Microsoft Azure for SAP Workloads Specialty
225 practice questions
Last reviewed: April 2026
Personal notes and resource links for your study journey
Filter by Certification
AZ-120 is Microsoft's specialty credential for engineers running SAP workloads on Azure. It validates the ability to migrate SAP estates onto Azure, design and implement infrastructure to support SAP (compute, storage, networking specific to SAP), engineer high availability and disaster recovery for SAP HANA and SAP NetWeaver, and operate SAP workloads day to day. The audience is dual-skilled professionals who combine SAP Basis or infrastructure experience with Azure cloud expertise — a relatively narrow but well-paid intersection. Expect 40–60 questions in 100 minutes including drag-and-drop, hot-area, multiple-response, and at least one case study.
About 28%. Migration strategies (lift-and-shift, replatform, RISE with SAP), Azure Migrate, DMO with System Move, SAP database migration tooling, target architecture sizing, and assessment / readiness reviews.
About 27%. SAP-certified VM sizes (M-series, Mv2, Mv3), Premium SSD v2 / Ultra Disk for HANA, Azure NetApp Files for shared file systems, Proximity Placement Groups, and SAP-specific network design.
About 23%. SAP HANA System Replication with Pacemaker, SAP NetWeaver ASCS / SCS clustering, Azure Site Recovery for SAP, multi-region DR patterns, and backup with Azure Backup for SAP HANA.
About 22%. Monitoring with Azure Monitor for SAP solutions (AMS), patching, scaling, OS-tier optimizations (SLES / RHEL for SAP), and operational runbooks.
Services you'll encounter on the exam and why each one matters.
SAP-certified VM SKUs — M-series, Mv2, and Mv3 — that scale from 192 GB to 32 TB of memory for SAP HANA scale-up workloads, with SAPS ratings published per SKU.
Why it's on the exam: Domain 2 (Design and Implement an Infrastructure to Support SAP Workloads) tests VM-size selection against SAP-published SAPS targets and HANA TDI memory requirements.
Bare-metal-backed NFS/SMB file service that meets SAP HANA shared-storage performance and latency SLAs for /hana/shared, /hana/data, and /hana/log volumes.
Why it's on the exam: Domain 2 expects ANF as the reference shared-storage tier for HANA scale-out, sapmnt, and trans directory layouts.
Block storage tiers that decouple IOPS, throughput, and capacity for the SAP DB tier, certified for HANA /hana/data and /hana/log with sub-millisecond latency.
Why it's on the exam: Domain 2 questions on HANA storage sizing distinguish Premium SSD v2 / Ultra Disk from Premium SSD on disk-throughput grounds.
Logical grouping that pins SAP application servers, central services, and DB VMs into the same low-latency datacenter zone.
Why it's on the exam: PPGs are the canonical AZ-120 answer for keeping the SAP three-tier stack within the network-latency budget HANA requires.
Datacenter fault isolation primitives — AZs span physically separate facilities in a region; availability sets split fault and update domains within one datacenter.
Why it's on the exam: Domain 3 (HA/DR) tests AZ vs. availability-set placement for ASCS/ERS pairs, HANA primary/secondary, and PAS/AAS replicas.
Replication and failover service that orchestrates cross-region DR of SAP application VMs with recovery plans, replication groups, and test-failover runbooks.
Why it's on the exam: Domain 3 names ASR for application-tier DR, asking candidates to design RPO/RTO targets and exclude HANA from ASR in favor of native replication.
Backint-certified, application-consistent backup of SAP HANA databases to Recovery Services vaults, supporting full, incremental, and log backups.
Why it's on the exam: Domain 4 (Maintain SAP Workloads on Azure) tests Backint configuration, retention policy design, and restore RPO objectives.
Managed deployment, registration, and operations plane that models an SAP system as a first-class Azure resource (Virtual Instance for SAP / VIS).
Why it's on the exam: Domain 1 and Domain 4 reference ACSS for guided deployments, quality checks, and unified monitoring as the modern landing zone for SAP on Azure.
Software-defined network with subnets, NSGs, route tables, and global VNet peering used to build the hub-spoke topology SAP landing zones standardize on.
Why it's on the exam: Domain 2 expects the hub-spoke pattern with shared services (DNS, AD, jump hosts) in the hub and SAP tiers segmented across spoke subnets.
