AZ-900 cheat sheet — every exam topic on one page

Describe cloud concepts

What Is Cloud Computing? An Azure AZ-900 Guide

• Cloud computing is the on-demand delivery of compute, storage, and networking over the internet, paid for on a pay-as-you-go basis.
• The consumption-based model means you pay only for the resources you use, with no large up-front purchase and no charge for capacity you have not requested.
• Cloud shifts spending from a capital expense (CapEx — buying and owning datacenter hardware) to an operating expense (OpEx — paying for a service as you consume it).
• Pay-as-you-go has no commitment and the highest rate; a reservation (a VM series in one region, one or three years) gives a deeper discount but is billed whether used or not; a savings plan discounts committed spend across changing sizes and regions; Spot VMs are cheapest but can be evicted.
• Reserve the steady baseline and use pay-as-you-go for peaks. A deallocated VM stops compute charges, but its managed disks keep billing.
• Serverless still runs on servers — the provider manages them; code runs on events, scales automatically and is billed per execution, with little or no idle cost (unlike an App Service plan, which bills while idle).
• You always own your information and data, devices, and accounts and identities; the provider always owns the physical datacenter, network and hosts; the OS, network controls, applications and directory infrastructure shift with IaaS, PaaS and SaaS.
• Public clouds are open to anyone who buys services (low cost, fast scale); a private cloud serves a single entity, onsite or offsite (maximum control and strict compliance); hybrid interconnects the two (for example, to surge for temporary demand); multicloud uses two or more public providers.
• Azure Arc manages resources where they already run; Azure VMware Solution runs VMware workloads in Azure.

Benefits of Cloud Services: An Azure AZ-900 Guide

• High availability keeps applications running with minimal downtime through redundancy; an SLA states the provider's uptime commitment.
• Read an SLA as allowed downtime: in a 30-day month 99.9% allows about 43 minutes, 99.95% about 22, and 99.99% about 4; each extra nine divides downtime by ten.
• Vertical scaling changes one resource's power (scale up/down); horizontal scaling changes the number of resources (scale out/in).
• An application that cannot spread its work across several servers cannot use extra instances; until it is redesigned, it can only scale up.
• Scaling by hand is scalability; capacity that follows measured demand automatically is elasticity.
• Fault tolerance keeps the service running through a failure with no outage; disaster recovery restores service after an outage has happened.
• Predictability covers performance (consistent response as demand changes) and cost (forecasting and tracking spend).
• PaaS, serverless, and SaaS hand OS patching to the provider but give up OS administrator access; OS-level requirements keep you on IaaS.
• Governance sets, enforces, and audits rules such as tags, approved regions, and naming standards.
• Management of the cloud is automation (autoscale, templates, auto-replacing failed resources, metric alerts); management in the cloud is the portal, CLI, PowerShell, and APIs.

IaaS vs PaaS vs SaaS: Cloud Service Types Explained

• The three cloud service types are IaaS, PaaS, and SaaS; moving up the ladder the provider manages more, you manage less, and flexibility falls (IaaS most flexible, SaaS least flexible but easiest to start).
• IaaS: the provider maintains hardware, connectivity and physical security; you own the OS, network and storage configuration, and everything above. Azure update tooling and scale sets do not change that.
• PaaS: the provider maintains the OS, middleware, runtime and tools (no OS or database licensing or patching for you); network settings such as firewall rules are shared; you own your code, the libraries you bundle, app releases, data and access.
• SaaS: the provider runs and fixes the application itself; you keep your data, identities and access (including accounts in your own Entra ID tenant) and the devices allowed to connect.
• The same workload can sit at different types: SQL Server on Azure VMs is IaaS, while Azure SQL Database, SQL Managed Instance and Azure Database for MySQL flexible server are PaaS.
• Use cases: IaaS for lift-and-shift, test/dev and OS-level control; PaaS as a development framework and for analytics/BI; SaaS for email and messaging, productivity and finance/expense tracking (plus payroll, CRM and similar ready-made apps).
• Configuring settings in a finished app is still SaaS; DaaS (Azure Virtual Desktop) delivers hosted desktops and is not one of the three main types.

Describe Azure architecture and services

Azure Regions, Availability Zones & Resource Hierarchy

• Datacenters make up regions and regions make up geographies; the finest placement you can choose is a region plus, where offered, an availability zone, never a specific datacenter.
• Regions differ in latency, service availability, price and compliance; some services, such as Microsoft Entra ID, Azure Traffic Manager and Azure DNS, are global and have no region.
• Region pairs give a recovery sequence, staggered updates and (almost always) same-geography replication, but many newer regions are unpaired and no pair gives automatic failover.
• GRS replicates to the fixed paired region; Brazil South pairs with South Central US, so its secondary copy is in the United States.
• Sovereign regions such as Azure Government and Azure operated by 21Vianet are isolated Azure instances; a public region in a country gives only data residency.
• Availability zones are separate datacenters in one region: zonal pins a resource to one zone, zone-redundant replicates it across zones, and only a second region survives a region outage.
• Every resource is in exactly one resource group; groups do not nest, can hold resources from many regions, store metadata in their own fixed location, and delete everything inside when deleted.
• A subscription is the billing and access boundary and is not tied to a region; management groups pass settings to every subscription beneath them, each of which has exactly one parent.

