AZ-720 Exam Guide: Retirement Status and Azure Connectivity Troubleshooting Study Plan
AZ-720, Troubleshooting Microsoft Azure Connectivity, was designed to validate advanced Azure networking and connectivity troubleshooting for support engineers. It covered diagnosing issues across hybrid connectivity, virtual networks, routing, PaaS access, virtual machines, security, and VPNs. The practical decision is straightforward: AZ-720 is retired, so it is not a certification target to schedule; use its learning objectives only if they match the Azure support and network troubleshooting skills you need to build.
Confirm AZ-720 status before investing in exam prep
AZ-720 was retired on July 31, 2023, at 11:59 PM Central Standard Time, so candidates should not build a plan around booking or passing this exam now. Microsoft also retired the related Microsoft Certified: Azure Support Engineer for Connectivity Specialty certification and its renewal assessment.
The retirement changes the purpose of this guide. The official AZ-720 study guide and associated Microsoft Learn content remain useful references for building troubleshooting capability, but they are not evidence that the exam or certification can still be earned. If your employer, job description, or training plan names AZ-720, clarify whether it is requesting historical knowledge, an existing transcript record, or a current replacement credential before spending money on third-party training.
Microsoft stated that a previously earned Azure Support Engineer for Connectivity Specialty certification remains on the learner's Microsoft transcript after retirement. That is relevant to people documenting an earlier achievement, not to new candidates seeking a currently available credential.
Do not assume an old exam code has an active successor with identical objectives. Start with the current Microsoft credentials catalogue and the role requirements you are trying to meet. Then retain the AZ-720 learning path as a structured technical curriculum if Azure connectivity support is the capability gap you need to close.
What AZ-720 was intended to validate
AZ-720 was intended for support engineers who could apply advanced troubleshooting methods to networking and connectivity issues in Azure, particularly in hybrid environments. Its emphasis was diagnosis: isolating a failure, selecting an appropriate tool, interpreting evidence, and identifying a corrective action.
The official audience description goes beyond basic deployment knowledge. Candidates were expected to troubleshoot issues involving business continuity, hybrid environments, IaaS, PaaS, access control, networking, and virtual-machine connectivity. This is why a study approach based only on memorizing service descriptions would have been weak even when the exam was available.
The associated job role is Support Engineer, although the learning path also identifies Administrator and Network Engineer audiences. It is a sensible skills-development route for an operations engineer who receives connectivity incidents, a cloud administrator who needs a repeatable fault-isolation process, or a network engineer expanding from traditional networking into Azure services.
It is less suitable as a first Azure topic for someone who has not yet worked with cloud concepts, command execution, or common networking layers. Build the foundations first, then use incident-style practice. A candidate who can explain why a connection fails at a particular layer will gain more durable value than one who only recognizes Azure product names.
Use the measured-skills scope as a troubleshooting curriculum
The official learning path organizes the AZ-720 subject matter into nine troubleshooting areas. Treat those areas as an incident-response curriculum: learn the normal design, identify the observable symptom, collect evidence, test a likely cause, and document the resolution.
The supplied official materials enumerate objectives but do not provide domain weightings for this guide. Do not invent percentages or prioritize a topic merely because it feels familiar. Instead, assess your own exposure and spend more practice time where you cannot yet explain the troubleshooting sequence or choose the right diagnostic evidence.
Business continuity is one area in the learning path. Review how backup and recovery problems affect service restoration, then practice separating a connectivity symptom from a recovery or availability problem. This prevents a common support error: changing network controls before confirming that the workload and its recovery path are healthy.
Name resolution deserves independent practice. Build a clear sequence for checking whether the problem is name lookup, address selection, routing, a security control, authentication, or the destination service. A connection described as a 'DNS problem' can originate elsewhere, so write down what evidence would prove or disprove each layer.
Cloud and hybrid connectivity covers ExpressRoute, Azure virtual networks, and Azure Virtual WAN. The related module also includes troubleshooting ExpressRoute, site-to-site VPNs, point-to-site VPNs, virtual network connectivity, and Virtual WAN issues. Focus on drawing traffic paths between an on-premises endpoint and an Azure workload before attempting to diagnose them.
PaaS troubleshooting covers connectivity from on-premises users to Azure PaaS services and connectivity between PaaS services. Study the path as a service-access problem rather than treating it as a virtual-machine problem. Identify the client, the target service, the intended access path, and the configuration boundaries that can affect the connection.
