☁

Azure Fundamentals

Complete certification guide · Exam AZ-900 · Updated July 1, 2026

⏱ 45 min

🎯 700/1000 to pass

♾ No expiry

🔄 Retake after 24h

0/16

Topics Studied

0/48

Cards Mastered

—

Best Quiz Score

Exam Readiness

📐 Key Diagrams

🤝 Shared Responsibility Model

🏢 Azure Scope Hierarchy

🌍 Availability Zones vs Region Pairs

☁️ Cloud Concepts 25–30%

📘 Official Microsoft Learn path for this domain: Describe cloud concepts ↗

🌐What is Cloud Computing?Foundation›

On-demand self-serviceYou can provision compute resources — spin up a VM, create a storage account, deploy a database — at any time, instantly, without calling Microsoft or waiting for anyone to approve it. You do it yourself through the Azure Portal, the CLI, PowerShell, or an API call. No humans on Microsoft's side are involved in your provisioning.
Broad network accessAzure resources are accessible over the internet from any device with a network connection — a laptop, a phone, a tablet, a server in your office. The only requirement is a network and a browser or client app. This is what makes remote work and global teams possible.
Resource poolingMicrosoft owns massive datacenters shared by thousands of customers simultaneously. Your VM runs on the same physical hardware as other customers' VMs — this is called multi-tenancy. You don't know or care which physical machine you're on. Microsoft abstracts the hardware completely. This pooling is what lets Azure keep costs low and scale to meet demand.
Rapid elasticityResources can be scaled up or out almost instantly to handle more demand, then scaled back down when demand drops. From a user's perspective, the cloud looks like it has infinite capacity — you can request 1,000 VMs or 1 petabyte of storage and Azure will accommodate it. You only pay for what you use while you use it.
Measured serviceEverything you use is metered — compute hours, gigabytes stored, network egress, API calls. You're billed precisely for what you consume, like a utility bill for electricity. This enables the consumption-based pricing model and means you never pay for idle capacity.

LearnMS Learn: What is cloud computing? ↗

My Notes

Saved ✓

🤝Shared Responsibility ModelHOT›

Microsoft always ownsNo matter what service you use, Microsoft is always responsible for the physical datacenters (buildings, power, cooling), the physical network hardware, the physical servers, and the hypervisor layer that runs virtual machines. You never touch any of this. If a datacenter burns down, that's Microsoft's problem, not yours.
Customer always ownsRegardless of which service model you use — IaaS, PaaS, or SaaS — you are always responsible for your own data and the information you put into Azure. You are also always responsible for managing user accounts and identities (who has access to what) and for the devices your employees use to access Azure. Microsoft never manages your data or your users for you.
What shifts with IaaSWith IaaS (like Azure VMs), you are responsible for the operating system — patching it, securing it, configuring it. You manage the runtime, middleware, and applications installed on the VM. You also control the network settings and firewall rules inside the VM. This is the most responsibility a cloud customer can have.
What shifts with PaaSWith PaaS (like App Service or Azure SQL Database), Microsoft takes over the OS, the runtime, and the middleware. You only manage your application code and your data. You don't patch the OS or worry about the underlying server configuration. This significantly reduces your management burden.
What shifts with SaaSWith SaaS (like Microsoft 365 or Teams), Microsoft manages everything: the infrastructure, OS, runtime, middleware, and the application itself. You only manage your data (what you put in), your access policies (who can use it), and your user identities. This is the least customer responsibility of any model.
Exam tipThe question "who is responsible for X in Y model?" is extremely common. Draw the line mentally: IaaS = you manage everything above the hypervisor. PaaS = you manage only code and data. SaaS = you manage only data and identities.

LearnMS Learn: Shared responsibility model ↗

My Notes

Saved ✓

🏢Cloud Deployment ModelsMEDIUM›

Public CloudAll infrastructure is owned and operated by Microsoft. You access resources over the internet and share underlying hardware with other customers. There is no upfront capital expense — you pay only for what you use. Anyone with a credit card can sign up. Azure, AWS, and Google Cloud are all public clouds. Best for: most workloads, cost efficiency, rapid deployment.
Private CloudInfrastructure is dedicated exclusively to your organization. It can be physically located in your own datacenter (on-premises) or hosted by a third party, but it is not shared with any other organizations. You get maximum control and isolation, but you pay for all the hardware whether you use it or not. Best for: regulatory requirements, highly sensitive data, organizations that need full control.
Hybrid CloudA combination of public and private cloud (or on-premises). Resources and data can move between the two environments. This is the most common model for large enterprises — for example, keeping customer financial data on-premises for compliance while running the public-facing website in Azure. Azure Arc and Azure VPN Gateway are key technologies that enable hybrid scenarios.
Multi-CloudUsing services from more than one public cloud provider simultaneously — for example, running some workloads in Azure and others in AWS. Organizations do this to avoid vendor lock-in, take advantage of specific services each provider does best, or increase resilience. It adds operational complexity because teams need expertise in multiple platforms.
Exam tipThe key distinguishing factor: Public = shared infrastructure, no CapEx. Private = dedicated infrastructure, maximum control. Hybrid = both together. Multi-cloud = multiple public providers. If a question mentions "keep data on-premises for compliance but run apps in Azure," the answer is Hybrid Cloud.

