cloud concepts for the virtual-machine section. The routing and load-balancing module added familiarity with Visual Studio Code and JSON. Candidates who can explain a service but cannot inspect its configuration or validate a hypothesis would have had a significant preparation gap.
Which capability areas formed the blueprint?
The historical blueprint grouped troubleshooting into eight practical areas: business continuity, name resolution, cloud and hybrid connectivity, platform-as-a-service connectivity, authentication and access control, network security, routing and traffic control with load balancing, and virtual-machine connectivity. Study these as connected diagnostic domains, not as isolated product names.
The official study guide included skills-measured versions for different dates, including objectives measured as of April 18, 2023 and objectives measured before that date. Microsoft also noted that exam content could be updated periodically and that most questions covered generally available features, with preview-feature questions possible when those features were commonly used. For historical study, use the version relevant to the intended date rather than blending revisions casually: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-720.
Business continuity and backup
This area required more than knowing that Azure Backup exists. A troubleshooter needed to think about whether protection, recovery, connectivity, permissions, or the recovery target was responsible for a failure. The learning path included a module on troubleshooting business continuity with Microsoft Azure and framed reliable backup and recovery as an operational troubleshooting concern.
Prepare by drawing the recovery flow for a protected workload. Mark where the source resource, vault, identity, network path, policy, and recovery operation interact. For each point, write the evidence you would collect before changing anything. This prevents a common error: altering backup configuration while the actual fault is an authorization or connectivity problem.
Name resolution
Name resolution was treated as its own troubleshooting area because a reachable IP address does not prove that an application’s name-based path works. The learning path included public, private, and internal network name-resolution issues. A useful investigation separates registration, query path, resolver choice, private-zone association, and the client’s actual DNS behavior.
Build a decision worksheet for a failing hostname. Record the client location, expected address, resolver being used, returned address, network boundary, and whether the failure affects one name or an entire namespace. Then connect the result to the next test. Avoid jumping straight to firewall changes when the client never resolved the intended endpoint.
Cloud and hybrid connectivity
Cloud-and-hybrid troubleshooting covered Microsoft ExpressRoute, Azure virtual networks, and Azure Virtual WAN. The learning objectives also included site-to-site VPNs, point-to-site VPNs, virtual-network connectivity, and Virtual WAN issues. This domain tested the ability to follow a path across premises, gateways, peerings, routes, and Azure network constructs.
Study this domain with topology diagrams rather than service summaries. Draw the source, destination, interconnection, gateway or hub, route decision, and security boundary. For each scenario, ask whether the problem is reachability, route selection, tunnel state, address overlap, or policy. The dedicated module is available at https://learn.microsoft.com/en-us/training/modules/cloud-hybrid-connectivity/.
Platform-as-a-service connectivity
The PaaS area addressed connectivity from on-premises users to Azure PaaS services and connectivity between PaaS services. The module specifically includes Azure Storage, Azure Private Link connectivity problems, firewalls for virtual machines, Content Delivery Network issues, and integration between virtual machines and virtual networks.
The most effective preparation is to compare public and private access paths. For a service that appears unavailable, identify the endpoint, DNS behavior, private-link relationship, firewall or network rule, identity requirement, and originating network. Keep service integration separate from service health: an application can be healthy while its network path or name resolution is wrong. Review the Microsoft module at https://learn.microsoft.com/en-us/training/modules/troubleshoot-platform-service-issues/.
Authentication and access control
This area connected connectivity symptoms with identity and authorization. The learning path listed Microsoft Entra authentication topics including self-service password reset, multifactor authentication, hybrid integration, and passwordless authentication. The practical lesson is that a user who cannot reach or use a resource may have an access failure rather than a packet-delivery failure.
Prepare by separating three questions: can the client reach the service, can the identity authenticate, and is the authenticated identity authorized for the requested operation? Record the account, authentication method, conditional requirements, resource scope, and error stage. Do not treat a successful sign-in as proof that the identity has the required resource permission.
Network security
Network-security troubleshooting covered web application firewall controls, network security groups, Azure Firewall, and latency within a virtual network. The objective was not simply to list security products; it was to determine which control sees the traffic, what rule or policy applies, and whether the observed symptom is denial, timeout, or degraded performance.
Use a traffic matrix during study. For each source and destination, document protocol, port, direction, subnet, network interface, route, and security control. Then identify the evidence that would confirm or reject each control as the cause. A common mistake is to inspect only the nearest network security group and ignore the route or an Azure Firewall policy farther along the path.
Routing, traffic control, and load balancing
This area focused on troubleshooting routing, traffic control, and load-balancing issues in Azure. The official module covers routing and traffic control separately from load-balancing issues and uses Azure Firewall, Azure Firewall Manager, Azure Private Link, Azure Virtual Machines, and Azure Virtual Network in its service context: https://learn.microsoft.com/en-us/training/modules/troubleshoot-routing-traffic-control-load-balancing/.
Study the difference between traffic that chooses the wrong path and traffic that reaches a service but is distributed or rejected incorrectly. Trace the effective route, next hop, health state, frontend or backend relationship, probe behavior, and relevant security rule. Do not infer backend health from the load balancer’s existence; inspect the path and the condition that determines whether a backend receives traffic.
Virtual-machine connectivity
The virtual-machine area covered deployment, connectivity, and authorization issues involving Azure Bastion and just-in-time virtual-machine access. Microsoft’s module teaches candidates to choose between Azure Bastion and just-in-time VM access and to troubleshoot both: https://learn.microsoft.com/en-us/training/modules/troubleshoot-connectivity-issues-virtual-machines-azure/.
Create separate checklists for Bastion and just-in-time access. For Bastion, examine deployment prerequisites, the target virtual machine, network configuration, and authorization. For just-in-time access, examine whether the request opened the intended management port for the intended source and time window, then verify that other controls still permit the connection. Familiarity with Remote Desktop and the Azure portal was listed as a prerequisite for this content.
VPN gateway troubleshooting
VPN gateways were another blueprint area, with the learning path specifically including monitoring and troubleshooting site-to-site and point-to-site VPNs. Prepare by distinguishing tunnel establishment from traffic transfer. A tunnel can appear established while routing, address ranges, authorization, or security policy still prevent the required workload communication.
Use two diagrams: one for negotiation and tunnel state, and one for application traffic. Annotate local and remote address ranges, gateway or client configuration, route propagation, and the destination resource. This prevents the common mistake of repeating tunnel resets when the actual problem is an incorrect prefix or an application-side restriction.
How should you prepare when the exam is retired?
Use the AZ-720 material to build troubleshooting competence, not to hunt for an appointment or memorize old question wording. Start with the official study guide, identify the historical skills version relevant to your reference point, and then work through Microsoft Learn modules in an order that moves from fundamentals to path analysis and service-specific diagnosis.
Because the exam is retired, there is no current blueprint guarantee. Azure services and interfaces change, and the study guide itself warns that exams are updated periodically. Use the modules for concepts and methods, then consult current Microsoft documentation before applying a procedure in a live environment. Do not assume that an old objective list defines a current certification.
A practical study sequence
Begin with the OSI model, IP addressing, routing, DNS, authentication boundaries, and the distinction between IaaS and PaaS. Refresh Azure CLI, PowerShell, and Cloud Shell so that tool use does not interrupt reasoning. The goal is to explain what evidence belongs at each layer before you study individual Azure services.
Next, work through cloud and hybrid connectivity. Build a topology for ExpressRoute, site-to-site VPN, point-to-site VPN, virtual networks, and Virtual WAN. Then study name resolution and PaaS connectivity, because both frequently determine whether a seemingly healthy Azure resource is usable from a particular network.
After that, cover network security, routing, traffic control, and load balancing. Finish with virtual-machine access, Bastion, just-in-time access, and business continuity. This order moves from path fundamentals to controls and service behaviors, then applies the method to operational scenarios.
The associated path provides the historical sequence of modules, including business continuity, name resolution, cloud and hybrid connectivity, PaaS, authentication and access control, network security, routing and load balancing, virtual-machine connectivity, and VPN gateways: https://learn.microsoft.com/en-us/training/paths/azure-support-engineer-for-connectivity-specialty/.
How to study each module
Do not read a module once and mark it complete. For every topic, produce four outputs: a small architecture diagram, a symptom-to-cause table, a command or portal evidence list, and a safe remediation sequence. If you cannot state what observation would disprove your first hypothesis, your study has not yet reached troubleshooting level.
Use the module assessments as checks on understanding, not as a substitute for the lessons. After an incorrect answer, write down the boundary you missed: DNS versus routing, authentication versus authorization, route selection versus security filtering, or service configuration versus client configuration. Revisit that boundary before continuing.
When a lab or sandbox is available, change one variable at a time and record the expected result. If you use an Azure account, monitor resource creation and cleanup carefully. Microsoft’s training pages include Azure account links, but the pages supplied here do not establish a fixed study cost or a guaranteed free-lab arrangement for every learner.
What should a troubleshooting notebook contain?
A troubleshooting notebook turns disconnected product facts into a repeatable investigation. Keep one page for the incident statement, one for the topology, one for observations, one for hypotheses, and one for the remediation and validation plan. This structure is more useful than collecting unconnected command snippets.
Start each entry with the user-visible symptom and scope. “The application is down” is too broad; record the source, destination, protocol, time, affected users, and whether the issue is intermittent. Then document the intended path and actual evidence. Do not write the suspected cause as though it were already proven.
For each hypothesis, include the test, expected result, observed result, and next action. Examples of useful distinctions include: hostname fails but direct address works; one subnet fails while another succeeds; a tunnel is up but the destination prefix is absent; authentication succeeds but authorization fails; or a load-balancing frontend responds while a backend probe remains unhealthy.
End with validation. A remediation is incomplete until the original path works, the relevant scope is tested, and the change has not created a new exposure. This habit also prepares you for scenario questions because it forces you to select the next diagnostic action rather than choose a familiar product name.
Tools to practise
Practise the Azure portal for resource relationships and configuration, Azure CLI and PowerShell for repeatable inspection, and Cloud Shell for command execution. Pair each tool with a question: what is configured, what is effective, what is reachable, what identity is involved, or what state is reported? Tool familiarity matters only when it produces evidence tied to a hypothesis.
The learning modules identify prerequisites and tool expectations explicitly. The routing and load-balancing module includes Azure CLI, PowerShell, Cloud Shell, Visual Studio Code, JSON, and the OSI model; the cloud-and-hybrid module includes Azure CLI, PowerShell, and Cloud Shell. Use those requirements to create a short skills checklist before attempting service labs.
What mistakes weaken AZ-720 preparation?
The most damaging mistake is preparing as though AZ-720 were an active exam. Retirement changes the scheduling decision, so first verify the current Microsoft certification catalogue. The next mistake is treating the blueprint as product trivia. Connectivity troubleshooting requires path analysis, evidence collection, and controlled remediation across multiple services.
Avoid these patterns:
1. Memorizing isolated portal locations without understanding the traffic path.
2. Changing several rules at once, which removes the ability to identify the cause.
3. Treating a reachable host as proof that DNS, authorization, and application traffic are correct.
4. Assuming a VPN tunnel state proves that the required prefixes and workloads communicate.
5. Studying only virtual networks while neglecting identity, PaaS, backup, load balancing, and name resolution.
6. Using leaked questions, exam dumps, or remembered wording as a replacement for technical understanding. No collection of unauthorized material guarantees a pass and it does not provide a valid route to a retired exam.
7. Ignoring objective-version dates in the historical study guide. Microsoft supplied separate skills-measured lists for different periods, so mixing them without checking the date can create an inaccurate study outline.
A better response to uncertainty
When documentation or a lab result is unclear, label the uncertainty and gather a narrower observation. Check the source and destination, confirm the effective route, inspect the applicable security control, validate name resolution, and test identity separately. Avoid escalating from uncertainty directly to a broad configuration change.
For historical exam analysis, distinguish three kinds of statements: what Microsoft listed as a skill, what a training module teaches, and what is a sensible operational recommendation. The first two are source-backed scope; the third is a preparation method. Keeping those categories separate prevents an old study guide from being mistaken for current product guidance.
What were the historical delivery and scoring details?
The historical Microsoft study guide stated that a score of 700 or greater was required to pass Exam AZ-720. It also described an exam sandbox, accommodation requests, language availability through the Schedule Exam section, and a possible additional 30 minutes when the exam was not available in the candidate’s preferred language. These details describe the former exam documentation and should not be read as evidence that AZ-720 can now be scheduled.
Microsoft stated that English exam versions were updated first and that localized versions were updated approximately eight weeks after the English version in the usual process, while noting that exceptions could occur. Since the exam is retired, language and delivery information should be checked only for the current credential you choose, not carried forward automatically from AZ-720.
The historical study guide also explained that connecting a certification profile to Microsoft Learn allowed candidates to schedule and renew exams and share or print certificates. That profile workflow is useful context, but it does not override the retirement notice. The official historical study guide is https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-720.
Why the passing score is not a scheduling signal
A documented passing score tells you how the retired assessment was scored; it does not indicate that a registration slot exists. Do not use the 700 requirement to evaluate unofficial “pass guarantees,” and do not compare it with another certification’s score unless the current official documentation supports that comparison.
The same caution applies to delivery mode, language, accommodations, exam sandbox access, and score reports. Confirm those items on the official page for an active exam. If you require accommodations, use the current Microsoft process rather than relying on the historical AZ-720 study guide.
Can the old certification be renewed?
No current renewal path should be assumed. Microsoft’s renewal page states that the renewal assessment and the related Azure Support Engineer for Connectivity Specialty certification are retired. A community announcement reported that eligible holders could renew the certification one final time for one year, with the renewal window ending January 31, 2024; that historical window has passed.
The renewal page describes the former renewal model for Microsoft associate, expert, and specialty certifications as an online assessment and lists the same broad troubleshooting areas. It is useful for understanding the certification’s maintenance expectations, but it is not a live renewal option for AZ-720: https://learn.microsoft.com/en-us/credentials/certifications/azure-support-engineer-for-connectivity-specialty/renew/.
If you previously earned the certification, check your Microsoft Learn profile for its transcript record and expiration information. If you are planning a new credential, select an active certification instead of trying to revive the retired specialty through a third-party provider.
How to preserve the value of prior study
Map your old AZ-720 notes to current work tasks: diagnose a private endpoint failure, explain a VPN path, validate an effective route, isolate a firewall rule, investigate a load-balancer health problem, or separate authentication from authorization. Then compare those tasks with the objectives of a current Microsoft certification before choosing a replacement.
Keep dated notes for Azure features and commands. The historical study guide notes that exam content changes as required skills change, and current service behavior may not match older screenshots or procedures. A dated notebook makes it clear which knowledge needs revalidation.
A practical AZ-720 skills roadmap
Use the roadmap below as a compact decision framework. It is intended for historical AZ-720 study or present-day Azure support development, not for booking the retired examination. Progress only when you can explain the evidence and the next diagnostic step, not merely when you have read the service name.
First, establish the foundation: OSI layers, addressing, DNS, routing, Azure virtual-network structure, CLI, PowerShell, and Cloud Shell. Build a reusable incident template and practise tracing a request from client to endpoint.
Second, study hybrid paths: ExpressRoute, site-to-site VPN, point-to-site VPN, and Virtual WAN. Draw both control-plane state and data-plane traffic. Check address ranges and route selection before changing gateways.
Third, study name resolution and PaaS. Compare public and private endpoints, Private Link, Storage, CDN, VM integration, and the relationship between DNS, firewalls, and originating networks.
Fourth, study access and protection: Microsoft Entra authentication, authorization, network security groups, Azure Firewall, web application firewall controls, and latency. Record which control can deny, redirect, or slow the request.
Fifth, study traffic distribution and VM access: routing, traffic control, load balancing, Bastion, and just-in-time VM access. Practise selecting the correct evidence for deployment, connectivity, health, and authorization faults.
Sixth, finish with business continuity and mixed incidents. Combine two or more domains in one investigation, such as a private endpoint with DNS and firewall behavior, or a VM access problem involving just-in-time authorization and network rules.
Finally, review your notes against the official historical study guide and the individual Microsoft Learn modules. Mark each objective as explain, inspect, test, or resolve. Any objective marked only “recognize” needs practical work before you rely on it in an Azure support role.
A readiness check for practical work
You are better prepared when you can take an unfamiliar symptom and produce a bounded investigation without guessing the product at fault. You should be able to state the intended path, list the layers involved, select evidence, make one controlled change, and validate the original requirement.
Use these prompts for a final self-review:
1. Can I separate DNS failure from routing failure?
2. Can I distinguish tunnel establishment from application reachability?
3. Can I identify the effective security control for a flow?
4. Can I separate authentication from authorization?
5. Can I explain why a backend is or is not receiving load-balanced traffic?
6. Can I choose between Bastion and just-in-time VM access for a stated access need?
7. Can I use Azure CLI, PowerShell, or Cloud Shell to support an investigation rather than merely name the tools?
8. Can I cleanly document evidence, hypothesis, remediation, and validation?
If several answers are no, return to the relevant module and create a small lab or diagram. If the answers are yes, move to the more important current decision: identify an active certification or job requirement that reflects the skills you now possess.
What should you do next?
Do not schedule AZ-720: it was retired on July 31, 2023. Instead, use the official study guide to understand the historical scope, work through the Microsoft Learn modules that match your gaps, practise evidence-led troubleshooting, and verify a current certification choice against Microsoft’s live catalogue.
A sensible next action depends on your situation. A former candidate should check the Microsoft Learn transcript and convert the old plan to a current credential. A support engineer should start with the cloud-and-hybrid, PaaS, routing, and VM connectivity modules that match current incidents. A learner new to Azure should first satisfy the OSI, Azure CLI, PowerShell, and Cloud Shell prerequisites before tackling mixed scenarios.
The AZ-720 materials still provide a coherent model for Azure connectivity support: trace the path, verify name resolution, inspect routes and controls, separate identity from reachability, and validate the fix. Use that model responsibly, while treating retirement and current Microsoft documentation as the boundaries for any certification or scheduling decision.
Conclusion
AZ-720 is best approached today as a retired certification reference and an Azure troubleshooting curriculum, not as an available exam. Its historical scope centered on advanced support work across hybrid connectivity, PaaS, DNS, security, routing, load balancing, VPNs, virtual machines, access control, and business continuity. Build those abilities through Microsoft’s official study guide and learning modules, document your reasoning with evidence, and then choose an active Microsoft credential whose current requirements you have verified.
Related exams
- AI-200 exam — Developing AI Cloud Solutions on Azure
- AZ-104 exam — Microsoft Azure Administrator
- GH-600 exam — Developing in Agentic AI Systems
- AZ-120 exam — Planning and Administering Microsoft Azure for SAP Workloads
- PL-500 exam — Microsoft Power Automate RPA Developer
- AZ-140 exam — Configuring and Operating Windows Virtual Desktop on Microsoft Azure
Official sources
- Study guide for Exam AZ-720: Troubleshooting Microsoft Azure ...
- Microsoft Certified: Azure Support Engineer for Connectivity Specialty ...
- Azure Support Engineer for Connectivity Specialty - Training
- Renewal for Microsoft Certified: Azure Support Engineer for ...
- Troubleshoot cloud and hybrid connectivity in Microsoft Azure
- Troubleshoot platform-as-a-service issues in Microsoft Azure
- Troubleshoot connectivity issues with virtual machines in Microsoft Azure
- Troubleshoot routing, traffic control and load balancing in Microsoft Azure
