AZ-900 Microsoft Azure Fundamentals โ Compressed Exam-Preparation Course
Alignment: AZ-900 skills measured as of January 14, 2026 Purpose: A fast but complete revision course built from the analyzed 1,100-question AZ-900 practice bank and organized around the current Microsoft blueprint. Best use: Learn the decision rules first, then use practice questions to test whether you can select the correct Azure concept or service from plausible distractors.
1. Exam Overview
What the exam is testing
AZ-900 tests whether you can recognize foundational cloud concepts and choose the most appropriate Azure concept, service, or management tool for a short scenario.
You are not expected to design complex enterprise systems or configure services from memory. You are expected to answer questions such as:
Is this public, private, or hybrid cloud?
Is the best fit IaaS, PaaS, SaaS, or serverless?
Does the scenario need a virtual machine, a container, a web app, or a function?
Does the network requirement call for VNet peering, VPN Gateway, ExpressRoute, a public endpoint, or a private endpoint?
Is the question about governance, cost, monitoring, security, or deployment?
Which Azure tool solves the stated problem most directly?
The official passing score is 700 or greater. Treat every question as a decision problem: identify the requirement, eliminate unrelated service categories, and select the option that most directly solves the problem.
How to think like the exam
Most AZ-900 questions use a simple pattern:
A company has a requirement.
Several answers are real Azure concepts or services.
Only one answer matches the primary requirement.
The strongest distractor often solves a nearby but different problem.
Use this mental sequence:
Identify the category: cloud concept, architecture, compute, network, storage, identity, cost, governance, deployment, or monitoring.
Highlight the decisive words: private, over the public internet, without managing servers, prevent deletion, estimate cost before deployment, service incident, or application telemetry.
Eliminate services from the wrong category.
Choose the simplest Azure option that directly satisfies the requirement.
Do not add complexity unless the scenario requires it.
How to use this course
Use the guide in four passes:
Pass 1: Learn the maps and comparison tables.
Pass 2: Practice service selection by covering the answer column and choosing from the scenario alone.
Pass 3: Review the traps and explain why the best wrong answer fails.
Pass 4: Use the rapid-review section and exam-day checklist.
2. Exam Domains
Domain list and priorities
Official domain
Official weight
Study priority
Why it matters
Describe cloud concepts
25โ30%
High
Establishes the vocabulary used in every other domain
Describe Azure architecture and services
35โ40%
Very high
Largest domain; contains the most service-selection questions
Describe Azure management and governance
30โ35%
Very high
Frequently tests tools that sound similar but solve different problems
Priority notes
Spend the most time on:
Azure architecture, compute, networking, storage, and identity.
Governance, cost management, deployment tools, and monitoring.
Cloud models, service models, shared responsibility, and cloud benefits.
What matters most
The exam repeatedly rewards accurate mapping:
Requirement signal
Likely answer
Control the guest operating system
Azure Virtual Machines / IaaS
Host a web application without patching the OS
Azure App Service / PaaS
Run event-driven code without managing servers
Azure Functions / serverless
Encrypted connection over the public internet
Azure VPN Gateway
Private connectivity that avoids the public internet
ExpressRoute
Private IP access to an Azure service
Private endpoint
Apply standards across resources
Azure Policy
Prevent accidental deletion
Resource lock
Estimate cost before deployment
Azure pricing calculator
Analyze current spending and set budgets
Microsoft Cost Management
Platform incident or planned maintenance
Azure Service Health
Telemetry, logs, metrics, alerts
Azure Monitor
Application performance and failures
Application Insights
Personalized optimization recommendations
Azure Advisor
3. Start-to-Finish Study Path
Foundation
Learn these first:
Public, private, and hybrid cloud.
Consumption-based pricing, CapEx, and OpEx.
Shared responsibility.
High availability, scalability, elasticity, reliability, predictability, governance, and manageability.
IaaS, PaaS, SaaS, and serverless.
Checkpoint: you should be able to explain why a VM is usually IaaS, why App Service is PaaS, and why Microsoft 365 is SaaS.
