Tag: Azure Cloud Services

Exam Prep Hub for AI-200: Developing AI Cloud Solutions on Azure

Welcome to the AI-200: Developing AI Cloud Solutions on Azure Exam Prep Hub!

Welcome to the one-stop hub with information for preparing for the AI-200: Developing AI Cloud Solutions on Azure certification exam. The content for this exam helps prepare you to be “responsible for contributing to all phases of implementing AI solutions on Azure, with an emphasis on back-end services and components. Youโ€™re also responsible for supporting all phases of the development lifecycle, including requirements gathering, design, development, deployment, security, and monitoring”.
Upon successful completion of the exam, you earn the Microsoft Certified: Azure AI Cloud Developer Associate certification.

This hub provides information directly here (topic-by-topic as outlined in the official study guide), links to a number of external resources, tips for preparing for the exam, practice tests, and section questions to help you prepare. Bookmark this page and use it as a guide to ensure that you are fully covering all relevant topics for the AI-200 exam and making use of as many of the resources available as possible.


Audience Profile (from Microsoft’s site)

As a candidate for this Microsoft Certification, youโ€™re responsible for contributing to all phases of implementing AI solutions on Azure, with an emphasis on back-end services and components. Youโ€™re also responsible for supporting all phases of the development lifecycle, including requirements gathering, design, development, deployment, security, and monitoring.
You should be proficient in:
- Azure SDKs and third-party SDKs used in Azure.
- Azure data management services.
- Azure monitoring and troubleshooting.
- Azure messaging and eventing.
- Vector databases.
- Python programming.
- Implementing containerized applications on Azure.

Skills at a glance (as specified in the official study guide)

  • Develop containerized solutions on Azure (20โ€“25%)
  • Develop AI solutions by using Azure data management services (25โ€“30%)
  • Connect to and consume Azure services (20โ€“25%)
  • Secure, monitor, troubleshoot Azure solutions (20โ€“25%)

Topic-by-Topic Exam Content

[click a topic link to access the content and practice questions for that topic]

Develop containerized solutions on Azure (20โ€“25%)

Implement container application hosting

Implement container-orchestrated solutions

Develop AI solutions by using Azure data management services (25โ€“30%)

Develop AI solutions by using Azure Cosmos DB for NoSQL

Develop AI solutions by using Azure Database for PostgreSQL

Integrate Azure Managed Redis in AI solutions

Connect to and consume Azure services (20โ€“25%)

Develop event- and message-based AI solutions

Develop and implement Azure Functions

Secure, monitor, and troubleshoot Azure solutions (20โ€“25%)

Implement secure Azure solutions

Monitor and troubleshoot Azure solutions


AI-200 Practice Exams

AI-200 Practice Exam #1 (30 questions)

AI-200 Practice Exam #2 (30 questions)

AI-200 Practice Exam #3 (30 questions)

AI-200 Practice Exam #4 (30 questions)


Important AI-200 Resources

Link to the free, comprehensive, self-paced course on Microsoft Learn:

Develop AI cloud solutions on Azure

This course has 9 learning paths:

(1) Implement container application hosting on Azure

This learning path has 2 modules:
(i) Store and manage containers in Azure Container Registry
(ii) Deploy containers to Azure App Service

(2) Deploy and manage apps on Azure Container Apps

This learning path has 3 modules:
(i) Deploy containers to Azure Container Apps
(ii) Manage containers in Azure Container Apps
(iii) Scale containers in Azure Container Apps

(3) Deploy and monitor applications on Azure Kubernetes Service

This learning path has 3 modules:
(i) Deploy applications to Azure Kubernetes Service
(ii) Configure applications on Azure Kubernetes Service
(iii) Monitor and troubleshoot applications on Azure Kubernetes Service

(4) Develop AI solutions with Azure Cosmos DB for NoSQL

This learning path has 3 modules:
(i) Build queries for Azure Cosmos DB for NoSQL
(ii) Implement vector search on Azure Cosmos DB for NoSQL
(iii) Optimize query performance for Azure Cosmos DB for NoSQL

(5) Develop AI solutions with Azure Database for PostgreSQL

This learning path has 3 modules:
(i) Build and query with Azure Database for PostgreSQL
(ii) Implement vector search with Azure Database for PostgreSQL
(iii) Optimize vector search in Azure Database for PostgreSQL

(6) Enhance AI solutions with Azure Managed Redis

This learning path has 3 modules:
(i) Implement data operations in Azure Managed Redis
(ii) Implement event messaging with Azure Managed Redis
(iii) Implement vector storage in Azure Managed Redis

(7) Integrate backend services for AI solutions

This learning path has 3 modules:
(i) Queue and process AI operations with Azure Service Bus
(ii) Develop event-driven AI workflows with Azure Event Grid
(iii) Build serverless AI backends with Azure Functions

(8) Manage application secrets and configuration for AI solutions

This learning path has 2 modules:
(i) Manage application secrets with Azure Key Vault
(ii) Manage application settings with Azure App Configuration

(9) Observe and troubleshoot apps on Azure

This learning path has 2 modules:
(i) Instrument an app with OpenTelemetry
(ii) Analyze app telemetry with logs and metrics

Link to the certification page:

Link to the “Microsoft Certified: Azure AI Cloud Developer Associate” certification page.

Link to the study guide:

Link to the Study Guide for AI-200: Building Intelligent Applications.

A highly rated course on Udemy:

AI-200: Azure AI Cloud Developer Associate Exam Prep

YouTube Video Series

AI Cloud Developer AI-200 Series


Good luck to you passing the AI-200 Exam!
However, the more preparation you have, the less luck you will need. ๐Ÿ™‚

Visit this post to see the list of all the certification preparation hubs available on The Data Community.

Implement event-driven workflows by using Azure Event Grid, including filters, custom events, and retries (AI-200 Exam Prep)

This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Connect to and consume Azure services (20โ€“25%)
   --> Develop event- and message-based AI solutions
      --> Implement event-driven workflows by using Azure Event Grid, including filters, custom events, and retries


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Modern AI applications frequently need to react to events rather than continuously poll systems for changes. For example:

  • A document is uploaded and needs to be processed.
  • A new customer record is created and should trigger enrichment.
  • An AI model finishes processing a request.
  • A database record changes and downstream systems need to respond.
  • A custom application event needs to trigger a serverless workflow.

Azure Event Grid is an event-routing service designed to connect event producers with event handlers. It can receive events from Azure services, custom applications, and partner sources and route matching events to subscribers.

For the AI-200 exam, you should understand how to:

  1. Design event-driven workflows with Event Grid.
  2. Create and use custom events and custom topics.
  3. Configure event subscriptions.
  4. Filter events.
  5. Understand Event Grid delivery and retry behavior.
  6. Configure retry policies and dead-lettering.
  7. Design consumers to tolerate duplicate or out-of-order events.

Event Grid is particularly useful when an application needs to react to something that has happened rather than explicitly requesting something to happen.


1. What Is Azure Event Grid?

Azure Event Grid is a managed event-routing service.

At a high level, the architecture looks like this:

Event source โ†’ Event Grid โ†’ Event subscription โ†’ Event handler

For example:

Blob Storage โ†’ Event Grid โ†’ Azure Function

A file upload can generate an event. Event Grid receives that event and routes it to an Azure Function, which processes the file.

Another example might be:

Application โ†’ Custom Event Grid Topic โ†’ Event Grid Subscription โ†’ AI Processing Service

The application publishes an event such as:

DocumentUploaded

Event Grid determines which subscriptions are interested in the event and delivers it to the appropriate handlers.

Event Grid supports system events from Azure services, custom application events, and partner events. It also provides filtering so subscribers receive only the events they need.


2. Event-Driven Architecture

An event-driven architecture separates the component that produces an event from the components that consume the event.

Consider an AI document-processing application.

A user uploads a document:

User
|
v
Blob Storage
|
| BlobCreated event
v
Event Grid
|
+----> Document Processing Function
|
+----> Audit Function
|
+----> Notification Service

The Blob Storage service doesn’t need to know how each consumer processes the event.

This provides several advantages:

  • Loose coupling
  • Independent scaling
  • Easier integration
  • Asynchronous processing
  • Multiple consumers
  • Reduced polling
  • Easier addition of new workflows

This is especially valuable for AI workloads because AI processing can be computationally expensive or time-consuming.

Instead of having an application constantly check whether something changed, an event can initiate processing only when necessary.


3. Important Event Grid Concepts

Several Event Grid terms are important for the AI-200 exam.

Event

An event describes something that happened.

Examples include:

ImageUploaded
DocumentCreated
OrderCompleted
ModelTrainingCompleted
CustomerCreated

An event generally contains information about the occurrence rather than instructions for what the receiver must do.

For example:

{
"eventType": "DocumentUploaded",
"subject": "/documents/invoice-123.pdf",
"data": {
"documentType": "invoice",
"customerId": "C1001"
}
}

Event Source

The event source is the system that generates the event.

Examples include:

  • Azure Storage
  • Azure resources
  • Custom applications
  • Partner services

Topic

A topic provides an endpoint through which events can be published.

For custom applications, you can create a custom topic and publish application-specific events to it.

For example:

OrderEvents

could receive:

OrderCreated
OrderUpdated
OrderCancelled
OrderCompleted

A custom topic allows an application to publish its own events without having to use an Azure service’s built-in event source.


Event Subscription

An event subscription tells Event Grid:

“Send matching events to this destination.”

A subscription connects an event source or topic to an event handler.

A subscription can define:

  • Destination
  • Event type filters
  • Subject filters
  • Advanced filters
  • Retry behavior
  • Dead-letter configuration

For example:

Custom Topic
|
+---- Subscription A โ†’ Azure Function
|
+---- Subscription B โ†’ Webhook
|
+---- Subscription C โ†’ Service Bus

Each subscription can independently determine which events it wants.


4. Event Handlers

The event handler is the destination that processes the event.

Depending on the Event Grid scenario, event handlers can include services such as:

  • Azure Functions
  • Azure Logic Apps
  • Webhooks
  • Azure Service Bus
  • Azure Event Hubs
  • Other supported Azure destinations

For AI applications, Azure Functions are particularly useful for lightweight event processing.

For example:

BlobCreated
|
v
Event Grid
|
v
Azure Function
|
+---- Extract text
+---- Generate embedding
+---- Store metadata
+---- Update search index

5. Event Grid vs. Message Queues

A common exam distinction is between events and messages/commands.

Event Grid is primarily an event-routing service.

It is appropriate when you want to communicate:

“Something happened.”

For example:

DocumentUploaded

A messaging service such as Azure Service Bus is more appropriate when you need durable message processing, commands, queues, transactions, sessions, or more sophisticated competing-consumer patterns.

For example:

ProcessThisDocument

is more command-like.

A useful rule is:

RequirementCommon choice
React to an eventEvent Grid
Route events to multiple consumersEvent Grid
Serverless event triggeringEvent Grid
Durable command/message processingService Bus
Queue-based workload processingService Bus
Pub/sub event routingEvent Grid

The services can also be combined.

For example:

Blob Storage
|
v
Event Grid
|
v
Service Bus Queue
|
v
AI Worker

Event Grid detects the event, while Service Bus provides durable message-processing capabilities.


6. Custom Events

A custom event is an event generated by your own application rather than an Azure service.

For example, an AI application might generate:

DocumentClassificationCompleted

with data such as:

{
"eventType": "DocumentClassificationCompleted",
"subject": "/documents/12345",
"data": {
"documentId": "12345",
"classification": "Invoice",
"confidence": 0.97
}
}

The application publishes the event to a custom Event Grid topic.

Other applications can subscribe to that topic.

For example:

AI Processing Application
|
| DocumentClassificationCompleted
v
Event Grid Topic
|
+------> Billing System
|
+------> Audit System
|
+------> Notification System

This provides a loosely coupled architecture.

The AI processing application doesn’t need to know which systems are consuming the event.


7. Custom Topics

A custom topic provides a user-defined Event Grid endpoint for publishing application events.

For example:

CustomerEvents

The application publishes events to the topic, and subscribers consume matching events.

A custom topic is appropriate when:

  • Your application generates its own events.
  • You need an application-specific event endpoint.
  • You want multiple applications to subscribe to your events.
  • You want Event Grid to perform routing and filtering.

The topic can support Event Grid or CloudEvents schemas depending on the configuration. Event Grid supports multiple event schemas, including Event Grid schema and CloudEvents schema.


8. Event Types

Event types identify what happened.

For example:

DocumentCreated
DocumentDeleted
DocumentProcessed
DocumentFailed

A single topic can publish multiple event types.

A subscriber may only be interested in one or two.

For example:

Topic
|
+-- DocumentCreated
+-- DocumentUpdated
+-- DocumentDeleted
+-- DocumentProcessed

A subscription could specify:

Included event types:
DocumentProcessed
DocumentFailed

The subscriber would not receive the other event types.

Event type filtering is one of the simplest and most important forms of Event Grid filtering.


9. Event Filtering

Event filtering is one of the most important AI-200 concepts.

Suppose a topic receives thousands of events:

DocumentCreated
DocumentUpdated
DocumentDeleted
ImageUploaded
VideoUploaded

A particular Function might only care about:

DocumentCreated

Instead of sending every event to the Function and filtering them in application code, Event Grid can filter the events before delivery.

This reduces:

  • Unnecessary network traffic
  • Function executions
  • Processing
  • Cost
  • Application complexity

Event Grid supports several filtering approaches.


10. Event Type Filtering

Event type filtering allows a subscription to receive only specific event types.

For example:

Included event types:
DocumentCreated
DocumentUpdated

Events such as:

DocumentDeleted

would not be delivered to that subscription.

This is appropriate when the routing decision is based primarily on the type of event.


11. Subject Filtering

Events have a subject that identifies the resource or object associated with the event.

For example:

/documents/invoices/2026/invoice-123.pdf

A subscription can filter based on whether the subject:

  • Begins with a specified value
  • Ends with a specified value

For example:

Subject begins with:
/documents/invoices/

would select events associated with invoice documents.

Another example:

Subject ends with:
.pdf

could be used to select PDF-related events.

Subject filtering is useful when the event type is the same but the resource or path differs.


12. Advanced Filtering

Advanced filtering provides more precise filtering based on event properties.

For example:

{
"data": {
"department": "finance",
"priority": 5,
"environment": "production"
}
}

A subscription could filter on:

data.department = "finance"

or:

data.priority > 3

or:

data.environment = "production"

Advanced filters support different data types and operators, including string, numeric, Boolean, and array-based filtering.


13. Common Advanced Filter Operators

Important operators include:

String operators

Examples include:

StringIn
StringNotIn
StringContains
StringNotContains
StringBeginsWith
StringNotBeginsWith
StringEndsWith
StringNotEndsWith

Numeric operators

Examples include:

NumberIn
NumberNotIn
NumberLessThan
NumberLessThanOrEquals
NumberGreaterThan
NumberGreaterThanOrEquals

Boolean

BoolEquals

There are also operators for null/undefined values and range-based comparisons.

For the exam, focus on understanding why you would use advanced filtering rather than memorizing every operator.


14. Example: Advanced Filtering

Imagine the application publishes:

{
"eventType": "DocumentUploaded",
"data": {
"documentType": "invoice",
"priority": 8,
"environment": "production"
}
}

A subscription might filter for:

data.documentType = invoice

This means the subscriber only receives invoice events.

Another subscription might use:

data.priority >= 7

to receive only high-priority documents.

This is much more efficient than delivering every event and performing the filtering inside the application.


15. Combining Filters

You can use multiple filters to create more selective subscriptions.

For example:

Event Type = DocumentUploaded
AND
data.documentType = invoice
AND
data.environment = production

This creates a narrowly targeted event stream.

A good event design therefore includes meaningful event metadata.

For example:

{
"eventType": "DocumentUploaded",
"subject": "/documents/12345",
"data": {
"documentType": "invoice",
"environment": "production",
"priority": 8
}
}

Good event metadata makes downstream routing much easier.


16. Designing Event Subjects

When designing custom events, don’t treat the subject as an arbitrary string.

A meaningful subject can make filtering easier.

For example:

/documents/invoices/2026/12345

is much more useful for routing than:

12345

A hierarchical subject can allow subscriptions to target broad or narrow groups of events.

For example:

/documents/invoices/

could represent all invoice documents.

A more specific path could identify:

/documents/invoices/2026/12345

This is particularly useful in large event-driven systems.


17. Event Delivery

Event Grid uses a push delivery model for many common Event Grid workflows.

When an event matches a subscription, Event Grid attempts to deliver it to the destination.

A successful HTTP response indicates successful delivery.

Event Grid considers HTTP status codes in the 200โ€“204 range successful for delivery. Other responses are treated as failures and may result in retries or dead-lettering depending on the error and configuration.


18. At-Least-Once Delivery

One of the most important concepts for the exam is that Event Grid uses an at-least-once delivery model.

This means an event can potentially be delivered more than once.

For example:

Event published
|
v
Event Grid
|
+----> Consumer
|
+---- Processing succeeds
|
+---- Response delayed

If Event Grid cannot determine that delivery succeeded, it may retry.

The consumer could therefore receive the same event again.

Design implication

Event handlers should be idempotent whenever possible.

For example, instead of blindly performing:

Insert record

the consumer could use the event ID to determine whether it has already processed the event.


19. Event Ordering

Event Grid does not guarantee event ordering.

For example, an application might publish:

Event A
Event B
Event C

but the consumer could receive:

Event B
Event A
Event C

Therefore, applications that require strict ordering should not assume that Event Grid delivery preserves publication order.

If ordering is a hard requirement, another messaging design may be more appropriate.


20. Retry Behavior

If Event Grid cannot successfully deliver an event, it can retry delivery.

Event Grid uses an exponential-backoff-based retry schedule.

The current documented retry schedule includes progressively longer delays, beginning with short delays and eventually extending to hours. Event Grid may also delay or skip certain retries when an endpoint remains unhealthy.

The important exam concept is:

Event Grid does not immediately give up when an endpoint fails.

Instead, it attempts delivery again according to its retry behavior and configured retry policy.


21. Configurable Retry Policy

Event Grid allows you to configure two important retry limits:

  1. Maximum delivery attempts
  2. Event time-to-live (TTL)

The documented limits are:

SettingDefaultValid range
Maximum delivery attempts301โ€“30
Event TTL1,440 minutes1โ€“1,440 minutes

If both are configured, whichever limit is reached first determines when Event Grid stops attempting delivery.

Example

Suppose you configure:

Maximum attempts = 5
TTL = 30 minutes

If the event reaches five attempts before 30 minutes:

Stop retrying

If 30 minutes expires before five attempts occur:

Stop retrying

The retry schedule itself is not directly configurable. You configure the limits, not the individual retry intervals.


22. Dead-Lettering

When an event can no longer be delivered within the configured retry policy, you may want to preserve it instead of losing it.

This is where dead-lettering comes into play.

Event Grid can send undeliverable events to an Azure Storage Blob container.

Conceptually:

Event Grid
|
| delivery failures
v
Retry
|
| retry limit reached
v
Dead-letter storage

Dead-lettering is not enabled automatically for every subscription. You configure a storage account/container as the dead-letter destination.


23. Why Dead-Lettering Matters

Dead-lettering is particularly important when events represent business-critical operations.

Suppose an AI application generates:

DocumentProcessingCompleted

and the downstream billing system is temporarily unavailable.

Without a dead-letter destination, an event that ultimately cannot be delivered may be dropped.

With dead-lettering:

DocumentProcessingCompleted
|
v
Event Grid
|
v
Billing System
|
delivery fails
|
v
retries
|
v
Dead-letter Blob

An operations team or automated process can later inspect and reconcile those events.


24. Important HTTP Failure Behaviors

Not all HTTP errors are treated identically.

For example, certain configuration-related errors such as:

400 Bad Request
403 Forbidden
413 Request Entity Too Large

can cause Event Grid to stop retrying rather than repeatedly attempting an endpoint that is unlikely to succeed.

Other failures can result in retries.

For example:

503 Service Unavailable

is a typical transient failure for which retry behavior is appropriate.

Exam takeaway

Do not assume:

“Every failed HTTP request is retried forever.”

Event Grid distinguishes between failures and applies its delivery and retry rules accordingly.


25. Dead-Lettering vs. Retry

These concepts should not be confused.

Retry

Retry means:

“Try delivering the event again.”

Dead-letter

Dead-letter means:

“The event could not be successfully delivered within the applicable delivery policy, so preserve it for later investigation or processing.”

The general workflow is:

Publish
|
v
Deliver
|
+---- Success โ†’ Done
|
+---- Failure
|
v
Retry
|
+---- Success โ†’ Done
|
+---- Limits reached
|
v
Dead-letter

26. Delayed Delivery

Event Grid also protects unhealthy endpoints through delayed delivery.

If an endpoint repeatedly fails, Event Grid can delay subsequent deliveries to avoid overwhelming an already unhealthy system.

This is important in high-volume AI workloads.

Imagine an AI endpoint can process only 100 requests per second but suddenly receives thousands of events.

Repeatedly retrying failures immediately could make the problem worse.

Event Grid’s retry and delayed-delivery behavior helps prevent this type of cascading overload.


27. Event Grid and Azure Functions

A common AI-200 scenario is:

Event Source
|
v
Event Grid
|
v
Azure Function

For example:

Blob uploaded
|
v
Event Grid
|
v
Function
|
+---- Extract text
+---- Generate embedding
+---- Store vector

This architecture provides several advantages:

  • Serverless execution
  • Automatic scaling
  • Event-driven processing
  • Loose coupling
  • Reduced polling
  • Integration with other Azure services

However, the Function should still be designed for retries and duplicate events.


28. Event Grid and AI Workloads

Event-driven architectures are particularly useful for AI applications.

Consider a document ingestion pipeline:

Blob Storage
|
| BlobCreated
v
Event Grid
|
v
Azure Function
|
+---- Extract content
|
+---- Generate embedding
|
+---- Store in PostgreSQL
|
+---- Publish DocumentIndexed
|
v
Event Grid
|
+---- Notify application
+---- Update analytics

This creates a pipeline in which each stage can react to the completion of another stage.


29. Example: AI Image Processing

Suppose an application receives images.

When an image is uploaded:

Image Upload
|
v
Blob Storage
|
v
Event Grid
|
v
Azure Function
|
+---- Computer vision analysis
|
+---- Store results
|
+---- Publish ImageAnalyzed

Another subscriber might listen for:

ImageAnalyzed

and update a search index.

A third subscriber might send a notification.

The original uploader does not need to know about these downstream processes.


30. Designing Reliable Event Handlers

Because Event Grid can deliver events more than once, consumers should be designed appropriately.

Make operations idempotent

An operation is idempotent when executing it multiple times produces the same intended result as executing it once.

For example:

Set document status = "Processed"

is naturally more idempotent than:

Increment processed-count

If an event is delivered twice, an increment operation could incorrectly increase the count twice.


Track Event IDs

Consumers can maintain a record of processed event IDs.

For example:

Event ID: 8f72...
Status: Processed

When the same event arrives again:

Event already processed

The consumer can safely ignore it.


31. Avoiding Long-Running Event Handlers

Event handlers should generally acknowledge events promptly when possible.

A common architecture for longer AI operations is:

Event Grid
|
v
Function
|
v
Service Bus
|
v
Long-running AI Worker

The Function receives the event and places a durable work item into Service Bus.

The worker can then perform the longer operation.

This separates event notification from workload processing.


32. Event Grid Filtering vs. Application Filtering

Consider two designs.

Design A

Event Grid
|
v
Function
|
+---- Check event type
+---- Check priority
+---- Check environment

Design B

Event Grid
|
| Filter
v
Function

When the filtering criteria can be expressed through Event Grid subscription filters, Design B is generally preferable.

Benefits include:

  • Less unnecessary invocation
  • Lower processing overhead
  • Less network traffic
  • Lower cost
  • Simpler application code

This is an important architectural principle.


33. Multiple Subscribers

One of Event Grid’s strengths is that multiple subscriptions can consume the same event stream independently.

For example:

CustomerCreated
|
v
Event Grid
|
+---- Subscription 1 โ†’ CRM Function
|
+---- Subscription 2 โ†’ Analytics Function
|
+---- Subscription 3 โ†’ Notification Function

Each subscription can have its own:

  • Destination
  • Filter
  • Retry configuration
  • Dead-letter configuration

This allows one event to initiate multiple independent workflows.


34. Event Grid Delivery Batching

Event Grid normally delivers events individually.

For high-throughput scenarios, batching can be enabled.

Batching can improve HTTP efficiency by delivering multiple events in one request.

Current Event Grid push delivery supports configurable batch settings, including maximum events per batch and preferred batch size. Batching uses all-or-none semantics for a delivery request, so consumers must be able to process the entire delivered batch appropriately.

Exam consideration

If a question says:

“The application receives a very high volume of events and HTTP overhead is becoming significant.”

Consider event batching as a possible optimization.


35. Common Exam Scenario

Scenario

An AI application receives thousands of document events.

A Function should process only:

DocumentUploaded

events for:

/finance/

documents.

The best solution is to configure the Event Grid subscription with:

  • Event type filtering
  • Subject filtering

rather than sending every event to the Function.

The conceptual design is:

Event Grid
|
| Event Type = DocumentUploaded
| Subject begins with /finance/
v
Azure Function

This is more efficient than filtering inside the Function.


36. Common Exam Scenario: Custom Events

Scenario

A custom AI application needs to notify multiple independent applications whenever a document classification operation completes.

The application generates:

DocumentClassificationCompleted

Which Azure service should provide the event-routing mechanism?

Azure Event Grid is a natural choice.

A custom topic can receive the application’s events, and multiple subscriptions can route them to different handlers.


37. Common Exam Scenario: Temporary Endpoint Failure

Scenario

An Event Grid subscriber temporarily returns HTTP 503.

What should you expect?

Event Grid treats the delivery as unsuccessful and can retry according to its retry behavior.

This is different from simply assuming that the event is permanently lost.


38. Common Exam Scenario: Duplicate Events

Scenario

A Function processes an event successfully, but the response isn’t successfully acknowledged by Event Grid.

Event Grid may deliver the event again.

What should the Function do?

The Function should be designed to handle duplicate events safely.

Possible techniques include:

  • Event ID tracking
  • Idempotent writes
  • Upsert operations
  • Deduplication records
  • Transactional processing where appropriate

The key concept is:

Do not assume exactly-once delivery.


39. Common Exam Scenario: Event Loss

Scenario

A critical event must not simply disappear if the subscriber remains unavailable.

What should you configure?

Dead-lettering should be considered.

Configure an Azure Storage Blob container as the dead-letter destination so undeliverable events can be preserved for later reconciliation.


40. Common Exam Scenario: Retry Configuration

Scenario

An application should stop trying to deliver an event after either:

  • 10 delivery attempts, or
  • 60 minutes.

The Event Grid subscription can be configured with:

Maximum delivery attempts = 10
TTL = 60 minutes

Whichever limit is reached first stops the delivery attempts.


41. Key Distinctions to Remember

For the AI-200 exam, remember these distinctions:

ConceptPurpose
EventDescribes something that happened
Event sourceProduces the event
TopicEndpoint/channel for events
Custom topicTopic for application-generated events
Event subscriptionDefines routing to a destination
Event handlerProcesses the event
Event type filterSelects event types
Subject filterSelects events by subject prefix/suffix
Advanced filterFilters event properties
RetryAttempts delivery again
TTLMaximum time Event Grid attempts delivery
Maximum attemptsMaximum delivery attempts
Dead-letterStores undeliverable events
IdempotencySafely handles duplicate delivery

42. AI-200 Exam Tips

Tip 1: Event Grid is about events

If the question says:

“Something happened, and another service should react.”

Think:

Event Grid


Tip 2: Service Bus is different

If the scenario emphasizes:

  • Commands
  • Queues
  • Durable messaging
  • Competing consumers
  • Sessions
  • Transactional messaging

think:

Azure Service Bus


Tip 3: Filter before invoking

If Event Grid can filter an event, don’t automatically filter it in application code.

Event subscription filtering can reduce unnecessary processing.


Tip 4: Expect duplicates

Event Grid delivery should be treated as at least once.

Design consumers accordingly.


Tip 5: Don’t assume ordering

Event Grid does not guarantee event ordering.


Tip 6: Know retry limits

Remember:

Maximum delivery attempts
+
Event TTL

Whichever limit is reached first stops delivery attempts.


Tip 7: Know dead-lettering

Dead-lettering provides a place to preserve events that could not be delivered.

For Event Grid, the dead-letter destination uses Azure Blob Storage.


Tip 8: Understand the three major filter types

Remember:

Event type
Subject
Advanced properties

43. Summary

Azure Event Grid provides a managed mechanism for building event-driven applications by routing events from producers to subscribers.

For AI-200, the most important concepts are:

  • Event sources produce events.
  • Topics provide event publishing endpoints.
  • Custom topics support application-generated events.
  • Event subscriptions define routing.
  • Event handlers process events.
  • Event type filters select specific types of events.
  • Subject filters select events based on their subjects.
  • Advanced filters can evaluate event properties.
  • Event Grid provides retry behavior for failed deliveries.
  • Retry limits can be configured using maximum attempts and TTL.
  • Dead-lettering can preserve events that cannot be delivered.
  • Event delivery should be treated as at least once.
  • Consumers should be designed to tolerate duplicates.
  • Event ordering should not be assumed.
  • Event Grid and Service Bus solve different messaging problems.
  • Event Grid is particularly useful for loosely coupled, event-driven AI workflows.

The most important mental model is:

Something happens โ†’ Event is generated โ†’ Event Grid routes it โ†’ Matching subscription receives it โ†’ Handler processes it โ†’ Retry/dead-letter mechanisms provide resilience.


Practice Exam Questions

Question 1

An AI application publishes a DocumentProcessed event whenever document processing finishes. Several independent applications need to react to this event, and the producing application should not need to know which applications consume it.

Which Azure service is the best fit for routing these events?

A. Azure Event Grid

B. Azure Key Vault

C. Azure App Configuration

D. Azure Container Registry

Answer: A

Explanation

Azure Event Grid is designed for event routing and pub/sub scenarios. A custom topic can receive application-generated events, while multiple event subscriptions can independently route those events to different handlers.

Azure Key Vault manages secrets, App Configuration manages application configuration, and Container Registry stores container images.


Question 2

An Event Grid subscription should receive only events whose subject begins with:

/documents/invoices/

Which filtering mechanism should be used?

A. Advanced numeric filtering

B. Subject filtering

C. Event TTL

D. Maximum delivery attempts

Answer: B

Explanation

Subject filtering is specifically designed to select events based on the beginning or ending of an event’s subject.

TTL and maximum delivery attempts control delivery behavior rather than which events are selected.


Question 3

An application publishes the following event:

{
"eventType": "DocumentUploaded",
"data": {
"department": "finance",
"priority": 8
}
}

A subscriber should receive only events where data.priority is greater than or equal to 7.

Which Event Grid capability should be used?

A. Subject filtering

B. Event TTL

C. Advanced filtering

D. Dead-lettering

Answer: C

Explanation

Advanced filtering allows subscriptions to evaluate properties within the event data using operators such as NumberGreaterThanOrEquals.

Subject filtering is appropriate for the event subject, while TTL and dead-lettering concern delivery reliability.


Question 4

An Event Grid subscriber temporarily returns HTTP 503 responses because the application is unavailable. What should you expect Event Grid to do?

A. Immediately delete all affected events

B. Permanently disable the subscription

C. Retry delivery according to its retry behavior and configured limits

D. Convert the events into Service Bus messages automatically

Answer: C

Explanation

HTTP 503 represents a service-unavailable condition. Event Grid can retry failed delivery using its retry behavior. Delivery continues until successful delivery or the applicable retry policy limits are reached.

Event Grid does not automatically convert the events into Service Bus messages or permanently disable the subscription.


Question 5

A critical Event Grid event cannot be delivered after the configured retry policy is exhausted. The organization needs to preserve the event for later investigation.

What should you configure?

A. A dead-letter destination in Azure Blob Storage

B. An Azure Container Registry

C. An Azure App Configuration store

D. An Azure Key Vault secret

Answer: A

Explanation

Event Grid supports dead-lettering to an Azure Storage Blob container. Undeliverable events can be stored there for later inspection and reconciliation.

The other services do not provide Event Grid dead-letter storage.


Question 6

An Event Grid subscription is configured with:

Maximum delivery attempts = 5
TTL = 60 minutes

The event reaches five delivery attempts after only 12 minutes. What happens next?

A. Event Grid continues retrying until 60 minutes have elapsed

B. Event Grid stops delivery attempts because the maximum attempt limit was reached

C. Event Grid automatically changes the maximum attempts to 30

D. Event Grid immediately sends the event to every other subscription

Answer: B

Explanation

When both maximum delivery attempts and TTL are configured, the first limit reached determines when Event Grid stops delivery attempts.

Because five attempts have occurred before the 60-minute TTL expires, the maximum-attempt limit is reached first.

If dead-lettering is configured, the event can then be dead-lettered.


Question 7

An AI application processes DocumentProcessed events. Occasionally, the same event is delivered twice. The application currently increments a counter every time it receives the event, causing inaccurate results.

What is the best design improvement?

A. Increase the event TTL

B. Disable event filtering

C. Make the event-processing operation idempotent

D. Increase the number of Event Grid subscriptions

Answer: C

Explanation

Event Grid uses at-least-once delivery semantics, so consumers must be prepared for duplicate events.

An idempotent operation can safely process the same event multiple times without producing an incorrect result. Event IDs can also be tracked to implement deduplication.

Changing TTL, filtering, or subscription count does not solve the fundamental duplicate-processing problem.


Question 8

An application generates its own events and needs an Event Grid endpoint to which it can publish those events.

Which resource should the application use?

A. Azure Service Bus session

B. Azure Event Hubs consumer group

C. Azure Storage queue

D. An Azure Event Grid custom topic

Answer: D

Explanation

A custom Event Grid topic provides a user-defined endpoint for applications to publish their own events.

Service Bus, Event Hubs, and Storage queues have different messaging purposes and do not represent the Event Grid custom-topic publishing model.


Question 9

An Event Grid subscription should receive only events of these types:

DocumentCreated
DocumentUpdated

It should not receive:

DocumentDeleted

Which configuration should be used?

A. Included event type filtering

B. Dead-lettering

C. Event TTL

D. Maximum delivery attempts

Answer: A

Explanation

Event type filtering allows a subscription to specify which event types it should receive.

The other options control delivery reliability rather than event selection.


Question 10

An AI application receives a very high volume of Event Grid events. HTTP request overhead is becoming significant, and the event-processing service can efficiently process multiple events in a single request.

Which Event Grid capability should be considered?

A. Dead-lettering

B. Event delivery batching

C. Subject filtering

D. Event TTL reduction

Answer: B

Explanation

Event Grid supports batching for push delivery. Instead of sending every event in an individual delivery request, multiple events can be delivered together.

Batching can improve HTTP efficiency in high-throughput scenarios. The consumer must be designed to process the batch appropriately because Event Grid uses all-or-none semantics for a batch delivery request.


Final Exam Takeaways

Before taking the AI-200 exam, make sure you can confidently answer these questions:

  1. When should I use Event Grid?
    For event-driven routing and reacting to things that happened.
  2. When should I consider Service Bus instead?
    When the scenario calls for durable messaging, queues, commands, sessions, or sophisticated message-processing patterns.
  3. How do I create application-generated events?
    Publish them to an Event Grid custom topic.
  4. How do I control which events a subscriber receives?
    Use event type, subject, and advanced filters.
  5. What happens when delivery fails?
    Event Grid can retry according to its retry behavior.
  6. What controls how long Event Grid retries?
    Event TTL and maximum delivery attempts.
  7. What happens when delivery ultimately fails?
    With dead-lettering configured, the event can be stored in Azure Blob Storage.
  8. Can an event be delivered more than once?
    Yes. Design consumers to tolerate duplicates.
  9. Does Event Grid guarantee event ordering?
    No.
  10. How can high-volume delivery be optimized?
    Consider event batching where the consumer supports it.

If you understand those ten pointsโ€”and especially the distinctions between event filtering, retry, TTL, dead-lettering, and idempotent processingโ€”you’ll have a strong foundation for the Event Grid portion of AI-200.


Go to the AI-200 Exam Prep Hub main page

Build and Run Images by Using Azure Container Registry Tasks (AI-200 Exam Prep)

This post is a part of the AI-200: Developing AI Cloud Solutions on Azure ย Exam Prep Hub.
This topic falls under these sections:
Develop containerized solutions on Azure (20โ€“25%)
ย ย  --> Implement container application hosting
ย ย ย ย ย  --> Build and Run Images by Using Azure Container Registry Tasks


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure Container Registry Tasks (ACR Tasks) provides cloud-based capabilities for building, testing, and managing container images in Azure Container Registry (ACR).

ACR Tasks is particularly useful when developers want to move container image builds into the cloud rather than relying on a locally installed Docker engine. It can support simple on-demand builds, automated builds triggered by source-code or base-image changes, and more sophisticated multi-step workflows involving multiple containers.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand not only how to execute an ACR Task, but also when to use each type of task, how build contexts work, how images are tagged, how multi-step tasks are defined, how tasks are triggered, and how tasks can securely access other resources.

Microsoft’s AI-200 training specifically identifies building and managing container images in the cloud with ACR Tasks and using the Azure CLI to run ACR quick tasks as learning objectives.


1. What Are Azure Container Registry Tasks?

ACR Tasks is a collection of capabilities within Azure Container Registry that allows you to perform container image operations in Azure.

At a high level:

Source Code / Dockerfile
|
v
ACR Task
|
+-----+-----+
| |
v v
Build Test
| |
+-----+-----+
|
v
Container Image
|
v
ACR

ACR Tasks can:

  • Build container images in Azure
  • Push images to ACR
  • Run containers as part of a task
  • Test container images
  • Build multiple images
  • Execute steps sequentially or in parallel
  • Automatically trigger builds from source-code changes
  • Automatically rebuild images when base images change
  • Run tasks on a schedule
  • Integrate into CI/CD workflows

ACR Tasks supports Linux, Windows, and ARM image platforms, depending on the configuration and supported scenarios.


2. Why Use ACR Tasks?

A traditional container development workflow might look like this:

Developer Computer
|
+-- Docker build
|
+-- Docker test
|
+-- Docker push
|
v
Azure Container Registry

This requires the developer’s machine to have the appropriate container tooling.

With an ACR Task:

Developer
|
| Azure CLI
v
Azure Container Registry
|
+-- Build
+-- Test
+-- Push

The build is performed in Azure.

This has several advantages:

  • No local Docker Engine is required for an ACR quick task.
  • Builds can be standardized.
  • Builds can be automated.
  • Container images can be built close to the registry.
  • Build workflows can be triggered by source-code changes.
  • Base-image updates can automatically initiate rebuilds.
  • More complex build/test workflows can be defined using YAML.

Microsoft describes quick tasks as an integrated development experience that offloads container image builds to Azure and can perform the equivalent of docker build and docker push in the cloud.


3. Three Important ACR Task Scenarios

For AI-200, understand these three categories:

Task typePrimary purpose
Quick taskOn-demand build and push
Automatically triggered taskAutomatically execute when an event occurs
Multi-step taskBuild, test, run, and push multiple images/workflows

These aren’t mutually exclusive concepts.

For example, a multi-step task can also be automatically triggered by a Git commit.


4. Quick Tasks

A quick task is an on-demand container image build performed in Azure.

It is particularly useful during development.

The Azure CLI command is:

az acr build

For example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The final . represents the build context.

Conceptually, this performs:

Dockerfile + build context
|
v
ACR Task
|
v
Build image
|
v
Push image
|
v
ACR

The important point is that the build takes place in Azure rather than requiring a local Docker engine.

ACR Tasks’ quick-build capability is essentially a cloud-based equivalent of performing a Docker build and push operation.


5. Understanding the Build Context

One of the most important concepts when using az acr build is the build context.

Consider:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The . specifies the current directory as the build context.

The build context contains files that are available to the Docker build process.

For example:

orders-api/
โ”‚
โ”œโ”€โ”€ Dockerfile
โ”œโ”€โ”€ requirements.txt
โ”œโ”€โ”€ app.py
โ””โ”€โ”€ src/

Running:

az acr build ... .

makes that directory the build context.

The context can also come from other supported locations, including source repositories.


6. Dockerfile and ACR Tasks

ACR Tasks uses familiar Docker build syntax.

For example:

FROM python:3.12
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "app.py"]

You can then build the image with:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The Dockerfile defines how the container image is constructed.

ACR Tasks handles the build environment and performs the build in Azure.


7. Specifying a Dockerfile

If the Dockerfile has a different name or location, specify it using --file.

For example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
--file Dockerfile.production \
.

You can also specify a Dockerfile located elsewhere relative to the build context.

The important exam concept is:

The build context and Dockerfile are related but are not necessarily the same thing.

The Dockerfile describes the build instructions.

The build context identifies the files available to the build.


8. ACR Tasks Versus Local Docker Builds

Consider this traditional command:

docker build -t orders-api:v1 .

With ACR Tasks, you can use:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The conceptual difference is:

Local DockerACR Tasks
Build occurs locallyBuild occurs in Azure
Requires Docker EngineNo local Docker Engine required for quick tasks
Image initially exists locallyImage can be pushed directly to ACR
Developer manages build environmentAzure provides the task execution environment

This distinction is a likely source of scenario-based exam questions.


9. Building Without a Local Docker Engine

Suppose a developer has:

  • Azure CLI
  • Access to an Azure Container Registry
  • A Dockerfile
  • Application source code

but doesn’t have Docker installed.

The developer can still build the image using:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

This is one of the strongest scenarios for recognizing ACR Tasks on the exam.


10. Running an Image with ACR Tasks

ACR Tasks can also run containers as part of a task.

The cmd step is used for this purpose in multi-step tasks.

For example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID

The cmd step runs a container using the specified image.

This makes it possible to use ACR Tasks for testing.

For example:

Build image
|
v
Run image
|
v
Execute tests
|
v
Push image

The cmd step supports parameters similar to familiar container-run operations, including environment variables and detached execution.


11. Multi-Step Tasks

A multi-step task allows you to create a more sophisticated container workflow.

Instead of simply:

Build โ†’ Push

you can implement:

Build
|
v
Run
|
v
Test
|
v
Push

You can also build multiple images:

             +--> Build API ----+
             |                  |
Source ------+                  +--> Test --> Push
             |                  |
             +--> Build Worker -+

Multi-step tasks are defined in a YAML file.

Microsoft identifies three primary ACR Tasks step types:

  • build
  • push
  • cmd

12. The build Step

The build step builds a container image.

Example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .

Conceptually, this is similar to:

docker build

but the build is performed within the ACR Tasks environment.

The image name should identify the image that the task builds.


13. The push Step

The push step pushes an image to a container registry.

Example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

The build step creates the image.

The push step publishes it to the registry.

An important exam distinction is that in a multi-step az acr run task, you should not assume that a built image is automatically pushed simply because it was built. The task definition can explicitly use a push step to publish it.


14. The cmd Step

The cmd step executes a container.

For example:

version: v1.1.0
steps:
- cmd: bash:3.0 echo "Hello from ACR Tasks"

It can also execute an image produced by an earlier build:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID

This is especially useful for testing.

The cmd step can use environment variables and other execution options.


15. Build, Test, and Push

A common ACR Tasks pattern is:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID
- push:
- $Registry/orders-api:$ID

Conceptually:

             BUILD
               |
               v
          Container Image
               |
               v
              TEST
               |
         Tests successful
               |
               v
              PUSH
               |
               v
              ACR

This pattern can prevent an image from being pushed until validation has occurred.


16. Step Dependencies

ACR Tasks allows steps to have dependencies.

The when property can specify which previous steps must complete before a step executes.

For example:

version: v1.1.0
steps:
- id: build
build: -t $Registry/orders-api:$ID .
- id: test
cmd: $Registry/orders-api:$ID
when: ["build"]
- id: push
push:
- $Registry/orders-api:$ID
when: ["test"]

The sequence is:

build
|
v
test
|
v
push

This allows the task to express workflow dependencies explicitly.


17. Parallel Execution

ACR Tasks can also execute independent steps concurrently.

For example:

version: v1.1.0
steps:
- id: build-api
build: -t $Registry/api:$ID .
when: ["-"]
- id: build-worker
build: -t $Registry/worker:$ID ./worker
when: ["-"]

The special:

when: ["-"]

indicates that the step has no dependency on another step and can begin immediately.

Therefore:

        +--> Build API ---+
        |                 |
START --+                 +--> Continue
        |                 |
        +--> Build Worker-+

This can reduce total task execution time when operations are independent.

Microsoft’s ACR Tasks YAML reference specifically documents when: ["-"] for steps that have no dependency and can execute concurrently.


18. Build Dependencies Versus Sequential Steps

If when isn’t specified, a step is dependent on the previous step in the task definition.

For example:

steps:
- id: build
build: -t $Registry/api:$ID .
- id: test
cmd: $Registry/api:$ID
- id: push
push:
- $Registry/api:$ID

This naturally produces:

build โ†’ test โ†’ push

If explicit dependencies are needed, use when.


19. Running an ACR Task

The Azure CLI command commonly used to execute a task definition is:

az acr run

For example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
.

You can also use a Git repository as the context.

For example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
https://github.com/example/project.git

The task receives the specified source context and executes the defined workflow.


20. az acr build Versus az acr run

This is an important distinction for AI-200.

az acr build

Designed primarily for a quick cloud-based image build.

Example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

Think:

Build an image quickly in Azure.

az acr run

Executes an ACR Tasks workflow.

Example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
.

Think:

Run a defined task workflow.

A multi-step task uses az acr run.


21. ACR Tasks Run Variables

ACR Tasks provides built-in run variables.

These variables can be used to create standardized image names and tags.

One particularly useful variable is:

Run.ID

which can be represented in task YAML using the $ID alias.

For example:

steps:
- build: -t $Registry/orders-api:$ID .

This gives each task run a unique identifier that can be incorporated into the image tag.

ACR Tasks also provides variables associated with:

  • Registry
  • Registry name
  • Run ID
  • Date
  • Operating system
  • Architecture
  • Git commit
  • Git branch
  • Task name


22. Why Use Unique Build Tags?

Suppose every build uses:

orders-api:latest

You lose an easy way to distinguish individual builds.

Instead, you could use:

orders-api:build-123
orders-api:build-124
orders-api:build-125

ACR Tasks’ run ID can help automate this.

For example:

steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

This produces unique image references for individual runs.

This is especially useful for CI/CD scenarios.


23. Automatically Triggered Tasks

ACR Tasks can automatically execute based on events.

Important trigger scenarios include:

Source-code updates

A task can run when code is committed to a supported Git repository.

For example:

Developer commits code
|
v
Git repository
|
v
ACR Task trigger
|
v
Build image
|
v
Push image

Base-image updates

A task can be triggered when a base image changes.

For example:

FROM python:3.12

If the base image is updated, an ACR Task can rebuild the application image.

This is useful for automatically incorporating updated OS or framework components.

Scheduled execution

ACR Tasks can also support scheduled execution.

For example:

Every night
|
v
ACR Task
|
v
Build/test image

Microsoft documents source-code, base-image, and timer-based triggers as ACR Tasks automation scenarios.


24. Base Image Update Triggers

Base image triggers are especially relevant to security and maintenance.

Suppose:

FROM ubuntu:24.04

A security update causes a newer version of the base image to become available.

Without automation:

Base image updated
|
X
Application image remains unchanged

With an ACR Task:

Base image updated
|
v
ACR Task trigger
|
v
Rebuild application image
|
v
Push updated image

This allows organizations to automatically rebuild images when their dependencies change.

Microsoft describes this scenario as a way to automate OS and framework patching for container images.


25. Source-Code Triggers

ACR Tasks can integrate with source repositories.

For example:

Git commit
|
v
ACR Task
|
+-- Build
+-- Test
+-- Push

This provides a simple cloud-based container CI workflow.

A task can be configured to respond to commits and, depending on the configuration, pull-request activity in supported Git repositories.


