Microsoft Azure Fundamentals (AZ-900) is a conceptual, non-technical exam, and that single fact should shape how you study for it. It does not ask you to configure anything. It asks whether you understand what the cloud is, what Azure offers, and how Azure handles cost, identity and governance, so that you can follow and contribute to cloud conversations. This guide is a full self-study course built around the three skill areas Microsoft measures. It explains each concept in plain English, shows why it matters, points out where beginners go wrong, and then turns the content into a short, realistic plan. It is original teaching material and study guidance only. It contains no real or simulated exam questions, and you should always confirm the current skills and weights against Microsoft’s own AZ-900 study guide before you book.
Chapter 1: Exam overview and how to use this guide
What AZ-900 actually measures
AZ-900 measures foundational understanding, not skill. Microsoft’s own audience profile describes the ideal candidate as someone who wants to demonstrate foundational knowledge of cloud concepts and of Azure, and who can describe Azure’s architectural components and services. The operative verb across the whole exam is “describe”. You are not creating a virtual machine or writing a policy. You are showing that you know what a virtual machine is for, when you would use platform services instead, and what a policy does. Holding that distinction in mind stops you from over-preparing, which is the most common mistake on this exam.
The exam is organised into three skill areas with published weight ranges: Describe cloud concepts at 25 to 30 percent, Describe Azure architecture and services at 35 to 40 percent, and Describe Azure management and governance at 30 to 35 percent. Those weights are the most useful planning fact in this guide. The two larger areas, architecture and services plus management and governance, together make up around 70 percent of the exam, so the bulk of your time belongs there. Cloud concepts is the smallest area, but it is also the quickest to learn because it is mostly vocabulary and reasoning rather than a long list of services.
Format and pass mark
AZ-900 is a short, mostly multiple-choice exam delivered through Pearson VUE, either at a test centre or online with a proctor. You need a score of 700 out of 1000 to pass. That score is scaled, so it is not a simple percentage of questions answered correctly, and you should treat 700 as the bar to clear comfortably rather than exactly. The certification is unusual among Microsoft credentials in that it does not expire. The role-based certifications such as AZ-104 and AZ-204 must be renewed every year, but a fundamentals certification, once earned, stays on your record. That permanence is part of why AZ-900 is a sensible first badge.
How to use this course
Read the three content chapters in order, because the concepts build: the cloud-concepts vocabulary in Chapter 2 underpins the services in Chapter 3, and the governance tools in Chapter 4 only make sense once you understand the resource hierarchy. Treat every bold term as a checklist item, and aim to be able to say what each one is and why it exists in a single sentence. The later chapters turn the content into a short plan, a final review routine, and a description of exam day. Wherever a concept is easy to confuse with a neighbour, a short plain-English comparison appears to make the difference concrete. None of these are exam questions; they are teaching illustrations.
Chapter 2: Describe cloud concepts (25 to 30 percent)
This is the smallest skill area and the foundation for everything else. It is about understanding what cloud computing is, why organisations adopt it, and the broad categories into which cloud services fall. Get these ideas solid and the rest of the exam becomes far easier, because Azure’s services are simply concrete examples of these abstract categories.
What cloud computing is, and the consumption model
Cloud computing is the delivery of computing resources, such as servers, storage, databases and networking, over the internet, on demand, and paid for as you use them. The single idea that separates it from running your own servers is the consumption-based model: instead of buying hardware up front and owning it whether or not you use it, you rent capacity and pay only for what you consume. The exam frames this as a shift from capital expenditure (CapEx), large up-front purchases of equipment, to operational expenditure (OpEx), ongoing pay-as-you-go spending. Understanding this trade-off is important because several questions reward recognising that the cloud turns a big fixed cost into a flexible variable one.