LearnMS Learn: Cloud deployment models ↗

My Notes

Saved ✓

💰CapEx vs OpEx & ConsumptionHOT›

CapEx (Capital Expenditure)Traditional IT spending where your organization buys and owns physical infrastructure upfront — servers, networking equipment, storage arrays, cooling systems. The cost is large and paid upfront, then depreciated over the useful life of the asset (typically 3–5 years). If you buy more servers than you need, the money is wasted. If you underestimate, you're stuck waiting for procurement cycles. This is how almost all on-premises IT was historically funded.
OpEx (Operational Expenditure)Ongoing expenses for running the business — salaries, rent, software subscriptions, and cloud services. Cloud computing is an OpEx model. You pay a monthly bill for what you actually consumed. There is no asset depreciation, no procurement cycle, and no wasted spend on idle hardware. The full cost is expensed in the current accounting period, which simplifies financial planning.
Consumption-based pricingAzure charges you only for what you use, while you use it. If you shut down a VM, you stop paying for compute (though you still pay for the disk). If you delete a storage account, billing stops immediately. This means you can experiment cheaply, scale instantly without pre-purchasing capacity, and pay predictably based on actual usage patterns rather than forecasts.
Why this matters for the examCloud computing shifts IT spending from CapEx to OpEx. This is one of the fundamental financial arguments for cloud migration. The exam will ask you to identify which model a given scenario represents, or why a company moving to cloud reduces CapEx. The answer framework: buying hardware = CapEx. Paying a monthly Azure bill = OpEx.

LearnMS Learn: Consumption-based model ↗

My Notes

Saved ✓

⚡Benefits of Cloud ServicesCore›

High AvailabilityAzure services come with Service Level Agreements (SLAs) that guarantee a minimum uptime percentage. 99.9% SLA means no more than 8.7 hours of downtime per year. 99.99% means no more than 52 minutes per year. High availability is achieved by deploying resources redundantly — across fault domains, Availability Zones, or regions — so that a single failure doesn't take down your application.
ScalabilityThe ability to add or remove resources to match changing demand. Vertical scaling (scale up) means making a resource more powerful — for example, upgrading a VM from 4 cores to 16 cores. Horizontal scaling (scale out) means adding more instances — for example, going from 2 VMs to 10 VMs during peak load, then back to 2 when traffic drops. Cloud makes both fast and cost-effective.
ElasticityClosely related to scalability, but specifically refers to automatic scaling — the system detects load changes and adjusts resource levels without human intervention. Azure VM Scale Sets, App Service auto-scale, and Azure Functions all demonstrate elasticity. You set the rules; Azure does the scaling.
Reliability & PredictabilityReliability means the system continues working correctly even when components fail. You achieve this by distributing resources across Availability Zones or Region Pairs. Azure automatically handles failover for many services. Predictability refers to consistent, expected performance and cost — Azure's pricing is transparent and services behave consistently regardless of load.
Security & GovernanceAzure provides built-in security tools at every layer: Microsoft Defender for Cloud monitors threats, Azure Policy enforces compliance rules, RBAC controls access, and encryption is available at rest and in transit. For regulated industries, Azure meets hundreds of compliance standards including ISO 27001, SOC 2, HIPAA, and FedRAMP.
ManageabilityYou can manage everything in Azure through multiple interfaces: the Azure Portal (web GUI), Azure CLI (command line), Azure PowerShell, REST APIs, ARM Templates, Bicep, or third-party tools like Terraform. This means you can automate repetitive tasks, deploy environments consistently, and integrate Azure management into your CI/CD pipelines.

LearnMS Learn: Benefits of cloud services ↗

My Notes

Saved ✓

🧩IaaS / PaaS / SaaS / ServerlessHOT›

IaaS — Infrastructure as a ServiceMicrosoft manages the physical hardware and the hypervisor. You are given a virtual machine and you manage everything on top of it: the operating system (including patching), the runtime environment, middleware, applications, and data. You have maximum control. Example: Azure Virtual Machines. Use when you need a specific OS version, custom software stack, or full admin access to the machine.
PaaS — Platform as a ServiceMicrosoft manages the infrastructure AND the platform — the OS, runtime, web server, and middleware are all handled for you. You deploy your application code and manage your data. You don't patch servers or configure runtimes. Example: Azure App Service, Azure SQL Database. Use when you want to focus on building your app and not managing servers.
SaaS — Software as a ServiceMicrosoft manages everything: infrastructure, platform, and the application itself. You simply use the software through a browser or client. You only manage your data (what you put in), your user accounts, and your access settings. Example: Microsoft 365, Teams, Dynamics 365. Use when you need a complete, ready-to-use application with no development required.
ServerlessA subset of PaaS where you write code in response to events, and the cloud provider manages everything including scaling. You don't think about servers at all. Billing is per-execution and per-millisecond of runtime — if nothing triggers your code, you pay nothing. Example: Azure Functions, Logic Apps. Use for event-driven, sporadic workloads where you want zero idle cost.
The key question to distinguish themAsk "who manages the OS?" — IaaS: you do. PaaS and SaaS: Microsoft does. Then ask "who manages the application?" — IaaS and PaaS: you do. SaaS: Microsoft does. This two-question filter correctly identifies the model in every scenario.
Real-world examples to memorizeVM = IaaS. App Service = PaaS. Azure SQL Database = PaaS. Azure Functions = Serverless (PaaS). Microsoft 365 = SaaS. Teams = SaaS. Dynamics 365 = SaaS. AKS (Kubernetes) = PaaS for the control plane, IaaS for worker nodes.

