---
title: "AZ-305 Study Guide — Azure Solutions Architect Expert"
description: "An interactive study guide built on 7 memory techniques to help you pass the Microsoft Azure Solutions Architect Expert exam."
url: "https://lucidlabs.com.au/insights/az-305"
---

# Master the AZ-305

An interactive study guide built on 7 memory techniques to help you pass the Microsoft Azure Solutions Architect Expert exam.

Identity, Governance & Monitoring 25-30%Data Storage 20-25%Business Continuity 15-20%Infrastructure 30-35%

What it covers

Identity design (Entra ID, multi-tenant B2B/B2C, Conditional Access, PIM), governance (management groups, Azure Policy, Blueprints, landing zones, RBAC), monitoring (Azure Monitor, Log Analytics, Application Insights), data storage design (redundancy tiers, Azure SQL, Cosmos DB, Blob/Files/Disk), business continuity (Availability Zones/Sets, Azure Site Recovery, Backup, geo-replication), and infrastructure design (compute, hub-spoke networking, ExpressRoute, Azure Firewall, Front Door/Application Gateway/Traffic Manager) — all aligned to the Well-Architected Framework and Cloud Adoption Framework.

Ideal for

Azure Administrators (AZ-104) or experienced developers ready to move from hands-on implementation into solution architecture — designing, not just deploying, Azure workloads.

Aspire to this if

You’ve operated Azure environments and now need to prove you can design them — translating business requirements into Well-Architected, governed, resilient solutions that other engineers build.

Section 1 / Spatial Memory

## The Map

Tap any component to see what you need to know for the exam.

**🪪 Identity & Access**

Entra ID · Conditional Access · PIM

**🏛️ Governance & Landing Zones**

CAF · Management Groups · Policy

**📊 Monitoring Design**

Azure Monitor · Log Analytics · Insights

**💾 Storage Redundancy & Tiers**

LRS · ZRS · GRS · GZRS

**🗄️ Relational & NoSQL Data**

Azure SQL · Cosmos DB

**📦 Non-Relational Storage**

Blob · Files · Disk · Data Lake

**🏢 Availability Design**

Zones vs Sets

**🔄 Site Recovery & Backup**

ASR · Azure Backup

**🖥️ Compute Design**

VMs · AKS · App Service · Functions

**🌐 Network Topology**

Hub-Spoke · Peering · ExpressRoute

**🚦 App Delivery & Traffic**

Front Door · App Gateway · Traffic Manager

**🔥 Perimeter Security**

Azure Firewall · NSG · DDoS

Section 2 / Narrative Memory

## The Story

Follow the narrative to build a mental model of how everything connects.

🪪

### The Identity Foundation

Every Azure design starts with who can do what. Microsoft Entra ID underpins authentication for the entire estate. Conditional Access layers risk-based controls — requiring MFA for risky sign-ins, blocking legacy authentication, enforcing compliant devices. For workforce collaboration with partners, B2B guest invites bring external identities in; for customer-facing apps, Entra External ID (B2C) manages millions of local accounts without touching the corporate directory.

**Exam Intel**Know the distinction between B2B (partner/employee access to your resources) and External ID/B2C (customer identity for your apps). PIM eliminates standing privileged access — expect scenario questions about an “always-on Global Admin” being a design smell. Conditional Access policies combine signals (user, location, device, risk) with controls (block, require MFA, require compliant device).

🏛️

### Building the Landing Zone

Governance at scale starts before the first workload is deployed. Management groups create a hierarchy so policy and RBAC apply once and inherit everywhere below. The Cloud Adoption Framework’s landing zone pattern splits platform concerns (connectivity, identity, management, security) from individual application landing zones, so platform teams and app teams can move independently.

**Exam Intel**Distinguish Azure Policy (ongoing compliance enforcement — deny, audit, deployIfNotExists) from Blueprints/landing zone templates (initial environment packaging). Expect questions naming a specific requirement (“prevent resources outside australiaeast”) and asking for the right policy effect. Landing zone = platform + application split is a recurring scenario theme.

📊

### Seeing Everything

A design isn’t complete until it’s observable. Azure Monitor unifies metrics and logs across every resource. Log Analytics workspaces become the queryable data store, interrogated with KQL. Application Insights extends that visibility into application code itself — request rates, dependency failures, exception traces — completing the picture from infrastructure to code.

**Exam Intel**Workspace design questions test whether you know when to centralise (one workspace, simpler RBAC via table-level permissions) versus segment (per subscription/region, for data sovereignty or strict access boundaries). Diagnostic settings are the mechanism that gets platform logs into Log Analytics — don’t forget them in a design.

💾

### Choosing Redundancy

Every storage account design begins with a durability decision. LRS survives a disk failure. ZRS survives a datacentre failure. GRS survives a regional disaster, asynchronously. GZRS combines both. The right choice trades cost against how much data loss and downtime the business can tolerate.

**Exam Intel**LRS/ZRS protect within a region; GRS/GZRS add cross-region protection. RA-GRS/RA-GZRS add read access to the secondary. Exam scenarios describe an RPO/RTO or compliance requirement and expect you to pick the matching redundancy tier — memorise what each SKU actually protects against.

🗄️

### The Right Data Platform

Relational or non-relational, the data platform decision shapes everything downstream. Azure SQL Database suits new cloud-native apps; Managed Instance suits lift-and-shift needing near-full SQL Server compatibility; Cosmos DB suits globally distributed, elastically scalable, low-latency workloads. Blob Storage, Files, and Managed Disks round out the non-relational estate for objects, shares, and VM disks respectively.

**Exam Intel**Exam scenarios describe workload characteristics (global users, millisecond latency, flexible schema, or strict relational integrity) and expect the matching service — not a generic “use a database” answer. Know Cosmos DB consistency levels and Azure SQL purchasing models (DTU vs vCore) at a design level, not implementation depth.

🏢

### Surviving Failure

Availability Zones protect against a datacentre going dark; Availability Sets protect against a single rack or maintenance window inside one datacentre. Zone-redundant services extend that same protection to load balancers, storage, and gateways. A Well-Architected design chooses zones wherever the region and service support them.

**Exam Intel**Zones require region support (not universal) and per-service opt-in. A common exam pattern: given an SLA target, work backward to the required combination of zones, managed disks, and load balancer SKU. Standard Load Balancer is zone-redundant by default; Basic is not.

🔄

### Recovering from the Worst

Azure Site Recovery keeps a whole workload running when a region fails — replicating VMs continuously and orchestrating failover through a recovery plan. Azure Backup protects against a different threat: accidental deletion, corruption, or ransomware, by keeping application-consistent recovery points you can restore from independently of any regional event.

**Exam Intel**The classic trap is confusing ASR (workload continuity across regions) with Backup (point-in-time data recovery). A scenario asking “how do we keep the app running if a region fails” needs ASR; “how do we recover last Tuesday’s data” needs Backup. Many designs need both.

🖥️

### Picking Compute

Compute choice sits on a spectrum from full control to full abstraction. VMs give complete control over OS and runtime. AKS orchestrates containers for microservices at scale. Container Apps offer serverless containers without cluster management. App Service abstracts away the server entirely for standard web apps. Functions go further still, billing only for the milliseconds code actually runs.

**Exam Intel**Exam scenarios rarely say “use a VM” outright — they describe constraints (custom OS driver, no containerisation experience, event-driven bursts, microservices with independent scaling) and expect you to infer the right compute tier. Match constraint to abstraction level.

🌐

### Wiring the Network

Hub-spoke topology centralises shared services — firewall, gateways, DNS — in a hub VNet, with workload VNets peered as spokes. VNet peering is fast and private but non-transitive, so spoke-to-spoke traffic must route through the hub. ExpressRoute delivers private, predictable connectivity to on-premises; VPN is the lower-cost fallback.

**Exam Intel**Peering non-transitivity is a favourite exam trap — spokes can’t talk to each other through the hub without a route table sending traffic via a firewall or virtual appliance. Virtual WAN is the answer when the scenario mentions “many regions” or “many branch offices” — it automates hub-spoke at scale.

🚦

### Directing Traffic

Front Door sits at the global edge, routing HTTP(S) traffic across regions with CDN and WAF built in. Application Gateway handles layer-7 routing within a single region. Traffic Manager works purely at DNS level, resolving clients to the best endpoint without touching the traffic itself. Load Balancer distributes layer-4 traffic across VMs inside a region.

**Exam Intel**The exam tests you on picking the right layer: global + HTTP = Front Door. Regional + HTTP + WAF = Application Gateway. Non-HTTP or DNS-only global routing = Traffic Manager. Regional TCP/UDP = Load Balancer. Watch for “global” + “any protocol” — that’s the Traffic Manager signal, not Front Door.

Section 3 / Acronym Memory

## Mnemonic Wall

Memorable acronyms and phrases to anchor key exam concepts in your memory.

🪪

BCP

**B**2B, **C**onditional Access, **P**IM

Three identity design pillars. B2B = partner guest access. Conditional Access = risk-based sign-in controls. PIM = just-in-time privileged access.

🏛️

MPB

**M**anagement Groups, **P**olicy, **B**lueprints/Landing Zones

Governance hierarchy. Management groups = scope inheritance. Policy = ongoing enforcement. Blueprints/landing zones = initial packaging.

📊

MLA

**M**etrics, **L**og Analytics, **A**pplication Insights

Azure Monitor’s three pillars. Metrics = near-real-time numbers. Log Analytics = KQL-queryable logs. App Insights = code-level telemetry.

💾

LZGG

**L**RS, **Z**RS, **G**RS, **G**ZRS

Storage redundancy ladder, cheapest to most durable. LRS = datacentre. ZRS = zones. GRS = region. GZRS = zones + region.

🏢

ZvS

**Z**ones vs **S**ets

Availability Zones = separate datacentres, region-level protection. Availability Sets = fault/update domains, single-datacentre protection.

🚦

FAT-L

**F**ront Door, **A**pplication Gateway, **T**raffic Manager, **L**oad Balancer

Traffic routing by scope and layer. Front Door = global L7. App Gateway = regional L7. Traffic Manager = global DNS. Load Balancer = regional L4.

Section 4 / Contrast Memory

## Versus Arena

Side-by-side comparisons to sharpen your understanding of similar concepts.

vs

Availability ZonesvsAvailability Sets

Click to compare

#### High Availability Building Blocks

| Aspect | Availability Zones | Availability Sets |
| --- | --- | --- |
| Scope | Separate datacentres (region) | Single datacentre (racks) |
| Protects against | Datacentre-level failure | Rack/host failure, maintenance |
| SLA | 99.99% (zonal VM) | 99.95% |
| Region support | Not all regions | All regions |
| Fault domains | Physical, up to 3 zones | Up to 3 fault domains |
| Best for | Mission-critical, regional resilience | Basic HA within a datacentre |

Click to flip back

vs

Azure Site RecoveryvsAzure Backup

Click to compare

#### Disaster Recovery vs Data Protection

| Aspect | Azure Site Recovery | Azure Backup |
| --- | --- | --- |
| Purpose | Keep workload running after regional failure | Recover data after deletion/corruption |
| Scope | Entire VM/workload replication | Point-in-time data recovery points |
| Failover | Orchestrated recovery plans | Restore individual items/VMs |
| Replication | Continuous, near-real-time | Scheduled snapshots |
| RPO | Seconds to minutes | Hours (backup interval) |
| Best for | Regional disaster continuity | Ransomware/accidental deletion recovery |

Click to flip back

vs

Application GatewayvsFront DoorvsTraffic Manager

Click to compare

#### Traffic Routing Compared

| Aspect | Application Gateway | Front Door | Traffic Manager |
| --- | --- | --- | --- |
| Scope | Regional | Global | Global |
| Layer | L7 (HTTP/S) | L7 (HTTP/S) | DNS only |
| WAF | Yes | Yes | No |
| Routing basis | URL path, host header | Latency, priority, weighted | DNS resolution only |
| CDN | No | Built-in | No |
| Best for | Single-region app tier | Global HTTP entry point | Non-HTTP or hybrid global routing |

Click to flip back

vs

Azure PolicyvsBlueprints/Landing Zones

Click to compare

#### Enforcement vs Provisioning

| Aspect | Azure Policy | Blueprints/Landing Zones |
| --- | --- | --- |
| Purpose | Ongoing compliance enforcement | Initial environment packaging |
| Mechanism | Deny, audit, append, deployIfNotExists | Bundles policies, RBAC, templates |
| Timing | Continuous evaluation | Applied at deployment/assignment |
| Scope | Any management group/subscription | Subscription-level environment setup |
| CAF role | Guardrails within landing zones | Defines the landing zone itself |
| Best for | Preventing drift after deployment | Standing up a compliant environment fast |

