Microsoft AZ-900: The Azure Fundamentals Exam That Rewards People Who Understand the Cloud, Not People Who Memorized It

AZ-900 is the most underestimated exam in the Microsoft catalog. People hear "fundamentals" and assume it is a vocabulary quiz you can pass by memorizing a list of Azure service names the night before. Then they sit down, face 60 questions in 45 minutes, and discover the exam keeps asking why — why this service and not that one, why this pricing model fits this workload, why this governance control exists at all.

That is the whole exam in one sentence. AZ-900 is not a test of whether you can name Azure services. It is a test of whether you understand what cloud computing actually changes about how organizations buy, build, and govern IT. Once you study with that in mind, the exam gets dramatically easier — and the knowledge is genuinely useful afterward, whether or not you ever touch an Azure portal again.

What AZ-900 actually measures

The exam is 60 questions with a passing score of 700 on a 100–1000 scale, and you get 45 minutes — about 45 seconds per question, so there is no time to reason from scratch on anything you have not already thought through. Microsoft splits it across three domains, and the split tells you where to spend your time:

• Describe cloud concepts (25–30%) — what cloud computing is, the shared responsibility model, cloud models (public, private, hybrid), and consumption-based pricing. This is the conceptual foundation, and it is also where memorizers lose points: the exam asks you to apply the concepts, not recite them.
• Describe Azure architecture and services (35–40%) — the largest domain: core architectural components (regions, availability zones, resource groups), compute, networking, and storage services. Not deep configuration — selection. Which service fits which scenario.
• Describe Azure management and governance (30–35%) — cost management, governance tools like Azure Policy and resource locks, identity and access, and monitoring. The domain most candidates under-study, and the one that most separates pass from fail.

Notice what is missing: there is no domain for clicking through the portal. AZ-900 never asks you to configure anything. It asks you to make the right choice among options, and to explain — by choosing — why that choice is right.

Stop memorizing service names. Start learning trade-offs.

Every AZ-900 candidate makes a list: Virtual Machines, App Service, Functions, Container Instances, Kubernetes Service, Blob Storage, SQL Database, Cosmos DB. The list grows, the exam still fails them, because the exam does not ask "what is Azure Functions?" It asks something like: a company runs a workload that spikes unpredictably twice a day and sits idle the rest of the time — which compute option keeps costs lowest? The answer is serverless, but only if you understand why consumption-based billing beats paying for idle VMs. The service name is the last step of the reasoning, not the first.

Here is a drill that works for every service in the syllabus. For each one, write three sentences: what it is in one line, the workload it is best for, and the workload it is wrong for. Azure Functions: event-driven code that runs without a server; best for sporadic, short tasks; wrong for long-running, always-on workloads. Blob Storage: object storage for unstructured data; best for images, backups, and archives; wrong for a relational database that needs transactions. Do that for twenty services and you have trained the exact muscle the exam grades — choosing between similar-sounding options under time pressure.

The same applies to the architecture concepts. Knowing that availability zones protect against datacenter failure is table stakes. The exam asks which design survives a zone outage, or why a company with strict data-residency rules picks a specific region. Learn each concept as a decision: what risk it removes, what it costs, and what breaks if you skip it.

The shared responsibility model is the exam's favorite trap

If there is one topic that decides more AZ-900 scores than any other, it is the shared responsibility model — and it is the topic most candidates study the shallowest. The model is simple on the surface: Microsoft secures the cloud, you secure what you put in it. The exam's questions live in the gray area between those two halves.

The rule that resolves almost every shared-responsibility question: the more Microsoft manages, the less you manage. On-premises, you own everything. With infrastructure as a service, Microsoft owns the physical datacenter and the hypervisor; you own the operating system, the applications, and the data. With platform as a service, Microsoft takes the OS and runtime too. With software as a service, Microsoft takes almost everything — your remaining responsibility is your data, your user accounts, and who can access what.

Practice by taking a service and sliding it along that spectrum. A virtual machine: you patch the OS. App Service: Microsoft patches the OS, you configure the app. Microsoft 365: Microsoft runs the whole stack, you govern the accounts and the data. Once that slider is intuitive, the exam's responsibility questions answer themselves — and the same thinking carries straight into the governance domain, where Azure Policy, role-based access control, and resource locks are all mechanisms for enforcing who can do what.

Pricing and governance: the 30% most people skip

Candidates love studying services and dread studying pricing and governance, which is exactly backward for AZ-900. The management and governance domain is nearly a third of the exam, and it is the most predictable third: the questions come from a small set of ideas, asked in a small set of ways.

Learn these cold: consumption-based pricing (pay for what you use, and the cost of idle resources), the Total Cost of Ownership calculator and the Pricing calculator (estimate before you commit, compare before you migrate), cost management tools and tags (track spending by department or project), and the difference between capital expenditure and operational expenditure — the single most-tested pricing concept on the exam, because the whole cloud business case rests on it.

On governance, the exam's favorite trio is Azure Policy (enforce rules, like "only deploy to these regions"), resource locks (prevent accidental deletion), and role-based access control (least privilege: give people exactly the access they need, nothing more). Pair each tool with the problem it solves and the mistake it prevents, and the questions become recognition exercises rather than recall exercises.

A two-week plan that actually works

Days 1–3: Cloud concepts. The shared responsibility model, cloud models, and consumption-based pricing. Do not move on until you can explain each concept to a non-technical colleague in plain language — if you cannot explain it, you do not know it well enough for the exam's scenario questions.

Days 4–8: Architecture and services. Work through the core services with the three-sentence drill above: what it is, what it is best for, what it is wrong for. Build a free Azure account and click through the portal once, just to see the services exist — AZ-900 does not test the portal, but seeing a resource group and a storage account makes the abstract concrete.

Days 9–11: Management and governance. Pricing calculators, cost management, Policy, locks, RBAC, and monitoring. This is the driest material and the highest-yield per hour spent. Flashcards actually work here, because the facts are crisp.

Days 12–14: Practice exams and review. Take full timed practice tests under exam conditions — 60 questions, 45 minutes, no pauses, no notes. Review every wrong answer by tracing it back to the domain and the concept, not just memorizing the right letter. Two or three full simulations in this week will tell you honestly whether you are ready, and the pattern in your misses is your remaining study plan.

Exam-day tactics

Forty-five minutes for 60 questions sounds comfortable until the scenario questions start eating the clock. Flag long questions and move on — answer the quick ones first, then return with a fresh brain and a known time budget. Read the last sentence of a scenario question first: it tells you what is actually being asked, and the paragraph above it is often full of distractors.

When two answers both look right, pick the one that fits the concept the question is testing, not the one that sounds most impressive. AZ-900 loves the simplest correct answer: the cheapest option that meets the requirement, the least-privilege access that gets the job done, the governance control that directly addresses the risk. Over-engineering is almost never the exam's answer.

Bottom line

AZ-900 rewards a specific kind of candidate: not the person who memorized the most service names, but the person who understands what the cloud changes — how costs move from capital to operational, how responsibility splits between Microsoft and the customer, and how to pick the right service for a real workload. Study like a decision-maker — trade-offs over lists, scenarios over flashcards, governance over trivia — and the exam stops being a memory contest and starts being a demonstration of something you can actually use.

If you want to test where you stand before exam day, work through realistic AZ-900 practice questions and pay attention to why you miss the ones you miss. The pattern in your misses is your study plan.

Practice the Microsoft AZ-900 exam with free practice questions on Study4Pass.