AZ-900 is still the most common first step into Azure. It's a fundamentals exam, but it rewards people who understand why services exist, not only what they're called. This guide follows Microsoft's current skills outline (updated July 20, 2026) and flags the places candidates most often get tripped up.
What the exam measures
| Skill area | Weight |
|---|---|
| Describe cloud concepts | 25-30% |
| Describe Azure architecture and services | 35-40% |
| Describe Azure management and governance | 30-35% |
A score of 700 or higher passes.
1. Cloud concepts (25-30%)
Know these cold:
- Shared responsibility model: the provider always owns physical security; you always own your data and identities; everything in between shifts depending on IaaS, PaaS or SaaS.
- Cloud models: public, private, hybrid, and a realistic use case for each.
- Consumption-based pricing: you pay for what you use, with no upfront hardware spend.
- Serverless: you don't manage servers, and you're billed on execution.
- High availability vs scalability vs reliability: three different benefits that exam questions like to blur.
2. Architecture and services (35-40%)
This is the biggest slice, so spend your time here.
Core components: regions, region pairs, availability zones, resource groups, subscriptions and management groups. Be able to draw the hierarchy: management groups contain subscriptions, subscriptions contain resource groups, resource groups contain resources.
Compute and networking: VMs, Virtual Machine Scale Sets, availability sets, Azure Virtual Desktop, containers and Functions. For networking, know VNets, subnets, peering, Azure DNS, VPN Gateway versus ExpressRoute, and public versus private endpoints.
Storage: Blob, Files, tiers (hot, cool, cold, archive) and redundancy:
| Option | What it means |
|---|---|
| LRS | Three copies in one datacenter |
| ZRS | Copies across availability zones in one region |
| GRS | LRS in the primary region plus a copy in a paired region |
| GZRS | ZRS in the primary region plus a copy in a paired region |
Identity and security: Microsoft Entra ID, SSO, MFA, passwordless, Conditional Access, RBAC, Zero Trust, defense in depth and Microsoft Defender for Cloud.
3. Management and governance (30-35%)
This area is where many candidates lose easy points.
- Cost: the pricing calculator, cost management tools and tags.
- Governance: Azure Policy, resource locks and Microsoft Purview.
- Deployment and management: portal, Cloud Shell, CLI, PowerShell, Azure Arc, ARM templates and infrastructure as code.
- Monitoring: Azure Advisor, Service Health, Azure Monitor, Log Analytics and Application Insights.
Pairs that get confused
- RBAC vs Azure Policy: RBAC controls who can do what. Policy controls what resources are allowed to look like.
- Policy vs resource locks: a lock blocks delete or modify operations regardless of role. Policy evaluates configuration.
- Advisor vs Service Health vs Monitor: recommendations, Azure platform incidents affecting you, and your own telemetry.
A 20-minute lab that covers three objectives
With a free account, create a tagged resource group, then lock it:
az group create --name rg-az900-lab --location swedencentral --tags env=lab owner=me
az lock create --name no-delete --lock-type CanNotDelete --resource-group rg-az900-lab
az group delete --name rg-az900-lab # fails while the lock exists
Remove the lock, delete the group, and you've touched resource groups, tags, locks and the CLI.
Study plan
- Read the official skills outline once and mark topics you can't explain.
- Work through the Microsoft Learn learning paths.
- Do the lab above plus a couple of portal walkthroughs.
- Take the free practice assessment and review every wrong answer.
- Try the exam sandbox so the interface isn't a surprise.
Skills outlines change. Check the official AZ-900 study guide before you book.
Which area do you find hardest: the cloud concepts or the governance tools? Let me know in the comments.
Top comments (0)