AZ-900 Microsoft Azure Fundamentals Complete Guide (2026)

Researching the most popular competitors (Microsoft Learn, GeeksforGeeks, Thomas Maurer and the big training platforms) shows that the best-ranking pages are able to provide a one-stop resource.They aren’t just exam modules, they also offer a complete journey to learning, deep dives into theoretical cloud architecture, clear explanations of key Azure services and useful preparation advice.

Nevertheless, this must be planned to be robust, build with good SEO (Search Engine Optimisation), semantics optimised in density and to read clearly in the SERPs to perform well and hit high in the rankings. We address 2 forms of search intent clearly: information (training which is technical and goes deep into a subject) and commercial (explaining how to take tests, certification benefits and learning paths).

AZ-900 Microsoft Azure Fundamentals Complete Guide

 whether a technical or non-technical business stakeholder. It’s the all-in-one study guide that includes conceptual architecture, product reviews and exam strategy hints for success on the modern blueprint of the Azure Fundamentals Certification. Understanding the AZ-900 Exam Structure & Objectives.Explain the structure and objectives of the AZ-900 exam.

1. Demystifying the AZ-900 Exam Structure & Objectives

It is important to know the following structural boundaries and administrative mechanics (as described by the official Microsoft Azure AZ-900 exam) before deploying services to the cloud ecosystem. The exam is deliberately formulated to test understanding of concepts and not extensive scripting, automation or engineering implementation.

Core Exam Parameters

The exam operates under strict parameters established by Microsoft Worldwide Learning:

• Length of Active Testing session: 60 minutes (including non-disclosure agreements and system set up).
  Question Volume: Usually 40 – 60 questions.
  Multiple choice (Single or Multiple Correct answers), Drag-and-Drop Structural Matchings, Drop-Down Option selections, Multi-part Case scenario evaluations with sequential true or false answers based on one premise.
  Scoring Threshold: Scored on points ranging from 1–1,000. The scaled score required to earn the credential is a minimum of 700. No marks are deducted for mistakes and no negative marking.
  Exam Delivery: Delivered via Pearson VUE, worldwide, either through an offline testing centre infrastructure or an online proctored environment through real-time biometric and video monitoring.

Objective Domain Breakdown

The modern AZ-900 exam guide reflects an updated operational blueprint. The test domain weights are distributed across three primary conceptual clusters:

[AZ-900 Exam Weight Distribution]
├── Describe Cloud Concepts (25-30%)
├── Describe Azure Architecture and Services (35-40%)
└── Describe Azure Management and Governance (30-35%)

This structural weighting emphasizes that while structural components and specific services form the core of the exam, administrative governance, billing mechanics, and conceptual cloud physics each carry equal weight in achieving a passing mark.

What is Cloud Computing?

Cloud computing involves the delivery of computer resources on demand through the internet at a pay-as-you-go price. Instead of purchasing, owning, and managing your own physical data centres and hardware, an organization buys computer capacity, storage devices, networking systems and database software services on an as-needed basis from a provider, like Microsoft. CapEx Vs OpEx: A Financial Shift Your accounting and reporting standards change significantly when you make the transition to cloud resources. CapEx (Capital Expenditures) represent physical expenditures for physical assets and capital equipment.

Purchasing a server rack, a network switch, office space for a new data centre, or investing in a UPS system are examples of CapEx.

• . These assets must be depreciated over their useful lifespans on corporate balance sheets, binding significant cash flow up front.
• Operational Expenditure (OpEx): This refers to spending money on products and services continuously as business operations demand. Cloud computing fits completely within OpEx. Organizations are billed instantly for the exact amount of computational resources consumed within a billing cycle. This eliminates massive upfront infrastructure costs and allows capital to be directed toward agile operational objectives.

The Consumption-Based Model

Under an operational expenditure framework, cloud providers operate on a consumption-based model. This means end users pay only for the resources they actively provision and use. If an enterprise spins down a collection of Virtual Machines over a weekend, Billing stops for those compute units. Key metrics driving consumption costs include:

• Compute runtime hours mapped to specific CPU/RAM configurations.
• Monthly data volume stored per gigabyte/terabyte.
• Network egress traffic (data leaving Azure data centers).

Core Benefits of Cloud Architectures

When creating the study plan for an Azure fundamentals course, it’s important to isolate some of the structural attributes of cloud systems:

High Availability (HA): Provides constant availability of cloud applications and data, even in the event of a local hardware failure, power grid disruption, or drop in network path. This is done in a component redundant fashion.
Scalability: The ability of a system to grow capacity by increasing the amount of resources it uses. There are two aspects of scalability:
Elasticity: The ability to automatically add or remove resources in a cloud platform on demand, in real time. For instance, when a company runs an e-commerce flash sale, it makes instances spin up to cope with the traffic and shuts them down when the traffic ebbs, saving on operational costs.
Agility: How quickly IT development teams can allocate, provision, test and deploy new software environments. With cloud control planes, developers can deploy entire data application stacks in minutes rather than weeks or months, waiting for physical hardware to be procured and racked.

Reliability & Disaster Recovery (DR): The ability of the system to recover from severe failures or natural disasters in a graceful manner. Distributed cloud data centres can enable data to be duplicated in several secure geographic locations. A complete region outage will allow operations to fail to another healthy region.
Cloud Service Categories (IaaS vs PaaS vs SaaS)

 

1. Infrastructure as a Service (IaaS)

Microsoft takes care of the physical equipment, virtualization layers and worldwide data centers. Access to virtual servers, raw network switches, and block storage volumes are all rented to the customer.

Customer Duties: Customer is responsible for manual installation, patching and maintenance of the operating system; configuring network firewalls; implementing middleware; and managing all software runtimes.
Analogy: Lease an empty lot. Structural walls and plumbing must be built, designed and maintained by the contractor.

2. Platform as a Service (PaaS)

The abstraction layer is raised by PaaS. Microsoft hosts the physical infrastructure, the operating system, database engines, web server runtimes and auto-patching systems. The customer gets a managed environment to upload and run application code, without having to worry about the hosting.

Customer Duties: Only application logic, code deployments and data state profiles.
Analogy: Hire an entirely furnished office suite. Building management will take care of security, heating, cleaning etc., and you bring your staff and get on with your job.

3. Software as a Service (SaaS)

SaaS provides end-to-end software application solution through the internet, and the vendor is responsible for managing it. A web browser or thin client is used as the interface to the application.

Customer Duties: Account settings, password, data entry, etc.
Self-directed learning: When eating out at a restaurant. You don’t have to cook, supervise the kitchen, or supervise the food; you just order and eat the food.
Serverless Computing

An advanced form of PaaS is Serverless Computing. In this model, the developers develop applications and don’t consider the server or resource provisioning. The Cloud Platform hides all infrastructure. Code only runs in response to specific events on the system (like an incoming HTTP Web request or file upload into storage). Serverless scales from 0 to thousands of instances in seconds and Billing is charged only for the precise millisecond of running time of code.

Cloud Deployment Models: Public, Private, and Hybrid

Enterprises deploy their infrastructure across three distinct cloud typologies:

• Public Cloud: All underlying physical compute infrastructure is owned, operated, and maintained by a third-party hyperscale cloud vendor (Microsoft). Resources are securely isolated and multi-tenanted across global hardware pools, with access delivered over secure internet connections.
• Private Cloud: Computing infrastructure is dedicated exclusively to a single business organization. This hardware can reside in the company’s on-premises data centre or be hosted by a third-party provider on a dedicated, isolated hardware footprint. It offers complete structural control but requires significant upfront CapEx.
• Hybrid Cloud: A combined deployment model that bridges public cloud environments and private on-premises clouds. Secure networking connections (such as VPNs or dedicated fiber lines) allow data and application states to interoperate smoothly between the two environments. This allows an enterprise to store sensitive regulatory data in an on-premises private cloud while bursting web applications to a public cloud to handle seasonal traffic spikes.

3. Domain 2: Core Azure Architecture & Services (35–40%)

This domain covers Microsoft Azure’s global physical footprint and the core digital services used to build cloud environments.

Azure Global Physical Infrastructure

Azure does not exist merely as an abstract concept; an enormous global physical infrastructure network anchors it. To build reliable systems, you need to understand how Azure groups its physical data centers.

Data Centers

The fundamental atomic building block of Azure’s infrastructure. These are massive, secure physical buildings distributed worldwide that contain rows of standardized server racks, cooling infrastructure, power distribution facilities, and high-speed network switches.

Regions

An Azure region is an area of the globe that has one or more physical data centres. The data centres are co-located, and they are all linked via an optimized and highly efficient, very low-latency fiber network called the regional network. When you make a decision to provide any resource on Azure, you always have to pick a target region, whether it’s East US, West Europe or Central India. Picking a region directly dictates the performance on the end-users of your application, legal and compliance considerations for your data, and of course, the rates of billing.

Region Pairs

An Azure region is tied to another geographic region on the same continent, and is located at least 300 miles apart. That makes it possible for Microsoft to manage a disaster recovery site from the good pair region in case a natural disaster such as earthquake or flood impacts the region, or the entire continent has power failures. Updates to systems also proceed pair by pair to avoid multiple region outages at the same time.

Availability Zones

Availability Zones are unique physical data center locations within an individual Azure Region. Each zone is an isolated physical entity equipped with independent power supplies, specialized cooling configurations, and dedicated network lines. A single region contains a minimum of three separate Availability Zones.

By deploying application workloads redundantly across multiple Availability Zones inside a region, enterprises create a highly resilient infrastructure stack that can withstand the complete loss of an entire data center building.

The Azure Resource Management Hierarchy

Azure enforces a strict four-level hierarchical structural framework for organizing and managing cloud resources safely and predictably.

1. Management Groups

The highest container level designed to govern governance, compliance policies, and identity access across multiple Azure subscriptions. Conditions applied at a Management Group level are automatically inherited downward by all nested subscriptions.

2. Subscriptions

An Azure Subscription is an administrative and logical billing container that links user accounts to an Azure environment. Every resource deployed must live inside a specific subscription. It sets operational limits (quotas) and acts as an explicit billing boundary for tracking cloud spending.

3. Resource Groups

A logical container that groups related Azure resources together for unified lifecycle management. A resource group holds items like Virtual Machines, Virtual Networks, and Storage Accounts that share a common project lifecycle. If a project is discontinued, an administrator can delete the single containing Resource Group, which cleanly tears down all nested components in one action.

4. Resources

The individual service instances created within the Azure platform. Examples include a single Database instance, a single Virtual Machine network card, or an isolated Public IP Address block.

Azure Resource Manager (ARM)

ARM is the underlying deployment and management control plane for all of Azure. When an administrator interacts with Azure via the graphical Azure Portal, the command-line interface, or an automation script, ARM processes the request, authenticates the identity, and orchestrates the physical infrastructure provisioning.

ARM allows engineers to declare infrastructure state files using declarative JSON or Bicep templates, a practice known as Infrastructure as Code (IaC).

Core Azure Compute Services

Compute services form the processing engine of cloud applications. Azure provides a variety of hosting models tailored to different application workloads.

• Azure Virtual Machines (VMs): Azure’s primary IaaS compute product. Virtual Machines provide customized, on-demand compute resources that allow users to run Windows or Linux operating systems in the cloud without purchasing physical hardware. They require manual configuration, operating system maintenance, and patching.
• Azure VM Scale Sets: A compute management product that allows administrators to deploy, configure, and manage a cluster of identical, load-balanced Virtual Machines. Scale sets support automated horizontal scaling. If web traffic demand surges, VM Scale Sets automatically spin up additional VM nodes; when demand drops, they cleanly terminate excess instances to save costs.
• Azure App Services: A fully managed PaaS platform tailored for hosting web applications, RESTful APIs, and mobile app backends. Developers can deploy code written in .NET, Java, Node.js, Python, or PHP without worrying about the underlying server infrastructure, operating system updates, or network security patching.
• Azure Container Instances (ACI): A serverless container service that allows for rapid execution of isolated Docker containers on demand. ACI eliminates the need to provision virtual machines or configure advanced container orchestration systems. It is optimized for simple containerized workloads, background processing tasks, and rapid build pipelines.
• Azure Kubernetes Service (AKS): A robust, enterprise-grade, fully managed container orchestration product based on open-source Kubernetes. AKS simplifies deploying, scaling, and managing complex, multi-container microservice architectures by abstracting the master management plane.
• Azure Virtual Desktop: A comprehensive desktop and application virtualization hosting service running securely in the cloud. It enables enterprises to deliver a secure remote-work experience, allowing employees to access Windows 10 or Windows 11 environments from any internet-connected consumer device.

Core Azure Networking Services

Networking services tie cloud environments together, securing communication paths between compute resources and the public internet.

• Azure Virtual Networks (VNet): The fundamental building block for private networks inside Azure. A VNet enables Azure resources (like VMs) to communicate securely with each other, the internet, and on-premises corporate infrastructure. VNets can be segmented into isolated subnets and support customized private IP address allocations.
• Virtual Network Peering: A high-speed connection mechanism used to link two separate Azure Virtual Networks seamlessly. Once peered, the networks route traffic between themselves as a single unified private network, leveraging Microsoft’s private backbone fibre rather than exposing traffic to the public internet.
• Azure VPN Gateway: A specialized virtual network gateway used to send encrypted network traffic between an Azure VNet and an on-premises corporate office location over the public internet. This is a common pattern for establishing hybrid cloud connectivity.
• Azure ExpressRoute: A premium connectivity service that creates direct, private physical connections between an enterprise’s on-premises data center and the Microsoft Azure cloud. ExpressRoute connections do not travel over the public internet. This ensures higher security, greater reliability, faster speeds, and ultra-low, predictable latencies.
• Azure DNS: A hosting service for DNS domains that provides name resolution using Microsoft Azure’s massive global infrastructure footprint.

Core Azure Storage Services

Azure provides highly durable, scalable, and secure storage options tailored for diverse data types and access patterns.

• Azure Blob Storage: An object storage solution optimized for storing massive amounts of unstructured data. Unstructured data is data that does not adhere to a rigid relational database schema, such as video files, image assets, large log files, backups, and data lakes for analytical engines.
• Azure Files: A fully managed cloud share service that allows developers to set up network file shares accessible via standard Server Message Block (SMB) or Network File System (NFS) protocols. It allows multiple virtual machines to mount and read/write to a shared file directory simultaneously.
• Azure Disk Storage: Block-level storage volumes designed to serve as the local persistent storage drives for Azure Virtual Machines. They are available as solid-state drives (SSDs) or traditional hard disk drives (HDDs), offering performance tiers tailored to application needs.

Storage Tier Optimization

To maximize cost efficiency, Azure Blob Storage offers three distinct data access tiers:

Storage Tier	Target Data Profile	Storage Cost	Access Cost	Minimum Storage Duration
Hot Tier	Frequently accessed, active data sets	Highest	Lowest	Immediate
Cool Tier	Infrequently accessed data (stored for ≥30 days)	Lower	Higher	30 Days
Archive Tier	Rarely accessed, historical long-term data	Lowest	Highest	180 Days

Note: The Archive tier keeps data offline. Retrieving archived data requires a multi-hour “rehydration” process before it can be read.

Core Azure Database Services

Azure provides fully managed relational and non-relational database services that eliminate the overhead of database administration.

• Azure SQL Database: A fully managed, evergreen relational database engine built on Microsoft’s SQL Server technology. It handles database scaling, automated daily backups, high availability patching, and database engine updates without causing application downtime.
• Azure Cosmos DB: A globally distributed, multi-model NoSQL database service. Cosmos DB supports single-digit millisecond response times at massive scale, features automated elastic scaling, and natively supports open-source APIs for MongoDB, Cassandra, and Gremlin. It is ideal for modern, high-velocity web applications that require global reach.
• Azure Database for MySQL / PostgreSQL: Fully managed, community-aligned open-source relational database options running securely within the Azure PaaS ecosystem.

4. Domain 3: Azure Management, Governance, & Security (30–35%)

Deploying cloud infrastructure requires deep administrative control. This final domain focuses on identity verification, security boundaries, cost control, and corporate governance.

Identity, Access, and Directory Services

Identity acts as the primary security perimeter in modern cloud architectures. Managing authentication and authorization is foundational to safeguarding cloud assets.

Microsoft Entra ID (Formerly Azure Active Directory)

The core cloud-based identity and access management service powering Microsoft Azure. It handles user management, group memberships, corporate domain services, and application access. It is important to distinguish its primary functions:

• Authentication (AuthN): The technical process of verifying the identity of a user, service principal, or device attempting to log into an environment. It asks the question: “Are you who you say you are?” Examples include validating password strings or verifying a biometric fingerprint.
• Authorization (AuthZ): The security process of determining what specific permissions and data resources an authenticated user is allowed to access. It asks the question: “What are you allowed to do?”

Multi-Factor Authentication (MFA)

A security mechanism that requires users to provide two or more distinct verification factors to gain access to Azure resources. This significantly reduces the risk of credential compromise by combining:

1. Something you know (e.g., a complex password pin).
2. Something you have (e.g., a hardware token or a physical smartphone generating a mobile notification).
3. Something you are (e.g., facial recognition profiles or biometric fingerprints).

Conditional Access

An advanced identity engine within Microsoft Entra ID that uses real-time signals to enforce security policies. It evaluates conditions such as the user’s geographical location, the health state of their device, or the specific application being requested. Based on these signals, it can automatically allow access, block access, or force a user to complete an MFA challenge before gaining access.

Role-Based Access Control (RBAC)

The security mechanism used to manage permissions across Azure resources. RBAC adheres strictly to the Principle of Least Privilege, ensuring that users are granted only the minimum access required to complete their jobs. Permissions are assigned by mapping security principals to specific scopes (e.g., Management Group, Subscription, Resource Group, or Resource).

Azure includes standard built-in roles:

• Owner: Full access to all resources, including the ability to delegate access permissions to other identities.
• Contributor: Can create and manage all types of Azure resources, but cannot delegate access permissions to others.
• Reader: Can view existing Azure resources but cannot make modifications or add new components.

Core Azure Security Architecture

To defend workloads against modern cyber threats, Azure employs a multi-layered security model.

Network Security Groups (NSGs)

A network security tool used to filter network traffic travelling to and from Azure resources inside a Virtual Network. An NSG contains a list of customizable security rules that allow or deny traffic based on source/destination IP addresses, communication ports, and network protocols.

Azure Firewall

A managed, cloud-based network security service that protects your Azure Virtual Network resources. Unlike NSGs, Azure Firewall is a fully stateful, highly available firewall service featuring built-in threat intelligence that can filter traffic across multiple subscriptions and virtual networks globally.

Azure DDoS Protection

Protects Azure applications against Distributed Denial-of-Service (DDoS) attacks. It actively monitors application traffic patterns, filtering out malicious volumetric traffic surges before they can exhaust application resources, while ensuring legitimate customer traffic flows without disruption.

Microsoft Defender for Cloud

A comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP) platform. It continually analyses the security state of your Azure resources, calculates a unified Secure Score that reflects your overall security posture, and provides actionable recommendations to remediate vulnerabilities.

Azure Governance and Compliance Frameworks

As cloud environments grow, maintaining organizational standards and regulatory compliance requires automated governance tools.

• Azure Policy: A service used to create, assign, and manage rules that enforce corporate standards across Azure resources. For example, an organization can implement an Azure Policy that blocks developers from creating Virtual Machines outside a specific region or prevents the creation of public-facing database instances.
• Resource Locks: Lock mechanisms used by administrators to prevent accidental deletion or modification of critical Azure resources. Resource locks inherit downward through the resource hierarchy and are available in two distinct types:
• CanNotDelete: Authorized users can read and modify a resource but cannot delete it.
• ReadOnly: Authorized users can read a resource but cannot delete it or modify its configuration.
• Service Trust Portal: A public-facing web repository provided by Microsoft that hosts detailed independent compliance audit reports, SOC reports, ISO certifications, and detailed privacy documentation demonstrating how Azure satisfies global regulatory compliance standards.

Strategic Azure Cost Management

Controlling cloud spend is a continuous operational requirement. Azure provides several tools to help estimate, track, and optimize costs.

Total Cost of Ownership (TCO) Calculator

An estimation tool used before migrating physical workloads to Azure. It allows financial analysts to compare the total costs of maintaining an on-premises data centre against the projected costs of running those same workloads on the Azure platform over a multi-year horizon.

Azure Pricing Calculator

An interactive tool used to estimate the real-time configuration costs of specific Azure resources. It allows users to select specific service models, resource sizes, and regions to generate a granular monthly cost estimate before provisioning resources.

Azure Cost Management + Billing

A comprehensive service suite that allows enterprises to track, analyze, and optimize their active cloud spend. It enables administrators to create customized spending alerts, set strict organizational budget caps, and analyze historical spending trends to prevent unexpected billing overages.

Factors Influencing Cloud Costs

1. Resource Type: The specific hardware profile, storage type, and performance tier selected.
2. Resource Location: Different regions feature distinct pricing structures based on local real estate, taxes, and power grid costs.
3. Network Traffic: Data entering an Azure data centre (ingress) is free; data exiting an Azure data centre (egress) incurs a per-gigabyte bandwidth charge.

5. Proven Preparation Strategy: Passing the Exam on Your First Attempt

Achieving success on the Microsoft Azure AZ-900 exam requires a structured study strategy that balances conceptual learning with hands-on practice.

Step-by-Step Study Track

1. Complete the Official Learning Paths by leveraging the free learning modules on Microsoft Learn. These modules mirror the official exam objectives and provide the conceptual foundation for the test.
2. Get Hands-on Practice with a Free Account: Create a free Azure account. Building resources yourself helps bridge the gap between theoretical knowledge and practical understanding. Practice navigating the Azure Portal, creating a Virtual Machine, configuring a Resource Group, and setting up an Azure Storage account.
3. Review Official Exam Guides: Continually check the official Microsoft exam page to review the latest objective changes and ensure your study materials are aligned with the current test blueprint.
4. Leverage Practice Assessments: Use official practice assessments to familiarise yourself with the question format and pacing. Read the explanations for both correct and incorrect answers carefully to reinforce your understanding.

For a complete, guided video breakdown that walks through every concept covered in this written guide—complete with step-by-step console demonstrations—watch this comprehensive AZ-900 Azure Fundamentals Full Course. This 2.5-hour video tutorial pairs perfectly with our written breakdown to help solidify your understanding.

Frequently Asked Questions (FAQs)

Does the AZ-900 exam require coding or scripting knowledge?

No. The AZ-900 exam evaluates your foundational understanding of cloud concepts and the Azure ecosystem. You will not be asked to write code, configure advanced deployment scripts, or memorize command-line syntax.

What is the difference between MS-900 and AZ-900?

While both are foundational certifications, AZ-900 focuses on core Azure cloud infrastructure, compute services, networking, and governance frameworks. MS-900 is dedicated to Microsoft 365 cloud productivity apps, team collaboration solutions, security, and device management.

How long does the AZ-900 certification remain valid?

Unlike advanced associate or expert-level Microsoft certifications that require annual renewal, the Microsoft Certified: Azure Fundamentals credential does not expire. Once earned, the certification remains valid indefinitely.

What is the passing score for the AZ-900 exam?

You must achieve a minimum scaled score of 700 out of 1,000. The scaling process ensures that exam difficulty remains consistent regardless of the specific question set you receive.

Conclusion.

The AZ-900 Microsoft Azure Fundamentals certification is one of the best starting points for anyone entering the cloud computing industry. Whether you are an IT professional, student, business analyst, developer, or complete beginner, this certification helps you understand the core concepts of Microsoft Azure, cloud architecture, security, governance, networking, storage, and pricing models.

Mohammed Shareef is the creator of Free Tech Web, a growing online resource dedicated to technology education and digital learning. He specializes in writing informative articles about cloud platforms, programming, web technologies, startups, and software solutions. His goal is to make technical subjects easier for beginners, students, and professionals by using clear explanations, practical examples, and research-based content.

For more information you can visit to https://azure.microsoft.com/