Private layer-3 connectivity from on-premises to Azure with up to 100 Gbps circuits, BGP routing, and ExpressRoute Global Reach for cross-region peering.
Why it's on the exam: Domain 1 (Migrate SAP Workloads) and Domain 2 require ExpressRoute for predictable latency between on-prem SAP estates and Azure-hosted DB or application tiers.
Layer-4 internal load balancer with floating-IP and HA-ports modes used to front ASCS/ERS, SCS, and HANA primary/secondary virtual hostnames.
Why it's on the exam: Domain 3 (HA/DR) asks how SAP central services achieve cluster failover — Standard LB with floating-IP is the AZ-120 answer.
Cluster engine that orchestrates HANA System Replication takeover, fencing via Azure Fence Agent, and stonith-block for split-brain protection on Linux.
Why it's on the exam: Domain 3 tests Pacemaker resource agents, sbd vs. Azure-fence-agent fencing, and the takeover dance during AZ failover.
Native Windows cluster that runs the SAP ASCS/ERS or SCS/ERS pair on Windows hosts with shared SOFS or Azure Shared Disk and a cluster-aware floating IP.
Why it's on the exam: Domain 3 covers the Windows path for ASCS HA — WSFC + SOFS or Premium SSD shared disk is the named pattern.
Managed jump host that brokers RDP/SSH to SAP application and DB VMs through the Azure portal without exposing public IPs on the SAP subnet.
Why it's on the exam: Domain 2 + Domain 4 emphasize zero public-IP exposure on SAP tiers; Bastion is the AZ-120 named admin-access pattern.
Migration-assessment hub that discovers SAP application and DB servers on-prem, sizes target Azure VMs against SAPS, and tracks waves through the migration project.
Why it's on the exam: Domain 1 (Migrate SAP Workloads) names Azure Migrate as the discovery and right-sizing tool for greenfield and brownfield SAP-to-Azure projects.
Cloud identity provider that federates SAP Fiori, SAP Cloud Platform, and S/4HANA with SAML / OIDC SSO via the Microsoft Cloud Connector for SAP.
Why it's on the exam: Domain 4 (Maintain SAP Workloads) tests Entra-ID-issued tokens, Conditional Access for SAP, and SAP IAS integration as the modern identity layer.
Managed HSM-backed key store that holds customer-managed keys for SAP HANA Transparent Data Encryption, ANF cross-region replication, and disk-set encryption.
Why it's on the exam: Domain 4 asks where HANA TDE root keys live — Key Vault with Managed HSM is the AZ-120 answer for regulated SAP estates.
Purpose-built monitoring service that ingests SAP HANA, SAP NetWeaver, SQL Server, and OS metrics into Log Analytics with SAP-specific dashboards and alert rules.
Why it's on the exam: Domain 4 makes AMS the named observability stack for production SAP estates, replacing point monitoring per VM.
CSPM + XDR plane that scores SAP subscriptions against the SAP-specific regulatory baseline (NIST, ISO, PCI-DSS, GDPR) and surfaces threat alerts from Defender for Servers/Storage.
Why it's on the exam: Domain 4 cites Defender for Cloud as the compliance-evidence and threat-detection layer covering SAP infrastructure end-to-end.
$130k–$175k–$240k USD annual
Range covers US-based senior SAP-on-Azure engineers and architects; salary data is sparser than for general Azure roles given the narrower talent pool. Senior consultants at large SAP-aligned consultancies (Accenture, Deloitte, Capgemini, IBM) and at SAP partners often clear $260k TC. The dual-skill premium is real.
Source: levels.fyi 2025 SAP / cloud-migration roles, U.S. BLS OEWS May 2024 (15-1241 computer network architects, 15-1252 software developers), Glassdoor 2025. Figures are approximate; actual compensation depends on role, region, and experience.
AZ-120 sits at one of the highest-leverage skill intersections in enterprise IT — SAP customers running large ERP / S/4HANA estates and migrating onto Azure or RISE with SAP. Demand is concentrated at large enterprises, SAP-aligned consultancies, and Microsoft-partner system integrators rather than at typical cloud-native shops. Recruiters use it as a strong signal of dual SAP-and-Azure competence, which commands a premium given the limited pool of qualified candidates. It pairs naturally with AZ-305 (architect track) and with traditional SAP certifications (SAP Certified Technology Associate). Demand should remain steady through the SAP S/4HANA migration deadline window into 2027–2030.
