Microsoft AZ-900: Azure Fundamentals for the 2026 Cloud Baseline

Microsoft AZ-900, Microsoft Azure Fundamentals, remains the current entry-level Azure exam. The English skills outline was updated on July 20, 2026. Microsoft groups the blueprint into cloud concepts, Azure architecture and services, and Azure management and governance. The exam is foundational, but “foundational” does not mean a list of product names.

The Azure Fundamentals credential is designed to show that a technology professional can explain why cloud computing is used, how Azure is organized, what its major service families do, and how identity, security, governance, cost, deployment, and monitoring fit around them. That makes relationships more important than deep configuration syntax.

AZ-900 is also a common starting point across the wider Microsoft certification ecosystem. A candidate may later specialize in administration, networking, architecture, security, development, data, or AI. The exam should therefore build a mental model that remains useful after the fundamentals badge is earned.

Cloud concepts start with responsibility, consumption, and the reason to abstract infrastructure

Candidates should be able to describe public, private, and hybrid cloud; the shared responsibility model; consumption-based pricing; high availability; scalability; elasticity; reliability; predictability; security; governance; and manageability. The AZ-900 cloud concepts are easier to retain when each term is tied to a business scenario.

For example, elasticity is not simply “the cloud can scale.” It is the ability to change resources as demand changes, ideally without paying permanently for peak capacity. Shared responsibility changes when a company moves from infrastructure as a service to a managed platform. Build small examples for each concept so the definition includes an operational consequence.

A virtual machine gives the customer control over the guest operating system and therefore responsibility for patching and configuration. A managed database removes much of that platform administration. A SaaS application moves even more responsibility to the provider. Serverless services further abstract infrastructure and usually align cost with execution or events.

Take one fictional web application and host it three ways: virtual machines, a managed application platform, and a serverless combination. For each, list what the provider manages and what the customer still manages. This turns service models into an ownership matrix rather than a set of acronyms.

Regions and availability zones explain how Azure turns geography into resilience options

Azure regions, paired or related geographies, availability zones, datacenters, and edge services define where resources run and what failure boundaries are available. The regions and availability zones topic matters because “deployed in Azure” does not automatically mean a workload survives a datacenter or regional outage.

Sketch a service deployed in one availability zone, then across multiple zones, then across two regions. For each design, consider cost, latency, data replication, and operational complexity. AZ-900 does not require an architect’s depth, but candidates should understand that resilience is a deliberate design choice rather than a universal default.

Subscriptions, resource groups, and management groups define administrative scope

Azure resources exist inside a hierarchy. Management groups can organize subscriptions, subscriptions create billing and access boundaries, resource groups organize resource lifecycle, and individual resources provide the services. The Azure resource hierarchy becomes easier to understand when ownership and policy are mapped to each level.

Design a simple company with production and development subscriptions, shared identity, and several application teams. Decide where policy should be assigned and which resources should share a resource group. The exercise shows why a resource group is more than a visual folder and why subscription design affects governance and cost.

Compute, networking, and storage are the basic building blocks of Azure solutions

AZ-900 candidates should recognize virtual machines, containers, managed application hosting, virtual networks, VPN and ExpressRoute concepts, DNS, load balancing, storage accounts, blobs, files, disks, queues, redundancy options, and migration services. The goal is not to configure all of them but to know what type of problem each family solves.

Create a simple web application diagram with a front end, application tier, database, object storage, and private network. Label which Azure service family could implement each component. Then change one requirement—for example, global users, large media files, or private on-premises connectivity—and identify which part of the diagram must change.

Identity and security explain who can access what and under which conditions

Microsoft Entra ID, authentication methods, multifactor authentication, conditional access, role-based access control, Defender for Cloud, network security, and Zero Trust are foundational concepts. Candidates should distinguish identity authentication from authorization to an Azure resource and recognize that security controls operate at several layers.

Use a simple example: an administrator signs in with multifactor authentication, satisfies a conditional-access policy, and then receives only the Azure role required for a resource group. Each step answers a different security question. This prevents the common mistake of treating “logged in” as equivalent to “allowed to do anything.”

Governance creates guardrails for cost, configuration, and compliance

Azure Policy, resource locks, tags, role-based access, management groups, and Microsoft Purview-related concepts help organizations control how cloud resources are created and used. The Azure governance and compliance controls are best understood by matching each tool to its purpose rather than memorizing definitions.

A tag labels or categorizes a resource; a policy can evaluate or restrict configuration; a lock can prevent accidental deletion or modification; a role controls actions an identity may perform. Build one scenario where all four are used together. Their overlap disappears once each control is tied to a different administrative risk.

Cloud cost is driven by architecture and usage, not just the listed price

Consumption, reservations or commitments, service tiers, data transfer, storage class, redundancy, idle capacity, and support choices all affect cost. The cloud cost management perspective helps connect pricing to accountability: teams need to know what they consume, why it costs money, and which changes reduce waste without breaking required service levels.

Compare a workload that runs continuously with one that runs for two hours each night. Ask whether the same compute model makes sense for both. Then consider a globally replicated dataset and identify how redundancy and network traffic can change the bill. AZ-900 questions often become easier when cost is treated as a consequence of design.

Management and deployment tools represent different ways to control the same resources

The Azure portal, Cloud Shell, Azure CLI, PowerShell, ARM templates, Bicep, Azure Arc, and APIs provide different interaction models. Candidates do not need administrator-level command expertise, but they should understand that portal clicks and infrastructure-as-code changes reach the same Azure control plane through different interfaces and automation levels.

Deploy a small resource in the portal, then inspect its representation through another management interface. The exercise illustrates why repeatable deployments move toward code and why a graphical portal remains useful for exploration and diagnostics. The choice is often about scale, repeatability, and auditability rather than capability alone.

Monitoring services answer different questions about health, recommendations, and incidents

Azure Monitor collects and analyzes telemetry, Service Health communicates platform issues that may affect a customer, Resource Health focuses on individual resources, and Azure Advisor provides recommendations. The Azure monitoring and service-health relationships are easier to learn by asking what question each service answers.

If a virtual machine is unreachable, Resource Health may indicate whether Azure sees a platform issue for that resource. Service Health can show a broader Azure incident. Monitor can show workload and platform telemetry. Advisor is not the incident console; it provides recommendations. Clear question-to-tool mapping is a more durable study method than memorizing portal locations.

AZ-900 does not require long configuration labs, but small experiments make the concepts stick. Create a resource group, deploy a basic resource, apply a tag and lock, inspect cost information, review monitoring, and remove the resource. Then explain the same lifecycle using the language of responsibility, governance, and consumption.

Finish by revisiting the cloud models and shared-responsibility concepts with real examples from your lab. If you can explain not only what a service is but why an organization would choose it, what it still must manage, how it is governed, and how it is paid for, you have built the conceptual baseline AZ-900 is intended to validate.

Service-level agreements and lifecycle concepts add useful context to Azure availability. A service may publish an SLA, but the application’s overall availability depends on how several services are combined and whether the architecture meets the conditions of those commitments. Learn the difference between an SLA, a service health event, and a design choice such as zone redundancy. Fundamentals candidates do not need to calculate complex composite availability, but they should know that a provider commitment does not automatically make every workload highly available.

Migration concepts are also easier when tied to business motives. Organizations move to Azure for reasons such as datacenter exit, scalability, faster delivery, global reach, managed services, resilience, or modernization. Rehosting a virtual machine and refactoring an application into managed services are both “cloud migration,” yet they transfer different amounts of operational responsibility. Recognizing that distinction helps connect cloud service models to real adoption decisions.

Finally, pay attention to service evolution. Azure product names and interfaces change, but the fundamentals categories remain stable: compute, networking, storage, identity, security, governance, cost, and monitoring. When a new service appears, ask which category it belongs to, what responsibility it removes from the customer, how it is billed, and what governance applies. That habit keeps AZ-900 knowledge useful after the exam rather than tying it to one snapshot of the portal.

A useful final test is to explain Azure to a nontechnical stakeholder without losing accuracy. Describe why a company might choose a managed service instead of a virtual machine, why a zone-resilient design costs more than a single instance, why governance is required even when teams can deploy quickly, and why identity controls still matter in a provider-operated datacenter. If you can answer those questions in plain language and then map them back to the correct Azure concepts, you are demonstrating the level of understanding the fundamentals exam is intended to measure.

ExamSnap's Microsoft AZ-900 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Microsoft AZ-900 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.