The AZ-900: Microsoft Azure Fundamentals exam is the entry-level certification for anyone starting their cloud computing journey with Microsoft Azure. It's designed for both technical and non-technical candidates — from developers and IT professionals to project managers, business analysts, and sales staff who work with or around Azure services.
Passing AZ-900 earns you the Microsoft Certified: Azure Fundamentals credential, which demonstrates foundational understanding of cloud concepts, Azure services, workloads, security, privacy, pricing, and support. It's not a deep technical exam — you don't need to configure servers or write code — but it does require genuine comprehension of how cloud computing works and where Azure fits in the ecosystem.
AZ-900 is a popular starting point because it has no formal prerequisites, it's accessible to people from diverse backgrounds, and it provides a common vocabulary for cloud conversations across an organization. Many companies require or recommend AZ-900 for employees who interact with Azure environments, even those in non-technical roles, because the credential establishes that everyone on the team understands what the cloud is, what Azure offers, and how to think about cost and governance.
The exam costs $165 USD globally and is offered through Pearson VUE at testing centers and via online proctored delivery. It typically takes 45–60 minutes to complete and consists of 40–60 questions in multiple choice, drag and drop, and short answer formats. You need a score of 700 out of 1000 to pass. Many candidates report finishing in 30–40 minutes with adequate preparation, though the time pressure increases if you're unfamiliar with the Azure portal's terminology and service categories.
One of the most useful aspects of AZ-900 is that it lays groundwork for all subsequent Azure certifications. The Associate-level exams (AZ-104 for administrators, AZ-204 for developers, AZ-305 for architects) assume you understand the foundational concepts covered in AZ-900. Earning AZ-900 first means you spend less time on basics in those more advanced courses.
Microsoft publishes the skills measured for AZ-900 and updates them periodically. Understanding the weightings helps you prioritize your study time. As of 2025, the exam covers three major areas.
The Describe cloud concepts domain covers approximately 25–30% of the exam. This section tests your understanding of what cloud computing is, the key benefits of cloud services (high availability, scalability, elasticity, agility, disaster recovery, economies of scale), and the differences between shared responsibility in the cloud. You need to understand the three deployment models (public cloud, private cloud, hybrid cloud) and the three service models (IaaS, PaaS, SaaS) well enough to identify examples and appropriate use cases for each.
The Describe Azure architecture and services domain covers approximately 35–40% of the exam and is the largest section.
This tests your knowledge of Azure's global infrastructure (regions, region pairs, availability zones, data centers), core Azure services across compute (Virtual Machines, App Service, Azure Functions, Container Instances, Azure Kubernetes Service), networking (Virtual Networks, VPN Gateway, ExpressRoute, Azure DNS, Load Balancer, Application Gateway), storage (Blob Storage, Azure Files, Azure Queue Storage, Azure Table Storage), and databases (Azure Cosmos DB, Azure SQL Database, Azure Database for MySQL, Azure Synapse Analytics). You don't need to configure these services — but you do need to know what each one is for and when you'd choose it over alternatives.
The Describe Azure management and governance domain covers approximately 30–35% of the exam. This covers cost management (pricing factors, Total Cost of Ownership calculator, Azure Cost Management, pricing calculator), features and tools for managing and deploying Azure resources (Azure portal, Cloud Shell, Azure CLI, PowerShell, Azure Arc, Azure Resource Manager, ARM templates, Bicep), monitoring tools (Azure Advisor, Azure Service Health, Azure Monitor), and compliance and security features (Microsoft Defender for Cloud, Azure Policy, resource locks, Microsoft Purview, Service Trust Portal).
Many candidates over-invest in memorizing Azure service lists and under-prepare for the governance and cost management domain. 30–35% of questions cover topics like Azure Policy, resource locks, cost calculators, and compliance tools — areas that are easy to skip when you're excited about cloud services. Balance your preparation across all three domains.
The cloud concepts domain is foundational — not just for the exam, but for understanding everything else in Azure. Candidates who rush past this section often get confused by governance and architecture questions later because they don't have a solid mental model of what cloud computing actually is.
The shared responsibility model is one of the most tested concepts in this section. In traditional on-premises environments, the customer owns and manages everything. In the cloud, responsibility is divided between Microsoft and the customer, and the division changes depending on the service model. In IaaS, Microsoft manages the physical infrastructure (hardware, datacenter, networking fabric), and the customer manages the operating system, applications, and data.
