Cheat Sheet AZ-900 — Azure Fundamentals

Reviewed edition: October 17, 2026. Reference: official skills effective from July 20, 2026.

This sheet brings together concepts to distinguish and apply in Azure Fundamentals scenarios. Use it for revision after studying and practicing with Microsoft Learn.

Exam map

Percentages are coverage ranges. Microsoft updates the English exam first; translated versions may incorporate changes later. Check the official AZ-900 guide before your exam appointment.

Cloud concepts

Deployment models

A private cloud need not be physically located on company premises. A public-cloud resource can use private connectivity.

Consumption and benefits

• Consumption: spending depends on the service, capacity, usage and purchasing model. Pay-as-you-go and consumption commitments offer different pricing structures.
• CapEx and OpEx: buying infrastructure involves upfront investment; consuming services shifts some spending to operations. Migration does not guarantee savings without usage controls.
• High availability: keep the service operational during certain failures.
• Scaling up: increase or decrease an instance’s capacity.
• Scaling out: add or remove instances.
• Elasticity: adjust capacity to variable demand; automation depends on the service and configuration.
• Reliability: recover from failures and continue delivering the service.
• Predictability: estimate performance and costs using capacity, metrics and tools.
• Security and governance: apply controls, permissions and rules consistently.
• Management: provision, configure and monitor using tools and automation.
• Serverless: the provider manages underlying infrastructure. Servers and customer responsibilities still exist.

Source: cloud concepts and benefits.

Services and shared responsibility

You retain responsibilities for data, identities and access in every model. SaaS does not eliminate account protection and permission configuration. On premises, the organization is responsible for the whole stack.

Source: shared responsibility in the cloud.

Azure architecture

Physical infrastructure

Not every region offers the same services, zones or pairing relationships. Distributing resources across zones and protecting against regional failure are different decisions. Cross-region recovery must be designed according to the service.

Resource organization

Grupo de administración raíz
  └── Grupos de administración
        └── Suscripciones
              └── Grupos de recursos
                    └── Recursos

• Microsoft Entra tenant: identity-directory boundary associated with subscriptions.
• Management group: organizes subscriptions and enables governance at greater scale.
• Subscription: scope for management, access, limits and billing.
• Resource group: logical container for related resources; nested resource groups are not supported.
• Resource: manageable instance, such as a VM, network or storage account.

A resource group can contain resources from different regions. Its location stores group metadata and does not require all resources to be located there.

Source: Azure architectural components.

Compute and hosting

A VM needs compute configuration, disks and connectivity, such as an interface and virtual network. A public IP is optional.

VM vs container: a VM has its own guest operating system; containers share the host operating-system kernel. App Service vs Functions: application hosting versus event-driven function execution.

Source: compute services.

Networking and connectivity

Private connectivity and encryption are different properties: ExpressRoute does not encrypt all traffic by default. Creating a private endpoint does not automatically disable the service’s public access either.

For additional context, Load Balancer distributes transport-layer traffic; Application Gateway routes HTTP/HTTPS web traffic and can incorporate WAF through compatible configuration.

Sources: virtual networks, ExpressRoute and Azure Private Endpoint.

Storage

Services and accounts

The storage account defines options such as region, performance, redundancy and access. General-purpose v2 accounts cover many scenarios; premium options depend on the service and workload.

Blob access tiers

Lower storage prices can mean higher access costs. Early deletion or tier changes may incur charges; conditions depend on the account type. Archive does not provide immediate access.

Source: storage services and tiers.

Redundancy

The geographic copy may lag behind. Redundancy is not a backup: also consider deletions, corruption and historical recovery. Each option’s support depends on the service and region.

Source: Azure Storage redundancy.

Transfer and migration

Source: migration and file movement.

Identity, access and security

Authentication: verify who you are. Authorization: determine what you can do. An Azure RBAC role is not the same as a Microsoft Entra administrative role.

Zero Trust: verify explicitly, grant least privilege and assume breach. Defense in depth: combine controls at multiple layers, such as identity, network, applications and data.

Sources: identity, access and security and Zero Trust in Azure.

Governance and compliance

• CanNotDelete: allows resource modification but prevents deletion.
• ReadOnly: restricts management-plane operations and may affect actions requiring writes.
• Tags do not grant permissions or automatically inherit from a resource group.
• A lock does not replace data-plane controls or a backup strategy.

Azure Blueprints has been in phased retirement since July 31, 2026, with retirement scheduled for January 31, 2027. It is not presented here as a tool for new designs. Microsoft recommends migration toward Deployment Stacks and template specs or Git-versioned templates.

Sources: governance and compliance and Blueprints retirement.

Costs and optimization

Cost may vary by service, SKU, region, duration, storage, operations, licenses and data transfer. Stopping a VM’s operating system does not deallocate it; even deallocated VMs may retain disk or other resource charges.

A budget alerts; it does not automatically stop consumption. Estimates should be reviewed against actual spending and purchasing terms.

Source: cost management in Azure.

Management and deployment tools

Infrastructure as code — IaC: describe and version configuration for consistent repeatable deployments. Bicep is an abstraction over ARM templates, not an “ARM superset”.

Sources: management and deployment tools and what Bicep is.

Monitoring and availability

Revision rule: recommendations → Advisor; platform incidents → Service Health; metrics, logs and alerts → Monitor.

Source: monitoring tools.

An SLA sets service commitments under specific conditions. Its value depends on the product, configuration and architecture. It does not guarantee absolute availability or replace recovery design. See official Azure SLAs to verify any percentage.

Revision scenarios

These are educational examples, not official questions. Practice explaining why each answer fits and which conditions could change it. Complete revision with the official practice assessment.