Microsoft AZ-900 Azure Fundamentals: What the 2026 Exam Covers

AZ-900 remains Microsoft’s active Azure Fundamentals exam in 2026. The current English-language skills outline was updated on July 20, 2026, and the structure is still deliberately broad: cloud concepts, Azure architecture and services, and Azure management and governance.

The exam is designed for technology professionals who want a working foundation in Azure rather than deep implementation expertise. That makes AZ-900 useful for beginners, career changers, technical managers, developers moving into cloud work, and administrators who need to understand the Azure platform before specializing.

It also means the right study strategy is conceptual. Candidates should be able to explain why a service or design exists, what problem it solves, and which responsibility belongs to Microsoft versus the customer. Memorizing portal locations or isolated product definitions is much less useful.

Cloud concepts come before Azure product names

AZ-900 starts with cloud computing itself. Candidates should understand public, private, and hybrid cloud models; the difference between capital and operational expenditure; consumption-based pricing; elasticity; scalability; high availability; reliability; and the shared responsibility model.

The shared responsibility model is especially important because responsibility changes with the service model. In infrastructure as a service, the customer still manages operating systems and much of the workload configuration. In platform as a service, Microsoft manages more of the underlying stack. In software as a service, the customer focuses more on identities, data, access, and how the application is used.

The AZ-900 cloud concepts material is useful because many exam questions become easier once the service model and responsibility boundary are clear.

Azure architecture begins with regions, zones, subscriptions, and resource groups

Azure resources exist inside a hierarchy. A resource is the individual service instance. Resource groups organize related resources. Subscriptions provide billing and access boundaries. Management groups can organize multiple subscriptions for policy and governance.

Physical architecture matters too. Azure regions contain datacenters in a geographic area, and availability zones provide separate locations within supported regions. Paired-region and multi-region designs can support broader resilience strategies, but AZ-900 expects candidates to understand the concepts rather than engineer a full disaster-recovery system.

These ideas explain why a cloud design is more than “put the server in Azure.” Resource organization, location, resilience, and governance are architectural choices from the beginning.

Compute services differ by control and operational model

Azure Virtual Machines provide the most familiar server model and the greatest operating-system control, but they also leave more management work with the customer. Azure App Service provides a managed platform for web applications. Azure Functions supports event-driven serverless execution. Containers and Azure Kubernetes Service support application packaging and orchestration models that differ from traditional VMs.

For AZ-900, the goal is to recognize which compute model best matches a scenario. A team that needs full operating-system control may choose VMs. A web application that does not need server administration may fit App Service. Short event-driven tasks may fit Functions.

Do not memorize every feature. Learn the control-versus-management tradeoff. That principle remains useful long after individual service details change.

Azure networking connects resources, users, and other environments

Virtual networks create private network boundaries for Azure resources. Subnets divide those networks into smaller segments. Network Security Groups filter traffic. Azure VPN Gateway and ExpressRoute support hybrid connectivity. Load-balancing and application-delivery services distribute or route traffic depending on the scenario.

DNS and routing are equally important concepts because a service can be healthy and still unreachable if name resolution or network paths are wrong. Private endpoints allow many Azure services to be reached through private IP addresses instead of public exposure.

AZ-900 does not require the depth of a network-engineering exam, but candidates should understand why segmentation, private connectivity, routing, and traffic control are core parts of cloud architecture.

Storage choices depend on how applications use data

Azure Storage includes object, file, queue, table, and disk-oriented services. Blob Storage fits large-scale object data. Azure Files provides managed file shares. Managed disks provide block storage for virtual machines. Queue Storage supports simple asynchronous messaging. Table Storage provides a scalable key-value style NoSQL service.

The exam usually rewards recognition of the correct model rather than detailed tuning. If the workload expects a mounted file share, Azure Files makes more sense than Blob Storage. If a VM needs persistent block storage, managed disks are the natural fit.

Redundancy and access tiers also appear at fundamentals level because storage architecture includes durability, availability, and cost—not just capacity.

Identity and security start with Microsoft Entra ID

Microsoft Entra ID is the identity platform used to authenticate users, applications, and services across Azure and Microsoft cloud services. AZ-900 candidates should understand authentication versus authorization, multifactor authentication, Conditional Access, role-based access control, and the idea of least privilege.

Security is layered. Identity controls who can sign in. Azure RBAC controls what authenticated identities can do to Azure resources. Network controls restrict paths. Encryption protects data. Microsoft Defender for Cloud can help assess security posture and workload risk.

The terminology changed from Azure Active Directory to Microsoft Entra ID, so older AZ-900 material that still treats “Azure AD” as the current product name should be updated even when the underlying identity concepts remain valid.

Management and governance are a major part of the exam

The July 2026 blueprint still gives substantial weight to management and governance. Azure Policy helps enforce organizational rules. Resource locks protect critical resources from accidental deletion or modification. Tags support organization and cost allocation. Management groups help apply governance across subscriptions.

Infrastructure can be deployed through the Azure portal, command-line tools, PowerShell, ARM templates, and Bicep. AZ-900 does not require advanced infrastructure-as-code development, but candidates should know why repeatable declarative deployment is useful.

Governance also includes cost. Azure Cost Management, budgets, pricing tools, and Azure Advisor help organizations understand and optimize spending rather than treating the cloud as an unlimited pool of infrastructure.

Resource locks and tags are simple but useful governance controls. Locks can protect important resources from accidental deletion or modification, while tags can identify owners, environments, applications, cost centers, or other organizational metadata. They do not replace policy or access control, but they help make a growing Azure estate easier to understand and operate.

Azure Resource Manager also provides the deployment and management boundary behind Azure resources. Understanding that resources are managed through a consistent control plane helps connect portal, CLI, PowerShell, templates, and Bicep into one model rather than treating each management tool as a separate Azure system.

Monitoring connects availability to operations

Azure Monitor provides a broad monitoring platform for metrics, logs, alerts, and application or infrastructure telemetry. Log Analytics allows teams to query collected log data. Application Insights focuses on application performance and behavior.

Azure Service Health and Azure Status answer different operational questions. Status provides a broad public view of Azure service health, while Service Health gives personalized information about issues and planned maintenance affecting the resources or regions relevant to a customer.

The exam tests these services because cloud operations require knowing whether a problem comes from the application, the Azure resource, or the platform itself.

AZ-900 is useful because it builds a shared Azure vocabulary

The certification does not make someone an Azure administrator or architect. What it does well is create a common vocabulary for discussing cloud design, cost, security, identity, governance, and service selection.

That can be valuable for business analysts, project managers, developers, security staff, and technical leaders because they often participate in cloud decisions without operating every Azure service directly.

For learners who later move into administration, the Azure Administrator Associate path adds much deeper implementation skill. Architects, data professionals, security engineers, and AI developers can follow different routes after the fundamentals are solid.

A practical 2026 AZ-900 study plan

Start by mastering cloud concepts and the shared responsibility model. Then learn the Azure resource hierarchy and core service families: compute, networking, storage, identity, security, management, and monitoring.

Use a small Azure subscription or Microsoft Learn sandbox to create a resource group, inspect a virtual network, review a storage account, explore Entra ID, and look at Cost Management and Azure Monitor. The goal is familiarity, not production deployment.

Then work through scenario questions. Ask what the requirement actually is: lower management overhead, private connectivity, cost visibility, policy enforcement, high availability, or identity protection. That reasoning is more reliable than memorizing definitions.

The common AZ-900 preparation mistakes are also useful to review because over-studying technical implementation is almost as inefficient as under-studying the conceptual differences between services.

AZ-900 is still current, but the study material should be current too

Microsoft continues to update AZ-900 as Azure terminology and services evolve. In July 2026, the broad structure remained stable while several objective details received minor changes.

That stability is good news for candidates: cloud concepts, architecture, service categories, identity, governance, cost, and monitoring remain durable. But old resources can still mislead readers with outdated names, retired services, or obsolete interface details.

The Azure Fundamentals certification remains one of the clearest entry points into Microsoft cloud learning. Treat the exam as a foundation: learn why Azure is designed the way it is, then choose the next role based on the work you actually want to perform.