The shared responsibility model
The shared responsibility model is one of the most heavily reinforced ideas at the fundamentals level, and it answers the question “who is responsible for what?” in the cloud. The provider, Microsoft, is always responsible for the physical things: the datacentres, the physical hosts, and the physical network. The customer is always responsible for their own data, their accounts and identities, and their devices. The interesting part is the middle, which shifts depending on the type of service you use. The more managed the service, the more responsibility Microsoft takes on, and the less falls to you. This model connects directly to the service types below, so learn the two together.
Cloud service types: IaaS, PaaS, SaaS
Cloud services are grouped into three types by how much the provider manages for you. The clearest way to remember them is to think about what you still have to look after in each.
Infrastructure as a Service (IaaS) gives you the raw building blocks, such as virtual machines and virtual networks, and you manage the most: the operating system, the runtime, the applications and the data. It offers the most control and is the closest to running your own servers, just without owning the hardware. Platform as a Service (PaaS) provides a managed platform on which you deploy your application, so the provider handles the operating system and the underlying infrastructure, and you focus on your code and your data. It trades some control for far less maintenance. Software as a Service (SaaS) is finished software you simply use, such as a webmail or productivity suite, where the provider manages essentially everything and you manage only your data and your access. As a teaching comparison: hosting a website on a virtual machine you patch yourself is IaaS, deploying the same site to a managed web-hosting service is PaaS, and using a ready-made online office suite is SaaS. The exam often gives a scenario and asks which type fits, so reason from how much the customer wants to manage.
Cloud deployment models
Where the service types describe how much is managed, the deployment models describe where the cloud lives and who can use it. A public cloud is owned and operated by a provider and shared across many customers over the internet, which is what most people mean by “the cloud”. A private cloud is dedicated to a single organisation, run either on its own premises or by a provider, offering more control and isolation at higher cost. A hybrid cloud combines the two, letting an organisation keep some workloads on a private environment while using the public cloud for others, which suits gradual migration or workloads with specific data-location needs. The exam wants you to match a model to a need: strict control or existing on-premises investment leans private or hybrid, while flexibility and minimal up-front cost lean public.
The benefits the exam asks you to describe
Microsoft’s skills list explicitly includes describing the benefits of the cloud, so know the vocabulary precisely. High availability means the service is designed to stay running and accessible, often backed by a service-level commitment. Scalability means you can add capacity to meet demand, and it comes in two flavours worth distinguishing: scaling up (a bigger, more powerful resource) and scaling out (more copies of a resource). Elasticity is the automatic version of scaling out and back in as demand rises and falls, so you are not paying for idle capacity. Reliability is the system’s ability to recover from failures and keep working, and predictability covers both predictable performance and predictable cost. Security, governance and manageability round out the list: the cloud offers central tools to secure resources, enforce organisational rules, and manage everything consistently. These are not just buzzwords on this exam; questions frequently ask which benefit a given scenario illustrates, so attach each term to a one-line meaning.
Common beginner traps in this area
Two confusions cause most lost marks here. The first is mixing up the service types, especially IaaS and PaaS, so anchor each to “how much do I still manage?”. The second is conflating scaling up with scaling out, or elasticity with scalability in general; remember that elasticity is the automatic, demand-driven version. Resisting these two slips handles a large share of the cloud-concepts questions.
Chapter 3: Describe Azure architecture and services (35 to 40 percent)
This is the largest skill area, so it deserves the most study time. It moves from abstract cloud concepts to Azure specifically: how Azure is physically and logically organised, and the main families of services for compute, networking, storage, identity and security. You are not learning to configure these. You are learning to recognise each one and say what it is for.
Azure’s global architecture
Azure is built on a global physical footprint organised into a logical hierarchy. A region is a geographic area containing one or more datacentres, and you choose a region to place resources close to your users or to satisfy data-location requirements. Many regions are linked as a region pair, two regions in the same geography used together for resilience, so that planned maintenance and recovery can be coordinated across them. Some workloads need sovereign regions, which are isolated instances of Azure for specific government or compliance needs. Within a region, availability zones are physically separate locations, each with independent power, cooling and networking, so that spreading resources across zones protects against the failure of a single datacentre. Understanding regions, region pairs and availability zones is essential because they are the foundation of how Azure delivers high availability, a benefit you met in the previous chapter.
The resource hierarchy
Azure organises everything you create into a logical hierarchy that controls billing, organisation and governance, and this hierarchy reappears constantly in the governance chapter, so learn it now. At the bottom are resources, the individual services you create such as a virtual machine or a storage account. Related resources are grouped into a resource group, a logical container that lets you manage and bill them together and that is a natural unit for applying access and policy. Resource groups belong to a subscription, which is a billing and management boundary that also carries limits and quotas. Subscriptions can be organised under management groups, containers that sit above subscriptions and let a large organisation apply governance and access across many subscriptions at once. The full top-to-bottom order is management group, then subscription, then resource group, then resource, and the key idea, picked up again in Chapter 4, is that settings applied higher up flow downward.
Compute services
Compute is where your code and workloads actually run, and the exam wants you to compare the main options at a high level. Azure Virtual Machines are the IaaS option: full virtual servers where you control the operating system, suited to lift-and-shift migrations and workloads needing maximum control. Azure Virtual Machine Scale Sets are groups of identical virtual machines that scale out and in together to meet demand. Availability sets are a way of grouping virtual machines so they are spread across underlying hardware to reduce the chance that a single failure takes them all down. Containers package an application with its dependencies so it runs consistently anywhere, and Azure runs them through services aimed at containerised workloads. Azure Functions are the serverless option: small pieces of code that run in response to an event without you managing any servers at all, and that scale automatically. Azure Virtual Desktop delivers a Windows desktop and apps from the cloud to users’ devices. The exam’s instinct is to ask which compute type fits a described need, so reason from the trade-off between control and management: virtual machines for control, functions for hands-off event-driven code, containers for portability, and managed app hosting in between.
Application hosting options
Closely related to compute is the question of where to host an application. The same workload could run on a virtual machine (you manage everything), in a container (portable and consistent), or on a managed web app hosting platform (the platform handles the operating system and scaling so you deploy just your code). This is the IaaS-to-PaaS spectrum from Chapter 2 made concrete, and recognising that a managed web-hosting platform is the lower-maintenance, PaaS-style choice is exactly the kind of judgement the exam rewards.
Networking services
Networking connects your resources to each other, to your users and to your on-premises systems. An Azure Virtual Network (VNet) is your private network in Azure, and a subnet divides a VNet into segments. Peering connects two virtual networks so resources in each can communicate privately. Azure DNS provides name resolution, turning friendly names into addresses. For connecting Azure to your own datacentre, Azure VPN Gateway creates an encrypted connection over the internet, while ExpressRoute provides a private, dedicated connection that does not traverse the public internet, offering more consistent performance for demanding hybrid scenarios. Finally, public and private endpoints control how a service is reached: a public endpoint is reachable over the internet, while a private endpoint brings a service into your private network so traffic stays off the public internet. You do not need to configure any of this; you need to recognise each component and what problem it solves.
Storage services
Azure storage holds your data, and the fundamentals exam focuses on recognising the options and the cost and durability choices around them. Azure offers several storage services for different data shapes, including blob (object) storage for unstructured data such as files and images, file shares, queues and tables. Storage tiers let you trade cost against access speed: a hot tier for data accessed often, a cool tier for infrequently accessed data, and an archive tier for rarely accessed data that is cheapest to store but slowest to retrieve. Redundancy options determine how many copies of your data are kept and where, ranging from copies within a single datacentre to copies spread across zones or replicated to a second region for geographic protection. The exam also expects you to recognise tools for moving data, such as AzCopy and Azure Storage Explorer, and migration options such as Azure Migrate for assessing and moving workloads and Azure Data Box for shipping very large datasets physically when transferring over the network would be impractical.
Identity, access and security
This is a substantial part of the architecture area and overlaps with the governance chapter, so treat it as a bridge. Microsoft Entra ID is Azure’s cloud identity and access service, the directory where users, groups and applications live, and Microsoft Entra Domain Services provides managed domain capabilities for workloads that need them. For signing in, the exam expects you to recognise single sign-on (SSO), which lets users access many applications with one set of credentials; multifactor authentication (MFA), which requires more than one form of verification and significantly strengthens security; and passwordless sign-in methods. External identities let you grant access to people outside your organisation, and Microsoft Entra Conditional Access grants or blocks access based on signals such as the user, device, location and risk level. Azure role-based access control (RBAC) is how permissions are granted, by assigning roles at a scope, a concept developed further in Chapter 4. Three security concepts round out the area: Zero Trust, the principle of never assuming trust and always verifying explicitly; defense in depth, layering multiple security controls so no single failure is catastrophic; and Microsoft Defender for Cloud, which assesses the security posture of your resources and helps protect them. Learn these as ideas and purposes, not configurations.
Chapter 4: Describe Azure management and governance (30 to 35 percent)
This area is about a third of the exam and is, for many beginners, the easiest place to gain marks once the tools are learned, because each one has a clear purpose. It covers how you control and predict cost, how you keep deployments compliant and governed, the tools for managing and deploying resources, and how you monitor health and performance.
Cost management in Azure
Because the cloud is consumption-based, controlling and forecasting spend is a discipline of its own, and the exam expects you to know the cost vocabulary and tools. Several factors affect cost, including the resource type, the region you deploy to, how much you use, and the data you transfer (in particular, moving data out of Azure can incur charges). The pricing calculator lets you estimate the cost of a proposed set of services before you deploy, while the broader cost management capabilities let you analyse and control actual spend after deployment, including setting budgets that alert you as you approach a limit. Tags are name-value labels you attach to resources, and although they are a small feature they appear repeatedly because they are the primary way to organise resources and track cost by project, department or environment. The judgement the exam rewards is matching the tool to the moment: the pricing calculator for “what will this cost?” before you build, and cost management and budgets for “what is this costing and how do I control it?” after.
Governance and compliance tools
Governance is how an organisation keeps its Azure environment consistent, compliant and under control, and three tools carry most of the weight. Azure Policy enforces rules on resources, such as restricting which regions resources can be deployed to or requiring certain tags, so that deployments stay compliant automatically rather than relying on people to remember. Resource locks protect important resources from accidental change or deletion, with a read-only level that prevents modification and a delete level that prevents removal. Microsoft Purview helps you govern and understand your data across your estate. The crucial conceptual link, carried over from the resource hierarchy in Chapter 3, is that governance applies at a scope and flows downward: a policy set at a management group or subscription affects the resource groups and resources beneath it. As a teaching example of the difference between two governance tools: Azure Policy stops a non-compliant resource from being created in the first place, whereas a resource lock stops an existing, important resource from being accidentally deleted. Recognising which tool addresses which concern is exactly what these questions test.
Tools for managing and deploying resources
Microsoft expects you to recognise the main ways of interacting with Azure. The Azure portal is the web-based graphical interface for managing resources by clicking. Azure Cloud Shell is a browser-based command-line environment that includes both the Azure CLI and Azure PowerShell, the two scripting tools for managing Azure from the command line. For repeatable, automated deployments, infrastructure as code (IaC) is the practice of defining your infrastructure in files rather than configuring it by hand, and Azure Resource Manager (ARM) is the underlying deployment and management service, with ARM templates being the files that describe the resources you want to deploy. Azure Arc extends Azure management to resources outside Azure, such as servers in your own datacentre or in another cloud, so you can govern them with the same tools. You do not need to write a template; you need to know what each tool is and when an organisation would reach for it.
Monitoring tools
Finally, the exam covers the tools that tell you how your environment is doing. Azure Advisor analyses your resources and offers recommendations across cost, security, reliability, performance and operational excellence. Azure Service Health tells you about the health of Azure services themselves and any incidents or planned maintenance that might affect you. Azure Monitor is the broad platform for collecting and analysing telemetry, and it includes Log Analytics for querying collected log data, Azure Monitor alerts for being notified when something needs attention, and Application Insights for monitoring the performance of applications. The distinction worth holding is that Advisor gives proactive recommendations, Service Health reports on Azure’s own status, and Monitor (with its components) observes your specific resources and apps.
Chapter 5: Study plan and timeline
With the content understood, the remaining work is pacing it, and the guiding principle for AZ-900 is restraint: this exam does not reward over-preparation, and a plan only helps if it stays short. Two things drive the plan: the domain weights and the fact that no hands-on skill is required.
Allocate time by weight
Spend your hours roughly in proportion to the weights. The two larger areas, Azure architecture and services (35 to 40 percent) and management and governance (30 to 35 percent), together account for around 70 percent of the exam, so most of your time belongs there, learning to recognise services and governance tools. Cloud concepts (25 to 30 percent) is smaller and faster to absorb because it is reasoning and vocabulary rather than a long service list, but do not skip it, since it underpins the rest.
Choose a timeline
A balanced plan runs about two to three weeks at a few hours a week. Spend the first week on cloud concepts, until you can confidently explain IaaS versus PaaS versus SaaS and the deployment models. Spend the second week on Azure architecture and the core services by category, until you can name what each service is for. Spend the third week on cost and governance, until you can explain RBAC, Azure Policy, resource locks and the cost tools, and then run a timed review. If you already work in IT, you can compress this to roughly a week of lighter study; if Azure and cloud terms are entirely new, stretch it to about four weeks at a gentler pace. To turn whichever timeline you pick into dated weeks for your own start date, use the free study-plan generator.
Lean on the free Microsoft Learn path
For a conceptual exam, Microsoft’s own free Azure Fundamentals learning path plus its free practice assessment is the most efficient route, because the path mirrors the three skill areas and the practice assessment shows the level of detail you actually need: recognition of services and tools, not configuration. Work through the path, then drill practice questions until the few sticky points, usually the service models and the cost and governance tools, are solid. Avoid unauthorized question-sharing sites that claim to reproduce the test; they breach Microsoft policy and copyright, and they teach you nothing about how Azure works.
Chapter 6: Final preparation, exam day, and format
Final preparation
In the closing days, consolidate rather than learn new material. Do a final pass over the service and deployment models, the core services grouped by category (compute, networking, storage, identity), and the cost and governance tools, then sit one timed practice run. When your practice scores sit comfortably above the pass mark of 700 across all three areas on fresh questions, you are ready to book. A free Azure account is not required, but an hour spent opening the portal, looking at a resource group, the pricing calculator and a storage account turns abstract terms into things you have actually seen, which makes the questions feel concrete. The goal is familiarity, not skill.
Exam day and format
On the day, AZ-900 is a short exam, mostly multiple-choice, taken either at a Pearson VUE test centre or online with a proctor, and you will need government-issued identification. You need 700 out of 1000 to pass, and because the score is scaled it is not a literal percentage of questions correct. Read each question carefully and watch for the verb: the exam asks you to “describe”, “identify” or “compare”, so it is testing understanding of what Azure offers and why, not how to configure it. The single most common mistake is going too technical and second-guessing yourself toward an overly detailed answer; trust the conceptual understanding you built over the weeks. The free practice assessment on Microsoft Learn mirrors the real style closely, so if it has felt comfortable, the exam will too. Because the certification does not expire, passing it once gives you a permanent foundation and a natural on-ramp to the role-based certifications, AZ-104 for administration or AZ-204 for development, whenever you are ready for them.