LearnMS Learn: Cloud service types ↗

My Notes

Saved ✓

🏗 Architecture & Services 35–40%

📘 Official Microsoft Learn path for this domain: Describe Azure architecture and services ↗

🌍Azure Global InfrastructureHOT›

RegionsAzure has 60+ regions worldwide — geographic areas each containing one or more physical datacenters. When you deploy a resource, you choose a region. Your choice affects latency to your users (pick the closest region), data residency compliance (some laws require data stays in a country), and service availability (not all services are in all regions). Examples: East US, West Europe, Southeast Asia.
Region PairsEvery Azure region is paired with another region in the same geography, at least 300 miles apart. Microsoft uses these pairs for disaster recovery: during planned maintenance, only one region in the pair is updated at a time. Certain services (like geo-redundant storage) automatically replicate to the paired region. If East US has an outage, West US is its pair and takes over. Region Pairs = cross-region DR protection.
Availability ZonesWithin a single region, Availability Zones are physically separate datacenters — each with its own independent power supply, cooling, and networking. Deploying your VMs or services across three Availability Zones means a failure of one entire datacenter won't take your application offline. AZs give you 99.99% SLA on VMs. Critical distinction: AZs protect within a region. Region Pairs protect across regions.
Availability SetsAn older resiliency mechanism for VMs within a single datacenter. VMs in an Availability Set are spread across fault domains (separate physical racks/power) and update domains (groups rebooted separately during maintenance). Protects against rack failures and maintenance reboots — but NOT against a full datacenter failure. Availability Zones are preferred for new deployments.
Resource GroupsA logical container that holds related Azure resources. Every resource must belong to exactly one resource group. Resources in the same group share a lifecycle — you can deploy, update, and delete them together. Deleting a resource group deletes everything inside it. Best practice: group resources that serve the same application or share the same lifecycle.
SubscriptionsA billing and access control boundary. Each subscription gets its own invoice and its own set of resource limits (quotas). An organization can have multiple subscriptions — for example, one for development, one for production, one per business unit. All subscriptions belong to a single Azure AD/Entra ID tenant.
Management GroupsContainers that sit above subscriptions. You can nest management groups up to 6 levels deep. Policies and RBAC assignments applied to a management group automatically cascade down to all subscriptions and resources within it. This is how enterprises enforce governance at scale — one policy at the top level covers all 50 subscriptions without configuring each individually.
Sovereign RegionsIsolated Azure regions operated under separate legal and compliance frameworks. Azure Government (US) is operated exclusively by US-screened personnel for US government agencies and meets FedRAMP, DoD, and other US government standards. Azure China is operated by 21Vianet and subject to Chinese law — not directly by Microsoft. Sovereign regions are physically and logically isolated from commercial Azure. You need separate accounts and subscriptions to access them.
Azure DatacentersThe physical buildings housing Azure infrastructure. Microsoft designs, builds, and operates these facilities with multiple redundant power feeds, cooling systems, physical security, and networking. They are grouped into Availability Zones within regions. Customers never interact with individual datacenters directly — you work with the abstraction of regions and zones. Microsoft publishes sustainability and design details but not exact datacenter locations.
Scope hierarchyThe full Azure management hierarchy from broadest to narrowest: Management Groups → Subscriptions → Resource Groups → Resources. Azure Policy and RBAC assignments made at any level automatically cascade down to all child scopes. This hierarchy is how enterprises govern large estates without configuring each subscription individually.

LearnMS Learn: Core architectural components ↗ LabSandbox: Explore Azure portal ↗

🧪 Sandbox: Explore Azure portal ↗

My Notes

Saved ✓

🖥Azure Compute ServicesHOT›

Azure Virtual Machines (IaaS)The most fundamental compute service — a virtualized server in the cloud. You choose the OS (Windows or Linux), the size (CPU/RAM), the disk type, and the network configuration. You are responsible for everything inside the VM: OS patching, software installation, security configuration, and application management. Best for: lift-and-shift migrations from on-premises, legacy applications requiring a specific OS version, workloads needing full administrator/root access.
VM Scale SetsA group of identical VMs managed together. You define a template for the VM configuration and Scale Sets automatically creates instances from it. You set autoscale rules (e.g., "add a VM when CPU > 75% for 5 minutes, remove one when CPU < 25%") and Azure handles the scaling. A Load Balancer distributes traffic across all instances. Best for: web tiers, batch processing, any workload needing many identical VMs that scales with demand.
Azure App Service (PaaS)A fully managed hosting platform for web applications, REST APIs, and mobile backends. You deploy your code (in .NET, Java, Node.js, Python, PHP, or Ruby) and Azure manages the underlying OS, web server, patching, load balancing, and auto-scaling. Built-in features include custom domains, SSL certificates, deployment slots (staging/production swaps), and CI/CD integration. Best for: any HTTP workload where you don't need OS-level control.
Azure Functions (Serverless)Event-driven code execution. You write a function that runs in response to a trigger — an HTTP request, a timer, a message in a queue, a file uploaded to Blob Storage, or dozens of other events. Azure manages all the infrastructure, scales automatically from zero to thousands of instances, and charges per execution (about $0.20 per million executions). Best for: event-driven, sporadic workloads where traffic is unpredictable and you want zero cost at idle.
Azure Container Instances (ACI)The fastest way to run a container in Azure without managing any cluster or VM. You specify the container image, CPU, memory, and Azure runs it — billing per second. Startup time is typically under 10 seconds. Best for: short-lived batch jobs, burst compute, isolated testing, one-off tasks. Not suitable for production microservices that need orchestration, health monitoring, or rolling deployments.
Azure Kubernetes Service (AKS)Managed Kubernetes — Microsoft runs the Kubernetes control plane (API server, etcd, scheduler) at no cost. You manage and pay for the worker nodes (VMs). AKS handles control plane upgrades, scaling, and availability. Full container orchestration: rolling updates, self-healing, service discovery, ingress controllers. Best for: production microservices architectures running containerized workloads at scale.
Azure Virtual Desktop (AVD)Delivers Windows 10/11 desktop environments and applications from Azure to any device. Uniquely supports multi-session Windows — multiple users sharing a single VM simultaneously, reducing cost. Integrates with Microsoft 365 licensing. Best for: remote workers who need a full Windows desktop, BYOD scenarios, organizations moving away from physical workstations, and call centers.

LearnMS Learn: Azure compute services ↗ LabSandbox: Create a VM ↗

🧪 Sandbox: Create a VM ↗

My Notes

Saved ✓

🌐Azure Networking ServicesMEDIUM›

Virtual Network (VNet)The foundational networking construct in Azure. A VNet is a logically isolated private network in Azure — like your own private section of the Azure datacenter. You define an IP address space, divide it into subnets, and connect your Azure resources to it. VMs, app services, databases, and other resources communicate privately within a VNet. NSGs (Network Security Groups) act like firewalls controlling inbound and outbound traffic to subnets or individual resources.
VPN GatewayCreates an encrypted IPSec/IKE tunnel between your Azure VNet and your on-premises network over the public internet. Types: Site-to-Site (connects your office/datacenter network to Azure), Point-to-Site (connects an individual device to Azure), and VNet-to-VNet (connects two Azure VNets). Lower cost than ExpressRoute and faster to deploy, but traffic does traverse the public internet. Use when privacy requirements don't prohibit internet traffic.
ExpressRouteA private, dedicated circuit from your on-premises network to Azure delivered through a connectivity provider (like AT&T or Equinix). Traffic never touches the public internet — it runs on a private MPLS or Ethernet circuit. Offers guaranteed bandwidth (up to 100 Gbps), consistent low latency, and a higher SLA than VPN. Takes weeks to provision and costs significantly more. Required when: regulatory compliance prohibits internet exposure, or you need guaranteed bandwidth for critical workloads like real-time trading.
Azure Load BalancerDistributes inbound TCP and UDP traffic across multiple backend VMs using Layer 4 (transport layer) rules. It has no understanding of HTTP — it works at the IP/port level. Can be configured as public (internet-facing) or internal (private). Provides health monitoring and automatically stops sending traffic to unhealthy instances. Best for: non-HTTP workloads or when you need simple L4 load balancing across VMs.
Application GatewayA Layer 7 (application layer) load balancer that understands HTTP and HTTPS. Because it can inspect HTTP content, it supports: URL-based routing (send /api/* to one backend, /images/* to another), cookie-based session affinity (sticky sessions), SSL/TLS termination (decrypt at the gateway, not the VMs), and Web Application Firewall (WAF) that blocks OWASP Top 10 attacks like SQL injection and XSS. Best for: web applications needing intelligent routing or security inspection.
Azure DNSA hosting service for DNS domains that uses Azure's global network of name servers. You can't register domain names here — only host them. Once you point your domain's nameservers to Azure DNS, you manage all DNS records (A, CNAME, MX, TXT, etc.) through Azure. Microsoft guarantees 100% availability SLA — the only Azure service with this guarantee.
VNet PeeringConnects two Azure Virtual Networks so their resources can communicate privately, as if on the same network. Traffic between peered VNets travels over the Microsoft backbone — not the public internet. Can peer VNets in the same region (VNet Peering) or across different regions (Global VNet Peering). Used to connect VNets across subscriptions, regions, or business units while keeping traffic off the internet.
Public EndpointsA public IP address or DNS name that is accessible from the internet. When a resource has a public endpoint, anyone on the internet (with proper credentials) can reach it. Most Azure services have public endpoints by default. Example: an Azure Storage Account's public endpoint is accessible globally at accountname.blob.core.windows.net.
Private EndpointsBrings an Azure service (like Azure Storage, SQL Database, or Key Vault) into your VNet using a private IP address from your VNet's address space. Traffic to the service never leaves the Microsoft backbone — it goes from your VM directly to the service without touching the internet. Private Endpoints are how you make PaaS services accessible only from within your VNet, meeting compliance requirements for private connectivity.
Azure CDNCaches your static content (images, videos, JavaScript, CSS, downloadable files) at edge nodes located physically close to your users worldwide. When a user in Brazil requests an image, it's served from a CDN node in São Paulo rather than your origin server in West US — dramatically reducing latency. Reduces load on your origin server and improves perceived performance globally. Works with Blob Storage, App Service, or any public origin.

LearnMS Learn: Azure networking services ↗ LabSandbox: Configure network access ↗

