Microsoft Azure Fundamentals (AZ-900): Lessons 2026

Lesson 1: Cloud concepts: models, pricing and service types

AZ-900: Microsoft Azure Fundamentals is a beginner exam. Passing it earns the Microsoft Certified: Azure Fundamentals certification. You have 45 minutes and need a scaled score of 700 or greater out of 1,000.

Cloud computing and shared responsibility

Cloud computing is the delivery of computing services, such as servers, storage, databases and networking, over the internet. In your own datacentre you are responsible for everything. In the cloud, the work is shared:

• Always the provider: the physical datacentre, physical network and physical hosts.
• Always you: your information and data, the devices allowed to connect, and your accounts and identities.
• Depends on the service type: operating systems, network controls, applications, and identity and access. IaaS puts the most responsibility on you, SaaS the least, and PaaS sits in the middle.

Cloud models

• Public cloud: run by a third-party provider; anyone who wants to buy services can use it, and you pay only for what you use.
• Private cloud: used by a single organization. More control, but higher cost, and you buy and maintain the hardware.
• Hybrid cloud: public and private clouds connected. A private cloud can surge into the public cloud for temporary extra demand.
• Multicloud: two or more public cloud providers are used together.

The consumption-based model and pricing

Capital expenditure (CapEx) is up-front spending on things such as servers. Operational expenditure (OpEx) is ongoing spending on services. You pay for cloud services as you use them, so cloud computing is an operational expense. There is no up-front hardware cost, and you can add resources when demand rises and release them, and stop paying, when it drops.

Serverless computing, such as Azure Functions, runs your code when an event happens (a web request, timer or message). You don't maintain VMs or containers, and you pay only for the CPU time used while the code runs.

Benefits of the cloud

• High availability: uptime guarantees depend on the service and are written in its service-level agreement (SLA).
• Scalability: vertical scaling (up or down) changes a resource's size, such as adding CPUs or RAM to a VM. Horizontal scaling (out or in) changes the number of resources, such as adding VMs.
• Reliability: the ability of a system to recover from failures and keep working.
• Predictability, security, governance and manageability: autoscaling and load balancing keep performance steady, tools estimate spending, templates and auditing keep resources compliant, and you manage resources through a portal, command line, APIs or PowerShell.

Cloud service types

Topic quiz 1: Cloud concepts: models, pricing and service types

Lesson 2: Azure core architecture: regions, zones and resource hierarchy

Lessons 2 to 4 cover the largest skill area, Describe Azure architecture and services (35–40%).

Physical infrastructure

• Region: a geographical area with one or more nearby datacentres linked by a low-latency network. A few global services, such as Microsoft Entra ID and Azure DNS, don't ask you to choose a region.
• Availability zone: a physically separate location in a region, made up of one or more datacentres with their own power, cooling and networking. Regions that support zones have at least three. A zonal resource, such as a VM, is pinned to one zone you choose; a zone-redundant service, such as zone-redundant storage, is copied across zones by Azure.
• Region pair: most regions are paired with another region in the same geography at least 300 miles (about 480 km) away. Planned updates roll out to one region of the pair at a time, and services can fail over to the other region in a disaster.
• Sovereign regions: instances of Azure isolated from the main one for compliance or legal reasons. US government regions are run by screened US personnel. China regions are offered through a partnership with 21Vianet, and Microsoft doesn't directly maintain those datacentres.

Management infrastructure

• Resource: anything you create, such as a VM, virtual network or database.
• Resource group: a container for resources. Each resource belongs to exactly one group at a time. Groups can't be nested, and deleting a group deletes everything in it.
• Subscription: a unit of management, billing and scale. It is a billing boundary (its own invoice) and an access control boundary, so companies often use separate subscriptions for production and development.
• Management group: a container above subscriptions. Management groups can be nested six levels deep, not counting the root or subscription level, and each has only one parent.

From largest to smallest: management groups → subscriptions → resource groups → resources. Policies and access flow down. A policy on a management group that limits VMs to one location applies to every subscription under it, and a subscription owner can't override it.

Topic quiz 2: Azure core architecture: regions, zones and resource hierarchy

Lesson 3: Azure compute, networking and storage

Compute

• Azure Virtual Machines: virtual servers as IaaS. You control the operating system and still manage its patches and updates.
• Virtual Machine Scale Sets: a group of identical, load-balanced VMs that scale out or in automatically.
• Availability sets: spread VMs across update domains (VMs rebooted together during planned maintenance) and fault domains (VMs that share a power or network failure point).
• Azure Virtual Desktop: Windows desktops and apps run in Azure, so data can stay off users' own devices.
• Containers: lightweight, and you don't manage their operating system. Azure Container Instances is the simplest way to run a container; Azure Kubernetes Service (AKS) orchestrates a large fleet of containers.
• Azure App Service: hosts web apps, background jobs, mobile back ends and REST APIs without you managing infrastructure.
• Azure Functions: serverless code that runs when an event happens (see lesson 1).

Networking

• Virtual network: lets Azure resources talk to each other, the internet and your on-premises network. You divide its private IP address space into subnets.
• Peering: connects two virtual networks, even in different regions. Traffic stays private on the Microsoft backbone network.
• Azure VPN Gateway: encrypted traffic over the internet. Site-to-site links an on-premises datacentre; point-to-site links one device.
• Azure ExpressRoute: a private connection through a connectivity provider that doesn't go over the public internet, for more reliability, speed and security.
• Azure DNS: hosts your DNS records on Azure's global name servers. You can't buy a domain name with it; buy the name through App Service domains or a registrar.
• Endpoints: a public endpoint has a public IP address; a private endpoint uses a private IP address from inside a virtual network.

Storage

A storage account holds your data. Standard general-purpose v2 is recommended for most scenarios. Services include Blob Storage (unstructured data such as images and video), Azure Files (file shares using SMB or NFS), Queue Storage (messages), Table Storage (NoSQL data) and Disk Storage (VM disks).

Secondary-region data can't be read until a failover unless you choose RA-GRS or RA-GZRS (read access).

Moving data

• AzCopy: a command-line tool to copy and sync files and blobs; its sync works one way only.
• Azure Storage Explorer: a graphical app for managing storage; it uses AzCopy.
• Azure File Sync: keeps a Windows file server and Azure Files in sync both ways, with cloud tiering keeping frequently used files local.
• Azure Migrate: a hub to discover, assess and migrate servers, databases and web apps.
• Azure Data Box: Microsoft ships you a rugged storage device with up to 80 TB of usable space. You load your data and a carrier returns it. Use it for very large transfers when bandwidth is limited.

Topic quiz 3: Azure compute, networking and storage

Lesson 4: Azure identity, access and security

Directory services and sign-in

• Microsoft Entra ID: Microsoft's cloud-based identity and access management service.
• Microsoft Entra Domain Services: managed domain join, group policy, LDAP and Kerberos/NTLM sign-in for older apps, without running domain controllers.
• Single sign-on (SSO): sign in once and use many trusted apps.
• Multifactor authentication (MFA): something you know (a password), something you have (a phone code) or something you are (a fingerprint or face scan).
• Passwordless: Windows Hello for Business (a face scan or PIN tied to the worker's own Windows PC), the Microsoft Authenticator app and FIDO2 security keys.

External identities and Conditional Access

With B2B collaboration, partners sign in with their own identities and appear in your directory as guest users. Microsoft Entra External ID for customers (formerly Azure AD B2C) handles sign-in for apps you offer to customers. Conditional Access uses signals (user, location, device, app) to make a decision (allow, require MFA or block), then enforces it. For example, a sign-in from an unusual location can be asked for MFA.

Azure role-based access control (RBAC)

RBAC follows the principle of least privilege: give only the access needed for the task. You assign roles such as Owner, Contributor and Reader at a scope (management group, subscription, resource group or resource), and child scopes inherit the access. RBAC uses an allow model, so permissions from several roles add together. It is enforced on actions that pass through Azure Resource Manager.

Zero Trust and defence in depth

Zero Trust assumes a breach and checks every request. Its principles are verify explicitly, use least privilege access and assume breach. Defence in depth (Microsoft spells it defense-in-depth) uses layers so one breach doesn't expose the data:

1. Physical security
2. Identity and access
3. Perimeter (DDoS protection, firewalls)
4. Network
5. Compute
6. Application
7. Data (the innermost layer)

Microsoft Defender for Cloud is a security posture management and threat protection service for Azure, on-premises, hybrid and multicloud resources. It gives recommendations, a secure score and security alerts.

Topic quiz 4: Azure identity, access and security

Lesson 5: Cost management, governance and compliance

Lessons 5 and 6 cover Describe Azure management and governance (30–35%).

Costs

• Resource type and consumption: settings, size and pricing option all change the price.
• Geography: power, labour, taxes and fees differ by region.
• Network traffic: outbound data is priced by billing zones, groups of regions used for data transfer pricing.
• Maintenance: deleting a VM may leave its storage and networking behind, still costing money.
• Azure Marketplace: you may pay the vendor as well as for Azure services.

The pricing calculator estimates costs before you deploy; nothing is created or charged. Microsoft Cost Management offers cost analysis (a quick visual of costs by region, resource or billing cycle) and budgets, whose budget alerts email people when spending reaches a threshold.

Tags

A tag is a name and value pair that adds metadata to a resource, such as Environment = Prod. Tags help with cost reporting and management. Resources don't inherit tags from their resource group or subscription; use Azure Policy to require tags.

Governance and compliance

• Microsoft Purview: data governance, risk and compliance solutions that give one view of your on-premises, multicloud and SaaS data.
• Azure Policy: flags non-compliant resources, including ones created before the policy, and can block new ones. A group of related policies is an initiative.
• Resource locks: a Delete lock (CanNotDelete) allows changes but not deletion; a ReadOnly lock blocks both. Locks apply even to owners, who must remove the lock first.

Topic quiz 5: Cost management, governance and compliance

Lesson 6: Managing, deploying and monitoring Azure

Tools and deployment

• Azure portal: a web-based console with a graphical interface.
• Azure Cloud Shell: a shell in your browser, already signed in, with nothing to install. Choose Azure PowerShell or the Azure CLI.
• Azure CLI and Azure PowerShell: they do the same management jobs; the main difference is the command syntax.
• Azure Arc: works with Azure Resource Manager to manage servers, Kubernetes clusters, SQL Server and other resources outside Azure (on-premises or in other clouds) in the same way as Azure resources.
• Azure Resource Manager: the deployment and management service. Every tool sends requests through the same Resource Manager API, so results are consistent.
• Infrastructure as code (IaC): managing infrastructure with code and templates instead of manual setup. ARM templates are declarative JSON: you describe what to deploy, not each step. Bicep is a simpler declarative language that also deploys through Resource Manager.

Monitoring

• Azure Advisor: recommendations for reliability, security, performance, operational excellence and cost.
• Azure Service Health: Azure status (all services in all regions), Service Health (the services and regions you use) and Resource Health (one resource, and whether a problem is on Azure's side).
• Azure Monitor: collects and analyzes logs and metrics from Azure, on-premises and multicloud resources. Log Analytics runs queries on that data.
• Alerts: an alert rule sets the condition, such as CPU above 80%; an action group sets who is notified and what happens next.
• Application Insights: tracks a web app's request rates, response times and failure rates.

Topic quiz 6: Managing, deploying and monitoring Azure