Azure Compute & Networking Services Explained

• Compute options trade control for convenience: virtual machines give the most control, containers add portability, and Azure Functions need the least management.
• Containers share the host operating system kernel and package only the app and its dependencies; a VM runs a full guest operating system.
• Azure Container Instances runs a single container (or small group) with no servers to manage; Azure Kubernetes Service orchestrates many containers at scale.
• Azure Functions is serverless and event-driven; on consumption plans you pay per execution, so idle code costs almost nothing.
• A VM needs a size, an OS disk, and a network interface in a VNet subnet; a public IP address and an NSG are optional additions.
• Scale sets change the number of identical VMs with demand; a load balancer only spreads traffic; availability sets spread VMs across fault and update domains within one datacenter.
• Azure Virtual Desktop delivers Windows desktops and apps from Azure; pooled host pools with Windows Enterprise multi-session let several users share one VM.
• Azure App Service hosts web apps and APIs from code or a container image without server management, but gives no OS-level access.
• Peering joins VNets over Microsoft's backbone with no gateway, within or across regions, and is not transitive.
• Azure DNS hosts public and private DNS zones but is not a domain registrar; you delegate a domain to it from the registrar.
• VPN Gateway offers site-to-site, point-to-site, and VNet-to-VNet encrypted tunnels over the internet; ExpressRoute is a private connection that avoids the internet.
• A private endpoint gives a service a private IP in your VNet through Private Link; it does not close the public endpoint, and a service endpoint keeps the public IP.

Azure Storage Services, Tiers & Redundancy: AZ-900

• Azure Blobs store unstructured objects by URL; Azure Files are SMB/NFS shares many machines mount; Azure Queues hold messages for asynchronous work; Azure Tables are NoSQL key-value; Azure Disks are block volumes attached to a VM as a local drive.
• Hot, cool, and cold are online tiers (immediate reads); archive is offline and cheapest to store. Minimum retention is 30 days for cool, 90 for cold, and 180 for archive, with a prorated early deletion charge.
• An archived blob must be rehydrated (up to about 15 hours) by changing its tier to an online tier or copying it to an online-tier blob; archive can never be the account default tier.
• LRS keeps three copies in one datacenter and ZRS across three availability zones; both stay in one region. GRS and GZRS add a copy in the paired secondary region to survive a regional outage.
• A GRS or GZRS secondary is readable only after a failover; RA-GRS and RA-GZRS allow reads from the secondary at any time.
• GRS and GZRS share the same durability design; GZRS adds zone redundancy in the primary region, so it stays available through a zone failure without failover.
• A storage account's globally unique name forms its endpoints (for example <account>.blob.core.windows.net); standard general-purpose v2 is the default, and premium SSD account types are specialized, such as premium file shares.
• AzCopy scripts copies, Storage Explorer is the graphical tool, Azure File Sync keeps Windows file servers in sync with Azure Files (cloud tiering keeps hot files local), Azure Migrate discovers, assesses, and migrates workloads, and Data Box ships data in or out when bandwidth is limited.

Azure Identity, Access & Security: AZ-900 Guide

• Microsoft Entra ID (formerly Azure AD) is the cloud identity and directory service; Microsoft Entra Domain Services adds managed domain join, Group Policy and Kerberos/NTLM without you running domain controllers, unlike self-managed AD DS on Azure VMs.
• SSO gives one identity and one sign-in for many apps; MFA needs two or more factor categories (know, have, are), and location is not one of them; passwordless replaces the password with a device plus PIN or biometric, still two categories.
• Microsoft Entra External ID lets partners (B2B guests using their own work accounts) and customers (social or local accounts) sign in while you control access.
• Conditional Access acts at sign-in on signals about the attempt (user, sign-in location, device, app, risk) to allow, block or require controls such as MFA or a compliant device; it does not grant permissions on resources.
• Azure RBAC authorizes actions on resources through role assignments (principal + role + scope) that are inherited downward; Owner can grant access, Contributor cannot, User Access Administrator manages access only, and roles such as Virtual Machine Contributor narrow permissions further.
• Azure Policy governs what resources may look like; RBAC governs who may act on them; logs record what was done.
• Zero Trust: verify explicitly, use least privilege (including just-in-time access) and assume breach (segment, encrypt end to end, limit blast radius). Defense in depth stacks independent layers from physical to data.
• Microsoft Defender for Cloud scores security posture (secure score = how closely resources follow its recommendations) and raises threat alerts for workloads, including hybrid and multicloud ones.

