The AZ-900 Microsoft Azure Fundamentals certification is the cleanest on-ramp to the cloud. It's built for anyone who works around Azure but isn't necessarily hands-on with architecture — technical staff finding their footing, but also project managers, business stakeholders, sales teams, and analysts. The exam rewards understanding over implementation: cloud concepts, what Azure's major services do, and how security, governance, pricing, and support fit together. This guide lays out what to focus on and a practical way to think about each topic.
Why AZ-900 is worth your time
Cloud adoption long ago stopped being an infrastructure-team concern. Applications, analytics, AI, security operations, and core business systems are increasingly built on cloud services, and that means a lot of people need a shared vocabulary for how it all works. AZ-900 provides exactly that common language.
Its value is the breadth. Rather than drilling into how to deploy a single virtual machine, it explains why organisations move to the cloud, how Microsoft organises Azure's services, and how cost, security, compliance, and reliability shape real decisions. That perspective is useful whether or not you ever touch the portal in anger — and it's a natural stepping stone toward role-based certifications later.
1. Core cloud concepts
Start with cloud computing in general. You'll want to be comfortable explaining what the cloud is and how it differs from traditional on-premises infrastructure — including the ideas that come up again and again: scalability, elasticity, high availability, disaster recovery, and the shared responsibility model.
One distinction the exam loves is capital expenditure (CapEx) versus operational expenditure (OpEx). On-premises means large upfront spend on hardware, space, and maintenance; the cloud lets you pay for what you use, when you use it. That shift is what gives businesses flexibility when demand spikes or shrinks unpredictably.
You should also know the three service models cold — and crucially, when each one fits:
Infrastructure as a Service
You control the VMs, networking, and storage. Most flexibility, most responsibility. Example: Azure Virtual Machines.
Platform as a Service
Deploy your app; Microsoft manages the servers beneath it. Example: Azure App Service.
Software as a Service
A finished application the provider runs end to end. Example: Microsoft 365.
As you move IaaS → PaaS → SaaS, you hand more management to Microsoft and keep less yourself.
Finally, know the deployment models — public, private, and hybrid. Azure shows up constantly in hybrid scenarios, where on-premises systems connect to cloud services rather than being replaced wholesale.
2. The core Azure services
Azure has hundreds of services, but AZ-900 only asks you to recognise the major categories and know when each is used. Don't try to become an expert in everything — aim to explain the purpose of the headline services in each group.
- Compute — Virtual Machines (full control of the OS), App Service (managed app hosting), Azure Functions (serverless, event-driven), and containers. The skill is knowing why you'd pick a serverless function over a VM, or App Service over either.
- Storage — Blob Storage (unstructured data: images, documents, backups, logs), Azure Files (managed file shares over standard protocols), plus Queue and Table storage. Blob is the one that comes up most.
- Networking — virtual networks and subnets, VPN Gateway, ExpressRoute, Azure DNS, and load balancing. These connect resources securely, distribute traffic, and bridge cloud and on-premises. Knowing when ExpressRoute beats a VPN is a classic exam beat.
- Data & analytics — Azure SQL Database and Cosmos DB, plus Synapse Analytics, Microsoft Fabric, and Azure Databricks. For AZ-900, focus on relational vs non-relational data and the idea that different workloads need different data services.
3. Security, identity, and governance
Security is a heavy slice of the exam. Anchor it on the shared responsibility model: Microsoft secures the cloud platform itself, while you remain responsible for your data, identities, access, and configuration — with the exact split depending on whether you're using IaaS, PaaS, or SaaS.
Three pieces work together, and the exam likes to test that they're related rather than isolated:
Identity controls who gets in, RBAC controls what they can do, and policy controls the rules the whole environment must follow.
- Microsoft Entra ID is the heart of identity and access — authentication, single sign-on, multifactor authentication, conditional access, and RBAC. Remember that identity is usually the first security boundary in the cloud.
- Role-Based Access Control (RBAC) assigns permissions to users, groups, service principals, or managed identities, following the principle of least privilege — only the access needed to do the job.
- Governance tools include Azure Policy (enforce standards like allowed regions or mandatory tags), resource locks (prevent accidental deletion or change), and Microsoft Purview plus the compliance offerings and Trust Center for privacy and regulatory needs.
4. Pricing, cost management, and support
Expect questions on how Azure billing works. Costs are driven by resource type, how long you run things, region, storage consumed, bandwidth, licensing, and your support plan. Just as important is knowing the tools that estimate and control spend:
Pricing Calculator
Estimate the cost of Azure services before you deploy them.
TCO Calculator
Compare the cost of on-premises infrastructure against Azure.
Cost Management
Monitor, analyse, and optimise your actual Azure spend.
Budgets & alerts
Notify teams when spending approaches a defined threshold.
Two calculators to plan, plus Cost Management and budgets to keep real spend in check.
Round it out with service level agreements (SLAs) — Microsoft's availability commitment for a service. Higher availability usually means designing for redundancy across availability zones or regions. And know the support plans: from free documentation and community support up to paid tiers with faster response times and dedicated technical help.
How to prepare
The most effective prep pairs concepts with a little hands-on exploration. Work through the official Microsoft Learn AZ-900 paths, then poke around the Azure portal to see how services are grouped — even light exposure makes the purpose of each service stick. And study scenarios, not definitions: don't just memorise "Functions is serverless," understand when serverless beats a VM or App Service.
A simple plan that works:
- Review cloud concepts and the service models.
- Learn the core compute, storage, networking, and database services.
- Study identity, security, governance, compliance, and monitoring.
- Cover pricing, SLAs, lifecycle, and support options.
- Drill practice questions and circle back to weak spots.
Common mistakes to avoid
- Going too deep. AZ-900 is a fundamentals exam — you don't need configuration steps or deployment scripts. It's about picking the right concept or service for a scenario.
- Skimping on pricing, governance, and support. Many candidates over-invest in compute and storage and then drop easy points on cost management, SLAs, support plans, and compliance. Those topics matter on the exam and in real decisions.
- Treating Entra ID, RBAC, and Policy as separate islands. They're a team: identity decides who gets in, RBAC decides what they can do, and policy sets the rules. Expect questions that hinge on how they combine.
Final takeaway
AZ-900 is a confidence-builder. It gives you a clear, well-rounded picture of cloud concepts, Azure services, security, governance, pricing, and support — the foundation everything else in Azure is built on. Approach it with a structured plan and a focus on real-world scenarios, and it becomes both an easy first certification and a genuine stepping stone toward deeper Azure roles. Learn the why behind each service, and the exam takes care of itself.