What AZ-900 actually proves

AZ-900 is Microsoft’s entry-level Azure certification. It does not test deep administration, scripting, architecture diagrams, or hands-on deployment skills the way AZ-104 or AZ-305 do. It tests whether you understand what Azure offers, when services are used, how cloud concepts work, and how Microsoft handles security, governance, pricing, and support.

This exam is for:

People new to Azure
IT support, sales engineering, project, procurement, and audit roles that touch cloud decisions
Admins from on-premises backgrounds who need Azure vocabulary before moving to associate-level certs
Anyone who needs a foundation before AZ-104, SC-900, AI-900, or DP-900

What the exam feels like:

Mostly conceptual, but not trivial
Heavy on service recognition and choosing the right Azure feature for a stated need
Some questions look simple until two answers sound almost right
Microsoft likes testing whether you know the difference between similar terms: Availability Zones vs Availability Sets, CapEx vs OpEx, Azure Policy vs RBAC, SLA vs support plan, region pair vs Availability Zone

Expect question types such as:

Standard multiple choice
Multiple select
True/false style statement sets
Matching style items
Short scenario questions

You are not expected to memorize PowerShell syntax or portal click paths. You are expected to know the purpose of services like Azure Virtual Machines, App Service, VNets, Blob Storage, Microsoft Entra ID, Azure Policy, Defender for Cloud, Cost Management, and where each fits.

A practical note: with 472 practice questions available on Truekia, you have enough volume to identify weak domains, but only if you map every miss back to an exam objective. Don’t just grind questions.

Cloud concepts: the easiest points, if you study them properly

This domain is foundational and usually the fastest to clean up. Still, people lose points here by assuming the terms are obvious.

Focus on four areas.

1. Cloud models

Know the difference between:

Private cloud: dedicated to one organization, more control, usually higher management burden
Public cloud: Microsoft owns the infrastructure, shared model, rapid scalability
Hybrid cloud: combines on-premises/private and public cloud resources

You should be able to identify when hybrid makes sense:

Regulatory or data residency constraints
Legacy systems that cannot move yet
Gradual migration instead of a big-bang cutover

2. Consumption-based model

This is classic AZ-900 territory.

Understand:

CapEx: upfront capital spending, such as buying servers
OpEx: ongoing operational spending, such as paying monthly for Azure resources
Why cloud shifts many decisions from CapEx to OpEx
Why this matters for scaling, forecasting, and avoiding overprovisioning

3. Shared responsibility model

This appears across security and governance too.

You need to know that responsibility changes depending on the service model:

IaaS: you manage more, including OS, patches, and many configurations
PaaS: Microsoft manages more of the platform, you focus on apps and data
SaaS: Microsoft manages most of the stack, you mainly manage data, users, and configuration

If a question asks who is responsible for the physical datacenter, it is Microsoft. If it asks about data classification or account access, that is still your organization’s job.

4. Benefits of cloud services

Know these cleanly:

High availability
Scalability
Elasticity
Reliability
Predictability
Security
Governance
Manageability

The exam often tests examples, not definitions alone. Example: adding resources to handle increased demand is scaling. Automatically adding and removing resources as demand changes is elasticity.

Also know service types:

IaaS: Virtual Machines, virtual networking, storage
PaaS: App Service, Azure SQL Database
SaaS: Microsoft 365 is the classic example, even though it is outside Azure proper

If you are brand new to cloud, spend enough time here to make the rest of the exam easier. These concepts show up everywhere else.

The Azure services map you need in your head

This is the biggest content area for most candidates. Don’t try to memorize every Azure product. Learn the services Microsoft repeatedly expects in a fundamentals exam.

Start with Azure’s physical and logical structure

Be able to explain:

Regions: geographic areas containing datacenters
Availability Zones: separate physical locations within a region for fault isolation
Region pairs: paired regions within the same geography for disaster recovery considerations
Datacenters: physical facilities, but Microsoft usually tests the region/zone concept above the raw hardware
Subscriptions: billing and access boundary
Management groups: organize multiple subscriptions for governance
Resource groups: logical containers for Azure resources
Resources: actual deployed services like VMs, storage accounts, VNets

Common confusion to fix now:

A resource group is not the same as a subscription
Availability Zones are not the same as Availability Sets
A region pair is not a zone

Compute: know what each service is for

You should be comfortable distinguishing these:

Azure Virtual Machines: full control over OS and software; classic IaaS
Virtual Machine Scale Sets: deploy and manage a group of identical VMs with scaling
Azure App Service: managed platform for hosting web apps, APIs, and background jobs
Azure Container Instances: run containers without managing servers
Azure Kubernetes Service (AKS): managed Kubernetes for orchestrated containers
Azure Functions: serverless, event-driven code execution
Azure Virtual Desktop: desktop and app virtualization

How questions usually frame this:

Need full OS control? VMs
Need to host a web app quickly with less infrastructure management? App Service
Need event-based serverless execution? Functions
Need container orchestration? AKS

Networking: enough to identify the right building blocks

Learn these core services and concepts:

Azure Virtual Network (VNet)
Subnets
Peering
VPN Gateway
ExpressRoute
Azure DNS
Network Security Groups (NSGs)
Azure Firewall
Load balancing options

For load balancing, know the broad role of:

Azure Load Balancer: Layer 4 traffic distribution
Application Gateway: Layer 7, web traffic features, web application firewall support
Traffic Manager: DNS-based traffic distribution across regions/endpoints
Front Door: global entry point for web applications with performance and security features

You do not need architect-level depth, but you do need to recognize the use case.

Storage: this is more testable than many candidates expect

Know the storage options and their purpose:

Blob Storage: object storage for unstructured data
Disk Storage: VM disks
File Storage: managed file shares
Queue Storage: message storage for asynchronous processing
Table Storage: NoSQL key-value store

Also learn storage redundancy options at a high level:

LRS
ZRS
GRS
GZRS

You should understand the tradeoff between cost and resilience, not just the acronyms.

Databases and analytics basics

At fundamentals level, know the purpose of:

Azure SQL Database
Azure Database for MySQL
Azure Database for PostgreSQL
Cosmos DB
Azure Synapse Analytics
Azure Data Factory

The exam may ask which is relational versus globally distributed NoSQL. That is where Azure SQL Database and Cosmos DB often get contrasted.

Identity and directory services

This is central to AZ-900.

Know:

Microsoft Entra ID (formerly Azure AD): identity and access management in Microsoft cloud
Single sign-on (SSO)
Multi-factor authentication (MFA)
Conditional Access at a basic level
External identities / B2B at a high level

Also know the difference between authentication and authorization. Microsoft tests that often because it underpins security and access questions.

Management tools and deployment options

Be familiar with:

Azure Portal
Azure Cloud Shell
Azure PowerShell
Azure CLI
Azure Arc
Azure Resource Manager (ARM) and ARM templates

You are not expected to write templates, but you should know ARM is the management layer and templates support consistent, repeatable deployments.

Security, compliance, and governance: where many people get sloppy

Candidates often underestimate this domain because the terms sound familiar. That is exactly why they miss questions. Microsoft wants you to know which tool handles which control.

Security services you must distinguish

Microsoft Defender for Cloud

Know it as a posture management and security tool that helps identify and improve security across Azure, and in many cases hybrid or multicloud-connected environments. It provides recommendations, secure score concepts, and threat protection capabilities depending on plan and workload.

Microsoft Sentinel

Know it as a SIEM/SOAR solution. If the question is about collecting, analyzing, and responding to security events across sources, think Sentinel.

Azure Key Vault

Used to protect secrets, keys, and certificates.

Network protections

NSGs filter traffic to and from Azure resources at network level
Azure Firewall is a managed network security service with centralized control
DDoS Protection helps defend against distributed denial-of-service attacks

Governance controls: learn the difference, not just the names

This matters a lot.

Role-Based Access Control (RBAC)

Controls who can do what on Azure resources
Based on role assignments
Think permissions and least privilege

Azure Policy

Controls whether resources are compliant with organizational rules
Can enforce standards such as allowed locations, required tags, or permitted SKUs
Think compliance and guardrails

If a question asks how to stop users from creating resources in unapproved regions, that is usually Azure Policy, not RBAC.

Resource locks

Protect resources from accidental deletion or modification
Types include delete lock and read-only lock

Tags

Metadata for organizing and reporting on resources
Often used for cost tracking, ownership, or environment labels

Management groups

Used to apply governance across multiple subscriptions

Compliance and trust topics

At AZ-900 level, you need awareness, not legal mastery.

Know that Microsoft provides:

Compliance offerings aligned to standards and regulations
Privacy and data protection commitments
Documentation through the Service Trust Portal

The Service Trust Portal is specifically worth remembering. If the exam asks where to find Microsoft audit reports, compliance documentation, and trust-related information, that is the answer.

Identity protection basics

You should understand:

Why MFA reduces risk
Why Conditional Access can enforce access conditions based on user, location, device, or risk signals
Why identity is the new control plane in cloud

This domain rewards precision. When you review practice questions, rewrite every missed item as a one-line distinction:

RBAC = permissions
Policy = compliance rules
Locks = accidental change prevention
Key Vault = secrets/keys/certs
Sentinel = SIEM/SOAR
Defender for Cloud = security posture and protection

Cost management, SLAs, and support plans: the business side of Azure

This domain is often ignored because it feels less technical. That is a mistake. Microsoft includes it because Azure decisions are never just technical.

Cost planning and pricing concepts

You need to understand what affects Azure cost:

Resource type
Consumption level
Region
Performance tier
Redundancy option
Licensing model

Know these pricing tools:

Pricing Calculator: estimate future Azure costs before deployment
Total Cost of Ownership (TCO) Calculator: compare on-premises costs with Azure

The exam may ask which tool helps estimate monthly spend for planned Azure resources. That is the Pricing Calculator. If it asks about comparing existing datacenter costs to Azure, think TCO Calculator.

Cost management capabilities

Know the role of:

Microsoft Cost Management
Budgets
Alerts
Tags for chargeback/showback support

At this level, the key is understanding that Azure provides visibility and controls to help monitor and optimize spending.

Support plans

You should know that Microsoft offers different support plans with different response times and scope. You do not need every commercial detail, but you should understand that support level changes based on business needs.

Service Level Agreements

This is one of the few areas where careful reading matters more than memorization.

Know:

What an SLA is: Microsoft’s uptime commitment for a service
That SLA percentages relate to expected availability
That combining services can change overall availability calculations

Also understand the basic implication of downtime percentages. You do not need advanced math, but you should be comfortable with the idea that higher SLA means less permitted downtime.

Service lifecycle terms

Know the difference between:

Public preview
General availability (GA)

Preview services may have limited support or weaker commitments compared with GA offerings. That distinction appears in fundamentals exams more often than people expect.

How to study AZ-900 without wasting time

The right study plan depends on your background. This is not a 10-week exam unless you are extremely new to both IT and cloud.

If you already work in IT infrastructure or Microsoft environments

Time needed: about 1 to 2 weeks, 45 to 90 minutes per day

Suggested order:

Review cloud concepts and service models
Learn Azure core architecture: regions, zones, subscriptions, resource groups
Cover compute, networking, storage, identity
Finish with governance, security, pricing, and support
Use practice questions to patch gaps

Your risk is overconfidence. You will assume Azure names map cleanly to VMware, Active Directory, or on-prem controls. Sometimes they do. Sometimes they don’t.

If you are new to Azure but not new to IT

Time needed: about 2 to 3 weeks, 60 to 120 minutes per day

Use this split:

Days 1-4: cloud concepts and core Azure architecture
Days 5-9: core services by category
Days 10-13: security, compliance, governance
Days 14-16: pricing, support, SLAs
Final days: practice exams and objective-based review

If you are new to cloud and IT both

Time needed: about 3 to 4 weeks, 60 to 90 minutes per day

Do not rush into practice questions on day one. First build vocabulary. Without that, every question becomes a guessing game.

Suggested sequence:

Week 1: cloud concepts, CapEx/OpEx, IaaS/PaaS/SaaS, shared responsibility
Week 2: Azure architecture and core services
Week 3: identity, security, governance, compliance
Week 4: pricing, support, SLAs, then practice sets

Best way to use practice questions

With 472 Truekia questions, you have enough material for pattern recognition.

Use them in three passes:

Pass 1: diagnostic set of 40-60 questions without pressure
Pass 2: domain-based sets after each study block
Pass 3: two or three mixed final sets under timed conditions

Do this after each session:

Log every miss by objective, not by question number
Write the exact distinction you missed
Revisit Microsoft Learn only for those weak points

If you consistently miss questions on pricing tools, that is not a signal to reread all of Azure. It is a signal to fix Pricing Calculator vs TCO Calculator vs Cost Management.

Resources that are actually worth your time

You do not need a huge pile of materials for AZ-900. You need a small set of reliable ones.

Microsoft’s official resources

1. Microsoft Learn: Azure Fundamentals learning path

This should be your primary source because it tracks the exam well and uses Microsoft’s current terminology.

Look for modules around:

Describe cloud concepts
Describe Azure architecture and services
Describe Azure management and governance

2. Official exam skills outline for AZ-900

Always study from the current measured skills page. Microsoft updates wording and emphasis over time.

3. Azure documentation

Use docs selectively for weak topics:

Azure global infrastructure
Azure storage redundancy
Microsoft Entra ID
Azure Policy
Microsoft Defender for Cloud
Cost Management and Billing
Service Trust Portal

Video courses with a strong reputation

John Savill’s AZ-900 content on YouTube is one of the best free resources for understanding Azure clearly and quickly.

Scott Duffy’s AZ-900 course on Udemy is widely used and practical for structured review.

If you prefer instructor-led Microsoft style content, check Microsoft Applied Skills and Learn event sessions, but for AZ-900 the free Learn path plus a respected video course is usually enough.

Books worth considering

For this exam, books are optional. If you learn well from print, use a current Azure fundamentals title from a reputable publisher, but check the publication date carefully because Azure branding and service coverage change fast.

Hands-on practice

AZ-900 is not a lab-heavy exam, but a little portal exposure helps a lot.

Use a free Azure account if available and look at:

Creating a resource group
Browsing VM, App Service, and Storage options
Viewing Microsoft Entra ID in the portal
Reviewing Cost Management screens
Looking at Azure Policy definitions

The goal is familiarity, not deployment expertise.

Practice exams

Use Truekia for volume and repetition, but verify any doubtful item against Microsoft Learn or docs. Fundamentals-level question banks are useful, but some third-party wording can drift from Microsoft’s intent.

A good benchmark before booking the exam:

You can explain every wrong answer, not just the right one
You consistently score around 80-85% or better on mixed sets
You can identify services from short scenarios without relying on memorized keywords

Final 48 hours and the exam appointment itself

In the last two days, stop broad studying. Tighten the seams.

What to review right before the exam

Make one-page notes for these distinctions:

IaaS vs PaaS vs SaaS
Public vs private vs hybrid cloud
Regions vs Availability Zones vs region pairs
Resource groups vs subscriptions vs management groups
VMs vs App Service vs Functions vs AKS
Blob vs File vs Queue vs Table storage
RBAC vs Azure Policy vs resource locks
Defender for Cloud vs Sentinel
Pricing Calculator vs TCO Calculator vs Cost Management
SLA vs support plan
Preview vs GA

If those are clean in your head, the exam becomes much easier.

Microsoft exam-taking advice specific to AZ-900

Read every answer fully. Microsoft likes near-neighbor options.
Watch for absolute words like always, only, and must.
If two answers seem correct, ask which one matches the exact service purpose at fundamentals level.
Do not overthink the scenario. AZ-900 usually wants the most direct fit, not an elaborate design.
Manage time, but don’t rush. This exam is less about speed than careful interpretation.

If you test online

Complete system checks early
Clear your desk and room exactly as instructed
Have ID ready
Join early to avoid check-in stress

If you test at a center

Arrive early
Use the tutorial time to settle down and note a few acronym distinctions mentally

Last honest advice

The hardest part of AZ-900 is not technical depth. It is precision. People fail because they study Azure broadly but not the exam objectives specifically. Stay close to the measured skills. Learn the major services by purpose. Drill the governance and pricing distinctions. Use practice questions to expose confusion, not to memorize answer patterns.

That is enough for this exam. More than enough, if you do it methodically.