AZ-900 Azure Fundamentals: Building a Practical Foundation for Microsoft Cloud

AZ-900, Microsoft Azure Fundamentals, is the entry-level Azure exam in the Microsoft certifications portfolio. It is designed for people who need a working vocabulary for cloud computing and Azure rather than deep implementation expertise. Microsoft’s current blueprint organizes the exam around cloud concepts, Azure architecture and services, and Azure management and governance. Those three areas create a useful foundation for technical learners, business stakeholders, students, and professionals moving toward more specialized Azure roles.

As of October 3, 2026, AZ-900 remains current, with the English skills outline updated for July 20, 2026. Passing it earns Microsoft Certified: Azure Fundamentals. The certification is not a prerequisite for role-based Azure credentials, but it can make later material easier because it teaches the language behind subscriptions, regions, compute, networking, storage, identity, governance, cost, and monitoring.

The biggest mistake is treating AZ-900 as a trivia exam. The objectives use words such as describe and compare, but the exam still expects candidates to understand why one cloud model, service type, or governance control fits a scenario better than another. A candidate who can explain tradeoffs will usually handle unfamiliar wording better than someone who memorized isolated definitions.

Cloud concepts explain why organizations use Azure in the first place

The cloud-concepts portion begins with the shared responsibility model, public/private/hybrid deployment models, consumption-based economics, scalability, elasticity, reliability, predictability, and manageability. These ideas matter because Azure services are easier to understand when they are connected to the problem they solve. A virtual machine is not simply “a server in the cloud”; it is one way to consume compute while retaining more operating-system responsibility than a managed application platform.

The shared responsibility model is especially important. Responsibility changes depending on whether the organization consumes infrastructure as a service, platform as a service, or software as a service. The provider always operates some layers, but customers still own responsibilities such as identities, data, configuration, and access decisions. Security problems often come from misunderstanding that boundary rather than from a missing product.

Cloud economics should also be understood beyond the phrase pay-as-you-go. Consumption can increase or decrease cost depending on architecture, utilization, data movement, licensing, and operational behavior. The four major cloud benefits—availability/scalability, reliability/predictability, security/governance, and manageability—are valuable only when organizations design and operate resources to use them.

Regions, zones, subscriptions, and resource groups create Azure’s basic structure

Azure’s physical and logical architecture explains where resources live and how they are organized. Regions provide geographic deployment locations, while availability zones offer separate datacenter fault domains within supported regions. Region pairs and sovereign regions reflect broader availability, residency, and regulatory considerations. Candidates do not need to memorize every Azure geography, but they should understand how location affects resilience, latency, service availability, and compliance.

On the logical side, resources live in resource groups, resource groups belong to subscriptions, and subscriptions can be organized under management groups. Each level supports different management and governance boundaries. Resource groups help organize lifecycle and permissions, subscriptions provide billing and access boundaries, and management groups allow policy or governance to be applied across multiple subscriptions.

This hierarchy becomes more practical in AZ-104, where administrators actually implement identities, governance, storage, compute, and networks. For AZ-900, the important skill is recognizing what each boundary means and avoiding the assumption that a resource group is merely a folder or that a subscription is only a billing record.

Compute choices reflect how much infrastructure control a workload needs

Azure offers virtual machines, scale sets, containers, web application platforms, serverless functions, and desktop virtualization among its compute options. The fundamentals exam expects candidates to distinguish them by management model and use case. Virtual machines provide operating-system control, containers package applications with dependencies, and serverless services can run event-driven code without requiring the customer to manage servers.

Availability sets and availability zones address different forms of failure, while Virtual Machine Scale Sets support groups of similar VMs that need coordinated scaling. Azure Virtual Desktop delivers desktops and applications rather than general-purpose server hosting. Web Apps can host application workloads with less infrastructure management than a VM.

The key is not to rank services from best to worst. A workload that requires custom drivers or a specific operating-system configuration may need virtual machines, while an HTTP application that benefits from managed scaling may fit a platform service better. AZ-900 tests whether candidates can recognize that management responsibility changes with the service model.

Networking and storage form the shared foundation underneath many Azure services

Virtual networks, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute, public endpoints, and private endpoints create the connectivity vocabulary of Azure. A virtual network provides an address space and segmentation boundary, while peering connects networks privately. VPN Gateway and ExpressRoute connect Azure to other networks through different connectivity models. Private endpoints expose supported services through private IP addresses inside a virtual network, reducing reliance on public access.

Storage concepts include Blob, Files, Queues, Tables, managed disks, access tiers, redundancy options, account types, and migration or transfer tools. Candidates should understand why object storage differs from file shares and why locally redundant storage differs from zone- or geo-redundant options. Redundancy improves durability and availability characteristics, but it does not remove the need to think about accidental deletion, application recovery, or data-governance requirements.

Tools such as AzCopy, Storage Explorer, Azure File Sync, Azure Migrate, and Data Box address different movement scenarios. The exam does not require detailed command syntax; it requires recognizing the type of problem each tool is intended to solve.

Identity and security begin with Microsoft Entra ID and least privilege

AZ-900 covers Microsoft Entra ID, authentication methods, single sign-on, multifactor authentication, passwordless methods, external identities, Conditional Access, Azure role-based access control, Zero Trust, defense in depth, and Microsoft Defender for Cloud. These concepts teach an important principle: identity is the control plane for many cloud actions, so protecting identities can be as important as protecting a network perimeter.

Authentication answers who or what is attempting access, while authorization determines what that identity is allowed to do. RBAC assigns permissions to Azure resources, and Conditional Access can evaluate signals before allowing authentication to proceed. Zero Trust assumes that access should be verified explicitly and limited to what is needed rather than automatically trusted because a user or device is inside a corporate network.

Learners who want a broader security-fundamentals path can compare AZ-900 with SC-900. AZ-900 introduces security as part of Azure fundamentals; SC-900 focuses more directly on security, compliance, and identity concepts across Microsoft services.

Governance turns technical resources into a manageable cloud estate

Cost Management, tags, Azure Policy, resource locks, Microsoft Purview, Azure Resource Manager, ARM templates, Azure CLI, Azure PowerShell, Cloud Shell, and Azure Arc all appear in the management and governance domain. The services are different, but they solve a shared challenge: cloud resources must be organized, controlled, deployed consistently, and observed over time.

Tags add metadata that can support cost allocation or organization. Azure Policy evaluates resources against defined rules and can help enforce standards. Resource locks protect against accidental deletion or modification at selected scopes. Azure Resource Manager provides the deployment and management layer for resources, while infrastructure as code expresses deployments in reusable definitions instead of relying entirely on manual portal clicks.

Azure Arc extends Azure management concepts to resources that run outside Azure. At fundamentals level, candidates should understand its purpose rather than its detailed implementation. A strong mental model is that governance is about applying consistent controls to a changing environment, not about producing more documentation.

Monitoring is about health, risk, and evidence

Azure Advisor, Service Health, Azure Monitor, Log Analytics, alerts, and Application Insights serve different monitoring needs. Advisor provides recommendations, Service Health reports service events that can affect resources, and Azure Monitor collects and analyzes telemetry. Log Analytics provides a query environment for logs, alerts notify teams when defined conditions occur, and Application Insights focuses on application behavior and performance.

The exam often becomes easier when candidates ask what question they are trying to answer. “Is Microsoft reporting a regional Azure issue?” points toward Service Health. “Which resources could be optimized?” points toward Advisor. “What does the telemetry say about this application or resource over time?” points toward Azure Monitor and its associated capabilities.

This is also where fundamentals become operational. Monitoring is not only about finding outages. It supports capacity decisions, security investigations, performance analysis, and validation that a change had the intended effect.

AZ-900 is a starting point, not a substitute for role-based practice

Azure Fundamentals can prepare candidates to choose their next direction. Infrastructure-focused learners often continue toward AZ-104. Data-focused learners may prefer DP-900, while security-focused learners may use SC-900 as another foundation before role-based security exams. The value of AZ-900 is that these paths share a common vocabulary for cloud models, Azure structure, identity, governance, and service categories.

Hands-on exploration still helps even though the exam is conceptual. Creating a resource group, browsing subscriptions, reviewing a virtual network, inspecting storage options, looking at RBAC roles, and opening Azure Monitor can make abstract terms concrete. Candidates do not need to build production architectures, but they should be able to connect a definition to something visible in the platform.

The distinction between AZ-900 and AZ-104 is fundamentally a difference in depth and responsibility: AZ-900 describes the platform and its concepts, while AZ-104 expects candidates to implement, secure, monitor, and operate Azure resources.

Prepare by explaining scenarios in plain language

For each objective, practice explaining the concept without relying on the product name itself. Describe why a company might choose a private endpoint, why an availability zone changes fault tolerance, why a resource lock is different from RBAC, or why PaaS shifts more operational responsibility to Microsoft than IaaS. If the explanation is clear, the terminology usually becomes easier to retain.

Use current objectives rather than old exam summaries because Azure terminology and service emphasis change. The July 2026 blueprint still centers on stable fundamentals, but examples and management features evolve. Review enough of the Azure portal and Microsoft Learn material to understand how the concepts appear today.

AZ-900 is successful preparation when it creates a map of Azure in the learner’s mind. That map should show what the cloud model means, how Azure is organized, what major service categories do, how access and governance work, and how costs and health are monitored. Once that foundation is stable, deeper certification paths have a much clearer context.