Describe Azure management and governance

Azure Cost Management: Estimate, Monitor, and Reduce Cloud Spend

• Azure costs depend on resource type, consumption, maintenance (leftover resources), geography, network traffic, subscription type, and Azure Marketplace purchases.
• Deallocating a VM stops its compute charges, but its disks keep billing; deleting a VM can leave disks and public IPs behind (depending on delete options), and they keep billing until removed.
• Inbound data is generally free; outbound data is billed by billing zone, and transfer between continents costs more than within one.
• The pricing calculator estimates a planned design and never deploys or charges anything; the TCO calculator is retired.
• Microsoft Cost Management provides cost analysis, budgets, and cost alerts (budget, credit, department spending quota) for actual spend.
• A budget only notifies unless an action group runs automation; a spending limit exists only on credit-based offers and disables the subscription.
• Reservations suit fixed capacity, savings plans suit steady spend across compute services, Spot suits interruptible work; Hybrid Benefit stacks with reservations.
• Tags allocate costs but are not inherited; Azure Policy can add a resource group's tag to its resources.

Azure Governance and Compliance: Purview, Policy, and Resource Locks

• Microsoft Purview governs data across Azure, on-premises and other clouds: its data map and catalog find data, classification labels sensitive data, lineage shows how data flows, and data loss prevention helps stop sensitive data leaking.
• Azure Policy governs resource configuration with rules such as allowed regions, required tags, allowed SKUs and required settings like HTTPS-only storage.
• Audit reports non-compliance, deny rejects non-compliant create or update requests, and modify adds or corrects a property; only deny meets a "must stop" requirement.
• A new policy assignment reports existing non-compliant resources but never deletes them; a remediation task applies a modify policy to resources that already exist.
• Policy assignments and initiatives are inherited by every child scope and resource, including ones created later; an initiative groups related definitions so they are assigned and tracked as one.
• RBAC controls who can perform actions; Azure Policy controls what configurations are allowed, and both often apply together.
• CanNotDelete blocks deletion but allows changes; ReadOnly blocks changes and deletion. Locks are inherited from a parent scope, including by resources added later.
• Locks apply to everyone; only roles with lock permissions such as Owner or User Access Administrator (not Contributor) can remove one, as a separate step before the blocked action.
• Azure Blueprints is retiring (fully by 31 January 2027) and is not in the AZ-900 outline — governance questions test Azure Policy, RBAC and resource locks.

Azure Management and Deployment Tools: Portal, CLI, PowerShell, Arc and IaC

• The Azure portal is the web-based GUI for managing Azure; dashboards are views of pinned tiles that start private and, when shared, become Azure resources whose access follows Azure RBAC.
• Azure Cloud Shell is a browser-based Bash or PowerShell shell (portal or shell.azure.com) with the Azure CLI and Azure PowerShell preinstalled; it runs as you, and files persist only if you attach a storage account.
• Azure CLI uses az commands and Azure PowerShell uses Verb-Noun cmdlets; both run on Windows, macOS and Linux, with Azure PowerShell relying on PowerShell 7 outside Windows.
• Choose the portal for occasional, visual work and a CLI or PowerShell script when steps must be repeated identically.
• Azure Arc manages servers, Kubernetes clusters, data services such as SQL Server, and VMware or SCVMM environments outside Azure where they run; Azure Migrate, Site Recovery and AKS move or host workloads in Azure instead.
• Declarative IaC (ARM templates, Bicep) states the end result; imperative scripts (CLI, PowerShell) list the steps.
• Azure Resource Manager handles every request from every tool, authorizing it with Azure RBAC and enforcing locks and Azure Policy consistently.
• ARM templates (JSON) and Bicep (compiles to ARM JSON) give idempotent redeployment, dependency ordering with parallel deployment, validation before changes and reusable modules; a failed deployment is not rolled back by default.

Azure Monitoring Tools: Advisor, Service Health and Azure Monitor

• Azure Advisor gives free, personalized recommendations across five categories: cost, security (from Microsoft Defender for Cloud), reliability, operational excellence, and performance; you can postpone or dismiss them.
• Azure Monitor collects the data (for example, that a VM is idle); Azure Advisor turns that kind of usage into an actionable recommendation (resize or shut it down).
• Azure Service Health has three parts: the global Azure status page, personalized Service Health events (service issues, planned maintenance, health advisories), and Resource Health for one individual resource.
• Resource Health shows the current and past availability of a single resource and whether a problem was platform-initiated or user-initiated.
• Azure Monitor is the full-stack platform for metrics and logs from Azure, on-premises and other-cloud resources; metrics are lightweight and near real time (Metrics explorer), logs are queried in depth with KQL (Log Analytics).
• The activity log records operations performed on resources; diagnostic settings route resource logs to destinations such as a Log Analytics workspace.
• An alert rule defines the condition; a reusable action group defines who is notified and what runs. Service Health alerts use action groups too.
• Application Insights is Azure Monitor's APM feature for a web app's response times, failures and usage, and its availability tests probe a URL from locations worldwide without code changes.
• Match the need to the tool: improve my resources means Advisor, is Azure affecting me means Service Health, and how are my apps and resources behaving means Azure Monitor.