AZ-900 — Microsoft Azure Fundamentals Quick Reference

Exam identity and study focus

This Quick Reference supports independent review for Microsoft Azure Fundamentals (AZ-900), exam code AZ-900, from Microsoft.

AZ-900 is a fundamentals exam. Expect concept and service-selection questions more than deep configuration. Focus on:

• Cloud concepts: IaaS, PaaS, SaaS, public/private/hybrid cloud, CapEx vs OpEx.
• Azure architecture: regions, availability zones, subscriptions, resource groups, management groups.
• Core services: compute, networking, storage, databases, identity, security, monitoring.
• Governance and cost: Azure Policy, RBAC, locks, tags, pricing tools, SLAs, support, compliance.

Cloud concepts

Cloud benefits and exam meanings

Cloud models

Service models and responsibility

High-yield rule: the customer is always responsible for data, identities, accounts, and access decisions. Microsoft handles more of the stack as you move from IaaS to PaaS to SaaS.

Azure architecture essentials

Core hierarchy

Important distinctions:

• A resource group has a location for metadata, but resources inside it can be in different Azure regions.
• A resource belongs to one resource group at a time.
• RBAC and Azure Policy inherit downward from higher scopes such as management groups, subscriptions, and resource groups.
• Tags do not automatically enforce rules. They help organize, report, automate, and allocate costs.

Regions, availability, and resilience

Common traps:

• Availability zones protect against datacenter-level failures within a region.
• Region pairs support regional recovery planning; you usually do not memorize pair names for fundamentals.
• Backups protect data recovery; they are not the same as high availability.
• A single highly available Azure service can still be part of a low-availability solution if other dependencies are single points of failure.

Compute and application hosting

Compute selection shortcuts

Storage and data services

Azure Storage options

Storage redundancy

High-yield rule: choose ZRS for zone resilience inside a region; choose GRS/GZRS for cross-region disaster recovery patterns.

Database and analytics services

Networking quick reference

Core networking services

Load balancing and traffic routing

Network security distinctions

Identity, access, and security

Identity and access control

High-yield distinction:

• Microsoft Entra ID authenticates identities.
• Azure RBAC authorizes actions on Azure resources.
• Azure Policy enforces resource rules.
• Resource locks prevent deletion or modification.
• These are often combined but answer different questions.

Security services and controls

Security principles to remember:

• Use least privilege with RBAC.
• Use MFA and Conditional Access for identity protection.
• Use managed identities instead of embedded secrets.
• Store secrets in Key Vault, not in source code or app settings when avoidable.
• Use Defense in Depth: identity, network, application, data, monitoring, governance.

Governance and resource management

Policy vs RBAC vs locks vs tags

Exam trap: RBAC says who can do something. Azure Policy says what is allowed or required.

Monitoring, health, and operations

High-yield distinction:

• Azure Monitor is the overall monitoring service.
• Log Analytics is where logs are stored and queried.
• Application Insights focuses on application telemetry.
• Service Health is about Azure service issues that may affect you.
• Resource Health is about a specific resource.

Integration, messaging, AI, and IoT

Messaging and integration

AI and machine learning

For AZ-900, know the purpose and service family. Deep model training details are not usually the focus.

IoT services

Cost management, pricing, and SLAs

Cost tools and decisions

Cost drivers commonly tested:

• Resource type, size, and SKU.
• Region.
• Runtime duration.
• Storage capacity, redundancy, access tier, and transactions.
• Network bandwidth, especially outbound data transfer.
• Licensing.
• Support plan.
• Commitment discounts, reservations, and savings plans.

SLA and availability formulas

If an application depends on multiple independent services, composite availability is lower than each individual service:

\[ \text{Composite availability} = A_1 \times A_2 \times \cdots \times A_n \]

If redundant components can serve the same function and either one can keep the solution available:

\[ \text{Redundant availability} = 1 - (1 - A_1)(1 - A_2) \]

AZ-900-level SLA points:

• An SLA defines Microsoft uptime commitments and possible service credits.
• Higher resilience often requires multiple instances, availability zones, or regional redundancy.
• Preview services typically do not carry the same production commitments as generally available services.
• Composite solutions inherit risk from all critical dependencies.

Support, lifecycle, and compliance

Do not memorize legal rules. Know which Microsoft tools help customers find compliance documentation and manage compliance posture.

Management and deployment tools

High-yield “if the question says…” table

Common traps to avoid

• IaaS does not remove OS responsibility. If you choose VMs, the customer still manages OS patching and configuration.
• Serverless does not mean no servers exist. It means server infrastructure is abstracted from the customer.
• Azure Policy is not permissions. Use RBAC for access, Policy for compliance.
• Locks override ordinary management intent. Even authorized users may be blocked until a lock is removed.
• Tags are metadata, not enforcement. Use Policy if enforcement is required.
• Traffic Manager is DNS-based. It does not sit in the traffic path like a proxy.
• Load Balancer is Layer 4. For HTTP path-based routing, think Application Gateway or Front Door.
• Defender for Cloud and Sentinel are different. Defender improves security posture and workload protection; Sentinel is SIEM/SOAR.
• Backup is not the same as high availability. Backup restores data; HA keeps service running.
• A subscription is not the same as a tenant. Tenant is identity; subscription is billing/resource boundary.
• Resource groups are not folders with nested groups. They are flat lifecycle containers under a subscription.
• Region choice can affect cost, latency, availability, and compliance.

Rapid final-review checklist

Before sitting for AZ-900, be able to answer quickly:

• Which cloud model is public, private, or hybrid?
• Which service model is IaaS, PaaS, or SaaS?
• What does the customer always remain responsible for?
• How do management groups, subscriptions, resource groups, and resources relate?
• When do you choose availability zones versus region redundancy?
• Which compute option fits VMs, web apps, serverless code, workflows, and containers?
• Which storage service fits blobs, files, queues, tables, and disks?
• Which database fits relational SQL, full SQL Server control, open-source relational, and NoSQL?
• Which networking service fits VPN, ExpressRoute, Bastion, NSG, Firewall, WAF, and load balancing?
• Which identity/security tool fits authentication, authorization, secrets, posture management, and SIEM?
• Which governance tool fits policy enforcement, access assignment, locks, and tags?
• Which monitoring tool fits metrics/logs, app telemetry, service incidents, and resource health?
• Which cost tool fits estimates, migration TCO, budgets, recommendations, and actual spend?
• How do composite SLAs change when multiple dependencies are required?

Practical next step

Use this Quick Reference as a service-selection map, then practice mixed AZ-900 scenario questions that force you to choose between similar Azure services, governance controls, monitoring tools, and cost-management options.