Intermediate
Move to Azure architecture and core services:
Regions, datacenters, availability zones, region pairs, and sovereign regions.
Management groups, subscriptions, resource groups, and resources.
Virtual machines, scale sets, availability sets, Azure Virtual Desktop, containers, Functions, and web apps.
VNets, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute, public endpoints, and private endpoints.
Blob, Files, Queue, Table, managed disks, storage tiers, and redundancy.
Microsoft Entra ID, Entra Domain Services, SSO, MFA, passwordless, external identities, Conditional Access, RBAC, Zero Trust, defense in depth, and Defender for Cloud.
Checkpoint: for each scenario, identify the service category before selecting a product.
Advanced
Focus on confusing pairs and multi-constraint questions:
Availability zone versus availability set versus region pair.
VPN Gateway versus ExpressRoute.
Public endpoint versus private endpoint.
Blob versus Files versus Queue versus Table versus managed disks.
Microsoft Entra ID versus Entra Domain Services.
SSO versus MFA versus passwordless versus Conditional Access.
Azure Policy versus resource locks versus tags versus RBAC.
Advisor versus Service Health versus Monitor versus Log Analytics versus Application Insights.
Pricing calculator versus Cost Management.
Portal versus Cloud Shell versus CLI versus PowerShell versus ARM templates.
Checkpoint: explain why the most tempting distractor is wrong.
Final review
Use the last-day method:
Read the quick memory rules.
Review the service-selection tables.
Rehearse the architecture hierarchy.
Revisit storage redundancy and monitoring tools.
Answer a mixed set of questions without notes.
Review only the concepts you missed.
4. Core Concepts by Domain
Domain 1 โ Describe Cloud Concepts
4.1 Cloud computing
Cloud computing delivers computing services over the internet or through a cloud environment. Instead of buying and operating every server yourself, you use resources as needed.
Cloud models
Model
Meaning
Best fit
Common trap
Public cloud
Provider-owned cloud resources shared across customers with logical isolation
Fast deployment, broad cloud services, consumption-based usage
โPublicโ does not mean your data is automatically public
Private cloud
Cloud environment dedicated to one organization
Dedicated control or specialized internal requirements
Private cloud is not the same as a single private endpoint
Hybrid cloud
Combines on-premises or private-cloud resources with public-cloud services
If any required workload remains on-premises while Azure is also used, consider hybrid
Consumption-based model
You use resources when needed and generally pay according to usage. The key advantage is avoiding unnecessary upfront hardware purchases.
Term
Meaning
Exam clue
Capital expenditure (CapEx)
Upfront purchase of assets such as physical servers
โBuy hardware before deploymentโ
Operational expenditure (OpEx)
Ongoing spending such as a variable cloud bill
โMonthly bill changes with usageโ
Consumption-based pricing
Charges align with resource usage
โStop paying after deleting or stopping resourcesโ
Shared responsibility model
Cloud adoption changes who manages each layer.
Layer
On-premises
IaaS
PaaS
SaaS
Physical datacenter
Customer
Microsoft
Microsoft
Microsoft
Physical network and hosts
Customer
Microsoft
Microsoft
Microsoft
Guest OS
Customer
Customer
Microsoft
Microsoft
Runtime and middleware
Customer
Customer
Microsoft
Microsoft
Application
Customer
Customer
Customer
Mostly Microsoft
Data, identities, and access decisions
Customer
Customer
Customer
Customer
Rule: the more managed the service, the less infrastructure the customer manages. The customer still remains responsible for data governance, identity choices, and access decisions.
Serverless
Serverless computing lets you run code without managing servers. The cloud provider handles infrastructure management and scaling details.
Exam clue: event-driven code, short execution, trigger-based processing, no server management โ Azure Functions.