There are no formal prerequisites, but AZ-120 has the most demanding implicit prerequisites of any Microsoft Azure exam. Microsoft recommends extensive SAP infrastructure experience (typically SAP Basis or SAP infrastructure engineer roles) plus Azure expertise equivalent to AZ-104. Candidates lacking either side of the dual-skill profile generally struggle. AZ-900 is a useful conceptual on-ramp for SAP engineers new to Azure.
The official Microsoft Learn path covers all four domains in roughly 25–35 hours, but the path assumes deep SAP context that the modules do not teach. Effective preparation requires reading the SAP-on-Azure architecture-center documentation end-to-end, the SAP Note collection for Azure (especially Notes 1928533 and 2015553), and the SAP Workloads on Azure planning guide. Hands-on access to a real SAP HANA / NetWeaver lab is invaluable but expensive; many candidates rely on employer-sponsored sandbox environments.
AZ-120 sits in the Specialty tier — Microsoft's narrow-scope but high-depth band. Plan on 60–100 hours of study over 8–12 weeks for candidates with both SAP and Azure backgrounds; substantially longer if either side is weak. The exam runs about 100 minutes with 40–60 questions in multiple-choice, multiple-response, drag-and-drop, hot-area, and case-study formats. Case studies are timed separately and cannot be revisited.
The most common stumbling block is SAP-certified VM and storage sizing — Microsoft expects candidates to know which VM SKUs (M-series, Mv2, Mv3, HANA-certified Edsv5) are valid for production HANA workloads, and which storage configurations meet SAP's KPIs. SAP HANA System Replication paired with Pacemaker on SLES / RHEL is another consistent trap area. As a Specialty exam, AZ-120 has lower test-taker volume, so third-party study material is sparser than for associate or expert exams; lean primarily on Microsoft Learn and SAP-on-Azure architecture-center documentation.
Most recent skills-measured update. Refreshed VM SKU coverage (Mv3 series), expanded RISE with SAP framing, modernized Azure Monitor for SAP solutions content. Microsoft refreshes AZ-120 less frequently than role-based exams given its specialty status — typically every 18–24 months.
Restructured into the current four-domain layout, expanded RISE with SAP coverage, and integrated Azure NetApp Files content for HANA shared file systems.
Initial GA as one of the first Azure specialty exams. Original outline focused on classical SAP NetWeaver migrations and basic HANA HA on SUSE.
AZ-120 (Microsoft Azure for SAP Workloads Specialty) is a a deeply specialized exam covering advanced topics in a narrow domain — expect hands-on experience to be a prerequisite Specialty-level exam. Most candidates need 100–200 hours of study spread over 2–4 months for specialty exams. These assume hands-on experience in the specialty domain. Most candidates who score consistently above the passing threshold on practice exams pass on their first attempt.
Most candidates need 100–200 hours of study spread over 2–4 months for specialty exams. These assume hands-on experience in the specialty domain. Time-to-pass varies widely by prior experience. Engineers with hands-on production experience in the underlying technology typically need less; candidates new to the platform should plan toward the upper end of that range.
AZ-120 is a recognized credential in the Azure ecosystem and signals validated knowledge to employers, recruiters, and clients. Whether it is worth the time and fee for you depends on your role and goals — it tends to pay off most for cloud engineers, architects, and consultants who work with Azure day-to-day or want to move into roles that do.
The passing score for AZ-120 is 700 / 1000. The exam contains 50 questions and lasts 1 hr 40 min.
The AZ-120 exam fee is $165 USD. Fees are set by Azure and may vary by region; always confirm the current price on the official Azure certification page before booking.
Microsoft role-based certifications expire after 1 year but can be renewed for free via an unproctored online assessment on Microsoft Learn, starting 6 months before expiration.
Yes. You can take the exam online (proctored via the provider's secure browser, available 24/7 in most regions) or at an in-person Pearson VUE test center during business hours. Both formats use the same questions, time limit, and passing score.
CertLabPro provides 15 study modes across the practice question bank for AZ-120. The exam-simulation mode mirrors the real exam: 50 questions in 1 hr 40 min, with the same passing threshold of 700 / 1000. Browse mode lets you read every Q&A statically.