🧪 Sandbox: Configure network access ↗

My Notes

Saved ✓

💾Azure Storage ServicesMEDIUM›

Blob StorageObject storage for unstructured data — any type of binary or text file: images, videos, audio, documents, backups, log files, and application data. Three blob types: Block Blobs (standard files, most common), Append Blobs (optimized for append-only operations like log files), Page Blobs (VHD disk files for Azure VMs). Also used for static website hosting. Best for: any unstructured data that doesn't need to be accessed like a file system.
File StorageFully managed file shares accessible via the SMB (Windows) and NFS (Linux) protocols — the same protocols used by traditional file servers. Files can be mounted simultaneously from Azure VMs, on-premises Windows/Linux/Mac servers, and Azure services. Acts as a direct replacement or extension for on-premises file servers. Best for: applications that need shared file access from multiple machines, lifting on-premises file server workloads to Azure.
Disk StorageBlock-level storage that attaches to Azure VMs as virtual hard disks. Every VM has an OS disk and can have multiple data disks. Performance tiers from lowest to highest: Standard HDD (cheapest, for dev/test), Standard SSD (general purpose), Premium SSD (production workloads), Ultra Disk (highest performance for databases). Disks are managed — Azure handles replication within the datacenter automatically.
LRS — Locally Redundant StorageStores 3 synchronous copies of your data within a single datacenter in the primary region. Cheapest option. Protects against drive and server failures but NOT against a datacenter outage or regional disaster. Suitable for data that can be recreated easily or is already replicated at the application level.
ZRS — Zone-Redundant StorageStores 3 synchronous copies across 3 Availability Zones in the primary region. Protects against a single datacenter failing — if the datacenter hosting one copy goes down, your data is still available from the other two zones. Does not protect against a regional failure. Good for high availability within a region.
GRS — Geo-Redundant StorageStores 3 copies in the primary region (like LRS) and asynchronously replicates to a secondary paired region — for a total of 6 copies across 2 regions. Protects against a complete regional failure. Data in the secondary region is read-only and only accessible if Microsoft initiates a failover. More expensive than ZRS.
GZRS — Geo-Zone-Redundant StorageCombines ZRS (3 copies across 3 AZs in primary region) with geo-replication to a secondary region. The most durable option — protects against both datacenter-level failures and regional disasters simultaneously. Recommended for mission-critical data that cannot be lost under any circumstance.
Blob Access TiersHot: frequently accessed data, highest storage cost, lowest access cost. Cool: infrequently accessed data (stored for at least 30 days), lower storage cost, higher access cost. Cold: rarely accessed data (at least 90 days), even lower storage cost. Archive: almost never accessed (at least 180 days), lowest storage cost but data is offline and takes hours to retrieve (rehydration). Choose tiers based on how often you access the data.
AzCopyA command-line utility for copying data to and from Azure Blob Storage and Azure Files. Supports single-file copies, bulk transfers, and directory synchronisation. Can transfer between Azure accounts directly without downloading data locally. Optimised for high-throughput scenarios and can resume interrupted transfers. Commonly used in automation scripts and CI/CD pipelines for storage operations.
Azure Storage ExplorerA free, standalone desktop application (Windows, macOS, Linux) that gives you a graphical interface to manage Azure Storage accounts. You can browse containers, upload/download/delete blobs, manage file shares, and work with queues and tables. Supports multiple accounts and subscriptions simultaneously. Much easier than the Portal for batch operations or browsing large amounts of data.
Azure File SyncTransforms Windows Server into a cache for Azure file shares. You install the agent on an on-premises Windows Server and File Sync keeps selected folders synchronised with an Azure file share. Frequently accessed files stay cached locally for fast access; less-used files are tiered to Azure storage to save local disk space. Enables cloud-backed file servers with local performance.
Azure MigrateA centralised hub for assessing and migrating on-premises workloads to Azure. Includes: discovery and assessment tools (scan your on-premises VMs, identify dependencies, estimate Azure sizing and costs), server migration (replicate VMs from VMware, Hyper-V, or physical servers to Azure), and database migration guidance. Think of it as Microsoft's official migration factory.
Azure Data BoxA physical device Microsoft ships to you for offline data transfer. You copy up to 80 TB of data onto the device, ship it back to Microsoft, and they upload it to your Azure storage account. Used when: your internet connection is too slow to transfer the data online in a reasonable time, data transfer costs over the internet are prohibitive, or connectivity is unreliable. Data Box Disk (8 TB SSDs), Data Box (80 TB), and Data Box Heavy (770 TB) are the size options.

LearnMS Learn: Azure storage services ↗ LabSandbox: Create a storage blob ↗

🧪 Sandbox: Create a storage blob ↗

My Notes

Saved ✓

🗄Azure Database ServicesKnow the differences›

Azure SQL DatabaseA fully managed PaaS relational database using the SQL Server engine. Microsoft handles all infrastructure, OS patching, database engine updates, automatic backups, and built-in high availability. You only manage your database schema, data, and queries. Supports multiple pricing tiers including a Serverless tier that scales compute automatically and pauses when idle. Best for: new cloud-native applications that don't need every legacy SQL Server feature. Note: some advanced SQL Server features (like SQL Server Agent, cross-database queries, CLR) are not supported.
Azure SQL Managed InstanceA fully managed SQL Server instance with near-100% compatibility with on-premises SQL Server. Supports features that SQL Database doesn't: SQL Server Agent (scheduled jobs), CLR (Common Language Runtime), linked servers, cross-database queries, and Service Broker. Deployed inside a VNet for network isolation. Best for: migrating existing on-premises SQL Server databases to Azure with minimal or no code changes. More expensive than SQL Database.
Azure Cosmos DBMicrosoft's globally distributed, multi-model NoSQL database. It stores data in document, key-value, column-family, or graph formats and supports multiple APIs: SQL (document queries), MongoDB, Cassandra, Gremlin (graph), and Table. Guarantees single-digit millisecond read and write latency at any scale, anywhere in the world. You can configure it to replicate data to any number of Azure regions with active-active writes. Best for: applications needing global distribution, flexible/changing schema, sub-10ms latency, or massive scale. Not designed for complex relational queries or ACID transactions across multiple tables.
Azure Database for PostgreSQL / MySQLFully managed open-source relational databases. Microsoft handles infrastructure, OS, database engine patching, automatic backups, and built-in high availability. You bring your existing PostgreSQL or MySQL applications and they work with minimal changes. Best for: teams that prefer open-source databases over SQL Server, or existing applications already using PostgreSQL/MySQL on-premises.
How to choose: the key exam question"SQL Server compatibility" or "lift-and-shift SQL Server" → SQL Managed Instance. "New cloud app with relational data" → SQL Database. "Global", "NoSQL", "sub-10ms latency", "multi-region writes", or "flexible schema" → Cosmos DB. "PostgreSQL" or "MySQL" → Azure Database for PostgreSQL/MySQL.