In PaaS, Microsoft additionally manages the runtime environment and operating system, leaving the customer responsible mainly for the application and data. In SaaS, Microsoft manages nearly everything, and the customer is responsible only for data, user accounts, and access configuration. Getting this model right is essential for security and compliance questions throughout the exam.
The consumption-based model is another critical concept. Traditional IT requires capital expenditure (CapEx) — buying hardware upfront regardless of whether it's fully utilized. Cloud computing primarily uses an operational expenditure (OpEx) model — you pay for what you use, when you use it, with no upfront commitment required for most services. Understanding the CapEx vs OpEx distinction and being able to identify which Azure pricing options correspond to each model (reserved instances = commitment for lower cost; pay-as-you-go = pure consumption) is tested in both the cloud concepts and cost management domains.
High availability, scalability, and elasticity are often confused. High availability means the service remains accessible even when components fail, measured as a percentage of uptime (e.g., 99.9% SLA). Scalability means the system can handle increased load, either by scaling up (adding resources to existing machines) or scaling out (adding more machines). Elasticity goes further — it means the system can automatically scale up or down in response to demand, and scale back down when demand decreases to avoid unnecessary cost. Azure's auto-scaling features implement elasticity.
Infrastructure as a Service (IaaS) provides the fundamental computing resources — virtual machines, storage, and networking — on demand. You manage the OS and everything above it; Azure manages the physical infrastructure.
Platform as a Service (PaaS) provides a managed environment for building, testing, and deploying applications. Azure manages the infrastructure and OS; you focus on application code and data.
Software as a Service (SaaS) delivers fully managed applications over the internet. Users access the software via a browser or app; the provider manages everything else.
The Azure services domain is broad, but the exam tests at the conceptual level rather than requiring configuration knowledge. For most services, you need to know the purpose, the category it belongs to, and when you'd use it versus alternatives.
Azure's global infrastructure is organized into regions (geographic areas containing one or more datacenters), region pairs (two regions within the same geography paired for replication and disaster recovery), and availability zones (physically separate locations within a region, each with independent power, cooling, and networking). Virtual machines and other resources can be deployed across availability zones to achieve high availability — if one zone goes down, resources in the other zones continue running.
In compute services, the key distinctions are: Azure Virtual Machines (VMs) offer maximum control and flexibility for workloads requiring a specific OS or software — these are IaaS. Azure App Service is a PaaS platform for hosting web apps and APIs without managing servers. Azure Functions is serverless compute that runs event-triggered code without provisioning any infrastructure. Azure Container Instances and Azure Kubernetes Service (AKS) run containerized workloads, with AKS providing full orchestration for complex microservices architectures.
In networking, Virtual Networks (VNet) provide isolated private networks in Azure. VNet peering connects two VNets. VPN Gateway creates encrypted connections between on-premises networks and Azure over the public internet. ExpressRoute creates a private, dedicated connection from on-premises to Azure that doesn't travel over the public internet — it's more reliable, lower latency, and higher throughput than VPN, but more expensive. Azure Load Balancer distributes traffic across backend pool instances. Application Gateway provides layer-7 load balancing with WAF (Web Application Firewall) capabilities.
In storage, Azure Blob Storage handles unstructured data like images, videos, and backups — accessed via URL or SDK. Azure Files provides managed file shares accessible via SMB protocol, useful for lift-and-shift of on-premises file server scenarios. Azure Queue Storage provides message queuing for asynchronous communication between application components. The storage tier options (Hot, Cool, Cold, Archive) trade access speed for cost — Hot for frequent access, Archive for data that's rarely retrieved but must be retained.
Virtual Machines (IaaS, max control), App Service (PaaS, web/API hosting), Azure Functions (serverless, event-driven), AKS (Kubernetes container orchestration), Container Instances (single container, no orchestration needed).
Virtual Network (isolated private cloud network), VPN Gateway (encrypted tunnel to on-premises over internet), ExpressRoute (private dedicated circuit, no public internet), Load Balancer (layer 4), Application Gateway (layer 7 + WAF).
Blob Storage (unstructured data, images, video, backups), Azure Files (SMB file shares for lift-and-shift), Queue Storage (async message queuing). Tiers: Hot, Cool, Cold, Archive — lower access = lower storage cost.
Azure SQL Database (managed SQL Server), Azure Cosmos DB (globally distributed NoSQL, multi-model), Azure Database for PostgreSQL/MySQL (open-source managed). Azure Synapse Analytics for large-scale analytics workloads.
