AZ-900 Study Guide 2026: What the Azure Fundamentals Exam Really Tests

Usman Ghani Chaudhry — Mon, 09 Nov 2026 14:00:00 +0000

AZ-900 is still the most common first step into Azure. It's a fundamentals exam, but it rewards people who understand why services exist, not only what they're called. This guide follows Microsoft's current skills outline (updated July 20, 2026) and flags the places candidates most often get tripped up.

What the exam measures

Skill area	Weight
Describe cloud concepts	25-30%
Describe Azure architecture and services	35-40%
Describe Azure management and governance	30-35%

A score of 700 or higher passes.

1. Cloud concepts (25-30%)

Know these cold:

Shared responsibility model: the provider always owns physical security; you always own your data and identities; everything in between shifts depending on IaaS, PaaS or SaaS.
Cloud models: public, private, hybrid, and a realistic use case for each.
Consumption-based pricing: you pay for what you use, with no upfront hardware spend.
Serverless: you don't manage servers, and you're billed on execution.
High availability vs scalability vs reliability: three different benefits that exam questions like to blur.

2. Architecture and services (35-40%)

This is the biggest slice, so spend your time here.

Core components: regions, region pairs, availability zones, resource groups, subscriptions and management groups. Be able to draw the hierarchy: management groups contain subscriptions, subscriptions contain resource groups, resource groups contain resources.

Compute and networking: VMs, Virtual Machine Scale Sets, availability sets, Azure Virtual Desktop, containers and Functions. For networking, know VNets, subnets, peering, Azure DNS, VPN Gateway versus ExpressRoute, and public versus private endpoints.

Storage: Blob, Files, tiers (hot, cool, cold, archive) and redundancy:

Option	What it means
LRS	Three copies in one datacenter
ZRS	Copies across availability zones in one region
GRS	LRS in the primary region plus a copy in a paired region
GZRS	ZRS in the primary region plus a copy in a paired region

Identity and security: Microsoft Entra ID, SSO, MFA, passwordless, Conditional Access, RBAC, Zero Trust, defense in depth and Microsoft Defender for Cloud.

3. Management and governance (30-35%)

This area is where many candidates lose easy points.

Cost: the pricing calculator, cost management tools and tags.
Governance: Azure Policy, resource locks and Microsoft Purview.
Deployment and management: portal, Cloud Shell, CLI, PowerShell, Azure Arc, ARM templates and infrastructure as code.
Monitoring: Azure Advisor, Service Health, Azure Monitor, Log Analytics and Application Insights.

Pairs that get confused

RBAC vs Azure Policy: RBAC controls who can do what. Policy controls what resources are allowed to look like.
Policy vs resource locks: a lock blocks delete or modify operations regardless of role. Policy evaluates configuration.
Advisor vs Service Health vs Monitor: recommendations, Azure platform incidents affecting you, and your own telemetry.

A 20-minute lab that covers three objectives

With a free account, create a tagged resource group, then lock it:

az group create --name rg-az900-lab --location swedencentral --tags env=lab owner=me
az lock create --name no-delete --lock-type CanNotDelete --resource-group rg-az900-lab
az group delete --name rg-az900-lab   # fails while the lock exists

Remove the lock, delete the group, and you've touched resource groups, tags, locks and the CLI.

Study plan

Read the official skills outline once and mark topics you can't explain.
Work through the Microsoft Learn learning paths.
Do the lab above plus a couple of portal walkthroughs.
Take the free practice assessment and review every wrong answer.
Try the exam sandbox so the interface isn't a surprise.

Skills outlines change. Check the official AZ-900 study guide before you book.

Which area do you find hardest: the cloud concepts or the governance tools? Let me know in the comments.

I'm a sysadmin who built a practice exam site for 57 Microsoft certs. Here's what actually went wrong

Usman Ghani Chaudhry — Sat, 17 Oct 2026 18:45:17 +0000

I've been doing enterprise IT for about 13 years. Exchange migrations, hybrid AD, Intune rollouts, the usual. These days I look after Microsoft 365, Entra and Azure for a company with around 4,000 users.

Every time someone on a team I worked with was studying for an AZ-104 or an MS-102, the same thing happened. They'd find a practice test, do 50 questions, and then ask me why answer C was right. Half the time the "correct" answer was out of date. The other half there was no explanation at all, just a green tick.

So about a year ago I started building my own. That turned into MsCertQuiz. It now covers 57 Microsoft exams with 500 questions each. I'm not a developer by trade, so I learned a lot of this the hard way. Here's the stuff I wish someone had told me.

1. Writing questions is easy. Writing correct ones is not.

The first version of my question bank had problems I didn't notice for weeks. A license name Microsoft had renamed. A PowerShell module that was retired. An answer that was right for Azure AD but not quite right for Entra ID.

What fixed it was treating every question like a change request. Each one now has to point back to a specific Microsoft Learn page, and I run it through more than one model to check it, a local Qwen model on my own GPU plus two hosted ones. If they disagree with each other or with the docs, the question gets flagged and I look at it myself. It's slower, but the number of "this answer is wrong" emails dropped a lot.

2. The explanation is the product

I thought people were paying for questions. They aren't. They're paying to understand why the wrong options are wrong.

If you only explain the right answer, people memorise it. If you explain why the other three fail, they actually learn the concept, and they can handle a question worded differently on exam day. Every question I write now has a sentence or two for each option, not just the correct one.

3. Microsoft retires exams faster than you think

When I started, my list was mostly the classic exams. Now there's a whole new wave of AB- and AI- exams, plus GitHub certs and Fabric. Keeping up is a job in itself. I check exam pages every month and keep a "last reviewed" date on the site, mostly to keep myself honest.

4. Payments and tax ate more time than code

Nobody warned me about this one. About half my customers pay with PayPal instead of card, and as a sole trader in Sweden selling to people across the EU, I have to get VAT right for every country. Stripe Tax handles card payments nicely. PayPal took a lot more manual work. If you're planning to sell a digital product in Europe, sort this out before you launch, not after.

5. Building one more site is tempting

Once the Microsoft site worked, people asked about AWS and CompTIA. So I built CertSharp for multiple vendors (AWS, Cisco, CompTIA and Google Cloud), and later CompCertQuiz focused only on CompTIA, because CompTIA people search for CompTIA, not "IT certs".

Same codebase, same rule: original questions written from the published objectives, never brain dumps. Dumps can get your cert revoked, and they don't teach you anything anyway.

What I'd tell another sysadmin thinking about a side project

Build something for a problem you've watched people struggle with for years. You'll know the edge cases already.
Your ops habits transfer well. Change control, documentation and monitoring work just as well on a side project.
Ship the boring stuff early: billing, tax, password reset, refunds. That's where the support emails come from.

If you're studying for a Microsoft, AWS or CompTIA exam and want to try it, every exam has free questions with no card needed. And if you spot a wrong answer, please tell me. That's genuinely the most useful feedback I get.

Happy to answer questions in the comments, especially about M365 and Entra certs.

DEV Community: Usman Ghani Chaudhry