Click to flip back

vs

Entra IDvsEntra Domain Services

Click to compare

#### Cloud Identity vs Managed Domain

| Aspect | Entra ID | Entra Domain Services |
| --- | --- | --- |
| Protocol | Modern (OAuth, OIDC, SAML) | Legacy (LDAP, Kerberos, NTLM) |
| Use case | Cloud app authentication | Lift-and-shift apps needing domain join |
| Management | No domain controllers to manage | Managed domain, no AD DS servers to patch |
| Trust | Not domain-joinable directly | VMs can domain-join |
| Sync | Source of identity | One-way sync from Entra ID |
| Best for | Cloud-native SSO | Legacy auth for migrated workloads |

Click to flip back

Section 5 / Grouping Memory

## Cheat Sheet

Organised reference grouped by exam domain — everything you need on one page.

### Identity, Governance & Monitoring

25-30%

#### Identity & Access

-   Entra ID: central identity plane for Azure, M365, and SaaS
-   Conditional Access: risk-based sign-in controls (MFA, device compliance, location)
-   PIM: just-in-time, time-bound, approval-gated privileged role activation
-   B2B guest access for partners; Entra External ID (B2C) for customer-facing apps
-   Hybrid identity via Entra Connect: password hash sync, pass-through auth, federation

#### Governance

-   Management groups: hierarchy for policy/RBAC inheritance above subscriptions
-   Azure Policy: deny, audit, append, modify, deployIfNotExists effects
-   Blueprints/landing zones: package policy + RBAC + templates into repeatable environments
-   CAF landing zone: platform landing zone (connectivity/identity/management) + application landing zones
-   RBAC: least-privilege at management group, subscription, resource group, or resource scope

#### Monitoring

-   Azure Monitor: Metrics (near-real-time) + Logs (queryable via KQL)
-   Log Analytics workspace: central store for diagnostic and activity logs
-   Application Insights: distributed tracing, dependency maps, code-level telemetry
-   Diagnostic settings: route platform logs/metrics to Log Analytics, Storage, or Event Hubs
-   Alerts + action groups: metric, log, and activity log alerts trigger automated responses

### Design Data Storage Solutions

20-25%

#### Redundancy & Tiers

-   LRS: 3 copies, single datacentre — cheapest, least durable
-   ZRS: synchronous replication across 3 availability zones
-   GRS/RA-GRS: asynchronous replication to paired region, optional read access
-   GZRS/RA-GZRS: zone + geo redundancy combined — highest durability
-   Access tiers (Hot/Cool/Cold/Archive): balance storage cost vs retrieval latency

#### Relational Data

-   Azure SQL Database: PaaS, vCore or DTU, serverless option
-   SQL Managed Instance: near-full SQL Server compatibility, VNet-native
-   SQL on VM: full IaaS control for unsupported features
-   Elastic pools: cost-efficient multi-database resource sharing

#### Non-Relational & NoSQL

-   Cosmos DB: globally distributed, multi-model, tuneable consistency
-   Blob Storage: unstructured object data, data lake landing zone
-   Azure Files: SMB/NFS shares, Azure File Sync for hybrid
-   Managed Disks: Standard HDD/SSD, Premium SSD, Ultra Disk by IOPS need

#### Data Security & Access

-   Private endpoints: bring storage/SQL/Cosmos data plane into the VNet
-   Encryption at rest by default; customer-managed keys via Key Vault for control
-   Firewall rules and VNet service endpoints restrict network access
-   Data classification and Purview for discovering and labelling sensitive data

### Design Business Continuity Solutions

15-20%

#### Availability

-   Availability Zones: separate datacentres, protect against DC failure
-   Availability Sets: fault + update domains, protect within one DC
-   Zone-redundant services: Standard Load Balancer, ZRS storage, zonal App Gateway
-   SLA improves with zones (99.99%) over sets (99.95%) over single VM (99.9%)

#### Disaster Recovery

-   Azure Site Recovery: continuous VM replication + orchestrated regional failover
-   Recovery plans: sequence multi-tier failover (network, app, data)
-   Azure Backup: scheduled, application-consistent recovery points in a Recovery Services vault
-   ASR = keep workload running; Backup = recover specific data

#### Data-Layer Continuity

-   Active geo-replication / auto-failover groups: readable secondaries for Azure SQL
-   Cosmos DB multi-region writes: 99.999% SLA with Last Writer Wins conflict resolution
-   Geo-redundant backup storage: cross-region restore for storage account data
-   Design RPO/RTO targets first, then select redundancy and replication to match

#### Recovery Metrics

-   RPO: maximum acceptable data loss window
-   RTO: maximum acceptable downtime
-   Lower RPO/RTO = higher cost and complexity — align to business impact, not habit
-   Test failover regularly; an untested DR plan is not a DR plan

### Design Infrastructure Solutions

30-35%

#### Compute

-   VMs: full control, full patching/scaling responsibility
-   AKS: container orchestration for microservices at scale
-   Container Apps: serverless containers, Dapr and KEDA-based scaling
-   App Service: PaaS web apps/APIs, deployment slots, no OS management
-   Functions: event-driven, consumption-billed, shortest-lived workloads

#### Networking Topology

-   Hub-spoke: shared services centralised in hub, workloads isolated in spokes
-   VNet peering: private, low-latency, non-transitive by default
-   Azure Virtual WAN: automates hub-spoke at scale across regions/branches
-   ExpressRoute: private high-bandwidth connectivity; VPN as lower-cost fallback

#### Traffic & Delivery

-   Front Door: global L7 entry, CDN + WAF + cross-region load balancing
-   Application Gateway: regional L7, WAF, URL-based routing, SSL offload
-   Traffic Manager: global DNS-based routing, protocol-agnostic
-   Load Balancer: regional L4 distribution across VMs

#### Perimeter Security

-   Azure Firewall: managed stateful firewall in the hub VNet, FQDN filtering
-   NSGs: subnet/NIC-level 5-tuple filtering, first line of segmentation
-   DDoS Protection Standard: adaptive tuning, attack analytics, cost protection
-   Private Link: removes public exposure for PaaS services

Section 6 / Method of Loci

## The Memory Palace

Walk through themed rooms — each object anchors a concept in spatial memory.

### The Identity & Governance Tower

Identity, Governance & Monitoring — Where control begins

🪪

Entra ID

Central identity plane. Conditional Access for risk-based sign-in. PIM for just-in-time privilege.

🏛️

Management Groups

Hierarchy above subscriptions. Policy and RBAC inherit downward automatically.

📜

Azure Policy

Deny, audit, append, deployIfNotExists. Continuous compliance enforcement, not one-time setup.

🏗️

Landing Zones

CAF pattern: platform landing zone + application landing zones. Packaged via Blueprints or templates.

📊

Azure Monitor

Metrics + Logs. Log Analytics workspace queried with KQL. App Insights for code-level telemetry.

### The Data Storage Vault

Data Storage — Where information lives

💾

Redundancy Ladder

LRS < ZRS < GRS < GZRS. Each step trades cost for wider failure protection.

🗄️

Azure SQL Family

SQL Database (PaaS), Managed Instance (compat), SQL on VM (IaaS control).

🌐

Cosmos DB

Global distribution, multi-model, tuneable consistency for low-latency apps.

📦

Blob / Files / Disk

Objects, SMB/NFS shares, and VM disks — pick by access pattern, not habit.

🔒

Private Endpoints

Bring storage and database data planes into the VNet, remove public exposure.

### The Recovery Fortress

Business Continuity — Where resilience is proven

🏢

Availability Zones

Separate datacentres. Protects against a datacentre-level failure. 99.99% SLA.

🧱

Availability Sets

Fault + update domains within one datacentre. 99.95% SLA. Works in every region.

🔄

Azure Site Recovery

Continuous VM replication. Orchestrated regional failover via recovery plans.

💾

Azure Backup

Application-consistent recovery points. Recovers data, not the running workload.

⏱️

RPO / RTO

Design targets first. Lower numbers cost more — match to business impact.

### The Infrastructure Yard

Infrastructure — Where workloads run

🖥️

Compute Spectrum

VM > AKS > Container Apps > App Service > Functions — control to abstraction.

🌐

Hub-Spoke

Shared services in the hub. Workload VNets as spokes. Peering is non-transitive.

🛣️

ExpressRoute

Private, high-bandwidth on-premises connectivity. VPN as the lower-cost fallback.

🚦

Traffic Layer Stack

Front Door (global) > App Gateway (regional) > Load Balancer (L4) — layer by scope.

🔥

Azure Firewall

Managed stateful firewall in the hub. FQDN and network rule filtering at scale.

Section 7 / Pattern Recognition

## Pattern Spotter

Decision trees and trigger-answer pairs — see the pattern, know the answer.

Which Identity/Access Pattern?

Which Identity/Access Pattern?  
  ├── External partner needs access to your resources → Entra B2B guest invite  ├── Customer-facing app needs its own sign-up/sign-in → Entra External ID (B2C)  ├── Admin needs temporary elevated access → Privileged Identity Management (PIM)  ├── Legacy app needs LDAP/Kerberos and domain join → Microsoft Entra Domain Services  └── Enforce MFA only for risky sign-ins → Conditional Access policy

Which Storage Redundancy?

Which Storage Redundancy?  
  ├── Dev/test, cost is the priority → LRS  ├── Protect against a datacentre outage, single region OK → ZRS  ├── Protect against a full regional disaster → GRS (add RA-GRS for read access)  ├── Need both zone and regional protection → GZRS / RA-GZRS  └── Analytics workload needing hierarchical namespace → ADLS Gen2 over Blob Storage

Which Business Continuity Tool?

Which Business Continuity Tool?  
  ├── Keep a whole VM/workload running after a region fails → Azure Site Recovery  ├── Recover a deleted or corrupted file/VM/database → Azure Backup  ├── Protect against a single datacentre failure → Availability Zones  ├── Protect against rack/host failure in one datacentre → Availability Sets  └── Need automatic geo-failover for Azure SQL → Auto-failover groups

Which Traffic / Compute Tool?

Which Traffic / Compute Tool?  
  ├── Global HTTP entry point with CDN and WAF → Azure Front Door  ├── Regional HTTP routing with WAF and URL rules → Application Gateway  ├── Global routing for non-HTTP or hybrid protocols → Traffic Manager  ├── Event-driven, short-lived, consumption billing → Azure Functions  └── Microservices needing fine-grained orchestration → Azure Kubernetes Service (AKS)

## Decision Cards

“just-in-time” or “time-bound elevation”→Privileged Identity Management (PIM)

“partner” or “external guest access”→Microsoft Entra B2B collaboration

“management group” or “policy inheritance”→Management group hierarchy with Azure Policy assignment

“deployIfNotExists” or “auto-remediate”→Azure Policy with a deployIfNotExists effect

“KQL” or “queryable logs”→Log Analytics workspace

“zone-redundant” or “survive a datacentre outage”→Availability Zones (or ZRS for storage)

“region fails” and “workload must keep running”→Azure Site Recovery

“recover last week’s data” or “ransomware recovery”→Azure Backup with a Recovery Services vault

“non-transitive” peering issue→Hub-spoke needs explicit routing (UDR through firewall) — peering alone won’t connect spokes

“global” + “any protocol” routing→Traffic Manager (DNS-based, protocol-agnostic)

Ready to certify?

## Train with practitioners, not presenters

Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day.

🎯

Tailored Content

Training built around your actual Azure estate, landing zone maturity, and architecture challenges — not generic slides.

🛠️

Hands-On Labs

Design landing zones, configure hub-spoke networking, implement HA/DR, and architect data platforms in guided lab environments.

📈

Exam + Capability

Pass the AZ-305 exam and build lasting Azure solution architecture skills your team can apply from day one.

[Talk to us about Azure Solutions Architect Expert training](https://lucidlabs.com.au/?service=training-consulting&message=I%27m%20interested%20in%20AZ-305%20Azure%20Solutions%20Architect%20Expert%20training%20for%20my%20team%20-%20covering%20identity%20and%20governance%20design%2C%20data%20storage%2C%20business%20continuity%2C%20and%20infrastructure%20architecture%20on%20Azure.#contact)

Custom training for teams & individuals — remote or on-site across Australia

![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg)

Keith Oak

Chief Technology Officer — Lucid Labs

Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day.

[LinkedIn ↗](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au ↗](https://lucidlabs.com.au/)Published 29-03-2026