AZ-900 | Microsoft Azure Fundamentals 2026 - Exam Training

Define core cloud concepts, explore deployment models (public, private, hybrid) and the shared responsibility model, and identify IaaS, PaaS, SaaS use cases and serverless computing for AZ-900.

Explore the five core cloud computing characteristics from NIST—on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service—through Azure, AWS, and GCP, with an infrastructure focus.

Explore how cloud computing replaces traditional data centers with Azure, offering speed and agility, pay-as-you-go pricing, reduced maintenance, scalable storage, and global reach secured by authentication.

Compare public, private, and hybrid cloud models, including pay as you go resources and multi-tenancy, to select the best fit for security, scalability, and cost.

Explore SaaS, IaaS, and PaaS, and compare their responsibilities across on-premises versus cloud models, with practical analogies illustrating who manages apps, data, and infrastructure.

Explore how the IaaS model on Azure enables deploying and managing virtual machines, virtual networks, and SQL Server on VMs, with Azure and customer responsibilities.

Explore platform as a service on Azure, detailing how Azure manages infrastructure while developers deploy apps with services like App Service, Functions, Logic Apps, SQL Database, and Cosmos DB.

Discover serverless on Azure, where you deploy code to a cloud provider and run in response to events without managing servers. Enjoy scalability, reliability up to 99.9%, and pay-per-invocation pricing.

Compare CapEx and OpEx models in Azure, detailing capital investments in data center assets versus pay-as-you-go cloud services and scalable resource usage.

Choose the Azure consumption model to pay only for resources you actually use, enabling scalable capacity, cost transparency, and no upfront investments.

Explore key cloud concepts such as availability, high availability, scalability, elasticity, and agility, and see how redundancy, replication across regions, and auto-scaling enable reliable, scalable Azure services.

Learn fault tolerance and disaster recovery to maintain system continuity in scenarios. Explore replication across regions, load balancing, redundancy, backups, and disaster recovery plans with Azure Site Recovery.

Describe Azure architecture and services overview, including regions, region pairs, availability zones, resource groups, subscriptions, management groups, compute and networking, storage, identity and security, and migration options.

Explore the core architectural components of Azure, from computing, networking, storage, and identity management to regions, availability zones, and sovereign regions, plus resources, resource groups, subscriptions, and management groups.

Explore Azure regions, data centers, and availability zones to understand how geographic areas, physical facilities, and isolated zones ensure high availability and resilient cloud architectures.

Explore Azure regions and region pairs, including the active-passive model, data replication, and failover for high availability. Understand sovereign regions, data sovereignty, and regulatory compliance to deploy resilient, compliant workloads.

Azure resource groups are logical containers that organize related resources into a single management unit, enabling streamlined deployment, monitoring, access control, and unified cost tracking.

Learn to create a resource group in the Azure portal, configure subscription, name, region (Brazil South), and tags, review and download the ARM template, and delete the group.

Azure subscriptions serve as the billing unit for cloud costs. Access resources via the portal, command line interface, or SDKs, and group them into resource groups with pricing tiers.

Create a pay-as-you-go Azure subscription in the portal, set up billing and payment methods, and monitor costs with cost management and invoices after a trial expires.

Explore Azure management groups to organize subscriptions in a hierarchical structure with governance, unified policy enforcement, region restrictions, and inherited Azure RBAC roles across subscriptions.

Explore hands-on creation of Azure management groups to organize subscriptions by environment and department, link and rename subscriptions, export the management group hierarchy, and enforce centralized policy across resources.

Explore Azure compute and networking services, comparing containers, virtual machines, and functions, and learn to deploy apps with web apps, containers, or virtual machines while using virtual networks.

Explore Azure virtual machines as a core IaaS service offering flexible, on-demand computing with Windows or Linux, extensions, and provisioning via portal, CLI, PowerShell, APIs, or IaC.

Explore Azure virtual machines that host Windows, Linux, and other operating systems with pre-configured or custom images, and learn VM naming rules and fqdn for internet access.

Configure the network for an Azure VM by creating a VNet and subnet, attaching a NIC, and applying NSG rules, with options for public IP, load balancer, and VPN connectivity.

