Microsoft Azure Fundamentals (AZ-900) Study Guide: All Three Domains, Where the Points Are
Last updated October 24, 2026
AZ-900 is Microsoft's true entry point into Azure — no prerequisites, no assumed coding or infrastructure background, built for anyone who needs working cloud vocabulary and a map of Azure's services, whether or not they ever touch the portal day to day. It's also one of the most common "first cloud cert" choices precisely because it tests concepts and terminology rather than hands-on configuration. Here's how it's weighted, what each domain actually covers, and where candidates lose points.
How the exam is weighted
Microsoft publishes an official skills-measured breakdown for AZ-900, and it should directly drive how you allocate study time:
- Describe cloud concepts (25–30%) — what cloud computing actually is, the shared responsibility model, CapEx vs. OpEx, economies of scale, and the differences between public, private, and hybrid cloud.
- Describe Azure architecture and services (35–40%) — the largest domain, by a wide margin. Core architectural components (regions, availability zones, resource groups), compute options (VMs, App Service, containers, Functions), networking, storage, identity, and the main database services.
- Describe Azure management and governance (30–35%) — cost management and budgets, governance tools like Azure Policy and RBAC, monitoring with Azure Monitor and Advisor, and deployment/management tools.
Notice there's no separate "security" domain the way some certifications structure it — security concepts like the shared responsibility model and identity services are folded into the other two domains instead. Architecture and Services carries over a third of the exam by itself, so a candidate who shores up every other domain but skims the service catalog is leaving the single largest block of points on the table.
What each domain actually tests
Describe cloud concepts tests whether you understand cloud computing at the level of "why," not just "what" — why elasticity fits a short-lived workload, why OpEx-style billing appeals to an organization avoiding large upfront purchases, and the shared responsibility model's core idea that security duties shift between provider and customer depending on the service model (IaaS, PaaS, SaaS) rather than disappearing or landing entirely on one side.
Describe Azure architecture and services is where the sheer breadth of Azure's catalog gets tested: knowing that a region pair is two separate regions within the same geography (not two datacenters in one building), picking Azure Files over Blob Storage when a workload needs a mountable file share rather than object storage, and knowing when App Service's simpler managed platform fits better than a bare VM or a full Kubernetes cluster. Identity shows up here too — Microsoft Entra ID (the renamed Azure Active Directory) is tested as the answer to "which service handles authentication," distinct from networking or delivery services like DNS and CDN.
Describe Azure management and governance covers the tools that keep an Azure environment under control once it's running: Azure Policy for enforcing and auditing configuration standards, RBAC for scoping who can do what at the resource, group, or subscription level, and Cost Management's Budgets feature specifically for setting spending thresholds and alerts — a frequently tested distinction from Azure Advisor, which recommends savings but doesn't itself enforce a spending limit.
How long should you study
AZ-900 has no prerequisites and assumes no prior cloud experience, so study time depends mostly on how much general IT background a candidate already has. Candidates with some IT or networking exposure typically prepare in two to four weeks, since much of the content is vocabulary and service-mapping rather than deep technical skill. Candidates entirely new to IT concepts often need five to six weeks to build comfortable familiarity with the terminology before the service-specific content starts to stick.
Where candidates lose points
- Confusing similarly named Azure services. Blob Storage vs. File Storage vs. Queue Storage vs. Table Storage, or App Service vs. a bare VM vs. AKS, are all easy to blur together — the exam relies on that.
- Misreading the shared responsibility model as all-or-nothing. Candidates often pick an answer where the provider or the customer is "always" or "never" responsible for something, when the real answer is that the split varies by service model.
- Underweighting the Architecture and Services domain. At 35–40% it's the single largest block of the exam, and it's also the domain with the most distinct services to keep straight.
- Mixing up governance and monitoring tools. Azure Policy enforces and audits configuration; Azure Advisor recommends optimizations; Azure Monitor collects and analyzes telemetry — three different jobs that get tested as if they were interchangeable.
Why full-rationale practice questions help
AZ-900 leans heavily on "which Azure service does X" recognition, and the fastest way to lose points is picking a plausible-sounding but wrong service name. Full rationale on every option — explaining not just that Azure DNS is wrong for an identity question but what Azure DNS actually does — builds the service-to-purpose map that the real exam is testing, rather than just memorizing which letter went with which question.
Microsoft Azure Fundamentals (AZ-900) - 800 Questions & Answers with Full Rationale — $19.99, instant PDF download with full rationale on every answer.
View the practice questions →If you're building a broader cloud or IT path
AZ-900 pairs naturally with a vendor-neutral networking or security foundation for candidates who want cloud literacy alongside core IT fundamentals: