AZ-900 Exam Topics Breakdown 2026: What Microsoft Actually Tests

Exam Overview

The AZ-900 Microsoft Azure Fundamentals exam covers three domains. Microsoft publishes the exact weightings in the official Skills Measured document — which is worth downloading directly from Microsoft Learn before you start studying, as it's updated periodically.

The exam has 40–60 questions. Most candidates see around 45–50. You have 60 minutes. The pass mark is 700 out of 1000, which is approximately 70%.

Domain 1 — Cloud Concepts (25–30%)

This domain tests whether you understand what cloud computing is, why organisations use it, and the key models and concepts that underpin it. It's the most conceptual domain — no Azure-specific services are covered here.

What Microsoft actually tests

• Service models: IaaS, PaaS, and SaaS definitions and real-world examples. Questions often give a scenario ("a company wants to move their web app to the cloud without managing the OS") and ask which service model applies.
• Cloud deployment models: Public, private, hybrid. Know when each is appropriate.
• CapEx vs OpEx: The financial distinction between upfront hardware investment (CapEx) and pay-as-you-go cloud (OpEx). Usually 1–2 questions.
• Cloud benefits: High availability, scalability, elasticity, agility, disaster recovery, fault tolerance. Know the precise definition of each — especially elasticity vs scalability.
• Shared responsibility model: Who manages what in IaaS, PaaS, and SaaS. This is a guaranteed question.

Common question patterns

"A company is migrating their on-premises SQL Server to Azure SQL Database. Which service model does Azure SQL Database represent?" — PaaS.

"Which cloud benefit allows a company to automatically add resources during peak traffic and remove them when demand drops?" — Elasticity (not scalability — scalability is the ability to scale, elasticity is automatic scaling).

Domain 2 — Azure Architecture and Services (35–40%)

This is the largest domain and covers the broadest range of topics. It's split into five main areas:

Core architecture (infrastructure)

• Azure regions, geographies, and region pairs
• Availability Zones vs Availability Sets (common confusion point)
• Resource groups, subscriptions, and management groups
• Azure Resource Manager

Compute services

• Virtual Machines — IaaS, what you manage vs what Microsoft manages
• Azure App Service — PaaS, web apps and APIs
• Azure Functions — serverless, event-driven, pay per execution
• Azure Container Instances and AKS — when containers are appropriate
• Azure Virtual Desktop — cloud-hosted desktops

Networking

• Virtual Networks — private networking in Azure
• VPN Gateway vs ExpressRoute — the most tested networking comparison
• Azure Load Balancer vs Application Gateway — Layer 4 vs Layer 7
• Network Security Groups — allow/deny rules, priority numbers
• Azure DNS and CDN

Storage

• The four storage services: Blob, Files, Queue, Table
• Blob access tiers: Hot, Cool, Archive
• Storage redundancy: LRS, ZRS, GRS, GZRS
• Azure Disk Storage for VMs

Identity, access, and security

• Microsoft Entra ID — authentication, SSO, MFA
• Azure RBAC — Owner, Contributor, Reader roles
• Zero Trust principles
• Defence in depth
• Azure Key Vault, Microsoft Defender for Cloud, Microsoft Sentinel
• Azure DDoS Protection

Domain 3 — Azure Management and Governance (30–35%)

This domain is often underestimated. It covers cost management, monitoring, governance tools, and compliance — all highly testable topics that candidates who focus only on services tend to neglect.

Cost management

• Azure Pricing Calculator — estimate future costs before deploying
• TCO Calculator — compare on-premises vs Azure (migration justification)
• Azure Cost Management — monitor and analyse existing spend
• Azure Advisor — recommendations including cost optimisation
• Reserved Instances, Spot VMs, Azure Hybrid Benefit — cost saving options

Governance and compliance

• Azure Policy — enforce what resources can be configured
• Resource locks — prevent deletion or modification
• Resource tags — metadata for cost allocation and management
• Azure Blueprints — repeatable environment deployments
• Microsoft Purview — data governance and compliance
• Microsoft Trust Center and compliance certifications

Monitoring and management tools

• Azure Monitor — performance and health of your resources
• Service Health — Azure platform issues affecting your services
• Azure Status — global Azure outages (not personalised)
• Azure Portal, CLI, PowerShell, Cloud Shell
• ARM templates and Bicep — infrastructure as code

SLAs and support

• SLA uptime percentages and what they mean in hours of downtime
• Composite SLAs — multiply individual SLAs
• Azure support plans — Basic, Developer, Standard, Professional Direct

Question Formats to Expect

AZ-900 uses several question formats. Knowing what to expect reduces exam-day surprises:

• Multiple choice (single answer): Most common. One correct answer from four options.
• Multiple select: "Select all that apply" or "Select 2 answers." Read carefully — selecting too many or too few is wrong.
• Drag and drop / matching: Match services to descriptions, or arrange steps in order.
• Yes/No statements: A scenario with 2–3 yes/no statements. Each must be evaluated independently.

Where to Focus Your Revision Time

Based on the domain weightings and common candidate weak spots, here's how to allocate your revision time: