AZ-900 (Microsoft Azure Fundamentals) is the most common first cloud certification for freshers in India. It checks that you understand cloud concepts and the main Azure services. It doesn't check whether you can build or run them. This guide follows Microsoft's current study guide (skills measured as of 20 July 2026). It covers every exam domain in plain language, gives you a 21-day plan, ten hands-on labs you can do on a free account, and 25 practice questions written for this guide.
Quick facts (from Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Exam | AZ-900: Microsoft Azure Fundamentals |
| Level | Fundamentals (no prerequisites) |
| Passing score | 700 (scale 1–1000) |
| Exam time | About 45 minutes of answering time |
| Price | Set by country; check the exam page before booking |
| Renewal | Fundamentals certifications do not expire |
| Free practice | Microsoft's free Practice Assessment on Learn |
Check the official AZ-900 study guide before you book, because Microsoft updates the skills list from time to time.
Is AZ-900 worth it for freshers?
On its own, AZ-900 will not get you a job. Recruiters for cloud support, junior cloud engineer and DevOps trainee roles still treat it as a positive signal, for three reasons:
- It shows you have learned the vocabulary: regions, availability zones, IaaS, PaaS, RBAC, Azure Policy. Interviewers use these words in the first ten minutes.
- It is a cheap, low-risk first exam. You learn how Pearson VUE booking and online proctoring work before you sit a harder associate exam.
- It leads straight into AZ-104, which is the certification hiring managers actually ask about for Azure administrator roles.
If you already work hands-on with Azure, you can usually skip AZ-900 and go straight to AZ-104. If you are a fresher, from a non-IT background, or in sales or presales, take it first.
AZ-900 exam domains and weights
| Domain | Weight |
|---|---|
| Describe cloud concepts | 25–30% |
| Describe Azure architecture and services | 35–40% |
| Describe Azure management and governance | 30–35% |
The middle domain carries the most weight, so spend the most time there.
Domain 1: Cloud concepts (25–30%)
Cloud computing and the shared responsibility model
Cloud computing means renting compute, storage, networking and software over the internet and paying for what you use. Under the shared responsibility model, the provider is always responsible for the physical datacenter, hosts and network. You are always responsible for your data, your devices and who can access them (accounts and identities). The parts in between move with the service type:
- IaaS (for example, Azure Virtual Machines): you manage the operating system, patches, runtime and application.
- PaaS (for example, Azure App Service or Azure SQL Database): Microsoft manages the OS and runtime. You manage the app and its data.
- SaaS (for example, Microsoft 365): you mainly manage users, data and settings.
Cloud models
- Public cloud: shared infrastructure owned by the provider. You pay as you go and can scale quickly.
- Private cloud: infrastructure used by one organisation, either in its own datacenter or hosted.
- Hybrid cloud: public and private connected together. Azure Arc lets you manage on-premises and other-cloud servers from Azure.
Consumption-based model, pricing and serverless
You pay for what you use (OpEx), not for hardware you buy up front (CapEx). Know these pricing options at a high level:
- pay-as-you-go
- reserved instances (a one- or three-year commitment at a lower price)
- spot VMs (spare capacity at a discount, which can be evicted)
Serverless means you run code or services without managing servers, and you are billed per execution or per use. Azure Functions is the standard example.
Benefits of the cloud
Expect scenario questions on each of these:
| Benefit | What it means |
|---|---|
| High availability | The service stays up. SLAs are expressed as uptime percentages. |
| Scalability | Add or remove resources: vertical (a bigger VM) or horizontal (more VMs). |
| Reliability | Recover from failures. Spread resources across zones and regions. |
| Predictability | Predictable performance (autoscale, load balancing) and predictable cost (pricing calculator, budgets). |
| Security and governance | Policies, compliance offerings and built-in security tools. |
| Manageability | Manage resources through the portal, CLI, templates and monitoring. |
Domain 2: Azure architecture and services (35–40%)
Core architectural components
- Region: a geographic area containing one or more datacenters. India has Central India (Pune), South India (Chennai) and West India (Mumbai), plus newer regions.
- Region pairs: many regions are paired with another region in the same geography. Some platform updates and recovery priorities use the pair.
- Sovereign regions: isolated clouds such as Azure Government (US) and Azure operated by 21Vianet (China).
- Availability zones: physically separate datacenters within one region, each with its own power, cooling and networking.
- Resource → resource group → subscription → management group: know this hierarchy. Policies and role assignments applied higher up are inherited by everything below.
Compute and networking
- Virtual machines (IaaS) and Virtual Machine Scale Sets (identical VMs that scale automatically).
- Availability sets, which protect against rack-level failures inside one datacenter.
- Azure Virtual Desktop, which provides Windows desktops and apps hosted in Azure.
- Containers: Azure Container Instances and Azure Container Apps. AKS is managed Kubernetes.
- Azure Functions: event-driven, serverless code.
- App Service: hosting for web apps and APIs.