Explore how network interfaces connect Azure VMs to a virtual network, where each VM has at least one NIC and multiple NICs enable subnets and traffic routing.

Explore how public IP addresses enable internet access for Azure resources, while private IPs support internal communication in virtual networks and enhance security with subnets, rules, and private endpoints.

Create and access a Windows Server 2019 VM in the Azure portal via RDP, install IIS, host websites, and configure networking and NSG rules for web access.

Explore Azure VM disks and storage options, including standard HDD, standard SSD, premium SSD, and Ultradisk; configure managed disks, VM sizes, scaling, encryption, snapshots, and backups.

Attach a new disk to an Azure VM via the portal, configure its type and size, then partition and format it in Windows Explorer to create drive E.

Create an ubuntu linux vm in the azure portal, login via serial console, then install nginx, verify with curl to 127.0.0.1 and the public IP, and set a DNS name.

Gain secure remote access to Azure virtual machines via Azure Bastion, eliminating public IP exposure and enabling RDP or SSH through the Azure portal with TLS encrypted sessions.

Create a Windows Server VM and provision Azure Bastion within your virtual network to enable secure, browser-based access to the VM without a public IP or VPN.

Azure VM scale sets enable automatic scaling of a cluster of identical virtual machines to meet dynamic workload demands. They simplify management with automatic updates and load balancing.

Distribute your virtual machines across fault domains within an availability set to protect apps from hardware glitches and updates, and use update domains with load balancing to ensure high availability.

Access your full desktop from anywhere with cloud-based Azure Virtual Desktop, supporting multiple operating systems, remote access on any device, centralized management, strong security, and cost savings from hardware reduction.

Explore Azure App Service, a PaaS platform to host and manage web, mobile, and API apps with deployment, auto scaling, integrated Azure services, monitoring, authentication, and hybrid connectivity.

Explore the Azure app service plan as the backbone for hosting web, mobile, API, and logic apps with resource pools, automatic scaling, isolation, and tier options from free to isolated.

Create an Azure app service in the portal by selecting subscription, resource group, unique name, runtime stack, and operating system, then configure the app service plan.

Explore the app service options and features in the portal. Review overview details, deployment center, settings, authentication, monitoring, and Application Insights for your Azure app service plan.

Explore the App Service plan in the Azure portal, reviewing resources, health graphs, scaling options, networking, and diagnostics, along with apps, slots, OS, location, and subscription details.

Publish your website to an Azure app service using ftp, retrieve ftp credentials, configure file transfer with FileZilla, upload site files, and manage deployment by starting, stopping, and deleting resources.

Explore azure container services, including the azure container registry for image storage and replication with RBAC, and learn how containers deploy across app service, AKS, and container apps.

deploy containerized apps quickly with Azure Container Instances, a container group hosting ideal for non-production testing, with restart policies and environment variables configurable via Azure Portal, PowerShell, or Azure CLI.

Explore Azure Kubernetes Service (AKS) as a container orchestration platform that automates deployment, scaling, and monitoring of containerized apps, with seamless Azure service integration and DevOps support.

Explore Azure Kubernetes Service architecture, including virtual network, ingress with nginx, and Azure Load Balancer, optional Kubernetes RBAC, Azure AD identities, Azure Container Registry, Helm, and Azure Pipelines.

Provision an AKS cluster in the Azure portal and configure the initial dev/test Kubernetes setup, including the node pool and manual scaling, then review and create.

Explore the Azure portal to manage an AKS cluster, examine resource groups, and navigate Kubernetes resources (namespaces, deployments, services, ingress) with networking, node pools, and git deployment options.

Deploy a quickstart Azure vote app through the Azure portal, choosing between a basic web app or a docker image, and monitor namespaces, deployments, and services; Reddis is the database.

Deploy a simple HTML site to AKS via the Azure portal using YAML deployment and service, exposed by a load balancer on port 80.

Discover Azure functions, Microsoft's serverless, event-driven compute that runs in the cloud and scales automatically. Learn about runtime configuration, NuGet dependencies, languages, and security with Azure Active Directory and OAuth.

Explore Azure Functions as the serverless, event-driven building block, focusing on triggers such as http, timer, blob, queue, cosmos db, and event grid, and bindings that connect inputs and outputs.

Create an Azure function app with an http trigger in the portal, configure runtime, hosting, storage, and monitoring, then test get and post requests to build a scalable api.

Create a timer-triggered Azure function to run every minute using a cron expression in the portal, with execution-time logging and a test run showing a 202 accepted status.

Azure virtual networks (VNet) create isolated, private cloud networks with customizable subnets and security policies to host VMs, databases, and apps, with flexible internet, other VNets, and on-premises connectivity.

Plan Azure virtual networks and subnets by assessing workload needs, choosing Resource Manager, and allocating non-overlapping IP ranges; configure routes and security with NSGs, firewalls, and DDoS protection.

Practice creating a virtual network (VNet) in the Azure portal, configuring IP addressing and subnets, and enabling optional security features like Azure Bastion, Azure Firewall, and DDoS protection.

Explore configuring an Azure virtual network (VNet) and subnets in the portal, including address space, domain name system, and features like subnet delegation, service endpoints, private endpoints, and peering.

Learn Azure connectivity types across vnet, peering, and vpn, including internet exposure, public ip addresses, load balancers, app service, aks, and hybrid vnet-to-vnet and site-to-site setups.

Explore VNet peering to connect Azure virtual networks across regions and within the same region, enabling private IP communication with low latency and high bandwidth.

Learn to create and peer Azure VNets across regions, deploy Ubuntu VMs in each VNet, and test private connectivity without gateways or public IPs.

Establish VNet peering between East US two and Brazil South to connect two regional VNets. Enable remote traffic and forwarding, and test connectivity with ping between Linux VMs.

Explore how Azure DNS provides a fully managed, highly available, and scalable DNS hosting service. Learn to create DNS zones and records, integrate with Azure resources, and secure access.

Integrate your domain with Azure DNS by creating a DNS zone, configuring parent and child zones, and pointing your registrar to Azure name servers, then add A and TXT records.

Create a virtual network, subnet, and nsg; open ports 80 and 443 and install iis on a vm. Bind the root domain to the vm's 80 IP using Azure DNS.

Securely connect Azure resources to Azure services in the same region through a private route, keeping traffic off the public internet and boosting security and performance.

Explore Azure point-to-site vpn for secure access to Azure resources via IKEv2 tunneling, supporting Windows, Linux, Mac, iOS, Android with Azure Active Directory, Radius, or Azure Certificate authentication.

Explore how site-to-site vpn creates an encrypted tunnel between on-premises networks and an Azure virtual network using ipsec ike, with gateway subnet and local network gateway configurations.

Azure ExpressRoute provides a private, secure link between on-premises networks and Azure, bypassing the public internet for lower latency, higher bandwidth, and greater data control, with connectivity and integration options.

Establish secure, private connections to Azure services with a private endpoint, enabling private link for web apps, AKS, container apps, and more, using the VNet address range.

Explore Azure storage services for cloud data persistence, including blob, tables, queues, and files, with hot, cool, and archive tiers, redundancy, and migration options such as Azure Data Box.

Explore the Azure storage account as a central resource that bundles blob storage, file storage, queue storage, and table storage, with high availability, scalability, and endpoints.

Follow a hands-on walkthrough to create an Azure storage account in the portal, exploring basics, networking, data protection, encryption, and storage services such as blobs, files, queues, and tables.

Explore Azure blob storage, a scalable, durable object storage for unstructured data like documents, images, videos, and audio, with hot, cool, archive tiers, global access, and Azure AD based security.

Understand how Azure redundancy safeguards data by replicating copies across multiple data centers and regions using LRS, ZRS, GRS, RA-GRS, and GZRS.

Explore Azure storage tiers: hot, cool, cold, and archive, to balance cost, access, and performance, with retention rules and tier migration for efficient cloud storage.

Create and manage containers in an Azure storage account, upload images to blob storage, and configure access levels, blob types, and storage tiers.

Explore Azure File Share, a scalable, cross-platform storage service with SMB and NFS support for VMs, web apps, and hybrid deployments, featuring disaster recovery, backups, and cost efficiency.

Create a file share in your Azure storage account, upload photos, and mount it as a Windows 11 drive via PowerShell to access cloud files locally.

Discover Azure queue storage for asynchronous, scalable messaging with retention, at least once delivery, and prioritization across tasks, integration, scheduling, and web app queues.

Create and explore Azure table storage, a NoSQL data store that uses tables to hold semi-structured key-value data for web apps and IoT, with scalable, low-latency access.

Azure Storage Explorer provides a graphical interface to navigate storage accounts, blobs, tables, and queues, while AzCopy enables fast, automated data transfers, synchronization, and scripting for large migrations.

Install Storage Explorer on Windows 11, connect to Azure Storage with a connection string, and navigate and upload blobs, file shares, queues, and tables. Save it as a copy command.

Discover Azure Data Box, a physical data transfer device for migration to Azure, including disc, box, and heavy versions, with encryption and transfer to blob storage, data lake, and files.

Describe Azure identity, access, and security across directory services, authentication methods, and policy controls. Cover external identities, conditional access, RBAC, zero trust, defense in depth, and Defender for cloud.

Explore authentication and authorization in Azure, including Azure AD, certificates and keys, managed identities, and federated authentication. Discover RBAC, ACLs, and service principals for granular access control.

Explore Microsoft Entra ID, a cloud-based identity management service for authentication and authorization. Learn features such as MFA, single sign-on, automatic provisioning, RBAC, SaaS integration, device management, and security reporting.

Create and manage Azure Active Directory tenants, add users, and form groups to control access. Export users to CSV and learn tenant deletion procedures.

Enable single sign-on with Azure AD to access multiple apps without re-entering credentials. Centralize access management with conditional access, MFA, and automatic provisioning to secure corporate apps.

Explore passwordless authentication in Azure, using Microsoft Authenticator, FIDO2 security keys, and Windows Hello to log in without passwords, improving security and user experience while reducing support costs.

Extend Azure Active Directory with a cloud-managed domain service that provides domain controllers and Kerberos/LDAP authentication. Integrate with Azure resources, enable hybrid scenarios, and manage policies without on-premises servers.

Azure AD connect syncs on-premises Active Directory identities and passwords with Azure AD, enabling enhanced single sign-on and a seamless hybrid cloud experience.

Enable conditional access in Microsoft Entra ID to enforce policies that require two-factor authentication, and consider location, time, and device to grant or block access to apps and data.

Enable authentication and identity management for external users with Azure AD B2C, letting customers register, log in, and manage profiles with secure and compliant access.

Explore how Microsoft Entra B2B enables secure collaboration with external partners by inviting them to access specific resources using their own credentials, with centralized access control.

Master how Azure RBAC uses role based access control to assign built in or custom roles to users, groups, service principals, or managed identities, with scope restricting actions to resources.

Learn how to implement Azure role-based access control by creating users in Azure Active Directory, assigning contributor and reader permissions to subscriptions, and validating access to resource groups and resources.

Explore zero trust in Azure, a security model that verifies every user, device, and access request before granting access to resources, using granular authentication, policy-based access control, and continuous verification.

Explore the defense in depth model in Azure, applying multiple security layers—from physical data center security and identity controls to network protection, threat monitoring, data encryption, and updates.

Protect cloud applications and resources with Microsoft Defender for cloud, offering real time detection, threat protection, behavior analysis, and centralized monitoring across Azure, Microsoft 365, and other supported services.

Explore Azure Firewall, a cloud native, fully stateful service that centrally protects Azure networks by routing, inspecting traffic, and applying filtering rules across inbound and outbound traffic.

Protect Azure apps from distributed denial of service attacks by deploying Azure DDoS protection alongside Azure Firewall, Azure Web Application Firewall, Azure Front Door, Azure Application Gateway, and Azure CDN.

Learn how Azure multi-factor authentication adds a second form of verification to protect accounts and resources, using mobile app, verification codes, phone calls, SMS, and hardware tokens.

Securely store secrets, keys, and certificates with Azure Key Vault, a central hardware-backed repository offering strict authentication, RBAC, and hardware or software mode using a hardware security module.

Create an Azure Key Vault to store keys, secrets, and certificates, enable soft delete, manage access with RBAC, and configure networking and private endpoints.

Master azure cost management with pricing calculator, budgets, tags, and TCO insights. Govern resources using Azure Policy, resource locks, and Purview, and monitor deployments with Azure Monitor.