AZ-900 · CHEAT SHEET

Microsoft Certified: Azure Fundamentals

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Describe cloud concepts

25–30%

Describe cloud computing

Cloud computing is the delivery of computing services over the internet: virtual machines, storage, databases and networking, plus IoT, machine learning and AI. Because it does not depend on building your own datacenter, you can expand infrastructure quickly, place services close to users and adapt capacity to what you need.
In the shared responsibility model the provider always handles the physical datacenter, network, hosts and infrastructure, while the customer always answers for its data, connected devices, and accounts and identities. Operating systems, network controls, applications and identity and access depend on the service type: IaaS leaves the most to the customer and SaaS the least.
Cloud models define the deployment type. A private cloud is used by a single entity and gives more control at higher cost; a public cloud is run by a third party and open to anyone; a hybrid cloud interconnects public and private. Multicloud means using several public providers, and Azure Arc helps manage all these environments.
Public cloud fits when you want to scale without capital expenditure, provision and deprovision quickly and pay only for what you use. Private cloud fits when you need complete control and data that is not shared with other tenants. Hybrid cloud lets you choose where each service runs and absorb temporary spikes with public resources.
The cloud runs on a consumption-based model: you pay for the resources you use and nothing more, and release them when done. This makes it operational expenditure (OpEx) rather than capital expenditure (CapEx), avoids upfront hardware costs and idle capacity, and lets you add or remove resources to follow real demand.

Describe the benefits of using cloud services

High availability seeks maximum availability despite disruptions, and Azure offers uptime guarantees that vary by service and are set out in SLAs. Scalability lets you adjust resources to demand and avoid overpaying. Vertical scaling changes the CPU or RAM of a resource; horizontal scaling adds or removes instances.
Reliability is the ability of a system to recover from failures and keep functioning; the cloud decentralized design, with resources in regions around the world, supports it. Predictability can be about performance (autoscaling, load balancing, high availability) or cost (real-time tracking, data analytics and the Azure Pricing Calculator).
Templates help deployed resources meet technical and regulatory standards, and they can be updated at scale when those standards change. Cloud-based auditing flags resources that are out of compliance with the baseline and offers mitigation strategies. With IaaS the customer controls the operating system and patches; with PaaS or SaaS they can be applied automatically. The customer always keeps its data and identities.
Manageability has two sides. Management of the cloud is what the platform does for you: scaling based on need, deploying from templates, monitoring resource health and replacing failing resources, and sending alerts based on metrics. Management in the cloud is how you manage the environment: web portal, command line interface, APIs or PowerShell.

Describe cloud service types

IaaS is the most flexible category: the provider maintains the hardware, internet connectivity and physical security, and you manage the operating system, network and database and storage configuration. It is like renting hardware in a cloud datacenter. Typical scenarios are lift-and-shift migrations and development and test environments. Examples include Azure Virtual Machines and disks.
PaaS is a middle ground between IaaS and SaaS: the provider maintains the infrastructure, operating systems, middleware and development and analytics tools, and you focus on application code, data and access control. You do not deal with operating system licensing or patching. It fits development frameworks and analytics or business intelligence.
SaaS means using or renting a fully developed application, such as email, messaging, productivity tools or expense tracking. It is the least flexible model but the easiest to get running and the one needing the least technical knowledge. The provider manages almost the whole stack; you manage your data, identity and access settings and device access.
The right service type depends on how much control you want to keep. IaaS fits lift-and-shift migrations and development and test environments with full control. PaaS fits development frameworks and analytics or business intelligence tools without managing infrastructure. SaaS fits ready-made applications such as email, messaging, productivity and finance or expense tracking.

2. Describe Azure architecture and services

35–40%

Describe the core architectural components of Azure

An Azure region is a geographical area with at least one datacenter and a low-latency network. Each geography is a data residency boundary. Many regions form a pair with another region in the same geography: one is prioritized for recovery and updates are staggered, but the pair does not provide high availability by itself. Sovereign regions are isolated instances of Azure for legal or compliance reasons.
Availability zones are physically separate datacenters within a region, each with independent power, cooling and networking; regions that support them have at least three. A zone-redundant resource is replicated across zones and Microsoft manages failover; a zonal resource is pinned to one zone and failover is the customer's task. They do not protect against a full-region outage.
An Azure datacenter is a facility with servers in racks and dedicated power, cooling, and networking. Customers do not choose individual datacenters: they are grouped into regions, geographical areas with one or more datacenters linked by a low-latency network. An availability zone is a set of separate datacenters with independent power, cooling, and networking, and a sovereign region is an instance of Azure isolated for legal reasons.
A resource is a manageable item in Azure, such as a virtual machine or a storage account. A resource group is a container for related resources that share a lifecycle: each resource is in only one group, groups cannot be nested, and deleting a group deletes its resources. Its location says where metadata is stored, not where the resources must be.
A subscription is a unit of management, billing, and scale in Azure. It is a billing boundary, because each subscription generates its own reports and invoices, and an access control boundary, useful for separating environments such as development and production. It is linked to a single Microsoft Entra tenant and is not tied to a region: it can contain resources from several.

Describe Azure compute and networking services

Virtual machines are infrastructure as a service: they give total control of the operating system, but the customer handles patching. Containers are lightweight and do not require managing their operating system; Azure Container Instances is the simplest way to run one and Azure Kubernetes Service orchestrates fleets of containers. Azure Functions is event-driven serverless compute, suited to short tasks.
Virtual Machine Scale Sets manage groups of identical, load-balanced machines with automatic scaling. Availability sets spread machines across fault domains (shared power and network) and update domains (maintenance restarts), but do not protect against operating system or application failures. Azure Virtual Desktop delivers Windows desktops and apps from the cloud.
Creating a virtual machine also creates supporting resources: a virtual network, a network interface card that connects it to that network, a private IP address and sometimes a public one, a network security group that manages the allowed traffic, and an operating system disk, with optional data disks. By default they are created in the same resource group, and the location says where the disks are stored.
Virtual machines (IaaS) give the most control over the operating system, but you manage and patch it. Containers are lightweight and do not require you to manage the OS; Container Instances runs them simply and Kubernetes Service orchestrates fleets. App Service hosts web apps, APIs and background jobs without managing infrastructure.
An Azure virtual network isolates resources with a private address space that is divided into subnets. Peering connects virtual networks over the Microsoft backbone. VPN Gateway encrypts traffic over the internet (site-to-site, point-to-site), whereas ExpressRoute gives a private connection through a provider, bypassing the internet. Azure DNS hosts domains and resolves names but does not sell domains.

Describe Azure storage services

Azure Storage includes different services depending on the need: Blob Storage for unstructured data such as video, backups or archiving; Azure Files for SMB or NFS file shares; Queue Storage for asynchronous messaging between components; Table Storage for structured NoSQL data; and Azure Disk Storage for block volumes of virtual machines.
Blob Storage access tiers balance cost and retrieval speed: hot for frequently used data, cool (minimum 30 days) and cold (minimum 90 days) for rarely read data that stays available instantly, and archive (minimum 180 days) for almost unused data, with the lowest cost and retrieval in hours after rehydration. Archive cannot be the account default tier.
Azure Storage always replicates data three times in the primary region: LRS in a single datacenter (the lowest-cost option) or ZRS across three availability zones. GRS and GZRS add asynchronous replication to a distant secondary region, and the RA-GRS and RA-GZRS variants allow reading that copy before a failover.
A storage account provides a unique namespace in Azure; its name, together with each service subdomain (blob, file, queue, table), forms the endpoints. The standard general-purpose v2 type is recommended for most cases. Premium types focus on one use: block blobs for low latency, file shares for high performance, and page blobs.
AzCopy is a command-line utility for copying blobs and files to and from Azure Storage; its synchronization is one-directional. Azure Storage Explorer is a graphical app for Windows, macOS and Linux that uses AzCopy behind the scenes. Azure File Sync keeps a Windows server bi-directionally synced with Azure Files and supports cloud tiering.

Describe Azure identity, access, and security

Microsoft Entra ID is the cloud-based identity and access management service that provides authentication, single sign-on, application management and device management. Microsoft Entra Domain Services is a managed domain with domain join, Group Policy, LDAP and Kerberos/NTLM for legacy apps, with no domain controllers to manage, and it synchronizes one way from Entra ID.
Single sign-on lets users sign in once and reach several trusted apps, but it is only as secure as the initial authenticator. Multifactor authentication combines factors from different categories: something you know, something you have and something you are. Passwordless methods replace the password with a trusted device plus a biometric or PIN, such as Windows Hello for Business, Microsoft Authenticator or FIDO2 keys.
An external identity is a person, device or service outside your tenant. Microsoft Entra External ID offers B2B collaboration, which creates guest users in the directory for partners; B2B direct connect, for Teams shared channels with no directory presence; and customer identity management in an external tenant for consumer-facing apps. The external provider authenticates and your organization authorizes.
Microsoft Entra Conditional Access works as a policy engine: it gathers signals such as user, location, device, application and risk, makes a decision and enforces it. The decision can be to block access or to grant it while requiring, for example, MFA, a compliant device or an approved client app. Policies are enforced after first-factor authentication is completed.
Azure RBAC manages who can do what on Azure resources through role assignments made of a security principal, a role definition and a scope. Scopes are management group, subscription, resource group and resource, and permissions are inherited downward. The model is additive: effective permissions are the sum of the assignments. It supports the principle of least privilege.

3. Describe Azure management and governance

30–35%

Describe cost management in Azure

Azure charges by consumption, and cost depends on resource type, consumption, maintenance, geography, subscription type, and Azure Marketplace. Regions have different prices, and outbound data transfer is billed by zones. Reservations and savings plans lower the cost of predictable workloads; Spot lowers the cost of interruption-tolerant ones.
The Azure pricing calculator estimates the cost of provisioning resources: individual resources, a complete solution, or an example scenario, including compute, storage, and associated network. It is informational only: nothing is provisioned or charged, and prices are estimates. It serves as a baseline for approving budgets before deployment.
Microsoft Cost Management helps analyze, monitor, and manage Azure costs with three elements. Cost analysis shows spending by cycle, region, resource, subscription, or service. Cost alerts include budget, credit, and department spending quota alerts. Budgets set limits and can trigger automation.
Tags are name-value pairs that add metadata to resources and help manage costs, operations, security, governance, and automation. A resource can have one or more. Resources do not inherit tags from their subscription or resource group, and Azure Policy can require or reapply them.

Describe features and tools in Azure for governance and compliance

Microsoft Purview is a family of data governance, risk, and compliance solutions that gives a unified view of on-premises, multicloud, and SaaS data. It offers automated discovery, sensitive data classification, and end-to-end lineage. Its two areas are risk and compliance, and unified data governance.
Azure Policy lets you create, assign, and manage policies that control or audit resources so their configurations meet standards. Policies are grouped into initiatives, are inherited down the scope, also evaluate existing resources, and can prevent noncompliant resources or remediate them automatically, with exceptions possible.
A resource lock prevents resources from being accidentally deleted or changed. Delete allows reading and modifying but not deleting; ReadOnly allows reading only, like the Reader role. Locks apply to resources, resource groups, or subscriptions, are inherited, and apply regardless of RBAC: the lock must be removed before acting.

Describe features and tools for managing and deploying Azure resources

The Azure portal is a unified web console with a graphical interface for creating, managing and monitoring Azure resources, with guided wizards. It offers global search, a portal menu, a contextual service menu and customizable dashboards that can be shared. It is designed for resiliency and updates continuously with no maintenance downtime.
Azure Cloud Shell is an interactive, authenticated, browser-accessible terminal offering a Bash or PowerShell experience. Azure CLI is a cross-platform tool with az commands and Azure PowerShell is the Az module of cmdlets; both can be used interactively or in scripts, installed locally, and used from Cloud Shell without installing anything.
Azure Arc provides a consistent management platform for on-premises, multicloud and edge environments. It projects resources that are not in Azure into Azure Resource Manager so they can be managed as if they ran in Azure: servers and virtual machines, Kubernetes clusters, data services and SQL Server, with tags, access control and Azure Policy.
Infrastructure as code (IaC) defines and deploys infrastructure, such as networks and virtual machines, through a versioned descriptive model that always generates the same environment. It avoids configuration drift, relies on idempotence and favors declarative definitions. On Azure it is implemented with ARM templates or Bicep.
Azure Resource Manager is Azure's deployment and management layer: it authenticates and authorizes requests from the portal, CLI, PowerShell or APIs and forwards them to the right service. It organizes resources into resource groups. ARM templates are declarative, idempotent JSON files, and Bicep is a more concise language converted into a template.

Describe monitoring tools in Azure

Azure Advisor is a digital cloud assistant that analyzes resource configuration and usage telemetry and gives personalized, actionable recommendations. They fall into five categories: reliability, security, performance, cost and operational excellence. They can be filtered and marked as postponed, dismissed or completed.
Azure Service Health combines three services: Azure status, a global view of all Azure services in all regions; Service health, a personalized view of the services and regions you use, with outages, planned maintenance and health advisories; and Resource health, the health of individual resources. Alerts notify you through your chosen channels.
Azure Monitor is the unified observability service that collects, analyzes and acts on metrics, logs and traces. Log Analytics lets you query logs with KQL, alerts notify you proactively through action groups, and Application Insights monitors the performance of live web applications, with tools such as the application map.

Practice this certification