- Virtual network (VNet) and subnets. Peering connects VNets.
- Azure DNS.
- VPN Gateway: an encrypted tunnel over the internet.
- ExpressRoute: a private connection that does not go over the public internet.
- Public endpoint vs private endpoint: a private endpoint gives a PaaS service a private IP inside your VNet.
Storage
- Storage services: Blob (objects), Files (SMB/NFS shares), Queue (messages), Table (NoSQL key-value), and managed Disks for VMs.
- Access tiers: Hot, Cool, Cold and Archive. Each step down has a lower storage cost and higher access cost. Archive data must be rehydrated before you can read it.
- Redundancy options:
- LRS: three copies in one datacenter.
- ZRS: copies across zones.
- GRS: LRS plus a copy in a secondary region.
- GZRS: ZRS plus a copy in a secondary region.
- RA-GRS and RA-GZRS: as above, with read access to the secondary.
- Moving data:
- AzCopy: command-line copy tool.
- Azure Storage Explorer: desktop GUI.
- Azure File Sync: keeps Windows file servers in sync with Azure Files.
- Migration: Azure Migrate for servers, databases and apps, and Azure Data Box (a physical device) for very large offline transfers.
Identity, access and security
- Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity service.
- Microsoft Entra Domain Services provides managed domain join, LDAP and Kerberos for older (legacy) apps.
- Authentication methods: SSO, MFA and passwordless (Windows Hello, FIDO2 keys, Microsoft Authenticator).
- External identities: B2B guest users from partner companies, and customer identity for public-facing apps.
- Conditional Access: if/then policies on sign-in, for example requiring MFA when a user signs in from outside India.
- Azure RBAC: a role assignment combines who (a security principal), what (a role such as Reader, Contributor or Owner) and where (a scope).
- Zero Trust: verify explicitly, use least privilege, assume breach.
- Defence in depth: layers of protection (physical, identity, perimeter, network, compute, application, data).
- Microsoft Defender for Cloud: security posture management and threat protection across Azure, other clouds and on-premises.
Domain 3: Management and governance (30–35%)
Cost management
- Factors that affect cost: resource type, size, region, bandwidth (outbound data is charged), reservations and licensing. Azure Hybrid Benefit lets you reuse existing Windows Server and SQL Server licences.
- Pricing calculator: estimate the cost of resources before you deploy them.
- Cost Management: analyse spend, set budgets and get alerts.
- Tags: name/value labels such as
env=prodorcostcentre=hr, used for reporting and automation.
Governance and compliance
- Microsoft Purview: data governance, catalogue and compliance across your data estate.
- Azure Policy: enforces rules, such as "only Central India and South India allowed" or "every resource must have a costcentre tag", and reports which resources don't comply.
- Resource locks: CanNotDelete or ReadOnly. A lock overrides even an Owner's permissions until the lock is removed.
Management and deployment tools
- Azure portal
- Cloud Shell (Bash or PowerShell in the browser)
- Azure CLI
- Azure PowerShell
- Azure Arc: manage servers, Kubernetes clusters and data services outside Azure.
- Infrastructure as code: ARM templates (JSON) and Bicep (a simpler language that compiles to ARM). Terraform is a popular third-party option.
Monitoring
- Azure Advisor: personalised recommendations on cost, security, reliability, operational excellence and performance.
- Azure Service Health: Azure incidents and planned maintenance that affect *your* services and regions.
- Azure Monitor: collects metrics and logs. It includes Log Analytics (KQL queries), alerts and Application Insights (application performance monitoring).
21-day AZ-900 study plan
| Days | Focus | Output |
|---|---|---|
| 1–3 | Cloud concepts, shared responsibility, IaaS/PaaS/SaaS | One-page notes in your own words |
| 4–6 | Regions, zones, hierarchy, subscriptions | Draw the resource hierarchy from memory |
| 7–9 | Compute and networking | Labs 1–4 below |
| 10–12 | Storage and redundancy | Labs 5–6 |
| 13–15 | Entra ID, RBAC, Conditional Access, Zero Trust | Lab 7 |
| 16–17 | Cost, Policy, locks, tags | Labs 8–9 |
| 18 | Monitoring tools | Lab 10 |
| 19–20 | Microsoft's free Practice Assessment, twice | Score 80%+ consistently |
| 21 | Revise weak areas, book the exam | Exam booked |
Use the free Microsoft Learn AZ-900 learning path as your main reading. Use this guide as your checklist.
10 hands-on labs (free account)
Hands-on practice is not required to pass AZ-900, but it makes the concepts stick and gives you something to talk about in interviews. Delete everything after each lab.
- Create a resource group in Central India using the portal, then delete it.
- Open Cloud Shell and run
az group create -n rg-az900 -l centralindia, thenaz group list -o table. - Create a small Linux VM and note which resources Azure created alongside it (NIC, disk, public IP, NSG).
- Create a VNet with two subnets and peer it with a second VNet.
- Create a storage account, upload a blob, change its tier to Cool and then Archive, and note what happens when you try to read it.
- Compare LRS and GRS prices for the same account in the pricing calculator.
- Create a test user in Entra ID and assign them the Reader role on one resource group only.
- Assign the built-in Azure Policy "Allowed locations" to your resource group and try to create a resource in another region.
- Add a CanNotDelete lock and try to delete the resource group.
- Create a budget with an alert in Cost Management, and review Advisor recommendations.
25 practice questions with answers
These are original practice questions written for this guide, not exam questions.
1. A company wants to stop managing operating system patches for its web app but still deploy its own code. Which service type fits? PaaS, for example Azure App Service.
2. Under the shared responsibility model, who is always responsible for the data stored in a SaaS application? The customer.
3. Which Azure feature places resources in physically separate datacenters within the same region? Availability zones.
4. You need to apply the same policy to 12 subscriptions. Where do you assign it? At a management group that contains all 12 subscriptions.
5. What is the difference between vertical and horizontal scaling? Vertical scaling changes the size of a resource (a bigger VM). Horizontal scaling changes the number of instances (more VMs).
6. Which connection to Azure does not travel over the public internet? ExpressRoute.
7. Which storage tier has the lowest storage cost but requires rehydration before data can be read? Archive.
8. Which redundancy option keeps copies across availability zones in the primary region and also replicates to a secondary region? GZRS (or RA-GZRS if you also need read access to the secondary).
9. A team must move 80 TB to Azure over a slow link. What should they use? Azure Data Box.
10. Which tool estimates the cost of resources before deployment? The Azure pricing calculator.
11. Which service shows Azure outages affecting your subscriptions and regions? Azure Service Health.
12. Which service gives recommendations to reduce cost and improve reliability? Azure Advisor.
13. What does a ReadOnly lock prevent? Changes and deletion of the resource. Even an Owner must remove the lock first.
14. Which Entra ID feature can require MFA only when users sign in from outside the corporate network? Conditional Access.
15. What are the three parts of an Azure RBAC role assignment? A security principal, a role definition and a scope.
16. Which principle of Zero Trust says to give users only the access they need? Use least-privilege access.
17. What is Azure Arc used for? Managing servers, Kubernetes clusters and data services that run outside Azure (on-premises or in other clouds) from Azure.
18. Which language compiles to ARM templates and is easier to read than JSON? Bicep.
19. Which compute option runs event-driven code and bills per execution? Azure Functions.
20. Which service collects metrics and logs and lets you query them with KQL? Azure Monitor, through Log Analytics.
21. What are tags used for? Organising resources and reporting cost by name/value labels, such as environment or cost centre.
22. Which pricing option gives a discount in exchange for a one- or three-year commitment? Reservations (reserved instances).
23. Which identity service provides managed domain join and Kerberos for legacy apps? Microsoft Entra Domain Services.
24. What does a private endpoint do? It gives a PaaS service, such as a storage account, a private IP address inside your virtual network.
25. Which service provides governance and cataloguing of data across the organisation? Microsoft Purview.
Common mistakes that cost marks
- Confusing availability sets (racks within one datacenter) with availability zones (separate datacenters).
- Confusing Azure Policy (rules about resources) with RBAC (rules about people's access).
- Confusing Service Health (Azure's problems that affect you) with Advisor (recommendations for your setup).
- Assuming GRS lets you read from the secondary region. Only the RA- options allow that.
- Treating fundamentals like an associate exam. Questions test *which service and why*, not commands.
What to do after AZ-900
- Azure administrator path: AZ-104 Azure Administrator, the certification most asked for in Azure job descriptions.
- AI path: after AZ-900, study the Azure AI services interview questions and the Microsoft Foundry tutorial.
- Multi-cloud: many Hyderabad companies hire for AWS and Azure together, so look at the AWS Solutions Architect Associate guide.
- Read the Azure cloud engineer career path and which certifications freshers should take first.
- Browse current IT jobs for freshers to see which skills employers list alongside Azure.
Cloud Soft Solutions in Ameerpet, Hyderabad runs Azure, AWS and DevOps courses with real-time projects and placement support. You'll do the hands-on labs above in class, not only read about them.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What is the passing score for AZ-900?
700 on a scale of 1 to 1000.
Does the AZ-900 certification expire?
No. Microsoft fundamentals certifications do not expire; associate and expert certifications renew every 12 months.
How long should I study for AZ-900?
About three weeks at one to two hours a day is enough for most freshers, using Microsoft Learn plus hands-on labs.
Is AZ-900 required before AZ-104?
No, it is not a prerequisite, but it is a useful first step for freshers and non-IT learners.
Which AZ-900 domain has the highest weight?
Describe Azure architecture and services, at 35–40%.
Is AZ-900 enough to get a job?
Not alone. Pair it with hands-on projects and an associate certification such as AZ-104 for Azure roles.
