AZ-900: Azure Fundamentals Exam Prep 2026

Explore cloud computing with Azure, learn about compute, storage, database, and software services, and compare pay-as-you-go cloud options to building an in-house data center.

Contrast capital expenditure and operational expenditure to decide between a high upfront data center investment and the Azure cloud pay-as-you-go model, highlighting upfront costs, monthly costs, and tax implications.

Explore cloud benefits with high availability and scalable growth, driven by Azure SLAs; learn vertical scaling (scale up) and horizontal scaling (scale out) to handle increasing load.

Explore cloud reliability through global distribution, regional replication, and automatic failover to keep services running. Understand predictability with auto scaling, load balancers, and transparent pricing tools.

Azure handles security either fully or partially by service type, with automatic updates and protection against distributed denial of service attacks; governance templates auto-create resources to meet ISO standards.

Explore manageability of cloud resources by distinguishing management of the cloud—automation, auto scaling, templates, alerts, and monitoring—and management in the cloud through Azure portal, command line interface, APIs, and PowerShell.

Compare public cloud, private cloud, and hybrid cloud, detailing ownership, shared hardware, infrastructure control, and cost implications of capital expenditure versus operational expenditure.

Explore the three service types on Azure, focusing on infrastructure as a service, where you rent virtual machines, storage, and networking with full OS control and pay-as-you-go responsibilities.

Explore platform as a service, where Azure fully manages hardware and the operating system, reducing administration while you deploy apps and manage data and security responsibilities.

Explore software as a service, where end applications like Office 365 are accessed via web browser with pay-as-you-go pricing; users configure apps on devices, while the cloud provider handles infrastructure.

Explore the consumption-based model, paying only for storage, reads, writes, or operations by time, per execution, or per operation, with no upfront costs.

Explore cloud fundamentals, including high availability, fault tolerance, scalability and elasticity, plus deployment models like public, private, and hybrid clouds, and the IaaS, PaaS, SaaS spectrum.

Explore how azure regions group data centers and connect them by a low-latency network; availability zones provide redundancy, fault tolerance, and higher availability.

Learn how geo replication across region pairs boosts high availability and reliability by protecting data during regional disasters, while accounting for data residency, regulations, and latency.

Explore sovereign regions in Azure, which are physically isolated from the public cloud, and learn how US government and China regions meet strict compliance through partners and restricted access.

Build understanding of resources as Azure service instances deployed to regions and grouped into resource groups, a management layer for permissions, deletion, and tags.

Learn how to create a resource group, add resources like a storage account, assign a subscription and region, validate names, and manage deployment and deletion of resources and groups.

Learn how subscriptions and management groups organize an Azure account for billing and governance, with resource groups and resources that can move between subscriptions and nested groups for policy application.

Explore how to create and nest management groups within Azure, add subscriptions, and apply inherited policies, security configurations, and cost management across resources.

Explore Azure's global infrastructure—geographies, regions, and availability zones—and the resource hierarchy, including resource groups, subscriptions, and management groups, for data residency, compliance, and redundancy.

Explore Azure compute services to run applications and code in the cloud, covering virtual machines, scale sets, availability sets, Azure virtual desktop, container instances, app services, and serverless functions.

Learn about virtual machines, software simulations of real servers that provide full OS control, as infrastructure as a service, using images to deploy customizable web or database servers in Azure.

Create a virtual machine in the Azure portal by selecting a subscription, resource group, region, image, and size. Note authentication and RDP access, plus basic cost considerations.

Connect to the virtual machine via RDP, set inbound port 3389, and verify it runs; stop to save costs, as storage persists until VM deletion, then delete the resource group.

Learn how availability sets group virtual machines into update and fault domains to prevent downtime inside a data center, and how availability zones extend protection across data centers for SLAs.

Learn to create a resource group and availability set, deploy multiple Windows Server virtual machines in North Europe, and distribute them across full domains and update domains.

Learn how load balancers distribute traffic across virtual machines, routing to healthy, high-capacity servers for higher availability and performance, for public and internal traffic.

Discover how virtual machine scale sets automatically scale identical Azure virtual machines to handle dynamic demand, backed by a load balancer and 99.99% availability.

Enable developers to create and manage development and testing virtual machines with dev test labs, while admins enforce cost control via policies and artifacts like Visual Studio and SQL Server.

Azure Virtual Desktop virtualizes a desktop or selected apps and provides browser access, enabling device, location, and operating system independence with security and no fixed limits on simultaneous user connections.

Explore how Azure App Service provides a platform as a service to deploy and host web apps with managed security, auto scaling, and continuous deployment via Azure DevOps or GitHub.

Create Azure app service, select resource group and a unique web app name, deploy code with dot net seven on Windows, and use the app service editor to add content.

Discover how containers package software and dependencies for microservices, and how Azure container instances provide a fast, platform as a service to run them.

Create an Azure container instance from the portal, choose a resource group and region, deploy a hello world Linux image, monitor metrics, retrieve IP, access app, and delete the instance.

Learn how Azure Kubernetes Service orchestrates, deploys, and scales containers at large scale, offering auto scaling and configurable interactions to simplify management.

Explore Azure virtualization with virtual machines and infrastructure as a service, including scale sets with auto scaling and load balancing, availability in the data center, and Azure Virtual Desktop.

Understand how serverless services let you focus on code by hiding servers, enabling event-driven execution, automatic scaling, and micro billing per execution or compute time.

Learn about Azure Functions, a serverless, fully managed compute service that runs event-triggered code snippets. Use stateful or stateless functions for tasks like file processing or scheduled work across languages.

Create a function app in the Azure portal, configure a resource group, set up a serverless http trigger with anonymous access using dot net, test, and delete to avoid costs.

Explore Azure Logic Apps, a serverless feature to design graphical workflows with triggers, conditions, and automated actions like sending emails or copying files.

Explore the Azure portal's logic apps, create a logic app with a resource group and http trigger, configure a get url and http response using the visual designer and templates.

Azure virtual networks emulate private, isolated cloud networks, define an ip address space, and support scalable subnets, on-premises connectivity, and selective internet access.

Discover how virtual subnets partition a virtual network into public and private segments, allowing cross-subnet communication between a load balancer and private VMs while keeping private resources off the internet.

Demonstrate creating a virtual network and subnets in the Azure portal, assign resources and a virtual machine to the same region and resource group, and review IP addresses.

Learn how VPN gateways enable secure, encrypted site-to-site connections from your Azure VNet to on-premises infrastructure over the public internet, with options for network-to-network connections and express route for bandwidth.

Explore express route, a non-internet connection established via a connectivity provider, offering higher bandwidth, lower latency, and greater reliability than a VPN gateway for extending on-premises networks to the cloud.

Explore how private endpoints enable secure, private connections from a virtual network to resources like databases and storage, using private IPs and service private link.

Learn how the domain name system maps a domain name to an IP address and how Azure DNS provides global, high-availability name resolution with high performance.

Explore how a content delivery network uses edge servers and points of presence to cache and deliver web content worldwide, reducing latency for large files like videos.

Explore virtual networks that isolate and secure cloud and on-premises traffic, using subnets, VPN gateways, express routes, private endpoints with Azure Private Link, and Azure DNS for reliable connectivity.

Discover how a storage account serves as a central hub for blob storage, file shares, queues, and tables, with practical demonstrations on access tiers, redundancy, data transfers, and SQL databases.

Create a storage account by selecting a resource group, naming it uniquely, choosing a region, and setting standard performance with locally redundant storage, then review before deployment.

Compare Azure redundancy options to maximize availability and durability while balancing cost. Learn lrs, zrs, grs, and gzrs, including asynchronous replication and read access to the secondary region.

Explore blob storage, the binary large object service for unstructured, cost-optimized data in an Azure storage account, organized into top-level containers that act like folders for files.

Learn to create and manage containers in a storage account, including naming constraints, uploading files, viewing URLs, adjusting access levels (private to container), and deleting containers.

Control data storage costs by selecting the right azure blob storage access tier, hot, cool, or archive, based on access frequency and operations. Archive requires rehydration and suits long-term backups.

Explore access tiers in Azure blob storage, setting account defaults to hot or cool and managing file tier changes to hot, cool, or archive, with rehydration and cost implications.

Explore queue storage in a storage account to hold large numbers of messages as a backlog, accessed via a simple http url and processed one by one.

Explore Azure Files, a fully managed cloud file share accessible from multiple devices and virtual machines. Mount via SMB or NFS on Windows, macOS, or Linux, replacing on-prem file servers.

Create and configure Azure file shares in a storage account, and organize directories and files. Mount shares on Windows, Linux, or Mac using drive letters and a PowerShell script.

Sync on-premise Windows file servers with Azure Files using file sync to keep data consistent across multiple offices and enable cloud-backed disaster recovery through cached data.

Discover Azure Tables, a NoSQL, non-relational storage option in Azure Storage that stores large amounts of structured data without a schema, using entities with key-value attributes.

Explore Azure Tables in a storage account, create and manage tables with partition and row keys, and optimize queries using indexed properties for faster data filtering via the storage browser.

Storage accounts hold VM disks as blobs, including OS and data disks; use managed disks and choose standard HDD, standard SSD, or premium SSD, noting costs persist when VMs stop.

Discover how to manage your storage accounts locally with Azure Storage Explorer, an app that mirrors the storage browser, signs into your Azure account, and handles blob containers and uploads.

Learn how to use AzCopy, a command-line tool to copy, sync, and move data between Azure storage accounts across regions and subscriptions, using SAS tokens for authentication.

Azure Migrate guides cloud migrations from on-premises to Azure. It discovers servers, databases, OS, and apps, runs dependency analysis, and provides cost forecasts for migration projects in the Azure portal.

Explore Azure Migrate, a service to discover, assess, and migrate on-prem resources to the cloud. Create a migration project in a resource group, import a csv inventory, and review results.

Azure Data Box provides a fast, secure transfer of terabytes to and from Azure using a physical device, shipped via Azure Migrate and uploaded automatically.

Access the Azure marketplace from the Azure portal to find trusted third-party applications. Search by category, ratings and reviews, and create resources for analytics and other services.

Explore Azure storage fundamentals, including blob, file, queue, and table storage, redundancy, access tiers, and migration tools, to optimize data management and cost in cloud solutions.

Learn the crucial difference between authentication and authorization, from verifying identity with passwords and multi-factor authentication to granting access through role-based access control in Azure.

Explore Azure Active Directory, the cloud identity and access management service for authentication and authorization across Microsoft 365, the Azure portal, and guest access.

Explore how to manage Azure Active Directory tenants in the Azure portal, create and switch between tenants, and provision users with role-based access control.

Explore how single sign-on with Azure Active Directory lets you sign in with one set of credentials to access multiple independent software systems, improving security and convenience.

Explore multifactor authentication, adding a second method to password-based login with biometrics, trusted devices, or email codes, and learn why admins should enable this security measure.

Enable and configure per-user multi-factor authentication in Azure Active Directory for Maria, including revoking sessions, resetting passwords, adding a phone verification method, and completing MFA sign-in.

Discover passwordless authentication in Azure AD, leveraging Windows Hello for Business, the Microsoft Authenticator app, and FIDO2 security keys to balance security with user convenience.

Learn how to enable guest access in Azure Active Directory by inviting external users, their redemption and sign-up, and granting them resource access through B2B collaboration in the Azure portal.

Learn how to invite a guest user to Azure Active Directory, send an external invitation, and sign in with a verification code. Explore guest status and on-premise sync flags.

Explore conditional access in Azure Active Directory, using real-time risk signals—user type, device, location, and apps—to decide allow, block, or require multi-factor authentication.

Master role-based access control (RBAC) as the core method to authorize access to resources. Configure security principals, roles, and scope across hierarchies from resource group to subscription.

Demonstrates applying RBAC roles to a user or group by creating a new Azure Active Directory user, Maria, and granting the owner role at the resource group scope, with verification.

Explore zero trust in Azure: assume breach, enforce least privileged access with just-in-time and just-enough, and verify explicitly using device, location, and high-risk user signals.

Deploy defense in depth by layering seven security controls—physical security, identity and access, perimeter, network, compute, application, and data—to hinder attacker movement.

Discover Microsoft Defender for Cloud across cloud and on-prem resources, offering continuous assessment, security posture score, actionable recommendations, and real-time alerts to strengthen CSPM and CWPP pillars.

Access Microsoft Defender for Cloud from favorites or search, review security score and compliance reports, enable workload protections, view inventory and alerts, and address recommendations to improve security posture.

Learn to distinguish authentication from authorization, manage identities with Azure Active Directory, and implement single sign-on, multi-factor and passwordless methods, and role-based access control.