Microsoft Certified: Azure Fundamentals (AZ-900) Study Guide
- Time limit
- 45m
- Passing score
- 700/1000
- Governing body
- Microsoft
Microsoft Certified: Azure Fundamentals is a beginner-level credential earned by passing Exam AZ-900, designed to validate a foundational understanding of cloud computing concepts and how they are implemented on Microsoft Azure.
The exam does not assume prior technical experience with Azure or hands-on administration skills. Instead, it checks whether a candidate can talk intelligently about cloud service models, core Azure services, pricing and support, and the basics of governance and compliance. Because of this, AZ-900 is often the entry point into the broader Microsoft Certified: Azure certification ladder, including role-based paths like Azure Administrator, Azure Developer, and Azure Solutions Architect.
Who Should Take It
- IT professionals and students who are new to cloud computing and want a structured way to learn Azure basics
- Sales, marketing, and business stakeholders who work alongside technical teams and need to speak the language of cloud services
- Career changers exploring cloud computing as a specialization before investing in more advanced, technical certifications
From a career standpoint, AZ-900 signals baseline cloud literacy to employers and recruiters. It rarely qualifies someone for a hands-on engineering role on its own, but it is frequently used as a resume differentiator for early-career candidates, a prerequisite step encouraged by employers moving teams to Azure, or a low-risk way to test interest in cloud computing before committing to a specialty track.
AZ-900 is a proctored exam that can be taken online or at a testing center, and it follows the same structural conventions as other Microsoft Fundamentals-level exams.
Format and Timing
- Candidates have 45 minutes to complete the exam itself
- The total seat duration allotted for Fundamentals exams like AZ-900 is 65 minutes, which accounts for check-in, instructions, and the exam period together
- Five minutes are built into the exam time that can be used for an unscheduled break if needed
- Most Microsoft Certification exams, AZ-900 included, typically contain between 40 and 60 questions
Scoring
Exam scores are reported on a scale of 1 to 1,000, and a score of 700 or greater is required to pass. There is no penalty for guessing, so candidates should answer every question rather than leaving items blank.
Retakes
If a candidate does not pass on the first attempt, Microsoft requires a 24-hour waiting period before retaking the exam. For subsequent attempts, a 14-day waiting period applies between each try, and candidates may not take a given exam more than five times within a 12-month period from the first attempt.
Language and Delivery
The exam is offered in 13 languages, including English, Japanese, Chinese (Simplified), Korean, Spanish, German, and French, making it broadly accessible to a global test-taking population.
AZ-900 assesses foundational knowledge across three areas: describe cloud concepts, describe Azure architecture and services, and describe Azure management and governance. Each domain carries a different weight on the exam, and understanding those proportions helps prioritize study time.
Describe Cloud Concepts (25-30%)
This domain covers cloud computing fundamentals, the shared responsibility model, cloud deployment models, the consumption-based pricing model, the benefits of cloud services, and the three main cloud service types: IaaS, PaaS, and SaaS. Expect conceptual questions that test whether you understand the tradeoffs between these models rather than deep Azure-specific configuration details.
Describe Azure Architecture and Services (35-40%)
The largest domain on the exam, this section covers core Azure architectural components, compute and networking services, storage services, and identity, access, and security. Because this is the heaviest-weighted domain, candidates should expect the exam to lean most heavily on recognizing and differentiating specific Azure services and how they fit together.
Describe Azure Management and Governance (30-35%)
This domain covers cost management tools, governance and compliance features, tools for managing and deploying resources, and monitoring tools. It tests whether a candidate understands how organizations control spending, enforce policy, and keep visibility into their Azure environment once resources are running.
Together, the architecture and management domains make up roughly two-thirds of the exam, so candidates who under-prepare on service-specific details tend to struggle even if they have a solid grasp of general cloud theory.
AZ-900 is approachable for most learners within three to four weeks of consistent, part-time study, especially since it does not require hands-on lab experience to pass. The plan below distributes effort according to domain weighting.
Week 1: Cloud Concepts Foundation
Start with the lightest-weighted but conceptually foundational domain. Learn the differences between IaaS, PaaS, and SaaS, understand the shared responsibility model, compare public, private, and hybrid cloud models, and get comfortable with consumption-based pricing. This groundwork makes the Azure-specific material in later weeks easier to absorb.
