AZ-900: Build the Azure Mental Model Before Memorizing Services

AZ-900 is a fundamentals exam, but “fundamentals” does not mean memorizing a long list of Azure services. The fastest route to confusion is learning each product as an isolated definition. The useful goal is to build a small set of mental models that explain why cloud services exist, how Azure is organized, where responsibility sits, and which management tools answer which type of problem.

Effective July 20, 2026, Microsoft’s current blueprint keeps three broad areas: cloud concepts, Azure architecture and services, and Azure management and governance. The AZ-900 exam measures descriptive understanding rather than the implementation depth expected from role-based engineering exams, but candidates still need clean boundaries between ideas such as compute, governance, identity, and monitoring. The associated Azure Fundamentals credential is a common starting point in the wider family of Microsoft certifications, and a good mental map should remain useful when you later study administration, networking, security, data, or AI.

First mental model: who is responsible for what?

Cloud questions become simpler once you separate ownership from service type. In an on-premises environment, the organization owns nearly the entire stack. In cloud services, some responsibility shifts to the provider, but the customer never gives away every responsibility. The exact boundary depends on the service being consumed.

That is why IaaS, PaaS, and SaaS should be learned through responsibility rather than acronyms. With infrastructure as a service, the provider operates the physical datacenter and underlying infrastructure while the customer still manages substantial parts of the operating environment. Platform as a service removes more infrastructure administration from the customer. Software as a service moves further toward consuming a finished application while the customer still remains responsible for areas such as identities, data, access, and appropriate use.

The same logic helps when comparing public, private, and hybrid cloud models. The terms describe where and how computing resources are delivered, not whether the design is automatically secure, inexpensive, or easy. The comparison should stay focused on where resources run, who controls them, and how the environments connect.

The current exam also includes consumption-based pricing, serverless computing, scalability, high availability, reliability, predictability, governance, security, and manageability. Instead of memorizing each benefit separately, ask what problem the cloud model is reducing: unused capacity, slow provisioning, fixed hardware limits, single-site failure, inconsistent control, or operational overhead.

Second mental model: Azure is organized as a hierarchy

Azure resources do not float independently. A resource belongs to a resource group. Resource groups belong within subscriptions. Subscriptions can be organized under management groups. These scopes matter because access, policy, cost, and governance decisions can be applied at different levels.

Regions and availability zones solve a different class of problem. A region is a geographic Azure area containing one or more datacenters. Availability zones are physically separate locations within supported regions, designed to reduce the impact of a datacenter-level failure. Region pairs and sovereign regions add further geographic and regulatory context. Understanding Azure regions and availability zones is more useful than memorizing a map because the exam is interested in why those boundaries matter.

Keep the two hierarchies separate in your mind. Resource groups, subscriptions, and management groups are management scopes. Regions, zones, and datacenters describe physical or geographic placement and resilience. A resource group is not a fault domain, and an availability zone is not a billing container.

Third mental model: compute, networking, and storage are choices around a workload

The architecture-and-services domain is broad because Azure can host very different workloads. Virtual machines provide general-purpose compute with significant customer control. Containers package applications differently. Azure Functions support serverless execution. App Service provides managed application hosting. Virtual Machine Scale Sets help operate groups of VMs. Azure Virtual Desktop delivers virtualized desktops and applications.

Do not study these as products competing for one “best” answer. Ask what level of operating-system control the workload needs, how it should scale, whether the application is long-running or event-driven, and how much platform management the customer wants to retain.

Networking follows the same pattern. VNets create private network boundaries in Azure; subnets divide them; peering connects VNets; Azure DNS handles name resolution; VPN Gateway and ExpressRoute provide different forms of external or hybrid connectivity; public and private endpoints affect how services are reached. The broader structure of cloud networking is enough for AZ-900 when you can describe the purpose of each component without drifting into AZ-700 configuration depth.

Storage questions are also comparative. Blob, Files, Queues, and Tables serve different data patterns. Hot, cool, cold, and archive tiers trade access characteristics against storage economics. Redundancy options change the failure boundary. Tools such as AzCopy, Storage Explorer, Azure File Sync, Azure Migrate, and Data Box solve different movement and migration needs. The exam rewards knowing which category a requirement belongs to.

Fourth mental model: identity decides who, security decides under what conditions

Microsoft Entra ID is Azure’s cloud identity and access foundation. AZ-900 expects candidates to recognize directory services, single sign-on, multifactor authentication, passwordless methods, external identities, Conditional Access, and role-based access control. The distinction between authentication and authorization matters: proving who you are is different from deciding what you are allowed to do.

RBAC assigns permissions to Azure resources. Conditional Access evaluates sign-in conditions and can require stronger controls. MFA adds an authentication factor. Passwordless methods change how a user proves identity. Those tools can work together, but they do not solve the same problem.

The exam also includes Zero Trust, defense in depth, and Microsoft Defender for Cloud. Zero Trust is best understood as a security approach that avoids granting trust merely because a request originates from a familiar network. Defense in depth means layering controls so that one failed protection does not leave the entire system exposed. Defender for Cloud helps organizations assess and improve cloud security posture and protect workloads.

Fifth mental model: governance, cost, deployment, and monitoring happen after creation too

Beginners often imagine cloud work as choosing a service and deploying it. The governance domain exists because production cloud environments must also control cost, enforce standards, prevent accidental changes, deploy consistently, and observe what is happening.

Tags can help organize resources and costs. The pricing calculator estimates expected charges before deployment. Azure Cost Management helps analyze spending after resources exist. Cloud cost management goes beyond AZ-900, but it reinforces an important fundamentals lesson: cloud consumption is variable, so cost has to be measured and governed rather than treated as a fixed hardware purchase.

Azure Policy evaluates or enforces organizational requirements. Resource locks help prevent accidental deletion or modification. Microsoft Purview addresses data governance and related visibility. These controls are different from RBAC: permission to perform an action does not necessarily mean the action complies with organizational policy.

Azure Resource Manager provides the management layer for Azure resources. The portal, Cloud Shell, Azure CLI, and Azure PowerShell are different interfaces for working with that control plane. Infrastructure as code and ARM templates make deployments repeatable. Azure Arc extends management to resources outside conventional Azure boundaries.

Monitoring closes the loop. Azure Advisor gives recommendations. Azure Service Health reports issues affecting Azure services and the resources you use. Azure Monitor collects and analyzes telemetry, with Log Analytics, alerts, and Application Insights supporting different forms of observation. The exam may put these tools in one question because their names sound similar; the mental model should separate recommendation, service-status, and telemetry functions.

Turn definitions into comparisons instead of flashcard piles

Most AZ-900 mistakes come from concepts that are individually familiar but poorly separated. If you know that both availability zones and region pairs relate to resilience, the next step is to explain how they differ. If you know that RBAC and Azure Policy both affect control, explain which governs permissions and which governs compliance. If you know that VPN Gateway and ExpressRoute both connect networks, explain the basic difference in connectivity model. If you know that Azure Advisor and Azure Monitor both help operations, explain what each actually tells you.

Build two-column comparisons for the concepts that repeatedly collide in your head: CapEx versus OpEx, horizontal versus vertical scaling, public versus private endpoints, authentication versus authorization, IaaS versus PaaS, availability zones versus region pairs, Policy versus locks, Service Health versus Monitor. The purpose is not to memorize a table. It is to make the boundary between two ideas explicit enough that scenario wording cannot blur it.

A second useful method is active recall. After studying a topic, close the notes and explain it from memory in plain language. If you can only recognize the correct answer when you see it, you have not yet built a reliable mental model.

Use a small Azure lab to make abstract categories concrete

AZ-900 does not require deep implementation skill, but a small amount of hands-on work can eliminate a surprising amount of memorization. Create a resource group and inspect where it sits in a subscription. Deploy a simple storage account or virtual machine and look at region selection, networking, identity, tags, and cost information. Open Azure Monitor and Service Health so the names correspond to real interfaces rather than definitions on a page.

Then deliberately observe scope. Apply a tag to a resource and compare it with a resource-group-level tag. Inspect IAM and see where RBAC assignments live. Look at Azure Policy separately. Open the pricing calculator before deployment, then examine Cost Management afterward. You do not need a production architecture; you need enough contact with Azure to anchor the vocabulary.

The current Microsoft study guide gives the architecture-and-services domain the largest range at 35–40 percent, with cloud concepts at 25–30 percent and management and governance at 30–35 percent. Use those ranges to check coverage after you have built your conceptual map, not to allocate study time mechanically. A weak understanding of shared responsibility can cause errors in security and service-model questions, while weak hierarchy knowledge can affect governance, cost, and access questions.

You are ready for AZ-900 when Azure stops looking like hundreds of unrelated services. You should be able to place a new term into a category, explain what problem it solves, distinguish it from the nearest alternative, and connect it to the right management scope. That mental structure is what makes the exam manageable—and it remains useful long after the fundamentals credential is finished.