4.2 Benefits of cloud services
Benefit
Meaning
Scenario clue
Do not confuse with
High availability
Keep a service accessible when failures occur
โRemain available if a component failsโ
Scalability
Scalability
Adjust capacity to handle demand
โIncrease capacityโ
High availability
Horizontal scaling
Add or remove instances
โAdd more VMs behind a load balancerโ
Vertical scaling
Vertical scaling
Increase or decrease capacity of one resource
โIncrease CPU and memory on a VMโ
Horizontal scaling
Elasticity
Scale dynamically as demand rises and falls
โSeasonal spike; add and remove resources automaticallyโ
Static scaling
Reliability
Recover from failures and continue operating
โReduce effect of failures; recoverโ
Cost optimization
Predictability
Improve confidence in cost or performance planning
โForecast expected usage or costโ
Guaranteed zero variation
Security
Use cloud controls and provider capabilities to protect resources
โProtect workloads and identitiesโ
Governance
Governance
Enforce standards and organizational rules
โApproved regions and required tagsโ
Monitoring
Manageability
Deploy and operate resources using portals, CLI, APIs, templates, and automation
Do not confuse elasticity with scalability. Elasticity emphasizes dynamic adjustment as demand changes.
Do not confuse high availability with horizontal scaling. Scaling may support availability, but the concepts are not identical.
Do not say Microsoft patches the guest OS of an IaaS VM. The customer manages the VM guest OS.
Do not choose SaaS for a lift-and-shift migration. SaaS replaces the application with a complete managed application.
Do not choose PaaS when the requirement explicitly demands guest OS control.
Domain 2 โ Describe Azure Architecture and Services
4.4 Core Azure architecture
Physical and geographic concepts
Concept
Meaning
Key exam clue
Azure datacenter
Physical facility containing servers, networking, power, and cooling
โPhysical facilityโ
Azure region
Geographic area containing one or more datacenters connected through a low-latency network
โDeploy in a geographic areaโ
Availability zone
Physically separate location within a supported region with independent power, cooling, and networking
โProtect from datacenter-level failure in the same regionโ
Region pair
Relationship between two Azure regions used for certain replication and recovery considerations
โSecondary regionโ or regional recovery relationship
Sovereign region
Specialized Azure environment for particular government or legal requirements
โGovernment, legal, or isolated environmentโ
Management hierarchy
Memorize this order:
Management group โ Subscription โ Resource group โ Resource
Scope
Purpose
Exam clue
Management group
Organize and govern multiple subscriptions
โApply policy across subscriptionsโ
Subscription
Billing and access-control boundary
โSeparate billing for development and productionโ
Resource group
Logical container for resources managed together
โGroup resources for one application lifecycleโ
Resource
Individual Azure item, such as a VM, VNet, or storage account
โThe deployed service itselfโ
Hierarchy traps
A resource group is logical, not physical.
A resource belongs to one resource group at a time.
Resources inside one resource group can often be located in different regions.
A subscription is not an availability or resiliency feature.
A management group does not contain VMs directly; it organizes subscriptions.
4.5 Compute services
Compute selection table
Requirement
Recommended service
Why
Common wrong answer
Full guest OS control
Azure Virtual Machines
VM provides OS-level control
Azure Functions
Identical load-balanced VMs that can scale
Virtual Machine Scale Sets
Manages a scalable VM group
Availability set
Spread VMs across fault and update domains
Availability set
Helps reduce impact of host maintenance or faults
Availability zone
Virtualized desktops and apps for remote users
Azure Virtual Desktop
Delivers desktop and app virtualization
Azure Functions
Portable package with code and dependencies
Containers
Consistent deployment unit
Resource group
Event-driven execution without server management
Azure Functions
Serverless compute
Azure Virtual Machines
Managed hosting for web applications
Azure App Service Web Apps
PaaS-style web hosting
VM unless OS control is required
Azure VM supporting resources
A VM commonly needs:
A network interface (NIC).
A virtual network and subnet.
Storage for the operating-system disk.
Optional data disks.
Optional public IP or private connectivity depending on the design.
Exam rule: a NIC connects a VM to a VNet. Managed disks provide persistent block storage for VM OS and data disks.