Weeks 2-3: Azure Architecture and Services
Since this is the largest domain on the exam, give it the most time. Work through core architectural components such as regions, availability zones, and resource groups, then move into compute options (virtual machines, containers, serverless), networking basics, storage tiers, and identity and access management concepts like Azure Active Directory and role-based access control. Use flashcards or spaced repetition to memorize service names and their primary use cases, since the exam frequently tests recognition rather than deep configuration.
Week 4: Management, Governance, and Review
Cover cost management tools, governance and compliance features, deployment and management tools, and monitoring services. Spend the final days of preparation taking full-length practice exams under timed conditions to build comfort with the pacing, then review any domain where practice scores are weakest.
Daily Rhythm
- Short, frequent study sessions tend to outperform infrequent long sessions for memorization-heavy content
- Mix reading with active recall, such as glossary review or practice questions, rather than passive re-reading
- Revisit the domain weightings periodically to make sure study time roughly matches how heavily each area is tested
Before the Exam
- Confirm whether you are testing online or at a physical center well in advance, since online proctoring has its own room and identification requirements
- Arrive or log in early to account for check-in procedures, which are built into the total seat time allotted beyond the actual exam period
- Get a full night of sleep rather than cramming late; recognition-based questions reward a clear head more than last-minute memorization
During the Exam
- Answer every question, since there is no penalty for guessing and unanswered items are automatically scored as incorrect
- Use the built-in break time strategically if you need a moment to reset, rather than rushing through fatigue
- Flag uncertain questions and move on rather than getting stuck, then return to them if time allows
- Watch for questions that test the shared responsibility model or the differences between IaaS, PaaS, and SaaS carefully, since these concepts are easy to mix up under time pressure
Common Mistakes to Avoid
- Treating AZ-900 as purely conceptual and skipping memorization of specific Azure service names, since the architecture and services domain carries the heaviest weight on the exam
- Underestimating the governance and management domain, which many candidates assume is minor but which covers a substantial share of the exam
- Not practicing under timed conditions, which can lead to pacing problems even though the exam is relatively short
- Forgetting that a failed attempt requires a waiting period before retaking, which can delay certification timelines if not planned for
Because the exam favors breadth of recognition over depth of hands-on skill, candidates who combine structured reading with regular practice questions tend to perform more consistently than those who rely on documentation alone.
Because AZ-900 leans heavily on recognizing Azure services, terminology, and conceptual distinctions, the free study tools available on this site map naturally onto how the exam is actually structured.
Practice Questions
Timed practice questions modeled on the exam's domain weightings help build familiarity with question phrasing and pacing before test day. Working through scenario-style questions on cloud service models and Azure architecture is especially useful given how much of the exam falls under those two domains.
Flashcards
Flashcards are well suited to the recognition-heavy nature of this exam, particularly for memorizing which Azure service fits which use case, distinguishing compute and storage options, and reinforcing governance and monitoring tool names that are easy to confuse under time pressure.
Glossary
A glossary of Azure and cloud computing terminology helps candidates who are newer to the subject build a shared vocabulary early, before diving into deeper practice. Terms like shared responsibility model, availability zone, and resource group come up repeatedly, and having a quick reference reduces confusion while studying denser material.
Used together, these resources let a candidate move from unfamiliar terminology to confident recall in a structured way, mirroring the progression from foundational cloud concepts to specific Azure services and governance tools that the exam itself follows.
AZ-900 flashcards
29 cards on the highest-yield terms and rules. Grading uses spaced repetition and saves in this browser.
Browse all 29 cards
What is cloud computing?
The delivery of computing services—such as compute, storage, databases, networking, and analytics—over the internet, letting organizations rent resources instead of owning and maintaining physical infrastructure.
Explain the shared responsibility model.
Security and compliance responsibilities are divided between the cloud provider and the customer. The provider always secures the underlying physical infrastructure; the customer's share of responsibility varies by service type, growing largest in IaaS and smallest in SaaS.
What is IaaS (Infrastructure as a Service)?
A cloud model where the provider supplies virtualized compute, storage, and networking, while the customer manages the operating system, runtime, and applications on top of it.
What is PaaS (Platform as a Service)?
A cloud model where the provider manages the infrastructure and runtime environment, and the customer only manages the application and its data—useful for developers who want to focus on code rather than infrastructure.
What is SaaS (Software as a Service)?
A cloud model where the provider hosts and manages a complete application, and the customer simply uses it, typically through a browser (e.g., Microsoft 365).
What is the consumption-based (pay-as-you-go) model?
A pricing approach where customers pay only for the resources they actually use, rather than paying upfront for fixed capacity—reducing the need for large capital expenditure.
Name the core benefits of cloud services covered on AZ-900.
High availability, scalability, elasticity, agility, fault tolerance, and disaster recovery, along with the shift from capital expenditure (CapEx) to operational expenditure (OpEx).
What is an Azure region?
A geographic area containing one or more datacenters that are networked together with low-latency connections, used to deploy Azure resources close to users.
What is an Availability Zone in Azure?
A physically separate location within an Azure region, each with independent power, cooling, and networking, used to protect applications from datacenter-level failures.
What is an Azure Resource Group?
A logical container that holds related Azure resources for a solution, allowing them to be managed, deployed, and billed together as a unit.
What is Azure Resource Manager (ARM)?
The deployment and management layer for Azure that allows you to create, update, and delete resources through a consistent API, portal, CLI, or template.
What is Azure Virtual Machines?
An IaaS compute service that provisions on-demand, scalable virtual machines running Windows or Linux inside Azure's infrastructure.
What is an Azure Virtual Machine Scale Set?
A service that lets you deploy and manage a group of identical, load-balanced virtual machines that automatically increase or decrease in number based on demand.
What is Azure App Service?
A fully managed PaaS offering for hosting web apps, REST APIs, and mobile back ends without managing the underlying infrastructure.
What are Azure Functions?
A serverless compute service that runs small pieces of event-triggered code on demand, without provisioning or managing servers, and bills based on execution.
What is Azure Virtual Network (VNet)?
The fundamental building block for private networking in Azure, enabling Azure resources to securely communicate with each other, the internet, and on-premises networks.
What is VPN Gateway used for?
It sends encrypted traffic between an Azure virtual network and an on-premises location (or between virtual networks) over the public internet.
What is Azure Blob Storage used for?
Storing large amounts of unstructured object data, such as text or binary files, images, and documents, accessible via HTTP/HTTPS.
Name the Azure Blob Storage access tiers and their purpose.
Hot (frequently accessed data), Cool (infrequently accessed, stored for at least 30 days), and Archive (rarely accessed, stored offline for at least 180 days)—tiers trade off storage cost against access/retrieval cost.
What is redundancy in Azure Storage, and what does LRS mean?
Redundancy replicates data to protect against loss. Locally Redundant Storage (LRS) copies data synchronously three times within a single datacenter in one region.
What is Azure Active Directory (Microsoft Entra ID)?
Microsoft's cloud-based identity and access management service, used to authenticate users and manage access to Azure resources and other cloud applications.
What is Multi-Factor Authentication (MFA)?
A security process requiring users to provide two or more verification methods (such as a password plus a phone prompt) to prove their identity before gaining access.
What is Role-Based Access Control (RBAC)?
An authorization system that grants users only the specific permissions they need by assigning roles at a particular scope, following the principle of least privilege.
What is Azure Defender for Cloud (Microsoft Defender for Cloud)?
A unified security management and threat protection tool that assesses the security posture of cloud resources and provides recommendations to improve it.
What is Azure Cost Management?
A set of tools that help monitor, allocate, and optimize cloud spending, including budgets, cost analysis, and recommendations for reducing waste.
What is Azure Policy?
A governance service that creates, assigns, and enforces rules over resource properties, ensuring resources stay compliant with organizational standards.
What is Azure Advisor?
A free personalized recommendation engine that analyzes resource configuration and usage to suggest ways to improve cost, security, reliability, and performance.
What is Azure Monitor?
A comprehensive platform for collecting, analyzing, and acting on telemetry (metrics and logs) from Azure and on-premises environments to maximize performance and availability.
What is the Service Level Agreement (SLA) in Azure?
A formal commitment from Microsoft specifying the guaranteed uptime/performance level for a service, along with remedies if that level isn't met.
