Microsoft AZ-900: Azure Fundamentals through Practical Trade-Offs

AZ-900 is the entry point into Azure infrastructure concepts, yet it is most useful when learners understand why businesses choose cloud services, not just what the services are named. Microsoft's July 20, 2026 outline covers cloud concepts, Azure architecture and services, and Azure management and governance. The exam does not require deep administrator skills, but candidates should distinguish cloud service models, responsibility boundaries, regional design, compute and storage types, networking, identity, cost and monitoring. A correct answer usually follows from recognizing the purpose of a feature and the constraint it is intended to address.

Cloud models shift responsibility, not accountability

Public, private and hybrid clouds describe broad deployment models. Infrastructure as a service, platform as a service and software as a service describe how technical responsibilities are divided between provider and customer. The shared responsibility model is the core principle: the provider manages some underlying layers, while customers still own choices such as data classification, user access and often application security. A managed platform can reduce server maintenance, but it does not authorize a team to upload confidential documents without appropriate protection.

Imagine a startup choosing between operating its own virtual machine for a website and using Azure App Service. The VM offers greater guest-level control but also more direct patching and configuration work. The managed application platform shifts infrastructure operations, yet developers must still secure code and configure identity correctly. The right option depends on workload demands and the team's capacity to manage the service. Azure service choices require identifying who handles patching, identity, backup and capacity under each service model; a label such as IaaS or PaaS does not answer those questions.

Regions and availability zones solve different continuity problems

Azure regions group service locations geographically; availability zones provide distinct fault-isolated locations within supported regions. Region selection can affect data residency, service availability, latency and cost. Deploying a workload in one zone may improve some infrastructure characteristics but does not automatically provide zone redundancy. Likewise, a design spanning two regions still depends on data replication, routing, identity and application failover behavior. At fundamentals level, know which type of failure each design option is intended to address.

A retailer operating in two countries may need to keep customer records within specified jurisdictions while serving websites with acceptable latency. Choose regions based on compliance and business needs, then consider how to survive local equipment failure and broader regional outages. Backups, replication and redundancy are related but not interchangeable. Azure regions, compute and resilience offer concrete examples. The AZ-900 learner should not promise uninterrupted service simply because an application is 'in the cloud'; resilience must be designed and paid for according to a realistic service objective.

Compute services reflect how an application runs

Azure virtual machines provide configurable servers, while App Service, containers and Azure Functions support different deployment and scaling models. Azure Kubernetes Service is appropriate for some container orchestration needs but introduces operational concepts that a simple static website may not require. A function responding to a storage event has a different lifecycle from a continuously running web server. Compute selection affects scaling, control, availability, operating effort and cost. The fundamentals exam emphasizes understanding these distinctions rather than configuring advanced orchestration policies.

For a small nonprofit website, a managed web platform may be easier to operate than a customized VM cluster. A video-processing job that runs only when files arrive might be suited to event-driven execution, depending on runtime requirements. Be able to explain the advantages and limitations rather than assuming serverless always means free or limitless. The later AZ-104 examination asks administrators to implement and manage these resources; AZ-900 establishes the vocabulary and decision model for recognizing when each belongs in a design.

Networks connect resources and enforce boundaries

Virtual networks and subnets organize private address space in Azure. Network security groups can control allowed traffic, while DNS, routing, VPNs, ExpressRoute and load-balancing services fulfill other connectivity roles. A subnet is not automatically secure without intentional access policy. A private endpoint may allow a service to be reached through private addressing, but authorization remains a separate concern. The useful question is which communication path the application needs and what controls are appropriate for that path.

A business application might require public web access but private database access. Separating the frontend and backend reduces exposure, while well-designed routing and DNS ensure authorized connections still work. The terminology of network layers can seem abstract until illustrated through such a workflow. How Azure networking fits together gives that conceptual picture. A learner ready for AZ-900 can identify why a load balancer is not a firewall, why DNS is not authentication and why private network location alone does not authorize someone to read business data.

Storage types and redundancy should match the data

Blob Storage is suited to object data; Azure Files provides managed shares; managed disks support VM workloads. Different redundancy options protect against different failure conditions, while performance and access tiers affect cost and retrieval expectations. A cool or archive access tier can be useful for infrequently used data but inappropriate for a service that needs low-latency access every minute. High durability is not the same as protection against accidental deletion or application-level corruption, so retention and backups still deserve attention.

Consider a media company with active editing assets and years of historical footage. The active material may need rapid access and collaborative workflows; the archive has different retrieval and storage economics. Data classification, lifecycle and recovery requirements should determine the design. Azure storage and durability choices provide an example of how a simple feature selection follows business facts. The deeper AZ-104 role configures storage controls, while fundamentals learners should know which service class and resilience concept fit the problem.

Identity and security must be understood separately

Microsoft Entra ID provides cloud identity capabilities, while Azure RBAC manages access to Azure resources according to assigned roles and scope. Multifactor authentication and conditional access strengthen sign-in controls, but access decisions also depend on permissions inside the relevant service. Encryption in transit and at rest protects data under different threat conditions. Azure Key Vault can manage secrets, keys and certificates, yet using a vault does not eliminate the need to restrict who can retrieve those assets.

An employee who signs in successfully to Azure may still lack permission to manage a virtual machine; an administrator who can configure storage may not be able to read the blobs it contains. Such examples show the difference between identity verification and authorization. Azure identity, access and trust helps ground the concepts. AZ-900 does not require implementing an enterprise security architecture, but it does expect recognition of why controls exist and how the cloud's shared responsibility model affects who must configure them.

Governance, cost and monitoring turn services into operations

Azure Policy can help enforce configuration rules; locks can reduce accidental resource changes; tags can support ownership and reporting. Cost Management and budgets help teams understand consumption, although an alert alone does not stop spending in every scenario. Azure Advisor can surface recommendations, and monitoring tools provide signals about performance and health. Each tool answers a different question. An administrator should not confuse an advisory recommendation with a mandatory policy or a budget notification with an automatic billing cap.

A temporary test environment left running over a weekend may cause unexpected charges. Tags can reveal its owner, a budget can alert on growing expense and automation may schedule or delete resources according to approved rules. The organization still needs someone responsible for the response. At a higher level, AZ-305 incorporates governance and cost into architecture choices, but AZ-900 asks only for a sound conceptual understanding: cloud convenience makes consumption easier, not economically self-managing.

Pricing models also deserve a concrete distinction. Pay-as-you-go consumption can improve flexibility, while reservation or commitment choices may reduce cost for predictable workloads under particular terms. Spot capacity may be inexpensive for interruption-tolerant processing but unsuitable for a critical interactive application requiring continuous availability. Cost estimates should consider data transfer, storage access, backup retention and monitoring, not just compute hours. For AZ-900, the goal is to recognize that cost options are workload-dependent and that a 'low hourly rate' is not the same as a low total operating cost. A sensible comparison includes availability requirements and the practical effort required to manage the solution.

Prepare by explaining a small Azure environment

Draw a simple service: a web application, an identity system, a private database, storage for uploads and monitoring. Explain which components are customer-managed, which are platform-managed and how users connect to them. Add a new requirement such as geographic recovery, restricted public exposure or lower monthly cost. Change the design and explain the tradeoff in ordinary language. This approach connects the cloud concepts, architecture and governance domains that Microsoft's current skills outline actually measures.

Avoid building a study plan entirely around memorizing icons or prices that can change. Know the roles of resource groups, subscriptions, regions, service models, RBAC, network controls and storage options well enough to recognize a sensible use case. Microsoft AZ-104 is a common next step for people who will administer Azure, while AZ-305 serves broader architectural responsibilities later. AZ-900 is most valuable when it gives a learner the vocabulary to ask the right operational questions before the first production resource is deployed.