Availability set versus availability zone versus scale set
Feature
Primary purpose
Availability set
Distribute VMs across fault and update domains
Availability zone
Separate physical location inside a region
Virtual Machine Scale Set
Deploy and scale a group of similar VMs
Compute traps
Choose Functions for event-driven serverless code, not for OS administration.
Choose App Service for managed web hosting, not if the scenario explicitly requires guest OS control.
Choose containers when portability and packaged dependencies matter.
Choose VM Scale Sets when the question emphasizes a scalable group of similar VMs.
Choose Azure Virtual Desktop for remote user desktops, not ordinary VM autoscaling.
4.6 Networking services
Core networking concepts
Service or concept
Use it for
Key clue
Azure virtual network (VNet)
Private network address space for Azure resources
โPrivate network in Azureโ
Subnet
Segment a VNet into smaller ranges
โDivide a VNetโ
VNet peering
Private connectivity between VNets over the Microsoft backbone
โConnect two VNets privatelyโ
Azure DNS
Host DNS zones and resolve names
โName resolutionโ
Azure VPN Gateway
Encrypted connection over the public internet
โEncrypted tunnel over internetโ
ExpressRoute
Private connectivity from on-premises to Microsoft cloud services
โAvoid the public internetโ
Public endpoint
Access through a public address
โPublicly reachable service endpointโ
Private endpoint
Private IP address in a VNet for a supported Azure service
โReach storage or another service through a private IPโ
VPN Gateway versus ExpressRoute
Question clue
Choose
Encrypted connection using the public internet
VPN Gateway
Private circuit that does not send traffic over the public internet
ExpressRoute
Connect two Azure VNets privately
VNet peering
Give an Azure service a private IP inside a VNet
Private endpoint
Networking traps
ExpressRoute is not the answer merely because a connection is secure. It is the answer when private connectivity avoiding the public internet is required.
VPN Gateway uses encrypted traffic over the public internet.
VNet peering connects VNets; it is not a DNS service.
A private endpoint is not the same as a subnet. It places a private IP for a supported service in your VNet.
Azure DNS resolves names. It does not establish network connectivity.
4.7 Storage services
Storage service selection
Service
Purpose
Example
Azure Blob Storage
Unstructured object data
Images, videos, backups, documents
Azure Files
Managed file shares
SMB file share for users or applications
Azure Queue Storage
Asynchronous messages
Decouple application components
Azure Table Storage
NoSQL key-attribute data
Large structured non-relational entity data
Azure managed disks
Persistent block storage for Azure VMs
OS disks and data disks
Storage tiers
Tier
Best for
Access pattern
Hot
Frequently accessed data
Regular reads and writes
Cool
Infrequently accessed but still online data
Occasional reads
Archive
Rarely accessed long-term data
Retrieval delay is acceptable
Storage redundancy
Option
Replication pattern
Choose when
LRS
Multiple copies in one datacenter in the primary region
Lowest-cost local redundancy
ZRS
Copies across availability zones in the primary region
Protect against zone-level failure
GRS
Copies in the primary region and a paired secondary region
Geographic replication
GZRS
Zone redundancy in the primary region plus replication to a secondary region
Combine zone and geographic resiliency
Storage account options
A storage account provides a unique namespace for Azure Storage data. Important exam ideas include:
Standard versus Premium performance.
Storage services available through the account.
Redundancy choice.
Data-access pattern.
Access tier for Blob Storage where relevant.
Data movement and migration
Requirement
Tool
Command-line copying to or from Azure Storage
AzCopy
Graphical desktop management of Azure Storage data
Azure Storage Explorer
Cache an Azure file share on Windows Server and synchronize changes
Azure File Sync
Assess and plan migration of on-premises servers
Azure Migrate
Transfer a very large dataset offline because the network is too slow
Azure Data Box
Storage traps
Blob is object storage; Azure Files is a managed file share.
Queue Storage stores messages, not files.
Table Storage stores non-relational entities, not VM disks.
Managed disks are for VM block storage.
Archive is not for immediate access; retrieval takes time.
ZRS stays in the primary region across zones.
GRS adds a secondary geographic region.
GZRS combines zones in the primary region with geographic replication.
Azure Data Box transfers large offline datasets. It is not a monitoring, governance, or identity tool.
Azure Migrate assesses and plans migrations. It is broader than offline data transfer.
4.8 Identity, access, and security
Identity and directory services
Service
Purpose
Exam clue
Microsoft Entra ID
Cloud identity and access management
โUsers, applications, and access in the cloudโ
Microsoft Entra Domain Services
Managed domain capabilities such as domain join, LDAP, Kerberos, and NTLM without managing domain controllers
โLegacy domain features without deploying domain controllersโ
External identities
Collaboration with users outside the organization
โPartners use their own identitiesโ
Authentication and access controls
Capability
Purpose
Exam clue
Single sign-on (SSO)
Sign in once and access multiple authorized apps
โAvoid repeated sign-insโ
Multifactor authentication (MFA)
Require an additional verification factor
โBeyond a passwordโ
Passwordless authentication
Authenticate without entering a password
โBiometrics or security keyโ
Conditional Access
Apply access rules based on signals such as location, user, device, risk, or app
โRequire MFA from unfamiliar locationsโ
Azure RBAC
Grant authorized actions at a defined Azure scope
โAllow support team to restart VMs but not manage storageโ
Security concepts
Concept
Meaning
Zero Trust
Verify explicitly, use least privilege, and assume breach
Defense in depth
Apply multiple security layers: physical, identity, perimeter, network, compute, application, and data
Microsoft Defender for Cloud
Improve security posture and protect Azure and hybrid workloads
Zero Trust, defense in depth, and Defender for Cloud.
Pricing calculator, Cost Management, tags, and Advisor.
Policy, locks, Purview, and management groups.
Portal, Cloud Shell, CLI, PowerShell, Arc, IaC, ARM, and templates.
Advisor, Service Health, Monitor, Log Analytics, alerts, and Application Insights.
9.2 Last-day revision list
Do these in order:
Recite the architecture hierarchy.
Recite storage service mappings.
Recite storage redundancy mappings.
Compare VPN Gateway and ExpressRoute.
Compare Policy, locks, RBAC, and tags.
Compare Advisor, Service Health, Monitor, Log Analytics, alerts, and Application Insights.
Compare Entra ID and Entra Domain Services.
Compare SSO, MFA, passwordless, and Conditional Access.
Compare VMs, App Service, containers, and Functions.
Review every question you previously answered incorrectly.
9.3 One-minute rapid review
Guest OS control โ VM.
Managed web app โ App Service.
Triggered code โ Functions.
Two VNets โ peering.
Internet tunnel โ VPN Gateway.
Private circuit โ ExpressRoute.
Private service IP โ private endpoint.
Objects โ Blob.
SMB โ Files.
Messages โ Queue.
NoSQL entities โ Table.
VM disks โ managed disks.
Standards โ Policy.
Prevent deletion โ CanNotDelete lock.
Prevent all changes โ ReadOnly lock.
Permissions โ RBAC.
Estimate cost โ pricing calculator.
Spending trends and budgets โ Cost Management.
Recommendations โ Advisor.
Azure incident โ Service Health.
Telemetry โ Monitor.
Query logs โ Log Analytics.
Application telemetry โ Application Insights.
10. Exam-Day Checklist
Must-know topics
Cloud concepts
I can distinguish public, private, and hybrid cloud.
I can explain CapEx, OpEx, and consumption-based pricing.
I understand shared responsibility across IaaS, PaaS, and SaaS.
I can distinguish scalability, elasticity, high availability, and reliability.
I can select IaaS, PaaS, SaaS, or serverless for a scenario.
Architecture and services
I know region, datacenter, availability zone, region pair, and sovereign region.
I know the hierarchy: management group โ subscription โ resource group โ resource.
I can select VM, Scale Set, availability set, Virtual Desktop, container, Function, or App Service.
I know that a NIC connects a VM to a VNet and managed disks store VM OS and data disks.
I can select VNet, subnet, peering, DNS, VPN Gateway, ExpressRoute, public endpoint, or private endpoint.
I can select Blob, Files, Queue, Table, or managed disks.
I can select Hot, Cool, or Archive tiers.
I can distinguish LRS, ZRS, GRS, and GZRS.
I know AzCopy, Storage Explorer, File Sync, Azure Migrate, and Data Box.
I can distinguish Entra ID and Entra Domain Services.
I can distinguish SSO, MFA, passwordless, Conditional Access, and RBAC.
I understand Zero Trust, defense in depth, and Defender for Cloud.
Management and governance
I can select the pricing calculator, Cost Management, tags, or Advisor.
I can distinguish Policy, locks, RBAC, and tags.
I know the difference between CanNotDelete and ReadOnly locks.
I know Microsoft Purview is a data-governance capability.
I can select portal, Cloud Shell, CLI, PowerShell, Arc, IaC, ARM, or ARM templates.
I can distinguish Advisor, Service Health, Monitor, Log Analytics, alerts, and Application Insights.
Final confidence checklist
I read the entire question and identify the primary requirement before looking at the options.
I eliminate answers from the wrong service category.
I choose the simplest service that directly meets the requirement.
I explain why the strongest distractor is wrong.
I do not confuse a management tool with a network, storage, compute, or identity service.
I do not confuse a storage tier with a redundancy option.
I do not confuse an Azure platform incident with an application-performance issue.
I do not assume a more expensive or complex option is automatically better.
I am ready to use the practice bank for mixed review.
Appendix A โ Confusing-Service Master Table
Confusing services
Correct distinction
IaaS vs PaaS vs SaaS
OS control vs managed app platform vs complete application
VM vs Functions
OS-level compute vs serverless event-driven code
VM Scale Sets vs availability sets
Scaling similar VMs vs distributing VMs across fault and update domains
Availability set vs availability zone
Host-domain distribution vs physically separate location within a region
Availability zone vs region pair
Same-region datacenter isolation vs cross-region relationship
VNet peering vs VPN Gateway vs ExpressRoute
VNet-to-VNet private connection vs encrypted internet tunnel vs private circuit
Public endpoint vs private endpoint
Public address vs private IP in a VNet
Blob vs Files
Object storage vs managed file shares
Queue vs Table
Messages vs non-relational entities
Hot vs Cool vs Archive
Frequent vs infrequent online vs rare delayed access
LRS vs ZRS vs GRS vs GZRS
Local vs zones vs geography vs zones plus geography
Entra ID vs Entra Domain Services
Cloud identity vs managed legacy domain capabilities
SSO vs MFA vs passwordless vs Conditional Access
One login vs extra factor vs no password vs rule-based access enforcement
RBAC vs Policy vs locks vs tags
Permissions vs standards vs protection from changes vs metadata
Pricing calculator vs Cost Management
Estimate proposed design vs analyze spending and budgets
Advisor vs Service Health vs Monitor
Recommendations vs Azure platform issues vs telemetry platform
Monitor vs Log Analytics vs Application Insights
Telemetry platform vs log queries vs app performance monitoring
Portal vs Cloud Shell vs CLI vs PowerShell
Browser GUI vs browser shell vs az commands vs cmdlets
Azure Migrate vs Azure Data Box
Migration assessment and planning vs offline bulk data transfer
ARM vs ARM template
Azure management layer vs declarative JSON deployment file
Appendix B โ Source Alignment Note
This course was synthesized from the analyzed AZ-900 practice-question bank and aligned with the Microsoft Learn AZ-900 study guide for skills measured as of January 14, 2026. The guide intentionally consolidates repeated questions into original explanations, decision frameworks, and service-selection rules. It is a revision course, not a reproduction of live exam content.
lock_open
Unlock the full course
All 51 modules with detailed explanations, code examples, and exam tips.
