AZ-900 in 2026: What Changed in Microsoft Azure Fundamentals

AZ-900 is still one of the clearest entry points into Microsoft Azure, but candidates preparing in 2026 need to work from the current blueprint rather than from a 2025 study plan. Microsoft updated the English-language skills measured for AZ-900 on July 20, 2026. The exam still tests foundational cloud knowledge, but several topic descriptions and management concepts have been refreshed to reflect how Azure is actually used today.

The current weighting is straightforward: cloud concepts account for 25–30 percent, Azure architecture and services account for 35–40 percent, and Azure management and governance account for 30–35 percent. That structure tells you something important about the exam. AZ-900 is not a trivia test about every Azure product. It is designed to confirm that you understand the language and structure of cloud computing well enough to recognize what Azure services do, how they are organized, and how organizations control them.

The AZ-900 exam and Azure Fundamentals certification are useful reference points only if preparation stays anchored to the current skills outline. The credential validates foundational Azure knowledge; it does not substitute for administrator-level implementation skill.

The 2026 blueprint keeps AZ-900 focused on fundamentals rather than deep implementation

A common mistake is to prepare for AZ-900 as if it were an administrator exam. It is not. Microsoft expects candidates to describe concepts, services, and management capabilities rather than perform the detailed configuration work required in associate-level exams. You should understand what a virtual network is, why a network security group exists, and what a load balancer is for, but AZ-900 is not primarily testing whether you can build a production network from scratch.

The same distinction applies to identity, storage, compute, monitoring, and governance. You need to recognize the purpose of Microsoft Entra ID, Azure Policy, resource locks, Azure Monitor, Azure Advisor, and other platform capabilities. You should understand when a concept matters and how it fits into Azure’s operating model. Detailed implementation becomes more important later in paths such as AZ-104 or AZ-305.

That is why the best AZ-900 preparation uses architecture diagrams, short hands-on exercises, and scenario questions rather than large amounts of command memorization. The goal is to build a reliable mental model of Azure.

Cloud concepts now need to connect directly to business and technical decisions

The first domain covers cloud computing concepts, including the shared responsibility model, cloud deployment models, consumption-based pricing, and the characteristics of cloud services. These ideas sound simple, but candidates often learn them as definitions rather than decision tools.

The shared responsibility model is a good example. Responsibility shifts depending on whether you use infrastructure as a service, platform as a service, or software as a service. You should be able to explain which parts the cloud provider operates and which parts remain the customer’s responsibility. That understanding affects security, patching, identity, data protection, and compliance decisions.

Public, private, and hybrid cloud models should also be understood as architectural choices rather than labels. A hybrid environment may exist because an organization cannot move every workload at once, needs local systems for latency or regulation, or wants to integrate existing identity and networking with cloud services. AZ-900 questions often become easier when you ask what business requirement is driving the model.

The same is true of elasticity, scalability, high availability, and disaster recovery. These concepts overlap but are not interchangeable. Scalability concerns capacity. Elasticity concerns adapting that capacity to demand. High availability concerns continuing service through faults. Disaster recovery concerns restoring or failing over after more serious disruption. A candidate who can distinguish those ideas will be better prepared than someone who memorizes one-sentence definitions.

Azure architecture starts with regions, zones, subscriptions, and resource organization

The architecture-and-services domain is the largest part of AZ-900. Before learning individual services, understand the hierarchy around them. Azure resources live in resource groups; resource groups belong to subscriptions; subscriptions can be organized through management groups; and all of this exists within Microsoft Entra tenants and Azure’s global infrastructure.

Regions and availability zones are especially important because they explain where workloads run and how resilience is designed. Azure now provides more than 70 regions globally, but not every service is available in every region and not every service supports availability zones in every zone-enabled region. A region is not simply a label in a deployment menu. It affects latency, data residency, service availability, cost, and recovery design.

Understanding Azure regions and availability zones means connecting deployment location to latency, residency, service availability, and resilience rather than memorizing a list of region names.

Compute, networking, and storage should be learned as service families

AZ-900 does not require expert-level knowledge of every Azure service. A more efficient approach is to group services by the problem they solve. For compute, understand the difference between virtual machines, containers, serverless functions, and managed application hosting. Each model gives you a different balance of control and operational responsibility.

For networking, understand virtual networks, subnets, peering, VPN connectivity, private access, public endpoints, load balancing, and security controls. You do not need to become a network engineer for AZ-900, but you should understand how Azure resources communicate and why organizations isolate or connect networks in different ways.

For storage, know the broad purposes of object, file, disk, and queue-style storage, along with durability, redundancy, and access tiers. Candidates often over-focus on product names and miss the underlying use case. If a scenario describes unstructured files accessed over HTTP, think about object storage. If it describes a disk attached to a virtual machine, think about managed disks. If it describes shared file access, think about file services.

Identity and security are foundational even when the exam is not a security exam

Modern cloud architecture depends on identity. AZ-900 expects candidates to understand Microsoft Entra ID, authentication, authorization, multifactor authentication, conditional access concepts, and the principle of least privilege. These ideas shape how users and workloads access Azure resources.

Role-based access control is particularly important because it connects identity to authorization. You should understand that a role grants a set of permissions and that the scope determines where those permissions apply. Resource, resource-group, subscription, and management-group scopes create different levels of influence.

Security should also be viewed as layered. Network controls, identity controls, platform security services, encryption, governance, monitoring, and policy work together. AZ-900 is not asking you to operate a security operations center, but it does expect you to understand why cloud security cannot be reduced to “Microsoft secures Azure.” The provider secures parts of the platform; the customer still has substantial responsibility for identities, data, configurations, and workload behavior.

The management-and-governance domain is where many candidates underprepare

The final domain is substantial—30–35 percent of the current blueprint—and it is easy to underestimate. Microsoft expects candidates to describe cost management, governance, deployment tools, infrastructure as code, resource management, monitoring, and service-health capabilities.

Azure Policy and resource locks are different tools. Policy evaluates or enforces conditions across resources, while locks help prevent accidental deletion or modification. Role-based access control answers who can do something; Policy answers whether a resource configuration is allowed or compliant. These distinctions are common sources of confusion.

Infrastructure as code also appears explicitly in the current blueprint. Candidates should understand the purpose of Azure Resource Manager and ARM templates, and more broadly why repeatable declarative deployment matters. You do not need to become an infrastructure automation expert, but you should understand why organizations prefer controlled, versioned, reproducible deployments over manual configuration.

Monitoring is another area where product names need to connect to use cases. Azure Monitor provides the broad monitoring platform. Log Analytics is used to query collected log data. Alerts notify or trigger action when defined conditions occur. Application Insights provides application-focused observability. Azure Service Health helps you understand Azure service issues that can affect your resources. Azure Advisor provides recommendations for improving workloads.

The 2026 update is best handled by rebuilding your study map, not adding a few new flashcards

If you prepared from an older AZ-900 outline, do not simply append a list of “new topics.” Compare your notes against the current three-domain structure and reorganize them. This exposes gaps more clearly. A topic that used to sit in a separate section may now be grouped differently, and a candidate who studies by old headings can accidentally over-weight material that is no longer emphasized.

Start with the official current objectives, then create a one-page map showing each domain and its subtopics. Mark each concept as “can explain,” “can recognize in a scenario,” or “needs review.” This produces a much better readiness signal than counting how many videos or chapters you completed.

For hands-on work, create a free or controlled Azure environment only if you can do so safely and monitor costs. Deploy a basic resource group, inspect a virtual network, view access control, look at Policy, review Azure Monitor, and examine cost-management interfaces. AZ-900 does not require deep configuration, but seeing the services makes the terminology far easier to remember.

AZ-900 should leave you with a clear Azure mental model

AZ-900 is valuable because it helps you choose a direction. It does not certify that you are an Azure administrator, architect, network engineer, developer, or security specialist. It gives you enough platform context to decide which of those roles fits your experience and interests.

If you enjoy operating cloud infrastructure, Azure Administrator Associate is a common next step. If your interest is architecture, the Azure Solutions Architect Expert path becomes relevant after the required administrator prerequisite. If you are drawn to networking, AZ-700 moves much deeper into Azure network design and implementation.

The right takeaway for 2026 is simple: AZ-900 remains current, but the blueprint is not frozen. Study the July 2026 objectives, focus on the relationships between concepts, and use the certification as a foundation for a role rather than an end in itself.