The short version
AZ-900 has three domains: cloud concepts (25-30%), Azure architecture and services (35-40%), and Azure management and governance (30-35%). The weightings are ranges, so the exact share of questions varies. This page follows the study guide with skills measured as of July 20, 2026.
Describe cloud concepts (25-30%)
What it covers. Microsoft splits it into three groups: cloud computing, the benefits of cloud services, and cloud service types. In the first group you define cloud computing, describe the shared responsibility model, compare public, private, and hybrid models, and explain the consumption-based model, cloud pricing models, and serverless. The second covers high availability, scalability, reliability, predictability, security, governance, and manageability. The third covers IaaS, PaaS, and SaaS with their use cases.
Typical traps.
- Mixing up the benefits. High availability is about staying up, scalability is about adding or removing capacity, and reliability is about recovering from failure. Questions describe a situation and ask which benefit it shows.
- Shared responsibility. The customer always keeps responsibility for its data and for who has access. The provider always keeps the physical datacenter. Everything in between moves with the service type.
- Believing “serverless” means no servers. It means you do not manage them.
What to practice. Build a one-page grid with IaaS, PaaS, and SaaS as columns and “who manages what” as rows. Practice picking a cloud model (public, private, hybrid) from a short business requirement.
Describe Azure architecture and services (35-40%)
This is the biggest domain and has the most product names. It has four groups.
Core architectural components. Regions, region pairs, sovereign regions, availability zones, datacenters, resources, resource groups, subscriptions, and management groups, plus how they nest. Practice recalling the order: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources.
Compute and networking. Virtual machines, scale sets, availability sets, Azure Virtual Desktop, containers, functions, web apps, virtual networks, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute, and public and private endpoints. Traps: VPN Gateway sends encrypted traffic over the internet, while ExpressRoute uses a private connection. A service endpoint and a private endpoint sound alike but are not the same thing.
Storage. Storage services, access tiers, redundancy options, account options, tools for moving files (AzCopy, Azure Storage Explorer, Azure File Sync), and migration options (Azure Migrate, Azure Data Box). Traps: the redundancy acronyms (LRS, ZRS, GRS, GZRS) are easy to mix up, and cooler tiers have lower storage cost but come with trade-offs when you read the data.
Identity, access, and security. Microsoft Entra ID and Microsoft Entra Domain Services, single sign-on, MFA, passwordless, external identities, Conditional Access, Azure role-based access control, Zero Trust, defense in depth, and Microsoft Defender for Cloud. Traps: authentication proves who you are, authorization decides what you can do. RBAC answers the second question.
What to practice. Redundancy options as a ladder from one datacenter to two regions. Pair confusable services in your notes table and write one sentence on when each is the right pick.
Describe Azure management and governance (30-35%)
This domain is bigger than people expect. It has four groups.
Cost management. Factors that affect cost, the pricing calculator, Microsoft Cost Management, and tags. Trap: the pricing calculator estimates costs before you deploy. Cost Management shows and controls what you actually spend. Tags are labels used to group and report, and they do not enforce anything.
Governance and compliance. Microsoft Purview, Azure Policy, and resource locks. Trap: Azure Policy checks whether resources follow your rules, while a lock stops a deletion or a change no matter who tries it. They solve different problems, and exam scenarios often put them side by side.
Managing and deploying resources. The Azure portal, Cloud Shell, Azure CLI, Azure PowerShell, Azure Arc, infrastructure as code, and Azure Resource Manager with ARM templates. Trap: Azure Arc extends Azure management to resources outside Azure, such as servers elsewhere. ARM is the layer that every deployment tool goes through.
Monitoring. Azure Advisor, Azure Service Health, and Azure Monitor with Log Analytics, alerts, and Application Insights. Trap: Advisor gives recommendations, Service Health tells you about Azure problems that affect you, and Monitor collects and analyzes data from your own resources.
What to practice. Write one sentence per tool beginning “Use this when…”. Then test yourself with scenario questions, because this domain is mostly choosing between neighbors.
How to spend your time
Weight your hours roughly like the exam, but give extra time to whichever domain scores lowest in a practice set. A plan by week is on the study plan page. To see how the questions read, try the sample questions.
More guides for AZ-900
- Is AZ-900 Hard? An Honest Look
- AZ-900 Prerequisites: What to Know First
- AZ-900 Renewal and Retakes Explained
- Is AZ-900 Worth It? An Honest Look
- AZ-900 Cheat Sheet: Key Facts to Review
- AZ-900 vs AI-901: Which First?
- AZ-900 vs SC-900: Which Exam First?
Next step
Take a short set on your weakest domain in our AZ-900 practice tests, then check the exam format page before you book.
Frequently asked questions
Which domain is the hardest?
It depends on your background. People from IT often find the cloud concepts easy and the governance tools new. People from business roles often find the opposite.
Do I need to memorize prices?
No. The skills list covers what affects costs and which tools estimate them, not price figures.