The remaining areas are authentication and access control, network security, routing and traffic control, load balancing, virtual-machine connectivity, and VPN gateways. Microsoft Learn specifically frames the routing module around routing, traffic control, and load-balancing issues; the virtual-machine module addresses deployment, connectivity, and authorization issues involving Azure Bastion and just-in-time VM access.
Build the prerequisites before advanced troubleshooting
A productive AZ-720-aligned study plan starts with networking layers and command execution, because the official learning path lists the OSI model, Azure CLI, PowerShell, and Cloud Shell command execution as prerequisites. Without those basics, troubleshooting steps become disconnected product facts.
Use the OSI model as a reasoning aid, not as a script that must be repeated mechanically. For each incident you study, state the symptom, the initiating endpoint, the target, the expected path, and the evidence that would move your investigation to a different layer. This discipline is useful whether the issue involves a virtual machine, VPN, PaaS endpoint, or load-balanced application.
Before beginning complex hybrid scenarios, become comfortable running commands from Cloud Shell and reading the result rather than copying commands without interpretation. The goal is to know what question a command answers: whether it tests name resolution, confirms a configuration value, surfaces a route-related clue, or checks an access condition.
The routing, traffic-control, and load-balancing module adds useful preparation signals: experience with the OSI model, awareness of Azure Bastion, PowerShell and Azure CLI, Cloud Shell access, Visual Studio Code, and JSON. If JSON is new to you, practice reading a small configuration object and identifying the fields that could affect a network path. Do not make JSON syntax your main study topic; use it to improve your ability to inspect configuration data.
For the virtual-machine connectivity module, the stated prerequisites include Azure portal experience, Remote Desktop experience, Azure Bastion knowledge, familiarity with server and client management concepts and tools, and familiarity with Azure and cloud concepts. Address a missing prerequisite through targeted hands-on practice before you attempt broad troubleshooting exercises.
Study in a sequence that mirrors real fault isolation
Study connectivity from the simplest path dependencies to the most layered service scenarios. This order reduces confusion because later problems often depend on routing, access, name resolution, and endpoint behavior that should already be familiar.
Start with a baseline environment on paper or in a permitted Azure practice environment. Draw a client, a virtual network, a workload, a name-resolution component, an access boundary, and a destination. Annotate each arrow with the expected route and access method. The drawing does not need to represent a production architecture; it needs to help you reason about where a request can stop.
Next, work through name resolution and virtual-network connectivity. For every scenario, write a short hypothesis list before looking for a fix. A useful structure is: 'What changed?', 'Which clients are affected?', 'Can the target be reached by name and by address?', and 'What is the first failed dependency?' This prevents random configuration changes.
Then move to cloud and hybrid connectivity: ExpressRoute, site-to-site VPNs, point-to-site VPNs, virtual networks, and Virtual WAN. Practice differentiating a local-client issue from a gateway, route, or cloud-side issue. If you cannot express the expected end-to-end path in plain language, pause and redraw it before studying troubleshooting tools.
After that, add network security, routing, traffic control, and load balancing. These topics should be practiced together because a successful route does not necessarily mean the traffic is permitted, and a permitted connection does not necessarily reach the expected backend. Build scenarios with one observed symptom and several plausible causes, then identify what evidence would distinguish them.
Place PaaS connectivity, authentication and access control, Azure Bastion, just-in-time VM access, and business continuity later in the plan. These areas introduce service-specific or identity-related boundaries. By this point, you should already be comfortable ruling out basic path and name-resolution failures before examining more specialized controls.
Turn Microsoft Learn modules into usable practice
The official Microsoft Learn path is the most direct structured resource for AZ-720-aligned skills development: it is labeled Intermediate, contains 9 modules, and has an estimated duration of 6 hours 9 minutes. Treat that duration as the time for the learning path itself, not as a complete readiness estimate for advanced troubleshooting work.
Use each module in two passes. In the first pass, capture the intended troubleshooting workflow, important Azure components, and terms you need to revisit. In the second pass, close the material and explain a plausible incident from start to finish: the user-visible symptom, the likely boundaries, the evidence to collect, and the order in which you would test hypotheses.
The cloud and hybrid connectivity module is especially useful for path-based practice. Its objectives include ExpressRoute, site-to-site VPNs, point-to-site VPNs, virtual-network connectivity, and Virtual WAN. After completing it, create a compact comparison sheet that names the client location, connection method, Azure entry point, destination, and possible failure boundary for each scenario.
The PaaS module is useful for correcting an IaaS-only mindset. It addresses PaaS services and PaaS integration issues, including connectivity from on-premises users to Azure PaaS services and between PaaS services. Practice describing the service access path without assuming that a virtual machine is the destination or that VM troubleshooting steps apply unchanged.
For routing and load balancing, work through the module's distinction between routing and traffic control issues and load-balancing issues. A practical exercise is to write two incident notes that have similar symptoms but different causes: one where traffic does not follow the intended path and another where traffic reaches a balancing component but does not reach the intended backend behavior. The purpose is not to predict exam questions; it is to train precise problem classification.
The virtual-machine module can anchor secure administration scenarios. Microsoft Learn covers choosing between Azure Bastion and just-in-time VM access, as well as troubleshooting issues with each. Record what an authorization issue could look like versus a deployment or connectivity issue, and avoid treating every failed remote session as a network outage.
Use a practical phased study roadmap
A phased roadmap gives you a repeatable way to build skills without pretending that a retired exam has a current preparation timetable. Move forward when you can explain and test the troubleshooting logic for a phase, not when you have merely completed its reading.
Phase one is baseline fluency. Review the OSI model, Azure CLI, PowerShell, Cloud Shell, Azure portal navigation, and the basic components named in the learning path. Create a personal glossary only for terms you cannot define in the context of an incident. Finish this phase by tracing a simple client-to-workload request and naming the checks you would make at each point.
Phase two is core connectivity. Study name resolution, Azure virtual networks, VPN gateways, site-to-site VPNs, point-to-site VPNs, ExpressRoute, and Azure Virtual WAN. Build a troubleshooting worksheet for each technology with columns for symptom, scope of impact, expected path, diagnostic evidence, likely configuration boundary, and escalation information. This becomes more useful than scattered notes.
Phase three is traffic behavior and protection. Work through network security, routing, traffic control, and load balancing. Make yourself distinguish route selection, traffic permission, endpoint reachability, and backend distribution. A frequent mistake is to use a successful check at one boundary as proof that every later boundary is working.
Phase four is service and administration access. Study PaaS connectivity, authentication and access control, Azure Bastion, and just-in-time VM access. Frame every exercise around the identity of the client and the intended target. That framing makes it easier to spot whether a failure is tied to a particular user, device, network location, service endpoint, or access method.
Phase five is integrated incident practice. Select a scenario that combines at least two domains, such as an on-premises client accessing an Azure service through a hybrid connection while name resolution or access control changes the observed symptom. Write the investigation order before checking documentation. Afterward, compare your path with the official learning material and record the point where your reasoning became uncertain.
End each phase with a short review rather than immediately adding more material. Revisit incorrect assumptions, unclear terminology, and checks you performed in the wrong order. The practical outcome should be a smaller set of sharper diagnostic questions, not a larger set of product notes.
Practice troubleshooting without relying on answer memorization
The best practice for AZ-720 subject matter is to reason from a stated symptom to evidence and corrective options, not to memorize purported exam items. Microsoft noted that most AZ-720 questions covered general availability features, while Preview features could appear if commonly used; that historical guidance reinforces the need to understand behavior rather than memorize unstable details.
Create incident cards from the official topic areas. On one side, write a compact symptom such as an inability to connect from an on-premises client to an Azure service, inconsistent access to a workload, or a failed remote administration path. On the other side, write the client, destination, expected path, initial evidence, alternate hypotheses, and the next most useful check. Keep the scenario generic unless you can validate a configuration detail in official documentation.
When using hands-on exercises, change one condition at a time and keep a record of the symptom created. The record should distinguish what you changed, what you expected to happen, what you observed, and what evidence corrected your initial assumption. This is how you convert a lab into support-engineering practice rather than a sequence of clicks.
Use legitimate learning materials, official documentation, and practice that tests your reasoning. Material marketed as leaked questions or exam dumps is a poor substitute for diagnosis skills, may be inaccurate or outdated, and does not help with the real professional task of analyzing an unfamiliar connectivity incident.
If you use a commercial practice product for learning, treat every incorrect response as a research prompt. Verify the underlying Azure behavior against official documentation and explain why competing options do not fit the stated symptom. Do not treat a repeated score as proof of current certification readiness, particularly because AZ-720 itself is retired.
Avoid the troubleshooting mistakes that slow down study
Most weak AZ-720-aligned preparation fails because it skips problem definition and jumps straight to a preferred Azure service or command. Start with scope, path, and evidence; only then decide which configuration or tool deserves attention.
One common mistake is studying services in isolation. A candidate may know that ExpressRoute, VPN gateways, Azure Bastion, Private Link, Azure Firewall, or a load balancer exist but struggle to determine which boundary is relevant to a symptom. Counter this by drawing the path and naming which component is responsible for each stage of communication.
Another mistake is collapsing routing, security, identity, and application reachability into one broad idea of 'network access.' Keep separate notes for where traffic should go, whether it is permitted, whether the client is authorized, whether the name resolves as expected, and whether the target service is available through the intended method. The categories can interact, but they should not be assumed to be identical.
Do not neglect the client perspective. The PaaS module explicitly addresses on-premises-to-PaaS connectivity, while hybrid connectivity includes on-premises connection methods. In every scenario, define where the client is located, what it is attempting to reach, and whether the symptom is limited to that client population. This stops you from treating a localized problem as an Azure-wide outage.
Finally, avoid mistaking module completion for operational fluency. The learning path provides structured coverage, but readiness for a support role comes from repeatedly explaining why you would perform a particular check and what result would change your next action. Keep an evidence-first troubleshooting journal as you work through the modules.
What historical delivery information still means
Historical AZ-720 delivery information is useful only for interpreting old records and study-guide references; it is not a route to registration because the exam is retired. The official study guide stated that a score of 700 or greater was required to pass when the exam was active.
The same historical study guide described language availability through the Exam Details scheduling section and stated that candidates could request an additional 30 minutes if the exam was unavailable in their preferred language. Those details should not be used to plan an AZ-720 appointment now. For any current Microsoft exam, consult its live official details page and accommodation process instead of carrying forward information from a retired exam.
Microsoft's study guide also described periodic skills updates, with the English version updated first and localized versions generally updated approximately eight weeks later. It included objective lists for different dates because the skills measured had changed. That is a valuable reminder for current certifications: always align study materials to the current official skills outline, not to an older course, forum post, or archived exam page.
If you hold the historical certification, review your Microsoft transcript for the retained record and use the skills list to explain the technical scope you studied. If you do not hold it, describe the Microsoft Learn modules you completed and the troubleshooting skills you practiced rather than suggesting that you earned a retired credential.
Choose the next action based on your goal
Choose a current credential if you need an active certification, and choose the AZ-720 learning path if you need a focused Azure connectivity troubleshooting curriculum. Separating those goals prevents wasted preparation and makes your next step easier to explain to a manager or recruiter.
For a support-skills objective, begin the Microsoft Learn path and complete the modules in the phased order that matches your knowledge gaps. Start with the official prerequisites if command-line tools, networking layers, or portal basics are unfamiliar. Build evidence of learning through incident notes, path diagrams, and lab observations rather than an unsupported claim of exam readiness.
For a career or compliance objective, find the current Microsoft credential that matches the role requirement and review its current official skills outline before choosing a course or practice resource. Do not assume that a retired specialty certification's title, scope, or assessment model maps directly to a current offering.
For a historical-record objective, verify the transcript entry associated with the previously earned certification. Microsoft stated that previously earned Azure Support Engineer for Connectivity Specialty certifications remain on the learner's Microsoft transcript after retirement. Keep the wording accurate: recognize the credential as historical and focus discussions on the troubleshooting capabilities it represented.
The durable lesson from AZ-720 is a method: define the affected scope, map the path, collect evidence at the first likely boundary, test one hypothesis at a time, and document the result. That method remains useful long after a specific exam code has left the catalogue.
Conclusion
AZ-720 is a retired exam, not a current scheduling option. Its value now lies in the Azure troubleshooting curriculum it leaves behind: hybrid paths, name resolution, routing, security, PaaS access, VM administration access, load balancing, VPNs, and recovery-related incidents. Use the official learning path to develop those skills, verify any current certification against its live Microsoft outline, and keep your preparation centered on evidence-led diagnosis rather than memorized answers.
Related exams
- AI-200 exam — Developing AI Cloud Solutions on Azure
- AZ-104 exam — Microsoft Azure Administrator
- GH-600 exam — Developing in Agentic AI Systems
- AZ-120 exam — Planning and Administering Microsoft Azure for SAP Workloads
- PL-500 exam — Microsoft Power Automate RPA Developer
- AZ-140 exam — Configuring and Operating Windows Virtual Desktop on Microsoft Azure
Official sources
- Study guide for Exam AZ-720: Troubleshooting Microsoft Azure ...
- Microsoft Certified: Azure Support Engineer for Connectivity Specialty ...
- Renewal for Microsoft Certified: Azure Support Engineer for ...
- Azure Support Engineer for Connectivity Specialty - Training
- Troubleshoot cloud and hybrid connectivity in Microsoft Azure
- Troubleshoot platform-as-a-service issues in Microsoft Azure
- Troubleshoot routing, traffic control and load balancing in Microsoft Azure
- Troubleshoot connectivity issues with virtual machines in Microsoft Azure