LearnMS Learn: Azure database services ↗

My Notes

Saved ✓

🔐 Management & Governance 30–35%

📘 Official Microsoft Learn path for this domain: Describe Azure management and governance ↗

🪪Identity, Access & SecurityHOT›

Microsoft Entra ID (formerly Azure Active Directory)Microsoft's cloud-based identity and access management service. Every Azure subscription is linked to an Entra ID tenant. It authenticates users (verifies who you are), authorizes access to applications, and manages devices. It's not a domain controller like on-premises Active Directory — it uses modern protocols (OAuth 2.0, SAML, OpenID Connect) over HTTPS rather than Kerberos/LDAP. It enables SSO across Microsoft services (Azure Portal, Microsoft 365, Teams, Outlook) and thousands of third-party SaaS applications.
Multi-Factor Authentication (MFA)Requires users to prove their identity using two or more verification factors from different categories: something you know (password), something you have (phone/authenticator app/hardware token), or something you are (fingerprint/face scan). Even if an attacker steals a password, they can't log in without the second factor. Microsoft data shows MFA blocks 99.9% of automated account compromise attacks. Configurable per-user or enforced via Conditional Access policies.
Single Sign-On (SSO)Users authenticate once and gain access to multiple applications without entering credentials again. For example, an employee logs into their company laptop in the morning (authenticating against Entra ID) and then accesses Azure Portal, Microsoft 365, Salesforce, ServiceNow, and GitHub without logging in again. SSO reduces password fatigue, decreases help desk tickets for forgotten passwords, and centralizes authentication management.
Conditional AccessA powerful security feature in Entra ID that evaluates signals before granting or blocking access — functioning like an if/then policy engine. Signals include: the user's identity, their location (IP address/country), the device they're using (compliant/unmanaged), the application they're accessing, and the calculated sign-in risk score. Example policy: "If user is accessing from outside the corporate network AND is accessing a high-sensitivity application THEN require MFA." This is how organizations enforce Zero Trust access.
Azure RBAC (Role-Based Access Control)Controls who can do what to Azure resources. You assign a built-in or custom role to a user, group, or service principal at a specific scope. Scopes from broadest to narrowest: Management Group → Subscription → Resource Group → Individual Resource. Permissions granted at a higher scope are inherited by everything below it. Key built-in roles: Owner (full control including managing access), Contributor (full control but can't manage access), Reader (view only). Principle of least privilege: always assign the minimum role needed.
Zero Trust Security ModelA modern security philosophy that abandons the old "castle and moat" model where everything inside the corporate network was trusted. Zero Trust is built on three principles: (1) Verify explicitly — always authenticate and authorize using all available signals (identity, location, device health, data sensitivity); (2) Use least privilege — give users only the minimum access they need, using just-in-time and just-enough-access; (3) Assume breach — design systems as if attackers are already inside. Limit blast radius, encrypt everything, use analytics to detect anomalies.
Defense-in-DepthA layered security strategy where multiple independent security controls protect against threats — if one layer is breached, others still provide protection. The layers from outermost to innermost: Physical security (datacenter access controls), Identity & access (authentication, MFA, Conditional Access), Perimeter (DDoS protection, firewalls), Network (NSGs, network segmentation), Compute (endpoint protection, OS patching), Application (secure coding, WAF), Data (encryption at rest and in transit). No single control is sufficient — defence comes from depth.
Passwordless AuthenticationAuthentication methods that replace passwords entirely with stronger, phishing-resistant alternatives. Options in Microsoft Entra ID: Windows Hello for Business (biometric or PIN tied to the device), Microsoft Authenticator app (approve sign-ins from your phone using fingerprint/face recognition), FIDO2 security keys (physical hardware keys like YubiKey). Passwordless is more secure than passwords + MFA because there is no password to steal or phish.
External IdentitiesEnables collaboration with people outside your organisation without requiring them to have accounts in your directory. Azure AD B2B (Business-to-Business): invite partner users (guests) to access your apps using their existing work/personal accounts — a contractor with a Gmail account can collaborate in your Teams. Azure AD B2C (Business-to-Consumer): lets your customers sign in to your applications using their social accounts (Google, Facebook) or a local email/password — used by consumer-facing applications.
Microsoft Entra Domain ServicesProvides classic Active Directory domain services (LDAP, Kerberos, NTLM, group policy) as a fully managed cloud service — without having to deploy or manage domain controllers. Used for legacy applications that require traditional AD authentication methods but you want to run them in Azure without maintaining on-premises domain controllers. Distinct from Entra ID: Entra Domain Services supports LDAP and Kerberos; Entra ID uses modern protocols (OAuth, SAML, OIDC).
Microsoft Defender for CloudA unified Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It continuously assesses your Azure resources, on-premises servers, and resources in other clouds (AWS, GCP) against security best practices and gives you a Secure Score — a percentage representing your overall security posture. It provides actionable recommendations to improve your score, detects threats in real-time, and generates security alerts. Previously called Azure Security Center.

LearnMS Learn: Identity, access & security ↗ LabSandbox: Configure Entra ID ↗

🧪 Sandbox: Configure Entra ID ↗

My Notes

Saved ✓

💲Cost Management & BillingHOT›

Factors that affect Azure costsUnderstanding what drives your Azure bill: Resource type (a GPU VM costs more than a basic VM), Service tier (Premium SSD costs more than Standard HDD), Region (East US is cheaper than West Europe for most services), Bandwidth/Egress (data leaving Azure to the internet is charged per GB; data entering Azure is free), Reserved vs Pay-as-you-go (commitment discounts of up to 72%), Instance size (more CPU/RAM = higher cost), Operating hours (VMs billed per second when running; stopped VMs still incur disk storage charges).
Azure Pricing CalculatorA web tool at azure.microsoft.com/pricing/calculator that lets you estimate your monthly Azure costs before deploying anything. You select the specific services you plan to use, configure their settings (region, SKU, hours of operation, storage quantity, etc.) and the calculator shows you a projected monthly cost. Used for pre-deployment budget planning, building business cases, and comparing configuration options. Key exam distinction: this estimates FUTURE costs before you deploy.
TCO (Total Cost of Ownership) CalculatorA different tool that calculates and compares the total cost of running workloads on-premises versus in Azure over time. It accounts for hardware acquisition, power and cooling, datacenter space, IT staff labor, software licenses, and networking. Produces a report showing how much you'd save by moving to Azure — typically over 3–5 years. Used to justify a migration to leadership. Key exam distinction: this compares on-premises costs vs Azure, not just Azure service costs.
Azure Cost Management + BillingThe built-in Azure tool for monitoring, analyzing, and optimizing your actual cloud spending after you've deployed resources. Features: cost analysis views (by resource, by resource group, by tag, by service), budget creation with automated email alerts when you hit 80% or 100% of your budget, cost forecasting based on trends, and recommendations for cost optimization. Distinct from the calculators — this shows real spending, not estimates.
Resource TagsName-value pairs you attach to any Azure resource. Example: Department=Finance, Environment=Production, CostCenter=CC-1234. Tags are used for: cost allocation (filter your invoice by tag to see how much Finance spent), automation (run scripts that target all resources tagged Environment=Dev), governance reporting, and compliance tracking. Azure Policy can enforce that certain tags must be present on all resources.
Reserved InstancesA billing discount you get by committing to use a specific VM family, region, and size for either 1 year or 3 years. In exchange for the commitment, you get up to 72% off pay-as-you-go pricing. Payment options: all upfront (maximum discount), partial upfront, or monthly payments. The reservation applies to any running VM that matches the criteria — you can change the VM but keep the reservation. Best for: predictable, always-on production workloads like database servers or application servers.
Azure Spot VMsUnused Azure compute capacity sold at up to 90% discount compared to pay-as-you-go. The catch: Azure can evict your Spot VM with 30 seconds notice when it needs the capacity back. This makes Spot VMs unsuitable for production workloads that can't be interrupted. Best for: batch processing jobs, rendering workloads, dev/test environments, and any fault-tolerant workload that can checkpoint and restart. The massive discount makes Spot ideal for cost-conscious compute-intensive tasks.
Azure Hybrid BenefitAllows organizations with existing on-premises Windows Server or SQL Server licenses (with active Software Assurance) to use those licenses for VMs in Azure, eliminating the software licensing cost. Can save up to 40% on VM costs. Can be combined with Reserved Instances for maximum savings — potentially up to 80% off pay-as-you-go pricing. Example: you already pay for SQL Server Enterprise on-premises; you can run SQL Server on an Azure VM using that same license.

LearnMS Learn: Cost management in Azure ↗ LabOpen Pricing Calculator ↗ LabOpen TCO Calculator ↗

🧪 Open Pricing Calculator ↗ 🧪 Open TCO Calculator ↗

My Notes

Saved ✓

📜Governance & ComplianceMEDIUM›

Azure PolicyA service that creates, assigns, and manages rules (policies) that enforce standards on your Azure resources. Policies evaluate resources against defined conditions and mark them as compliant or non-compliant. Critically, policies can be set to Deny mode — which means a non-compliant resource creation attempt will be blocked outright before it happens. Example policies: "All resources must be deployed in West Europe or North Europe," "All storage accounts must require HTTPS," "All VMs must have a specific tag." Policies are assigned at a scope (Management Group, Subscription, or Resource Group) and cascade downward. Key distinction from RBAC: Policy controls what resources can look like; RBAC controls what users can do.
Resource LocksPrevent accidental modification or deletion of Azure resources, regardless of RBAC permissions. Two types: CanNotDelete lock — authorized users can read and modify the resource normally, but cannot delete it. Locks must be explicitly removed before deletion can proceed. ReadOnly lock — users can only read the resource; all modifications and deletions are blocked (equivalent to giving everyone the Reader role). Locks override RBAC — even a Subscription Owner cannot delete a locked resource without first removing the lock. Apply at Subscription, Resource Group, or individual resource scope.
Microsoft PurviewA unified data governance service that helps you discover, classify, and manage your data wherever it lives — in Azure, on-premises, in other clouds (AWS, GCP), and in SaaS applications. Key capabilities: automated data discovery and classification (identifies sensitive data like credit card numbers or social security numbers), a unified data map showing where all your data assets are, data lineage tracking (where data came from and where it goes), and compliance reporting. Used by data governance teams and compliance officers, not typically by application developers.
Azure BlueprintsA service that packages governance artifacts — Azure Policy definitions, RBAC role assignments, Resource Groups, and ARM templates — into a single deployable unit called a blueprint. Assigning a blueprint to a subscription rapidly creates a compliant environment that meets your organizational standards. Useful for: creating consistent environments for new projects, ensuring regulatory compliance from day one, and onboarding new teams. Note: Microsoft is deprecating Blueprints in favor of using Azure Policy + ARM/Bicep templates + template specs. Understand it conceptually for the exam but know it's being retired.
ARM Templates & Bicep (Infrastructure as Code)ARM Templates are JSON files that declaratively define Azure resources. You specify what you want (the desired state) and Azure creates or updates resources to match. Bicep is Microsoft's newer domain-specific language that compiles to ARM JSON — it has cleaner syntax, better tooling, and is the recommended approach for new projects. Both are idempotent: running the same template repeatedly produces the same result. Both are version-controllable and repeatable — key for consistent, automated deployments.

LearnMS Learn: Governance & compliance ↗ LabSandbox: Create Azure Policy ↗

🧪 Sandbox: Create Azure Policy ↗

My Notes

Saved ✓

📊Monitoring & ObservabilityMEDIUM›

Azure MonitorThe central observability platform for Azure — the hub that everything else feeds into. It collects two types of telemetry: Metrics (numeric time-series data like CPU percentage, request count, memory usage — collected every minute by default) and Logs (structured or unstructured records of events, errors, and activities stored in Log Analytics workspaces and queryable with KQL — Kusto Query Language). Azure Monitor powers alerts (notify you when a metric crosses a threshold), dashboards, Application Insights, and is the foundation of Azure's observability story.
Azure AdvisorA free, personalized recommendation engine that analyzes your actual deployed Azure resources and configurations — not hypothetical scenarios. It evaluates against Microsoft best practices across five pillars: Cost (identify idle resources, right-size VMs, use Reserved Instances), Security (enable MFA, apply missing security controls), Reliability (enable redundancy, fix single points of failure), Performance (remove bottlenecks, improve response times), and Operational Excellence (follow deployment best practices, use alerts). Recommendations are actionable — many can be implemented with one click. Key exam distinction: Advisor tells you WHAT TO DO to improve. Azure Monitor tells you WHAT IS happening right now.
Azure Service HealthShows the current status and health of the Azure platform itself — not your resources, but Microsoft's infrastructure. Three components: Azure Status (global overview of all Azure services and regions, public page at status.azure.com), Service Health (personalized view of only the services and regions you use, showing active incidents affecting your subscriptions), and Resource Health (status of your specific individual resources — is THIS VM healthy?). Use Service Health when you suspect an Azure outage or want to know about planned maintenance. Key exam distinction: Service Health monitors Azure's infrastructure. Azure Monitor monitors your resources.
Application InsightsAn Application Performance Monitoring (APM) service for live web applications — a feature of Azure Monitor. By adding a small SDK to your application code, Application Insights collects: request rates and response times, failure rates and exceptions, dependency calls (database queries, HTTP calls to other services), page load times for browser clients, and custom events you define. It has intelligent smart detection that automatically alerts you to unusual changes in performance or failure rates — even without configuring explicit alert rules. Best for: development teams that want deep visibility into application performance and user behavior.
Log AnalyticsA tool in Azure Monitor for collecting, storing, and querying log data. You create a Log Analytics workspace, then connect your Azure resources, VMs, and applications to send their logs there. You query the data using KQL (Kusto Query Language). Example: find all failed login attempts in the last 24 hours, count errors by resource, track a specific user's activity. Log Analytics is also the data store behind Microsoft Sentinel (SIEM) and the source for many Monitor alerts.

LearnMS Learn: Monitoring tools ↗

My Notes

Saved ✓

🛠Deployment & Management ToolsKnow tool for each job›

Azure PortalA web-based graphical interface at portal.azure.com where you can create, configure, monitor, and delete Azure resources by clicking through menus and forms. It's the easiest way to explore Azure and is great for one-off tasks, learning the platform, and visual monitoring of dashboards. It's not suitable for automation or deploying the same environment repeatedly — for that you need scripts or templates. The portal is also available as a mobile app for basic monitoring on the go.
Azure CLIA cross-platform command-line tool (runs on Windows, macOS, Linux) that lets you manage Azure resources through typed commands. Commands follow a consistent structure: az [resource type] [action] --parameters. Example: az vm create --name MyVM --resource-group MyRG --image UbuntuLTS. Ideal for scripting and automation — you can write shell scripts that provision entire environments. Preferred by developers on Linux/macOS and DevOps engineers building CI/CD pipelines.
Azure PowerShellA PowerShell module (Az module) that provides cmdlets for managing Azure resources. Commands use the PowerShell verb-noun convention: New-AzVM, Get-AzResourceGroup, Remove-AzStorageAccount. Runs on Windows, macOS, and Linux (via PowerShell Core). Preferred by Windows administrators and teams already invested in PowerShell automation. Both Azure CLI and PowerShell can accomplish the same tasks — the choice is personal preference and which scripting ecosystem your team already uses.
Azure Cloud ShellA browser-based shell environment accessible directly from the Azure Portal (the terminal icon in the top bar). It gives you a pre-authenticated, pre-configured shell with Azure CLI, Azure PowerShell, common developer tools, and a persistent file share already set up. You don't need to install anything on your local machine. Useful when you're on a shared machine, when your local environment isn't configured, or when you want to quickly run a command without context-switching away from the portal.
ARM Templates (Azure Resource Manager Templates)JSON files that declaratively describe the Azure resources you want to deploy. You define the desired end state and Azure figures out how to create or update resources to match it. Key properties: Declarative (you say what you want, not how to do it), Idempotent (deploying the same template repeatedly produces the same result — no duplicate resources), and Version-controllable (store templates in Git, track changes, roll back). ARM templates enable Infrastructure as Code (IaC) — treating your infrastructure the same way you treat application code.
BicepMicrosoft's domain-specific language for Azure infrastructure. Bicep code compiles down to ARM template JSON — it's not a different deployment system, just a cleaner way to write ARM templates. Benefits over raw JSON: much less verbose syntax (a 200-line ARM template might be 60 lines in Bicep), built-in type safety that catches errors before deployment, better IDE support with autocompletion, and cleaner module system for reuse. Microsoft now recommends Bicep for all new IaC work on Azure. The Azure CLI and Azure DevOps both compile Bicep automatically.
Azure ArcExtends Azure management capabilities to resources running outside of Azure — on-premises servers, VMs in other cloud providers (AWS, GCP), Kubernetes clusters anywhere, and edge devices. Once a server or cluster is Arc-enabled (by installing a lightweight agent), it appears in the Azure Portal and you can manage it using Azure tools: apply Azure Policy, use Defender for Cloud, collect logs with Azure Monitor, assign RBAC roles, and deploy applications. Arc is Microsoft's answer to hybrid and multi-cloud management — one control plane for everything regardless of where workloads actually run.

LearnMS Learn: Managing & deploying resources ↗ LabSandbox: Use Azure Cloud Shell ↗ LabSandbox: Deploy ARM template ↗

🧪 Sandbox: Use Azure Cloud Shell ↗

My Notes

Saved ✓

🛠 Build a Custom Quiz