Azure Fundamentals (AZ-900) Study Guide

Microsoft Azure Fundamentals is the friendliest certification in the Azure track — an entry-level exam covering cloud concepts, core Azure services, and Azure's management and governance tools. It requires no hands-on experience and never expires once earned, which makes it an easy, permanent addition to your CV.

The exam is not hard. Where people lose marks is on Microsoft's very specific trick pairings — Policy versus RBAC, Monitor versus Service Health versus Advisor — which are all completely learnable in an afternoon.

Who should take it

AZ-900 fits anyone who works around Azure: business stakeholders, sales and procurement teams, students, and engineers coming from AWS or on-premises who want a structured introduction to Azure's vocabulary. If you already administer Azure daily, skip ahead to AZ-104.

How the exam is scored

Expect roughly 40–60 questions in about 45–60 minutes, scored on a 1,000-point scale with 700 needed to pass. Note that 700 is a scaled score, not 70% of the questions — Microsoft weights items by difficulty, so you cannot map it directly onto a raw percentage.

Microsoft mixes formats more than any other vendor. Alongside multiple choice you will see drag-and-drop matching, hotspot dropdowns embedded in a sentence, and true/false blocks where the same scenario is repeated with three different proposed solutions. That last format catches people out: each statement is scored independently, so read every one on its own merits rather than assuming only one can be true.

The four domains, one by one

Describe Azure Architecture and Services (35%)

The largest domain and the service catalogue.

Get the hierarchy straight first, because governance questions all hang off it: management groups → subscriptions → resource groups → resources. Policy, RBAC, and locks all inherit downward. A resource lives in exactly one resource group; a resource group lives in exactly one subscription.

Then geography. A region is a datacentre location. Availability zones are physically separate datacentres within one region, protecting against a datacentre failure. A region pair is a second region hundreds of miles away that Azure pairs yours with, protecting against a regional failure. Confusing zones with pairs is one of the most common losses on this exam — zones are inside a region, pairs are across regions.

Core services at a "what is it for" level: Virtual Machines (IaaS), App Service (host a web app, PaaS), Azure Functions (serverless), Container Instances (a single container, fast), AKS (managed Kubernetes). Storage: Blob (objects), Files (SMB shares), Disks, with hot, cool, and archive access tiers. Databases: Azure SQL Database (managed relational), Cosmos DB (globally distributed NoSQL).

Describe Cloud Concepts (25%)

The vendor-neutral part. IaaS (you manage the OS and up — Virtual Machines), PaaS (you manage the app only — App Service), SaaS (you manage nothing — Microsoft 365). Public, private, and hybrid cloud.

CapEx versus OpEx appears reliably: buying servers up front is capital expenditure; paying monthly for cloud is operational expenditure, and the cloud pitch is the shift from the first to the second.

Learn the benefit vocabulary precisely, because the exam distinguishes terms that sound alike. Scalability is the ability to add capacity; elasticity is doing it automatically in response to demand; agility is how fast you can deploy new resources; high availability is staying up during a failure; disaster recovery is coming back after one.

Describe Azure Management and Governance (20%)

The governance tools, and the domain with the famous trick pairing.

Azure Policy controls what can be deployed — "no VMs larger than a D4, and everything must be tagged with a cost centre." RBAC controls who can do things — "Sam can restart VMs in this resource group." They are not alternatives and questions deliberately offer both. If the scenario is about enforcing a standard on resources, it is Policy. If it is about granting a person permission, it is RBAC.

Resource locks prevent deletion or modification regardless of RBAC — CanNotDelete and ReadOnly. Even an owner is stopped by a lock, which is exactly why the exam likes them.

Then the tooling: the Pricing Calculator estimates a workload you haven't built; the TCO Calculator compares on-premises cost against Azure; Cost Management analyses and budgets what you're already spending.

Describe Azure Identity, Access, and Security (20%)

Microsoft Entra ID (formerly Azure AD) is the identity service — users, groups, and app registrations. Know conditional access (policies that grant or block based on signals like location, device, and risk) and MFA.

Microsoft Defender for Cloud is the security posture and threat-protection service. Key Vault stores secrets, keys, and certificates. The Zero Trust model — verify explicitly, use least-privilege access, assume breach — comes up by name.

Note the distinction between Azure roles (RBAC, control access to Azure resources) and Entra roles (control access to identity features such as creating users). The exam tests the boundary.

The trick pairings

Microsoft builds a lot of AZ-900 around a handful of deliberately-similar tools. These are free marks once drilled.

Confused pair	The difference
Azure Policy vs RBAC	Policy governs what can be deployed. RBAC governs who can act.
Availability zones vs region pairs	Zones are datacentres inside one region. Pairs are two regions far apart.
Azure Monitor vs Service Health vs Advisor	Monitor = your resources' metrics and logs. Service Health = Azure's own outages. Advisor = recommendations to improve cost, security, and reliability.
Pricing Calculator vs TCO Calculator	Estimate a new Azure workload vs compare on-prem cost against Azure.
Availability sets vs availability zones	Sets protect against rack/hardware failure inside one datacentre; zones protect against a whole datacentre failing.
Hot vs cool vs archive storage	Frequent access; infrequent (cheaper storage, higher access cost); rarely accessed with a retrieval delay of hours.
ExpressRoute vs VPN Gateway	A private, dedicated circuit that never touches the internet vs an encrypted tunnel over the internet.
Resource lock vs Azure Policy	A lock stops deletion or changes to something that exists; Policy stops the wrong thing being created.

A realistic study plan

Most people pass with 10–20 hours across one to two weeks.

Days 1–3. Cloud concepts and the resource hierarchy. Draw the management group → subscription → resource group → resource tree from memory until you can do it without thinking, because governance questions all reference it.

Days 4–7. One session per service category — compute, storage, networking, databases — keeping it to a one-line purpose per service. Then a dedicated session on the trick pairings above.

Days 8–10. Practice questions only, until you consistently score above 85% on questions you have not seen. The structured formats reward familiarity as much as knowledge, so do enough that drag-and-drop matching and hotspot dropdowns feel routine rather than surprising.

Common pitfalls

The classic traps: confusing Azure Policy with RBAC, mixing up availability zones and region pairs, and misremembering which SLA improvement comes from availability sets versus zones.

The repeated-scenario format also catches people. When Microsoft shows you the same case three times with three different proposed solutions, candidates assume exactly one is correct and start reasoning by elimination. Each is scored independently. More than one can be right, and all three can be wrong.

After you pass

Check the official AZ-900 page for current pricing and the skills-measured document, which is the authoritative scope.

AZ-900 never expires. The natural next step for hands-on roles is the Azure Administrator (AZ-104), which takes the same service catalogue and asks you to actually configure it — a genuinely large step up.