The management and governance domain accounts for 30–35% of the exam and is frequently under-studied. Understanding Azure's governance tools is critical for both the exam and for any real-world Azure role.
Microsoft Entra ID (formerly Azure Active Directory) is Azure's identity and access management service. It manages user identities, authentication, and authorization for Azure resources and Microsoft 365. Conditional access policies, MFA, and role-based access control (RBAC) are Entra ID features that appear frequently in AZ-900 questions.
Role-Based Access Control (RBAC) is how Azure manages permissions. Instead of granting broad access, RBAC assigns specific roles at specific scopes. The four fundamental roles are: Owner (full access including access management), Contributor (create and manage resources, can't grant access), Reader (view resources only), and User Access Administrator (manage user access to resources). RBAC assignments can be made at the management group, subscription, resource group, or individual resource level — the scope determines how broadly the permissions apply.
Azure Policy allows organizations to enforce rules across their Azure environment. Policies can audit, deny, or deploy resources to maintain compliance with organizational standards. For example, a policy might prevent deployment of virtual machines outside approved regions, require specific tags on all resources, or enforce encryption at rest. Azure Blueprints bundles policies, RBAC assignments, and ARM templates into a single package for consistent governance across multiple subscriptions.
Cost management is a major exam focus. The Azure Pricing Calculator estimates costs before you deploy. The Total Cost of Ownership (TCO) Calculator compares on-premises costs to Azure costs to build a business case for migration. Azure Cost Management and Billing provides actual spending data, budgets, alerts, and recommendations for reducing costs. Azure Advisor integrates with cost management and provides personalized recommendations for reliability, security, performance, and cost optimization based on your actual usage patterns.
Most candidates with some IT background need two to four weeks of preparation to feel confident for AZ-900. Candidates with no prior IT or cloud experience should budget four to six weeks. The exam's conceptual nature means you need time to build mental models, not just memorize facts — so spaced repetition and hands-on exploration matter more than total hours studied.
The most effective study approach combines three resources: Microsoft Learn's free AZ-900 learning path, hands-on exploration in a free Azure account, and practice tests. Microsoft Learn covers all exam objectives with structured modules and knowledge checks. The free Azure account (with a $200 credit for 30 days and always-free tier services) lets you explore the Azure portal, create resources, and see how services are organized — spatial familiarity with the portal is genuinely helpful for the exam. Practice tests identify gaps before the real exam and get you comfortable with Microsoft's question style.
If you're preparing in two weeks, spend the first week on Microsoft Learn (cloud concepts and Azure architecture modules), the second week on governance, cost, and security topics, and take practice tests throughout. If you have a month, use the extra time for deeper hands-on exploration — create a virtual machine, deploy an app service, configure a storage account, and explore the Azure Policy and Cost Management portals. The muscle memory from clicking through the portal makes the exam feel more familiar.
John Savill's AZ-900 YouTube series is widely considered the best free video resource and covers all topics with clear diagrams. For those who prefer structured courses, Microsoft's official learning resources on Microsoft Learn are free, comprehensive, and directly aligned to the exam objectives. Paid course platforms offer instructor-led practice and structured Q&A but aren't required to pass — the free resources are sufficient for most candidates.
Practice tests for AZ-900 serve two purposes: they help you identify knowledge gaps early so you can study more efficiently, and they get you comfortable with Microsoft's question formats. Microsoft uses scenario-based questions that often describe a situation and ask which Azure service or feature best addresses the need — these require you to understand the purpose and use case of services, not just their names.
Take your first at the beginning of your preparation, even if you feel unprepared. A cold baseline shows you exactly where to focus. Then take targeted practice sets after each major study topic. In the final two to three days before your exam, take two or three full timed practice tests under exam conditions — 60 minutes, no breaks, no references. This builds the focus and confidence you'll need on exam day.
The free Microsoft practice assessment on Microsoft Learn is the most accurate indicator of your readiness because it uses the same question format and style as the real exam. It's shorter than a full practice exam, but the quality of questions is high. Complete it at least once, review every question regardless of whether you got it right, and read the explanations carefully.
One tip that helps many candidates: create a personal cheat sheet of the services you confuse most often. Azure Load Balancer vs Application Gateway vs Traffic Manager vs Front Door is a common source of confusion — each operates at a different layer with different capabilities. Writing out the distinctions in your own words cements the differences better than re-reading a definition. Review your cheat sheet on the morning of the exam.