AZ-900 glossary
25 terms the AZ-900 tests, defined in plain English.
- App Service
- A fully managed PaaS platform for building and hosting web apps and APIs without managing servers.
- Availability Zone
- A physically separate location within an Azure region with independent power and networking, used to protect against datacenter failures.
- Azure Files
- A managed cloud file-share service accessible via the SMB protocol, mountable like a traditional network drive.
- Azure Functions
- A serverless compute service that executes small units of code in response to events, billed only for actual execution time.
- Azure Resource Manager (ARM)
- The deployment and management service that underlies all resource creation, updates, and deletion in Azure.
- Blob Storage
- An Azure storage service optimized for storing massive amounts of unstructured object data such as documents and media files.
- Cloud Computing
- The on-demand delivery of IT resources like compute, storage, and networking over the internet with pay-as-you-go pricing.
- Container
- A lightweight, portable package of an application and its dependencies that shares the host operating system kernel.
- ExpressRoute
- An Azure service that provides a private, dedicated network connection between on-premises infrastructure and Azure, bypassing the public internet.
- IaaS
- Infrastructure as a Service; a cloud model providing virtualized compute, storage, and networking while the customer manages the OS and above.
- Management Group
- A container that sits above subscriptions in the Azure hierarchy, used to apply governance controls across multiple subscriptions at once.
- Microsoft Entra ID (Azure Active Directory)
- Microsoft's cloud-based identity and access management service used to authenticate users and control access to resources.
- Multi-Factor Authentication (MFA)
- An authentication method requiring two or more independent proofs of identity before granting access.
- Network Security Group (NSG)
- A set of rules that filter inbound and outbound network traffic to and from Azure resources within a virtual network.
- PaaS
- Platform as a Service; a cloud model where the provider manages the runtime environment so customers can focus only on their application code.
- Redundancy (LRS/GRS)
- Data replication strategies in Azure Storage; LRS copies data within one datacenter, while GRS also copies it to a distant secondary region for disaster protection.
- Region Pair
- Two Azure regions in the same geography linked together so that one can serve as a disaster-recovery target for the other.
- Resource Group
- A logical container in Azure used to group related resources for unified management, deployment, and billing.
- Role-Based Access Control (RBAC)
- An Azure authorization model that grants permissions to users, groups, or applications by assigning roles scoped to specific resources.
- SaaS
- Software as a Service; a cloud model delivering a complete, ready-to-use application managed entirely by the provider.
- Shared Responsibility Model
- The framework describing which security and operational tasks are handled by the cloud provider versus the customer, varying by service type.
- Virtual Machine (VM)
- An emulated, software-based computer running an operating system and applications, provisioned on Azure's IaaS compute service.
- Virtual Machine Scale Set
- An Azure service that manages a group of identical, load-balanced VMs that automatically scale in or out based on demand.
- Virtual Network (VNet)
- The core Azure networking construct that lets resources communicate securely with each other, the internet, and on-premises networks.
- VPN Gateway
- An Azure service that establishes an encrypted connection over the public internet between an Azure VNet and another network.
Sources
- 1.Study guide for Exam AZ-900: Microsoft Azure Fundamentals — Microsoft (accessed Jul 18, 2026)
- 2.Microsoft Certified: Azure Fundamentals certification page — Microsoft (accessed Jul 18, 2026)
- 3.Exam and Applied Skills assessment lab retake policies — Microsoft (accessed Jul 18, 2026)
- 4.Exam duration and exam experience — Microsoft (accessed Jul 18, 2026)
- 5.Exam scoring and score reports — Microsoft (accessed Jul 18, 2026)
Official sources
Primary documents used to verify the exam details shown on this page.
- Study guide for Exam AZ-900: Microsoft Azure FundamentalsMicrosoftlearn.microsoft.com
- Microsoft Certified: Azure Fundamentals certification pageMicrosoftlearn.microsoft.com
- Exam duration and exam experienceMicrosoftlearn.microsoft.com
- Exam and Applied Skills assessment lab retake policiesMicrosoftlearn.microsoft.com
- Exam scoring and score reportsMicrosoftlearn.microsoft.com
Last verified against the official exam content outline: