AZ-900 Study Guide

1. Cloud Concepts (25–30% of the exam)

Deployment models

Model	Description
Public cloud	Services over the internet, shared infrastructure, pay-as-you-go
Private cloud	Used by a single organization — more control, higher cost
Hybrid cloud	Public + private together (e.g., via VPN/ExpressRoute)
Multi-cloud	Using more than one public cloud provider

Benefits of the cloud

• High availability — minimal downtime through redundancy
• Scalability — vertical (bigger VM) and horizontal (more VMs)
• Elasticity — automatic scaling to match demand
• Fault tolerance — keeps running despite component failures
• Disaster recovery — data and apps survive regional outages
• Agility — deploy resources in minutes
• Economies of scale — lower costs from shared infrastructure

CapEx vs OpEx

CapEx = upfront spending on physical infrastructure. OpEx = pay-as-you-go operational spending. The cloud shifts you from CapEx to OpEx via the consumption-based model — you pay only for what you use.

Service models & shared responsibility

Model	Example	You manage
IaaS	Azure VMs	OS, apps, data (most control)
PaaS	App Service, SQL Database	Apps, data only
SaaS	Microsoft 365	Data & access only

The provider is always responsible for physical security and the underlying infrastructure. You are always responsible for your data and identities.

2. Core Azure Services (35–40% of the exam)

Compute

Service	What it is
Virtual Machines	IaaS — full control, you patch the OS
App Service	PaaS for web apps/APIs — managed, auto-scaling
Functions	Serverless — event-driven code, pay per execution
AKS / ACI	Kubernetes / serverless containers
Virtual Desktop	Managed Windows desktops & apps

Storage

Service	What it is
Blob Storage	Unstructured data (images, videos, backups) — hot/cool/archive tiers
Files	Managed file shares over SMB/NFS
Disk Storage	VHDs attached to VMs
Queue Storage	Message queues between app components
Table Storage	Key-value NoSQL storage

Databases

Service	What it is
Azure SQL Database	PaaS relational SQL database
Cosmos DB	Globally distributed multi-model NoSQL
SQL on a VM / Managed Instance	IaaS / more compatible SQL options

Networking

Service	What it is
Virtual Network (VNet)	Isolated network with subnets & peering
Load Balancer	Layer 4 (TCP/UDP), regional traffic
Application Gateway	Layer 7 (HTTP) + WAF
VPN Gateway	Encrypted tunnel over the internet
ExpressRoute	Private dedicated connection (not over the internet)
Traffic Manager	DNS-based global routing & failover
DNS	Domain hosting & resolution

Identity & management

• Microsoft Entra ID (formerly Azure AD) — identity, SSO, MFA, Conditional Access
• Resource groups — logical containers; a resource belongs to exactly one
• Management hierarchy: Management groups → Subscriptions → Resource groups → Resources

Monitoring & other services

• Azure Monitor — metrics, logs, alerts
• Service Health — status of services affecting you
• Advisor — recommendations (cost, security, reliability, performance, operations)
• Azure AI Services (pre-built AI APIs — formerly Cognitive Services), Azure OpenAI (GPT models), AI Foundry (build & deploy AI), Machine Learning, IoT Hub, Marketplace

3. Security, Privacy, Compliance & Trust (10–15% of the exam)

Defense in depth

Layers from outside in: Physical → Identity → Perimeter → Network → Compute → Application → Data. Data is the innermost, most protected layer.

Zero Trust (3 principles)

• Verify explicitly — always authenticate and authorize
• Use least privilege — give only the access needed
• Assume breach — segment access and monitor continuously

Key security services

Service	Purpose
NSG	Rules that allow/deny network traffic
Azure Firewall	Managed, centralized firewall
DDoS Protection	Protects against DDoS attacks
Key Vault	Stores secrets, keys, certificates
RBAC	Roles: Owner, Contributor, Reader
Azure Policy	Enforces standards (deny/audit/append)
Blueprints	Packages policy + RBAC + templates
Defender for Cloud	Security posture, secure score, threat protection
Sentinel	SIEM + SOAR — detect & respond to threats
Purview	Data governance, compliance manager, information protection
PIM	Just-in-time privileged access

Compliance

• Service Trust Portal — audit reports & compliance documents (ISO 27001, SOC 2, GDPR…)
• Compliance Manager — compliance score and improvement actions
• Encryption: at rest (default for Azure services) and in transit (TLS/HTTPS)

4. Pricing, SLA & Lifecycle (15–20% of the exam)

Cost factors

• Resource type and size
• Location (region)
• Egress (outbound data transfers are billed; ingress is free)
• Reserved capacity — 1–3 year commitments save up to ~72%
• Azure Hybrid Benefit — reuse existing Windows/SQL licenses

Tools

Tool	Purpose
Pricing Calculator	Estimate cost of a specific Azure solution
TCO Calculator	Compare on-premises vs Azure total cost
Cost Management + Billing	Budgets, alerts, cost analysis
Advisor (cost)	Right-sizing & reserved-instance recommendations
Tags	Organize resources & allocate costs

SLAs

• SLA = Microsoft's uptime commitment; breach → service credits
• Single VM: 99.9% · 2+ VMs in availability set: 99.95% · 2+ VMs across zones: 99.99%
• Composite SLA = multiply the SLAs of dependent services (0.999 × 0.999 ≈ 99.8%)
• Preview features have no SLA — don't use them in production

Support plans

Plan	Best for
Basic (free)	Billing & subscription support only
Developer	Non-production workloads
Standard	Production workloads
Professional Direct	Business-critical, proactive guidance

Lifecycle

• Private preview → Public preview (testable, no SLA) → General Availability (GA) (full SLA & support)
• Microsoft publishes retirement dates for services/features — plan upgrades in advance

5. Azure Management & Governance (30–35% of the exam)

The AZ-900 exam objectives were updated — security, compliance, and pricing topics now live under Azure Management & Governance. Key items:

Topic	What to know
Management groups	Contain subscriptions; policies & RBAC are inherited downward
Resource groups	Logical containers; a resource belongs to exactly one group
Resource locks	CanNotDelete (no deletion) or ReadOnly (no changes)
Tags	Key-value metadata for organization & cost allocation
Azure Policy	Enforces rules with Deny / Audit / Append effects
Blueprints	Packages policy + RBAC + templates for repeatable compliance
ARM templates	Declarative JSON infrastructure-as-code
Azure Arc	Manage on-premises & multi-cloud resources with Azure tools
Azure Automation	Runbooks for scheduled tasks (e.g., stop VMs at night)
Application Insights	Web app performance & dependency monitoring
Log Analytics	KQL queries across all resource logs

6. AI, Copilot & Responsible AI (NEW — January 2026 refresh)

The 2026 AZ-900 refresh added Azure AI Services, Microsoft Copilot, and Responsible AI across all domains. Key things to know:

Service / Concept	What to know
Azure OpenAI Service	Access OpenAI models (GPT, embeddings) as a managed Azure API with enterprise security
Azure AI Foundry	Unified platform to build, evaluate, and deploy AI solutions & custom copilots
Azure AI Services	Pre-built APIs: Vision (image/OCR), Speech (STT/TTS), Language (sentiment/entities), Document Intelligence, Content Safety, AI Search (formerly Cognitive Search)
Microsoft Copilot in Azure	AI assistant that helps manage Azure resources via natural language — assists admins, doesn't replace them
Prompt engineering	Crafting effective prompts to get the desired output from generative AI models
RAG (Retrieval-Augmented Generation)	Grounding a model's answers in your own data by retrieving relevant documents first
Responsible AI (6 principles)	Fairness · Reliability & Safety · Privacy & Security · Inclusiveness · Transparency · Accountability