26. Multi-Container Workflows

ACR Tasks becomes particularly valuable when an application contains multiple containers.

Suppose you have:

Web API
Worker
Test suite

You could define:

Build API
|
Build Worker
|
Run tests
|
Push API
|
Push Worker

Or independent builds could execute concurrently:

            +--> Build API -----+
            |                   |
START ------+                   +--> Test --> Push
            |                   |
            +--> Build Worker --+

Multi-step tasks are designed specifically for these types of workflows.


27. ACR Tasks and CI/CD

ACR Tasks can be incorporated into a broader CI/CD architecture.

For example:

Developer
|
v
Git Repository
|
v
ACR Task
|
+--> Build
|
+--> Test
|
+--> Push
|
v
Azure Container Registry
|
v
Container Apps / AKS / App Service

ACR Tasks is therefore not merely a command for building images. It can serve as a container lifecycle building block within an automated development process.


28. Accessing Other Registries

An ACR Task may need to access images or artifacts outside the registry where the task runs.

For example:

ACR Task
|
| Pull base image
v
External Registry

or:

ACR Task
|
| Push image
v
Another Registry

ACR Tasks supports authentication mechanisms for accessing protected resources.

Managed identities are particularly useful when an ACR Task needs to access other Azure resources without embedding credentials in the task definition.

Microsoft documents both system-assigned and user-assigned managed identities for ACR Tasks.


29. Managed Identities for ACR Tasks

An ACR Task can have a managed identity.

Two types are available:

System-assigned managed identity

The identity is associated with the specific ACR Task resource.

Its lifecycle is tied to that resource.

User-assigned managed identity

The identity is an independent Azure resource that can be assigned to multiple resources.

This can be useful when the same identity needs to be reused.

The key exam concept is:

Managed identities allow ACR Tasks to access protected Azure resources without embedding credentials in the task definition.


30. ACR Tasks and Azure Key Vault

ACR Tasks can also integrate with Azure Key Vault for scenarios where a task needs access to secrets.

A secure architecture might look like:

                 Azure Key Vault
                       |
                       | Secret
                       v
ACR Task ------ Managed Identity
                       |
                       v
                  Build/Test

This is preferable to hard-coding credentials into Dockerfiles, scripts, or task definitions.


31. Security Considerations

When designing ACR Task workflows:

Avoid putting secrets directly on command lines

Command-line arguments can potentially be captured by diagnostic or logging systems.

Avoid embedding credentials in Dockerfiles

A Dockerfile should not contain permanent passwords, tokens, or keys.

Prefer managed identities

When the target resource supports identity-based authentication, managed identities reduce credential-management overhead.

Use least privilege

Give the task only the permissions it needs.

Be careful with external registry credentials

If a task must access another private registry, configure authentication appropriately rather than placing credentials in source code.

Microsoft specifically warns that information supplied through command lines or URIs can appear in ACR diagnostic tracing, including sensitive values.


32. Task YAML Structure

A basic multi-step task looks like:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

A more sophisticated task could look like:

version: v1.1.0
steps:
- id: build-api
build: -t $Registry/orders-api:$ID .
- id: test-api
cmd: $Registry/orders-api:$ID
when: ["build-api"]
- id: push-api
push:
- $Registry/orders-api:$ID
when: ["test-api"]

The key elements are:

ElementPurpose
versionYAML task format version
stepsDefines task operations
buildBuilds an image
pushPushes an image
cmdRuns a container
idGives a step an identifier
whenDefines dependencies
$RegistryRegistry run-variable alias
$IDRun ID alias

ACR Tasks currently supports YAML as the task-definition format.


33. A Complete Build-Test-Push Example

Consider an API application with:

Dockerfile
src/
tests/

A multi-step task could conceptually perform:

version: v1.1.0
steps:
- id: build
build: -t $Registry/orders-api:$ID .
- id: test
cmd: $Registry/orders-api:$ID
when: ["build"]
- id: push
push:
- $Registry/orders-api:$ID
when: ["test"]

The workflow becomes:

                  +----------------+
                  |     Source     |
                  +-------+--------+
                          |
                          v
                       BUILD
                          |
                          v
                    Container Image
                          |
                          v
                        TEST
                          |
                    Tests pass
                          |
                          v
                        PUSH
                          |
                          v
                         ACR

This is an excellent pattern to recognize in scenario-based questions.


34. az acr build Versus Multi-Step Tasks

A useful exam comparison is:

RequirementAppropriate approach
Build one image nowaz acr build
Build image without local Dockeraz acr build
Build and push a simple imageQuick task
Build and test an imageMulti-step task
Build several imagesMulti-step task
Run a container during a workflowcmd step
Push an image from a multi-step taskpush step
Trigger from Git commitAutomatically triggered ACR Task
Rebuild when base image changesBase-image trigger
Run periodicallyScheduled task

35. Common Exam Traps

Trap 1: Choosing Azure Container Instances

ACR Tasks is about building and managing container image workflows.

Azure Container Instances is primarily about running containers.

If the question says:

“Build a container image in Azure without installing Docker locally.”

Think:

ACR Tasks

not Azure Container Instances.


Trap 2: Confusing ACR with ACR Tasks

ACR is the registry.

ACR Tasks provides cloud-based build and automation capabilities.

Think:

ACR
โ†“
Store images
ACR Tasks
โ†“
Build/test/automate images

Trap 3: Assuming az acr run and az acr build are identical

They are not.

az acr build is designed for the quick cloud build scenario.

az acr run executes a task definition or command in the ACR Tasks environment.


Trap 4: Assuming every build automatically pushes an image

For a quick az acr build, the resulting image is pushed to the registry by default.

For an az acr run multi-step task, you should explicitly define a push step when you want to push the built image.

This distinction is explicitly documented in the ACR Tasks YAML reference.


Trap 5: Using cmd when you need to build an image

cmd runs a container.

build builds a container image.

Remember:

build โ†’ create image
cmd โ†’ run container
push โ†’ publish image

Trap 6: Ignoring the build context

The build context determines what files are available to the Docker build.

A Dockerfile alone isn’t necessarily sufficient if it references files from the context.


Trap 7: Putting secrets in the Dockerfile

Never assume that a secret belongs in:

ENV PASSWORD=...

or:

RUN some-command --password ...

Use appropriate Azure identity and secret-management mechanisms instead.


36. AI-200 Exam-Focused Review

Make sure you understand the following:

ACR Tasks

Cloud-based container build and automation capabilities.

Quick task

On-demand image build, commonly using:

az acr build

az acr run

Executes an ACR task workflow or command.

Build context

The files supplied to the container build.

build

Builds a container image.

push

Pushes an image to a registry.

cmd

Runs a container as part of a task.

when

Defines dependencies between task steps.

$Registry

Identifies the registry associated with the task run.

$ID

Identifies the current task run and can be used to generate unique tags.

Multi-step task

Supports complex workflows involving building, testing, running, and pushing containers.

Source trigger

Automatically runs a task when supported source-code changes occur.

Base-image trigger

Automatically rebuilds images when a base image changes.

Scheduled trigger

Runs tasks according to a schedule.

Managed identity

Allows a task to access protected Azure resources without embedding credentials.


37. The Mental Model to Remember

For AI-200, think of ACR Tasks as a cloud-based container build and automation engine attached to Azure Container Registry.

                    SOURCE
                       |
             +---------+---------+
             |                   |
          Dockerfile          Git Repo
             |                   |
             +---------+---------+
                       |
                       v
                  ACR TASK
                       |
          +------------+------------+
          |            |            |
        BUILD         CMD         PUSH
          |            |            |
          |          TEST           |
          |            |            |
          +------------+------------+
                       |
                       v
                  ACR IMAGE
                       |
                       v
             Container Service
        +----------+----------+
        |          |          |
       AKS    Container Apps  App Service

The most important distinction is:

ACR stores the image; ACR Tasks builds, tests, and automates the image lifecycle.


Practice Exam Questions

Question 1

A developer has a Dockerfile and application source code but does not have Docker installed locally. The developer needs to build the image in Azure and store it in an Azure Container Registry.

Which command should the developer use?

A. az container create

B. az acr repository create

C. az acr build

D. az aks create

Answer: C

Explanation: az acr build performs a cloud-based container image build using Azure Container Registry Tasks. The build occurs in Azure, so a local Docker Engine isn’t required for this scenario. The command can build and push the resulting image to ACR.


Question 2

A development team wants to create an automated workflow with the following steps:

  1. Build an API container image.
  2. Run the image.
  3. Execute functional tests.
  4. Push the image only if the tests succeed.

Which ACR Tasks capability should be used?

A. A multi-step task

B. ACR geo-replication

C. An ACR repository

D. An Azure Container Apps revision

Answer: A

Explanation: Multi-step ACR Tasks are designed for workflows that combine multiple container operations. The build, cmd, and push step types can be combined, and dependencies can be defined using the when property. This allows testing to occur before the image is pushed.


Question 3

An ACR Task contains the following YAML:

steps:
- id: build
build: -t $Registry/api:$ID .
- id: test
cmd: $Registry/api:$ID
when: ["build"]
- id: push
push:
- $Registry/api:$ID
when: ["test"]

What is the purpose of when: ["test"] on the final step?

A. It causes the push to run before testing

B. It causes the push to run concurrently with testing

C. It causes the push step to be skipped

D. It makes the push step dependent on successful completion of the test step

Answer: D

Explanation: The when property establishes dependencies between task steps. Here, the push step depends on the step identified as test, so it won’t execute until the test step completes successfully.


Question 4

An organization wants an ACR Task to automatically rebuild application images whenever a new version of a base image becomes available.

Which trigger should be configured?

A. A repository namespace trigger

B. A base-image update trigger

C. A container restart trigger

D. An Azure Monitor alert trigger

Answer: B

Explanation: ACR Tasks supports base-image update triggers. When the configured base image changes, the task can automatically rebuild the application image. This is particularly useful for incorporating updated operating-system and framework components.


Question 5

An ACR Task needs to execute two independent image builds at the same time. Which YAML configuration allows the steps to start without depending on another task step?

A. when: ["-"]

B. when: ["parallel"]

C. when: ["async"]

D. when: ["none"]

Answer: A

Explanation: In ACR Tasks, when: ["-"] indicates that the step has no dependency on another step and can begin immediately. This can allow independent steps to execute concurrently.


Question 6

A developer wants to create a unique container image tag for every ACR Task execution. Which ACR Tasks variable is specifically designed to identify the current task run?

A. $Branch

B. $Registry

C. $ID

D. $Architecture

Answer: C

Explanation: $ID is an ACR Tasks alias for the current run ID. It can be used to create unique image tags, such as:

-t $Registry/api:$ID

This is useful for distinguishing images produced by different task executions.


Question 7

A multi-step ACR Task has the following steps:

steps:
- build: -t $Registry/api:$ID .
- push:
- $Registry/api:$ID

What is the primary purpose of the push step?

A. Run the container

B. Upload the built image to a container registry

C. Compile the Dockerfile

D. Create an Azure Container Apps revision

Answer: B

Explanation: The push step publishes a built or retagged container image to a container registry. The build step creates the image; push publishes it.


Question 8

An organization wants an ACR Task to execute whenever developers commit code to a supported Git repository. Which capability should be configured?

A. A source-code trigger

B. An ACR retention policy

C. An ACR private endpoint

D. A container health probe

Answer: A

Explanation: ACR Tasks supports source-code triggers that can automatically execute builds or multi-step tasks when changes occur in supported Git repositories. This provides a simple mechanism for integrating container builds into a CI workflow.


Question 9

An ACR Task must access a protected Azure resource. The organization doesn’t want credentials embedded in the task definition.

Which approach provides the most appropriate Azure-native solution?

A. Store the credential in the Dockerfile

B. Put the password in the task’s command line

C. Use a managed identity for the ACR Task

D. Make the Azure resource publicly accessible

Answer: C

Explanation: ACR Tasks can use system-assigned or user-assigned managed identities to access protected resources without embedding credentials in task definitions. The identity must be granted the required permissions on the target resource.


Question 10

A developer executes:

az acr build \
--registry myregistry \
--image orders-api:v2 \
.

What does the final . represent?

A. The ACR registry name

B. The image tag

C. The Docker image digest

D. The build context

Answer: D

Explanation: The final . specifies the current directory as the build context. Files in the build context are made available to the Docker build process. The Dockerfile and files referenced during the build generally need to be available through the selected context.


Key Takeaways

For the AI-200 exam, remember these relationships:

ConceptRemember
ACRStores and manages container images
ACR TasksBuilds, runs, tests, and automates container workflows
az acr buildPerforms an on-demand cloud image build
az acr runRuns an ACR Tasks workflow/command
Build contextFiles supplied to the image build
buildCreates a container image
cmdRuns a container
pushPublishes an image to a registry
whenControls task-step dependencies
when: ["-"]Allows an independent step to start immediately
$IDCurrent task run identifier
$RegistryRegistry associated with the task
Multi-step taskBuild/test/run/push workflows
Source triggerRun when source code changes
Base-image triggerRebuild when a base image changes
Scheduled triggerRun according to a schedule
Managed identitySecure access without embedding credentials

The single most useful mental model for this objective is:

                  ACR TASKS
                      |
       +--------------+--------------+
       |              |              |
     BUILD           CMD            PUSH
       |              |              |
   Create image    Run/test       Publish image
       |              |              |
       +--------------+--------------+
                      |
                      v
                     ACR

And when the exam gives you a scenario, ask:

  1. Do I need to build an image in Azure? โ†’ az acr build / ACR Tasks
  2. Do I need multiple build/test/run operations? โ†’ Multi-step ACR Task
  3. Do I need to execute a container? โ†’ cmd
  4. Do I need to publish an image? โ†’ push
  5. Do steps have dependencies? โ†’ when
  6. Do independent steps need to run concurrently? โ†’ when: ["-"]
  7. Should builds happen automatically after source changes? โ†’ Source trigger
  8. Should images rebuild when a base image changes? โ†’ Base-image trigger
  9. Does the task need secure access to another Azure resource? โ†’ Managed identity
  10. Do I need unique image versions for task runs? โ†’ Use $ID in the image tag

These distinctions are especially important because AI-200 scenario questions are likely to test which ACR Tasks capability best fits a particular development or deployment requirement, rather than simply asking you to recall an individual command.


Go to the AI-200 Exam Prep Hub main page

Build, Store, Version, and Manage Container Images by Using Azure Container Registry (AI-200 Exam Prep)

This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Develop containerized solutions on Azure (20โ€“25%)
   --> Implement container application hosting
      --> Build, store, version, and manage container images by using Azure Container Registry


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure Container Registry (ACR) is a managed, private registry service in Azure for storing and managing container images and other OCI-compatible artifacts. It provides a central location from which containerized applications can obtain the images they need to run on services such as Azure App Service, Azure Container Apps, Azure Kubernetes Service (AKS), and Azure Container Instances.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand more than simply how to push an image into ACR. You should be comfortable with the hierarchy of registries, repositories, images, tags, manifests, and layers; image versioning strategies; building images using ACR Tasks; managing and deleting images; and selecting appropriate authentication and registry capabilities.

The current Microsoft Learn study guide specifically identifies this objective as part of Implement container application hosting. It also separately identifies ACR Tasks as an exam objective, so understanding how ACR stores images and how ACR Tasks builds them is particularly important.


1. What Is Azure Container Registry?

Azure Container Registry is a private container registry service hosted in Azure.

A container registry solves a fundamental problem in containerized application development:

Where do applications securely obtain the container images they need to run?

Instead of relying exclusively on a public registry, an organization can maintain its own private registry in Azure.

A typical workflow looks like this:

Developer
|
| Build container image
v
Docker / ACR Tasks
|
| Push
v
Azure Container Registry
|
+------------------+
| |
v v
Azure App Service AKS
| |
v v
Container Apps Container workloads

ACR provides capabilities for:

  • Storing container images
  • Storing OCI artifacts
  • Organizing images into repositories
  • Tagging and versioning images
  • Pushing and pulling images
  • Building images using ACR Tasks
  • Managing image metadata
  • Controlling access
  • Replicating images across regions
  • Integrating with Azure container services

Microsoft describes ACR as a private, managed registry that supports building, storing, and managing images for container deployments.


2. Understand the ACR Hierarchy

One of the most important concepts for AI-200 is understanding how ACR organizes container content.

The hierarchy can be thought of as:

Azure Container Registry
|
+-- Repository
| |
| +-- Image : Tag
| +-- Image : Tag
| +-- Image : Tag
|
+-- Repository
|
+-- Image : Tag
+-- Image : Tag

The important concepts are:

  1. Registry
  2. Repository
  3. Artifact/Image
  4. Tag
  5. Manifest
  6. Layer
  7. Digest

Understanding the distinctions between these concepts is a common source of exam questions.


2.1 Registry

The registry is the overall ACR resource.

For example:

contosoregistry.azurecr.io

The registry provides the endpoint through which clients push and pull container images.

A registry can contain many repositories.


2.2 Repository

A repository is a collection of related container images or artifacts.

For example:

contosoregistry.azurecr.io/customer-api

The repository could contain:

customer-api:v1
customer-api:v2
customer-api:v3

Repositories can also use namespaces:

contosoregistry.azurecr.io/marketing/campaign-api:v2

Namespaces help organize repositories logically, although they aren’t independent Azure resources or hierarchical security boundaries simply because they contain / characters.

Microsoft notes that repository names can include namespaces and are managed independently by the registry.


3. Container Image Tags

A tag provides a human-readable identifier for a particular version or variant of an image.

For example:

customer-api:v1
customer-api:v2
customer-api:2026-08-07
customer-api:production

The complete image reference might be:

contosoregistry.azurecr.io/customer-api:v2

The structure is:

<registry>/<repository>:<tag>

For example:

contosoregistry.azurecr.io/customer-api:v2

where:

ComponentValue
Registrycontosoregistry.azurecr.io
Repositorycustomer-api
Tagv2

Microsoft recommends using appropriate tagging strategies for deployment scenarios and notes that latest is used by default when no tag is specified in Docker commands.


4. Tagging and Versioning Strategies

Image versioning is extremely important for reliable deployments.

Consider:

customer-api:latest

This tag is convenient, but it does not necessarily identify an immutable version.

Suppose today’s latest points to:

Image A

and tomorrow the same tag is updated:

latest โ†’ Image B

A deployment configured to use latest may therefore receive a different image without its configuration changing.

For production deployments, a better approach is generally to use unique version identifiers.

Examples:

customer-api:v1.0.0
customer-api:v1.1.0
customer-api:v1.2.0

or:

customer-api:20260807.1
customer-api:20260807.2

or a source-control commit identifier:

customer-api:a81f42c

A useful pattern is:

latest โ†’ convenient development/testing reference
v1.4.2 โ†’ human-readable release
a81f42c โ†’ unique build identifier

Exam Tip

If a question asks how to ensure that a deployment consistently uses a specific image version, be cautious about answers using:

:latest

A unique tag or, even more strongly, an image digest provides better version specificity.


5. Image Digests

Container images are also identified by a digest.

For example:

contosoregistry.azurecr.io/customer-api@sha256:abc123...

A digest identifies the content associated with a manifest.

Compare:

customer-api:v2

with:

customer-api@sha256:abc123...

A tag can be moved to point to another image.

A digest identifies a specific content-addressed version.

Microsoft specifically notes that pulling by digest guarantees the image version being retrieved even if an identically tagged image is subsequently pushed.

Exam Tip

Remember:

Tag = human-friendly version reference

Digest = content-addressed, precise image reference


6. Container Image Layers

Container images consist of one or more layers.

Dockerfiles commonly create multiple layers.

For example:

FROM python:3.12
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY app.py .

The resulting image is composed of layers.

One of the advantages of layers is reuse.

If two images share the same base layers, those layers don’t necessarily have to be independently stored and transferred each time.

This can reduce storage and transfer requirements.


7. Manifests

A container image is associated with a manifest.

The manifest contains information needed to identify the image and its layers.

Conceptually:

Image Manifest
|
+-- Configuration
|
+-- Layer 1
+-- Layer 2
+-- Layer 3

The manifest is also associated with the image’s digest.

This distinction matters when managing images in ACR.

For example, removing a tag doesn’t necessarily mean that all image data is immediately removed.

An untagged manifest and its associated layers may continue to consume storage until they are deleted and no longer referenced.

Microsoft specifically warns that repeatedly pushing modified artifacts with identical tags can create untagged artifacts that continue consuming registry storage.


8. Pushing an Image to ACR

A common workflow is:

Step 1: Build the image

docker build -t customer-api:v1 .

Step 2: Tag the image with the ACR login server

docker tag customer-api:v1 \
contosoregistry.azurecr.io/customer-api:v1

Step 3: Authenticate to ACR

az acr login --name contosoregistry

Step 4: Push the image

docker push \
contosoregistry.azurecr.io/customer-api:v1

The image is now stored in:

contosoregistry.azurecr.io/customer-api

with the tag:

v1

9. Pulling an Image

A client can pull the image by tag:

docker pull \
contosoregistry.azurecr.io/customer-api:v1

Or by digest:

docker pull \
contosoregistry.azurecr.io/customer-api@sha256:<digest>

The second approach provides stronger guarantees regarding exactly which image content is retrieved.


10. Azure Container Registry Tasks

One of the most important ACR features for AI-200 is ACR Tasks.

ACR Tasks allows container images to be built in Azure rather than requiring the developer to perform the build locally.

Microsoft describes ACR Tasks as a suite of capabilities for building, testing, and managing container images.

For example:

az acr build \
--registry contosoregistry \
--image customer-api:v1 \
--file Dockerfile .

The command:

  1. Sends the build context to Azure.
  2. Uses the Dockerfile.
  3. Builds the image in Azure.
  4. Tags the resulting image.
  5. Pushes the resulting image into the registry.

This is particularly useful when a developer doesn’t have Docker installed locally.

Microsoft’s current quickstart explicitly demonstrates building, pushing, and running an image using ACR Tasks without requiring a local Docker installation.


11. ACR Tasks Quick Tasks

A quick task is useful for an on-demand image build.

For example:

az acr build \
--registry contosoregistry \
--image customer-api:v1 \
.

This is useful during the development inner loop.

Instead of:

Developer machine
|
+-- docker build
+-- docker tag
+-- docker push

you can use:

Developer
|
| az acr build
v
Azure
|
+-- Build
+-- Tag
+-- Push
v
ACR

12. Automated ACR Tasks

ACR Tasks can also be configured to automatically execute when certain events occur.

For example:

Git commit
|
v
ACR Task
|
+-- Build image
+-- Test image
+-- Push image

ACR Tasks can also respond to base image updates.

For example, suppose an application uses:

FROM python:3.12

A base-image update can trigger an ACR Task to rebuild the application image.

This is useful for keeping application images current when their base images change.

Microsoft documents ACR Tasks triggers for Git commits and base-image updates.


13. Multi-Step ACR Tasks

ACR Tasks can execute more sophisticated workflows.

For example:

Build application image
|
v
Run application
|
v
Run test container
|
v
Push image

Multi-step tasks are defined using YAML.

A simplified example is:

version: v1.1.0
steps:
- build: -t $Registry/customer-api:$ID .
- push:
- $Registry/customer-api:$ID
- cmd: $Registry/customer-api:$ID

ACR Tasks supports three major step types:

StepPurpose
buildBuild a container image
pushPush an image to a registry
cmdRun a container as a command

Exam Tip

If a question describes a workflow that needs to build, test, and push multiple containers, think:

ACR Tasks multi-step task


14. ACR Tasks and External Registries

ACR Tasks can also interact with other registries.

For example, a task may need to:

ACR
|
+-- Pull base image from another registry
|
+-- Build application
|
+-- Push application image to ACR

Credentials can be configured for tasks when access to another registry is required.

For more secure scenarios, ACR Tasks can use managed identities to access protected Azure resources without embedding credentials directly in task definitions.


15. Authentication to Azure Container Registry

ACR is generally private, so clients need appropriate authentication and authorization to access it.

Common authentication approaches include:

  • Microsoft Entra identities
  • Managed identities
  • Service principals
  • Administrator credentials
  • Repository-scoped access mechanisms
  • Anonymous pull, where explicitly configured and supported

Microsoft’s documentation emphasizes that ACR operations such as push and pull require authentication unless anonymous pull is enabled.


16. Managed Identity and ACR

Managed identities are particularly important in Azure-native applications.

Suppose an AKS cluster needs to pull an image:

AKS
|
| Managed Identity
v
Azure Container Registry
|
v
customer-api:v1

Rather than storing a registry password in application configuration, the Azure resource can use a managed identity and appropriate permissions.

For a non-ABAC-enabled registry, a common pull-only role is:

AcrPull

For push and pull:

AcrPush

For ABAC-enabled registries, Microsoft documents repository-scoped roles such as:

Container Registry Repository Reader
Container Registry Repository Writer

The exact role depends on the registry’s authorization model.

Exam Tip

When the question says:

“An Azure service needs to pull images from ACR without storing credentials.”

Think:

Managed identity + appropriate ACR permissions


17. ACR Pricing Tiers

Azure Container Registry currently provides three pricing tiers:

  • Basic
  • Standard
  • Premium

The tiers provide increasing capacity and capabilities.

CapabilityBasicStandardPremium
Intended useLower-volume scenariosProduction scenariosHigh-volume/advanced scenarios
Included storage10 GiB100 GiB500 GiB
Geo-replicationNoNoYes
Private endpointsNoNoYes
Content trustNoNoYes
Customer-managed keysNoNoYes
Dedicated Tasks agent poolsNoNoYes
Higher throughput/concurrencyLowerMediumHigher

All three tiers provide core registry capabilities, while Premium adds advanced capabilities and higher limits.

Important Exam Distinction

If the requirement is:

“Replicate a registry across multiple Azure regions.”

Think:

Premium ACR

Geo-replication is a Premium feature.


18. Geo-Replication

Geo-replication allows an ACR to replicate its content across multiple Azure regions.

For example:

                 Azure Container Registry
                          |
             +------------+------------+
             |                         |
             v                         v
         East US                  West Europe
        Geo-replica               Geo-replica
             |                         |
             v                         v
          AKS US                  AKS Europe

When an image is pushed to the geo-replicated registry, its content is synchronized to the configured replicas.

The advantage is that applications can access images from regions closer to where they run.

Microsoft describes geo-replication as providing a single registry management experience while synchronizing content across selected regions.

Don’t confuse:

Availability zones and geo-replication.

Availability zones provide resilience across zones within a region.

Geo-replication distributes registry content across different Azure regions.

Current Microsoft documentation states that zone redundancy is enabled by default for ACR registries in supported regions across Basic, Standard, and Premium tiers.


19. Managing Images and Repositories

You can manage repositories and images through:

  • Azure portal
  • Azure CLI
  • REST APIs
  • SDKs
  • Docker/OCI tooling

For example, you can list repositories:

az acr repository list \
--name contosoregistry \
--output table

List tags:

az acr repository show-tags \
--name contosoregistry \
--repository customer-api \
--output table

You can also inspect manifests and image metadata.

The Azure portal exposes repositories and their image tags through the registry’s Repositories interface.


20. Deleting Images

Suppose a repository contains:

customer-api:v1
customer-api:v2
customer-api:v3

You can remove an image tag using Azure CLI.

For example:

az acr repository untag \
--name contosoregistry \
--image customer-api:v1

However, remember an important distinction:

Untagging an image does not necessarily immediately remove the underlying image data.

The manifest may become untagged while its layers continue consuming storage.

Microsoft specifically warns about the accumulation of untagged artifacts when images are repeatedly pushed using the same tags.


21. Retention of Untagged Manifests

ACR supports a retention policy for untagged manifests.

The purpose is to automatically remove untagged manifests after a configured period.

For example:

Image:v1
Image:v2
Image:v3

If v2 is removed:

Image:v2 โ†’ untagged manifest

A retention policy can eventually remove the untagged manifest.

The current Microsoft documentation identifies the untagged-manifest retention policy as a Premium feature and currently documents it as a preview feature. The policy can be configured for a retention period from 0 through 365 days.

Important Warning

If an application relies on pulling an image by its digest, automatically deleting untagged manifests can make that image unavailable.

This is an important operational consideration and a potential exam scenario.


22. Image Tagging Best Practices

A strong production tagging strategy should make image identification predictable.

A useful approach is to use multiple tags for different purposes.

For example:

customer-api:v2.4.1
customer-api:build-1847
customer-api:a81f42c

You might also maintain:

customer-api:production

as a deployment-oriented alias.

However, don’t rely on a mutable tag such as production or latest when you require immutable deployment behavior.

A good pattern is:

Human-readable release
+
Unique build identifier
+
Optional environment alias

For example:

customer-api:v2.4.1
customer-api:build-1847
customer-api:production

The production deployment can ultimately be pinned to a specific immutable image reference/digest.


23. Common ACR Mistakes

Mistake 1: Using latest for production deployments

latest can change.

Better: use unique version tags and/or digests.


Mistake 2: Assuming deleting a tag deletes the image immediately

An untagged manifest may continue consuming storage.

Better: understand manifests, layers, untagging, deletion, and retention.


Mistake 3: Giving every workload push permissions

An application that only needs to run an image generally doesn’t need permission to push images.

Better: follow least privilege.

For example:

Application โ†’ AcrPull
Build pipeline โ†’ AcrPush

Mistake 4: Storing registry passwords in application code

This creates unnecessary credential-management risks.

Better: use managed identities or another appropriate identity mechanism.


Mistake 5: Choosing Premium solely because it sounds better

Premium should be selected because its capabilities are required.

Examples include:

  • Geo-replication
  • Private endpoints
  • Content trust
  • Higher throughput
  • Advanced networking
  • Dedicated Tasks agent pools

Mistake 6: Confusing ACR with ACR Tasks

They are related but different concepts.

ACR:

Stores and manages container images.

ACR Tasks:

Builds, tests, and automates container image workflows.

A single ACR resource can therefore be used to store images while ACR Tasks provides the automation to build those images.


24. Important AI-200 Concepts to Know

For this exam objective, make sure you can explain the following without referring to documentation:

ConceptWhat you should know
Azure Container RegistryManaged private container registry
RegistryTop-level ACR resource
RepositoryCollection of related images/artifacts
TagHuman-readable image/version reference
DigestContent-addressed image reference
ManifestDescribes image/artifact and its layers
LayerComponent of a container image
az acr loginAuthenticates a client to ACR
docker pushUploads an image to ACR
docker pullDownloads an image from ACR
az acr buildBuilds an image using ACR Tasks
ACR TasksCloud-based image build/test automation
Multi-step taskBuild/test/push workflows using YAML
AcrPullPull permission for applicable non-ABAC registry scenarios
AcrPushPush/pull permission for applicable non-ABAC registry scenarios
Managed identityCredential-free Azure resource authentication
BasicEntry-level ACR tier
StandardHigher capacity production-oriented tier
PremiumAdvanced capabilities such as geo-replication/private endpoints
Geo-replicationReplicate registry content across regions
Retention policyAutomatically remove eligible untagged manifests

25. AI-200 Scenario Patterns to Recognize

The exam is likely to test your ability to choose the appropriate Azure capability based on a scenario.

Scenario: Build without Docker locally

Requirement: Developers don’t have Docker installed.

Answer: ACR Tasks / az acr build.


Scenario: Automatically rebuild after a Git commit

Requirement: Every source-code commit should trigger an image build.

Answer: ACR Task with a source-code trigger.


Scenario: Rebuild after base image updates

Requirement: Automatically rebuild application images when their base image changes.

Answer: ACR Tasks base-image trigger.


Scenario: Run the same image in several Azure regions

Requirement: Applications in multiple regions should access registry content efficiently.

Answer: ACR Premium with geo-replication.


Scenario: Application only needs to pull images

Requirement: A workload should retrieve images but shouldn’t be able to modify them.

Answer: Grant an appropriate pull-only role, such as AcrPull where applicable, or the appropriate repository reader role for an ABAC-enabled registry.


Scenario: Avoid credentials in application configuration

Requirement: An Azure-hosted application needs to access ACR without storing passwords.

Answer: Managed identity + appropriate registry permissions.


Scenario: Guarantee a specific image

Requirement: A deployment must always retrieve exactly the same image content.

Answer: Use an image digest rather than relying solely on a mutable tag.


26. Quick Review

The following mental model is useful for the exam:

                    AZURE CONTAINER REGISTRY
                             |
             +---------------+---------------+
             |                               |
        Repositories                    ACR Tasks
             |                               |
      +------+------+                  Build/Test/Push
      |             |
   Image          Image
      |             |
    Tags          Tags
      |             |
   Manifest      Manifest
      |
    Layers

And remember the major distinction:

ACR
โ†“
Store/manage images
ACR Tasks
โ†“
Build/test/automate images

For production deployments:

Avoid:
:latest
Prefer:
:v2.4.1
:build-1847
@sha256:<digest>

For authentication:

Azure workload
|
| Managed Identity
v
ACR
|
| Appropriate least-privilege role
v
Pull image

For global deployments:

ACR Premium
|
+---- Region 1
|
+---- Region 2
|
+---- Region 3

Practice Exam Questions

Question 1

A development team has a Dockerfile and wants to build a container image directly in Azure. Developers should not need Docker installed on their local computers. The resulting image should be pushed to Azure Container Registry.

Which Azure capability should you use?

A. Azure Container Registry Tasks

B. Azure App Service deployment slots

C. Azure Container Apps revisions

D. Azure Kubernetes Service Jobs

Answer: A

Explanation: Azure Container Registry Tasks can build container images in Azure using a Dockerfile. The az acr build command provides an on-demand build capability and can push the resulting image to ACR. A local Docker installation isn’t required for this workflow.


Question 2

An application image is stored as:

contosoregistry.azurecr.io/orders:v4

What does v4 represent?

A. The registry name

B. The image tag

C. The image digest

D. The repository namespace

Answer: B

Explanation: In an image reference such as:

registry/repository:tag

the portion after the colon is the tag. Therefore, v4 is the image tag. Tags are commonly used to identify image versions.


Question 3

A production application must always retrieve exactly the same container image content. Developers are concerned that a tag could later be reassigned to a different image.

Which image reference should the application use?

A. :latest

B. :production

C. :stable

D. @sha256:<digest>

Answer: D

Explanation: Tags can be moved to different image versions. A digest is a content-addressed identifier and can be used to pull a specific image version. Microsoft specifically identifies digest-based pulls as a way to guarantee the image version being retrieved.


Question 4

An organization deploys applications to Azure regions in North America and Europe. The organization wants container images to be replicated to both regions while maintaining a single ACR management experience.

Which ACR capability should be used?

A. Repository namespaces

B. Availability zones

C. Geo-replication

D. Image tags

Answer: C

Explanation: ACR geo-replication synchronizes registry content across selected Azure regions while allowing the organization to manage the registry as a single logical registry. Geo-replication is a Premium ACR capability.


Question 5

An AKS workload needs to pull private container images from ACR. The organization does not want to store registry passwords in Kubernetes configuration.

Which approach is most appropriate?

A. Use a managed identity with appropriate ACR permissions

B. Store the ACR administrator password in the container image

C. Make the repository publicly accessible

D. Embed an ACR password in the application source code

Answer: A

Explanation: Azure resources can use managed identities to authenticate to ACR without storing credentials in application code or configuration. The identity must be granted the appropriate pull permissions.


Question 6

A development team wants an automated container workflow that performs the following:

  1. Builds an application image.
  2. Runs a test container.
  3. Builds another image.
  4. Pushes the resulting images.

Which ACR capability should the team use?

A. ACR repository namespaces

B. ACR multi-step Tasks

C. ACR geo-replication

D. ACR anonymous pull

Answer: B

Explanation: ACR Tasks supports multi-step workflows using YAML. The workflow can build, run/test, and push one or more images. The available step types include build, push, and cmd.


Question 7

An organization repeatedly pushes new builds using the same image tag. After several months, the registry contains significant amounts of storage that cannot be explained by the currently tagged images.

What is the most likely explanation?

A. ACR automatically creates a new repository for every push

B. Geo-replication is duplicating every image within the same region

C. Previous manifests became untagged while their image data remained in the registry

D. ACR stores every Dockerfile indefinitely

Answer: C

Explanation: Repeatedly pushing modified images using the same tag can result in previous manifests becoming untagged. Their layers can continue consuming registry storage until the underlying content is deleted.


Question 8

A company needs to automatically rebuild its application container whenever a new version of the application’s base container image becomes available.

Which capability should be configured?

A. Azure App Service deployment slots

B. ACR geo-replication

C. ACR repository tagging

D. An ACR Task with a base-image update trigger

Answer: D

Explanation: ACR Tasks can automatically trigger builds when a base image is updated. This is useful for rebuilding application images when their underlying base images change.


Question 9

An organization requires private connectivity to its Azure Container Registry through Azure Private Link. Which ACR pricing tier supports this capability?

A. Premium

B. Basic

C. Standard

D. All three tiers

Answer: A

Explanation: Azure Container Registry Premium supports private endpoints through Private Link. Basic and Standard do not provide this capability according to the current ACR SKU documentation.


Question 10

An administrator removes the v1 tag from an image in an ACR repository. The administrator assumes that the underlying image data has immediately been removed from the registry.

Which statement is correct?

A. Removing a tag always immediately deletes every associated layer

B. Removing a tag converts the image automatically into a public image

C. Removing a tag deletes the entire repository

D. The manifest can become untagged while its data continues consuming storage

Answer: D

Explanation: Removing a tag can leave the manifest untagged while its associated data remains in the registry. Untagged artifacts can continue consuming storage until they are deleted. ACR provides mechanisms such as retention policies for eligible untagged manifests.


Final AI-200 Takeaways

For this particular AI-200 objective, concentrate on these distinctions:

Azure Container Registry

Store and manage container images and artifacts.

ACR repository

Organizes related images.

Tag

Human-readable version/reference that can be reassigned.

Digest

Content-addressed identifier for a specific image version.

Manifest

Describes the image/artifact and its layers.

ACR Tasks

Build, test, and automate container image workflows.

az acr build

Perform an on-demand cloud-based container build.

Multi-step ACR Task

Build/test/push multiple images or perform multi-stage workflows.

Managed identity

Authenticate Azure workloads to ACR without managing passwords.

AcrPull

Pull permission for applicable non-ABAC registry scenarios.

AcrPush

Push/pull permission for applicable non-ABAC registry scenarios.

Premium

Required for capabilities such as geo-replication and private endpoints.

Geo-replication

Replicate registry content across Azure regions.

Retention

Help clean up eligible untagged manifests.

The most important exam mindset is to distinguish where the image is stored, how it is identified, how it is built, and how the workload is authorized to retrieve it. Those four dimensionsโ€”registry/repository, tag/digest, ACR Tasks, and authentication/RBACโ€”cover a large portion of the practical knowledge behind this objective.


Go to the AI-200 Exam Prep Hub main page

Identify Microsoft Cloud Services for real-time analytics (DP-900 Exam Prep)

This post is a part of the DP-900: Microsoft Azure Data Fundamentals Exam Prep Hub. 
This topic falls under these sections:
Describe an analytics workload (25โ€“30%)
--> Describe considerations for real-time data analytics
--> Identify Microsoft Cloud Services for real-time analytics


Note that there are 10 practice questions (with answers and explanations) for each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available on the hub below the exam topics section.

Real-time analytics enables organizations to ingest, process, and analyze data as it is generated, allowing for immediate insights and actions. Microsoft Azure provides several services specifically designed to support real-time analytics workloads.

For the DP-900 exam, you should understand which services are used, their roles, and how they work together in a streaming architecture.


What Is Real-Time Analytics?

Real-time analytics refers to:

  • Processing data as it arrives (streaming data)
  • Producing insights with low latency (seconds or milliseconds)
  • Supporting immediate decision-making

Key Components of a Real-Time Analytics Solution

A typical real-time pipeline includes:

  1. Ingestion โ†’ Capture streaming data
  2. Processing โ†’ Analyze and transform data
  3. Storage โ†’ Persist results
  4. Visualization โ†’ Display insights

Core Azure Services for Real-Time Analytics


1. Event Ingestion Services


Azure Event Hubs

Purpose

  • High-throughput event ingestion service

Key Features

  • Handles millions of events per second
  • Scalable and distributed
  • Supports real-time data pipelines

Use Cases

  • IoT telemetry ingestion
  • Application logs
  • Streaming data pipelines

โœ” Think: โ€œEntry point for streaming dataโ€


Azure IoT Hub

Purpose

  • Specialized ingestion for IoT devices

Key Features

  • Device-to-cloud communication
  • Secure device management

Use Cases

  • Sensor data
  • Connected devices

โœ” Think: โ€œEvent Hubs for IoT scenariosโ€


2. Stream Processing Services


Azure Stream Analytics

Purpose

  • Real-time data processing using SQL-like queries

Key Features

  • Low-latency processing
  • Easy-to-use query language
  • Built-in integrations with Azure services

Use Cases

  • Real-time dashboards
  • Fraud detection
  • Alerting systems

โœ” Think: โ€œReal-time analytics with SQLโ€


Azure Databricks

Purpose

  • Advanced stream and batch processing using Apache Spark

Key Features

  • Supports structured streaming
  • Handles large-scale data processing
  • Integrates with machine learning workflows

Use Cases

  • Complex event processing
  • Advanced analytics
  • Machine learning pipelines

โœ” Think: โ€œPowerful, flexible streaming + big data processingโ€


3. Real-Time Analytics & Query Services


Azure Synapse Analytics

Purpose

  • Analyze streaming and batch data

Key Features

  • Integrates with streaming pipelines
  • Supports near real-time analytics

โœ” Often used as part of a larger analytics architecture


Microsoft Fabric

Purpose

  • End-to-end analytics including real-time capabilities

Key Features

  • Real-Time Analytics workloads
  • Integrated with OneLake and Power BI
  • Unified platform for ingestion, processing, and visualization

โœ” Think: โ€œAll-in-one analytics platform (including real-time)โ€


How These Services Work Together

Typical Real-Time Pipeline

  1. Ingestion
    • Azure Event Hubs / Azure IoT Hub
  2. Processing
    • Azure Stream Analytics / Azure Databricks
  3. Storage
    • Data Lake / Synapse / Fabric OneLake
  4. Visualization
    • Power BI / Fabric dashboards

Service Selection Guidance


Use Azure Event Hubs when:

  • You need high-throughput event ingestion
  • Handling streaming data at scale

Use Azure IoT Hub when:

  • You are working with connected devices (IoT)

Use Azure Stream Analytics when:

  • You want simple, SQL-based real-time processing
  • Need quick setup and low complexity

Use Azure Databricks when:

  • You need advanced processing or machine learning
  • Working with complex or large-scale streaming data

Use Microsoft Fabric when:

  • You want a unified platform with real-time analytics built in
  • Need end-to-end analytics (data + BI)

Why This Matters for DP-900

On the exam, you may be asked to:

  • Identify which service handles streaming ingestion vs processing
  • Choose the correct service for real-time scenarios
  • Understand how services work together in a pipeline

Summary โ€” Exam-Relevant Takeaways

โœ” Real-time analytics = low-latency insights from streaming data

โœ” Core services:

  • Ingestion
    • Azure Event Hubs
    • Azure IoT Hub
  • Processing
    • Azure Stream Analytics
    • Azure Databricks
  • Analytics / Platform
    • Azure Synapse Analytics
    • Microsoft Fabric

โœ” Key distinctions:

  • Event Hubs โ†’ ingestion
  • Stream Analytics โ†’ real-time processing
  • Databricks โ†’ advanced processing
  • Fabric โ†’ unified analytics platform

โœ” Exam tip:
๐Ÿ‘‰ Streaming ingestion โ†’ Event Hubs
๐Ÿ‘‰ Real-time processing โ†’ Stream Analytics
๐Ÿ‘‰ Advanced analytics โ†’ Databricks
๐Ÿ‘‰ Unified solution โ†’ Fabric


Go to the Practice Exam Questions for this topic.

Go to the DP-900 Exam Prep Hub main page.

Practice Questions: Identify Microsoft Cloud Services for real-time analytics (DP-900 Exam Prep)

Practice Questions


Question 1

Which Azure service is primarily used for ingesting large volumes of streaming data?

A. Azure Data Factory
B. Azure Event Hubs
C. Azure SQL Database
D. Azure Files

โœ… Answer: B

Explanation:
Azure Event Hubs is designed for high-throughput event ingestion in real time.


Question 2

Which Azure service is specifically designed for ingesting data from IoT devices?

A. Azure Blob Storage
B. Azure IoT Hub
C. Azure Synapse Analytics
D. Azure Table Storage

โœ… Answer: B

Explanation:
Azure IoT Hub enables secure communication with IoT devices and ingests telemetry data.


Question 3

Which Azure service allows real-time data processing using a SQL-like query language?

A. Azure Databricks
B. Azure Data Factory
C. Azure Stream Analytics
D. Azure Virtual Machines

โœ… Answer: C

Explanation:
Azure Stream Analytics processes streaming data using SQL-like queries.


Question 4

Which service is BEST suited for advanced real-time analytics and machine learning on streaming data?

A. Azure Files
B. Azure Databricks
C. Azure Table Storage
D. Azure DNS

โœ… Answer: B

Explanation:
Azure Databricks supports advanced analytics, Spark processing, and ML workflows.


Question 5

Which service provides a unified analytics platform that includes real-time analytics capabilities?

A. Azure Virtual Machines
B. Azure Blob Storage
C. Microsoft Fabric
D. Azure Files

โœ… Answer: C

Explanation:
Microsoft Fabric integrates real-time analytics, data engineering, and BI into one platform.


Question 6

Which component of a real-time analytics solution is responsible for capturing incoming data?

A. Processing
B. Storage
C. Visualization
D. Ingestion

โœ… Answer: D

Explanation:
The ingestion layer is responsible for capturing streaming data.


Question 7

You need to process streaming data with minimal setup using SQL-like queries. Which service should you choose?

A. Azure Databricks
B. Azure Synapse Analytics
C. Azure Stream Analytics
D. Azure Data Factory

โœ… Answer: C

Explanation:
Stream Analytics is ideal for simple, real-time processing with SQL syntax.


Question 8

Which service is MOST appropriate for handling millions of streaming events per second?

A. Azure SQL Database
B. Azure Files
C. Azure Event Hubs
D. Azure Table Storage

โœ… Answer: C

Explanation:
Event Hubs is built for high-throughput event ingestion at scale.


Question 9

Which of the following describes a typical real-time analytics pipeline?

A. Storage โ†’ Visualization โ†’ Ingestion โ†’ Processing
B. Processing โ†’ Ingestion โ†’ Storage โ†’ Visualization
C. Ingestion โ†’ Processing โ†’ Storage โ†’ Visualization
D. Visualization โ†’ Storage โ†’ Processing โ†’ Ingestion

โœ… Answer: C

Explanation:
The standard flow is:
Ingestion โ†’ Processing โ†’ Storage โ†’ Visualization


Question 10

Which scenario BEST demonstrates a real-time analytics use case?

A. Generating a yearly financial report
B. Archiving historical data
C. Monitoring live sensor data and triggering alerts
D. Migrating legacy databases

โœ… Answer: C

Explanation:
Real-time analytics is used for immediate insights and actions, such as alerts from live data.


โœ… Quick Exam Takeaways

โœ” Real-time analytics = low-latency insights from streaming data

โœ” Core services:

  • Ingestion
    • Azure Event Hubs
    • Azure IoT Hub
  • Processing
    • Azure Stream Analytics
    • Azure Databricks
  • Platform
    • Microsoft Fabric

โœ” Key roles:

  • Event Hubs โ†’ ingestion
  • Stream Analytics โ†’ real-time processing
  • Databricks โ†’ advanced analytics
  • Fabric โ†’ unified analytics platform

โœ” Exam tip:
๐Ÿ‘‰ Ingest streaming data โ†’ Event Hubs
๐Ÿ‘‰ Process with SQL โ†’ Stream Analytics
๐Ÿ‘‰ Advanced analytics โ†’ Databricks
๐Ÿ‘‰ End-to-end solution โ†’ Fabric


Go to the DP-900 Exam Prep Hub main page.