FREE AZ-900 Study Guide 2026

This free AZ-900 study guide walks through every skill area the Microsoft Certified: Azure Fundamentals (AZ-900) exam tests, organized to the current official Microsoft study guide.^[1]

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, flashcards, and practice questions, so you learn by doing — not just reading.

AZ-900 tests three official skill areas. We teach them in three study modules, leading with the heaviest-weighted content. Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This guide is a high-yield overview that maps the official content — not a full Azure reference manual.

AZ-900 Exam Snapshot

AZ-900 covers three skill areas. The largest by far is Azure architecture & services (35–40%), so that is where to invest first, followed by management & governance.^[1] Study by weight:

Module 1 · Azure Architecture & Services

35–40% of the exam — the single largest skill area. This is the catalog of what Azure actually offers: the global infrastructure your workloads run on, the management hierarchy that organizes them, and the core compute, networking, storage, and identity services. Knowing what each service does and when to use it is the highest-yield knowledge on the test.

1.1 Core Architectural Components

Azure’s physical footprint is a hierarchy. An Azure region is a set of datacenters in a latency-defined area. Within an enabled region are at least three availability zones — physically separate datacenters with independent power, cooling, and networking. Two regions in a geography form a Region pair for disaster recovery, and some workloads use an isolated Sovereign region.^[4]

Logically, resources are organized top-down: a Management group contains subscriptions, a subscription contains resource groups, and a resource group contains resources. Governance applied higher up — a policy on a management group — is inherited by everything below it. A resource lives in exactly one resource group.^[5]

1.2 Compute & Networking

Compute spans a spectrum of control. Azure Virtual Machines (IaaS) give you a full OS to manage; Azure App Service (PaaS) hosts web apps without managing servers; and Azure Functions (serverless) runs event-triggered code with nothing to provision. Containers sit between them — Azure Container Instances for a single container and Azure Kubernetes Service for orchestration at scale. A Virtual Machine Scale Set runs identical, autoscaling VMs.

Networking centers on the Virtual network (VNet) — your private network in Azure, divided into subnets and secured with a Network Security Group. VNet peering links two VNets privately. To reach on-premises, a VPN Gateway sends encrypted traffic over the internet, while ExpressRoute uses a private, dedicated connection that bypasses the public internet entirely.

1.3 Storage

Azure Storage data lives in a Storage account. Blob Storage holds unstructured objects (files, images, video, backups) and uses an Access tier — hot, cool, cold, or archive — to trade storage cost against retrieval cost. Azure Files provides mountable SMB/NFS file shares, and Disk Storage is the managed block storage attached to a VM.

Durability comes from redundancy. LRS keeps three copies in one datacenter; ZRS copies across availability zones; GRS adds a copy in a paired region to survive a regional outage; and GZRS combines zone and geo redundancy for the highest durability.^[6]

1.4 Identity, Access & Security

Microsoft Entra ID (formerly Azure Active Directory) is Azure’s cloud identity service. It handles Authentication (proving who you are) and works with Authorization (what you may do). Key features include Single sign-on (SSO), Multifactor authentication (MFA), and Conditional Access, which grants or blocks access based on signals like location, device, and risk.^[7]

Azure security follows Defense in depth — layered defenses — and a Zero Trust mindset that verifies every request and grants least privilege. Microsoft Defender for Cloud continuously assesses your posture, gives a secure score, and detects threats across Azure, hybrid, and multicloud.^[10]

Module 2 · Management & Governance

30–35% of the exam — the second-largest skill area. Once you know what Azure offers, this area is about running it well: controlling cost, enforcing standards and compliance, deploying resources consistently, and monitoring everything. These are the tools that keep a cloud estate cheap, compliant, and healthy.

2.1 Cost Management

Azure cost depends on resource type, services used, region, and especially data egress (outbound traffic is charged; inbound is usually free). Two tools help you plan: the Pricing Calculator estimates the cost of a planned deployment, while the TCO Calculator compares your current on-premises costs against Azure to show migration savings. After deployment, Microsoft Cost Management tracks spend, sets budgets, and fires alerts; a Tag groups costs by team or project.

You can lower cost with Azure Reservations (a one- or three-year commitment for a discount), the Azure Hybrid Benefit (reuse existing Windows/SQL Server licenses), spot VMs for interruptible work, and by right-sizing or shutting down idle resources.

2.2 Governance & Compliance

Governance keeps a growing estate consistent. Azure Policy controls what resources can be — it enforces standards (e.g., allow resources only in certain regions) and reports compliance.

Role-based access control (RBAC) controls who can do what, by assigning roles at a scope that is inherited downward.^[8][9] A Resource lock prevents accidental deletion or modification, and Microsoft Purview governs and classifies data across the estate.

2.3 Managing & Deploying Resources

You can manage Azure several ways: the graphical Azure portal, the browser-based Azure Cloud Shell (Bash or PowerShell), the Azure CLI and Azure PowerShell, and the mobile app. To manage resources outside Azure — on-premises, edge, or other clouds — use Azure Arc.

For repeatable deployments, use Infrastructure as code (IaC). Every management request goes through the Azure Resource Manager (ARM), and an ARM template (or the cleaner Bicep language) defines resources declaratively so you can deploy the same environment again and again.

2.4 Monitoring Tools

Three services answer three different questions. Azure Advisor gives personalized recommendations across cost, security, reliability, performance, and operational excellence. Azure Service Health tells you about Azure outages and maintenance affecting your resources. Azure Monitor collects and analyzes metrics and logs from your environment — including Log Analytics for querying logs and Application Insights for application performance.^[11]

Module 3 · Cloud Concepts

25–30% of the exam. This is the “why the cloud” foundation — what cloud computing is, how security responsibility is shared, the benefits that make the cloud compelling, and the three service types (IaaS, PaaS, SaaS). It is conceptual, high-yield, and the bedrock for everything else.

3.1 Cloud Computing & the Shared Responsibility Model

Cloud computing is the delivery of computing services over the internet on a Consumption-based model. Security is governed by the Shared responsibility model: Microsoft is always responsible for the physical hosts, network, and datacenter; the customer is always responsible for their information and data, devices, and accounts and identities. Everything in between shifts with the service type.^[3]

3.2 Benefits of Cloud Services

The cloud’s appeal comes from a handful of benefits. High availability keeps services running across availability zones; Scalability and Elasticity match resources to demand automatically; Reliability recovers from failure using redundant regions; and built-in security and governance, plus cloud manageability, reduce operational burden. Underpinning them is the shift from CapEx to OpEx.^[1]

3.3 Cloud Service Types (IaaS / PaaS / SaaS)

The three service types differ by how much you manage. IaaS gives you virtualized infrastructure (Azure VMs) and you manage the OS and up — the most control and responsibility. PaaS gives a managed platform (Azure App Service) where you manage only apps and data. SaaS delivers finished software (Microsoft 365) where you manage little beyond your data and access.

These map onto the deployment models too: a Public cloud is shared and provider-run; a Private cloud is exclusive to one organization; and a Hybrid cloud combines both so data and apps can move between them.

How to Use This AZ-900 Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

• Study by weight. Azure architecture & services (35–40%) is the biggest area — start there, then management & governance, then cloud concepts.
• Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
• Take every checkpoint. The end-of-module quizzes show you exactly which skill areas need another pass.
• Drill the weak area. Send your weak topics into the flashcards and a practice test until the score climbs.
• Learn what each service does. This is a breadth exam — recognizing the job of each service beats memorizing configuration detail.

AZ-900 Glossary

The high-yield Azure terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

Access tier

A Blob Storage setting (hot, cool, cold, archive) that trades storage cost against retrieval cost and speed.

Application Insights

An Azure Monitor feature for application performance monitoring of live web apps.

ARM template

A JSON file that defines Azure infrastructure as code for repeatable, declarative deployment.

Authentication

Proving who you are (AuthN), for example with a password and an MFA code.

Authorization

Determining what an authenticated identity is allowed to do (AuthZ).

Availability zone

A physically separate datacenter (or group) within a region, with independent power, cooling, and networking.

Azure Advisor

A free service giving personalized recommendations for cost, security, reliability, performance, and operations.

Azure App Service

A PaaS for hosting web apps and APIs without managing the underlying infrastructure.

Azure Arc

A service that extends Azure management and governance to on-premises, edge, and other clouds.

Azure Cloud Shell

A browser-based, authenticated shell (Bash or PowerShell) for managing Azure resources.

Azure Container Instances

The simplest way to run a single container in Azure without managing VMs (serverless containers).

Azure Files

Fully managed cloud file shares accessible over SMB or NFS that cloud and on-premises machines can mount.

Azure Functions

A serverless compute service that runs event-triggered code; you pay only while it runs.

Azure Hybrid Benefit

A license benefit that reuses existing Windows Server and SQL Server licenses to lower Azure cost.

Azure Kubernetes Service

AKS — a managed Kubernetes service for deploying and scaling containerized applications.

Azure Monitor

A platform service that collects and analyzes metrics and logs from Azure and on-premises resources.

Azure Policy

A governance service that enforces standards and assesses the compliance of resource configurations.

Azure portal

A web-based graphical console for building, managing, and monitoring Azure resources.

Azure region

A set of datacenters within a latency-defined perimeter connected by a dedicated low-latency network.

Azure Reservations

A one- or three-year commitment to a resource for a discount over pay-as-you-go pricing.

Azure Resource Manager

ARM — the deployment and management layer all Azure management requests pass through.

Azure Service Health

A service giving personalized alerts about Azure outages, maintenance, and health advisories.

Azure Virtual Machine

An on-demand, scalable IaaS compute resource that runs a full operating system.

Blob Storage

Object storage optimized for massive amounts of unstructured data such as text, images, and video.

CapEx

Capital expenditure — upfront spending on assets you own, such as servers and datacenters.

Cloud computing

The delivery of computing services — compute, storage, databases, networking, and software — over the internet, billed on a pay-as-you-go basis.

Conditional Access

An Entra policy that grants or blocks access based on signals like user, location, device, and risk.

Consumption-based model

Pricing where you pay only for the resources you use, with no upfront cost and no charge when you stop using a resource.

Defense in depth

A layered security strategy where multiple defenses each slow and stop attackers.

Disk Storage

Managed block-level storage volumes attached to Azure Virtual Machines, like a disk in a server.

Elasticity

The ability to automatically add or remove resources in near real time to match changing demand.

ExpressRoute

A private, dedicated connection between on-premises infrastructure and Azure that bypasses the public internet.

GRS

Geo-redundant storage — copies in a paired region to survive a regional outage.

GZRS

Geo-zone-redundant storage — zone redundancy plus a paired-region copy; the highest durability.

High availability

Designing a service to remain operational with minimal downtime, commonly by spreading across availability zones.

Hybrid cloud

A mix of public and private cloud that lets data and applications move between them for flexibility and compliance.

IaaS

Infrastructure as a Service — virtualized compute, storage, and networking where the customer manages the OS and above (e.g., Azure Virtual Machines).

Infrastructure as code

IaC — defining and deploying infrastructure declaratively through files such as ARM templates or Bicep.

Log Analytics

An Azure Monitor tool for writing and running queries against collected log data.

LRS

Locally redundant storage — three copies in a single datacenter; lowest cost and durability.

Management group

A container above subscriptions used to apply governance across many subscriptions at once.

Microsoft Cost Management

Tools to monitor, allocate, and optimize Azure spend with analysis, budgets, and alerts.

Microsoft Defender for Cloud

A tool for cloud security posture management and workload protection, with a secure score and threat detection.

Microsoft Entra ID

Microsoft's cloud identity and access management service (formerly Azure Active Directory).

Microsoft Purview

A unified data governance service to discover, catalog, classify, and manage data across an estate.

Multifactor authentication

MFA — requiring two or more verification factors to sign in for stronger security.

Network Security Group

An NSG — a set of inbound and outbound rules that allow or deny traffic to Azure resources.

OpEx

Operational expenditure — variable, pay-as-you-go spending on services as they are consumed.

PaaS

Platform as a Service — a managed platform where the provider runs the OS and infrastructure and the customer manages apps and data (e.g., Azure App Service).

Pricing Calculator

A free tool to estimate the cost of an Azure deployment before you build it.

Private cloud

Cloud resources used exclusively by one organization, on-premises or hosted, offering more control at higher cost.

Public cloud

Cloud services owned and operated by a third-party provider and shared across many customers, with no capital expense.

Region pair

Two regions in the same geography paired for disaster recovery and sequential (non-simultaneous) updates.

Reliability

A system's ability to recover from failure and keep functioning, supported by redundant regions worldwide.

Resource

A manageable item in Azure, such as a virtual machine, storage account, or virtual network.

Resource group

A logical container that holds related resources; a resource belongs to exactly one resource group.

Resource lock

A lock that prevents accidental deletion (CanNotDelete) or modification (ReadOnly) of a resource.

Role-based access control

Azure RBAC — granting users, groups, and apps only the access they need by assigning roles at a scope.

SaaS

Software as a Service — finished software delivered over the internet where the customer mainly manages data and access (e.g., Microsoft 365).

Scalability

The ability to add or remove resources to handle growth; scaling up adds power, scaling out adds instances.

Serverless

A model where the provider fully manages the infrastructure and you pay only while your code runs (Azure Functions).

Service-level agreement

An SLA — Microsoft's formal commitment on a service's uptime and performance, expressed as a percentage.

Shared responsibility model

The division of security duties between Microsoft and the customer; what each side owns shifts with the service type (IaaS, PaaS, SaaS).

Single sign-on

SSO — signing in once to access multiple applications without re-entering credentials.

Sovereign region

An isolated instance of Azure for specific compliance needs, such as Azure Government or Azure operated by 21Vianet.

Storage account

A container that holds Azure Storage data — blobs, files, queues, and tables — with a unique namespace.

Subscription

A logical unit of Azure services that sets a billing and access boundary and contains resource groups.

Tag

A name-value pair applied to resources to organize them and group costs for billing and reporting.

TCO Calculator

A tool that compares on-premises costs against Azure to estimate migration savings.

Virtual Machine Scale Set

A group of identical, load-balanced VMs that automatically scale out or in with demand.

Virtual network

A VNet — the fundamental building block for private networking in Azure.

VNet peering

Connecting two virtual networks so resources communicate using private IP addresses.

VPN Gateway

A service that sends encrypted traffic between Azure and an on-premises location over the internet.

Zero Trust

A model that assumes breach, verifies every request explicitly, and uses least-privilege access.

ZRS

Zone-redundant storage — copies across availability zones in one region.

AZ-900 Study Guide FAQ

References

1. 1.Microsoft. “Microsoft Certified: Azure Fundamentals (AZ-900) Study Guide.” learn.microsoft.com. ↑
2. 2.Microsoft. “Microsoft Certified: Azure Fundamentals — Certification Page.” learn.microsoft.com. ↑
3. 3.Microsoft. “Shared responsibility in the cloud.” learn.microsoft.com. ↑
4. 4.Microsoft. “Azure regions and availability zones.” learn.microsoft.com. ↑
5. 5.Microsoft. “Azure Resource Manager — management hierarchy.” learn.microsoft.com. ↑
6. 6.Microsoft. “Azure Storage redundancy.” learn.microsoft.com. ↑
7. 7.Microsoft. “What is Microsoft Entra ID?.” learn.microsoft.com. ↑
8. 8.Microsoft. “What is Azure Policy?.” learn.microsoft.com. ↑
9. 9.Microsoft. “What is Azure RBAC?.” learn.microsoft.com. ↑
10. 10.Microsoft. “What is Microsoft Defender for Cloud?.” learn.microsoft.com. ↑
11. 11.Microsoft. “Azure Monitor overview.” learn.microsoft.com. ↑
12. 12.Microsoft. “Exam duration and exam experience.” learn.microsoft.com. ↑
13. 101.Microsoft. “Describe cloud service types.” learn.microsoft.com, accessed 19 June 2026. ↑
14. 102.Microsoft. “Describe the types of cloud models.” learn.microsoft.com, accessed 19 June 2026. ↑
15. 103.Microsoft. “Azure Functions overview.” learn.microsoft.com, accessed 19 June 2026. ↑
16. 104.Microsoft. “Describe cloud computing.” learn.microsoft.com, accessed 19 June 2026. ↑
17. 105.Microsoft. “Describe the benefits of using cloud services.” learn.microsoft.com, accessed 19 June 2026. ↑
18. 106.Microsoft. “Azure Virtual Machines overview.” learn.microsoft.com, accessed 19 June 2026. ↑
19. 107.Microsoft. “What is Azure Virtual Network?.” learn.microsoft.com, accessed 19 June 2026. ↑
20. 108.Microsoft. “What is Azure ExpressRoute?.” learn.microsoft.com, accessed 19 June 2026. ↑
21. 109.Microsoft. “Introduction to Azure Blob Storage.” learn.microsoft.com, accessed 19 June 2026. ↑
22. 110.Microsoft. “What is Microsoft Cost Management?.” learn.microsoft.com, accessed 19 June 2026. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts