Mastering Azure Fundamentals means understanding how cloud decisions fit together. A service name alone rarely supplies the full answer: cost, data residency, access controls, operational responsibility and required resilience can change which option suits a workload. This guide uses a single illustrative business application to connect the main AZ-900 concepts rather than repeating a generic timetable.
Microsoft’s active AZ-900 guide dated July 20, 2026 assesses cloud concepts (25–30%), Azure architecture/services (35–40%), and management/governance (30–35%). A broad fundamentals candidate must understand the decision categories, not deploy a production system or memorize advanced CLI syntax.
Model the workload and the cloud boundary
Imagine a small service company operating an on-premises ticketing application with document attachments. It wants remote access for staff, predictable recovery, controlled authorization and greater visibility into operational spending. The cloud question is whether to lift the application to virtual machines, use a managed application host or replace it with software as a service.
A VM can preserve certain legacy dependencies while leaving OS patching and application operations to the customer. A managed application platform can reduce that burden when the application is compatible. SaaS changes the product and operating model further but still requires customer decisions about accounts and data. The shared-responsibility model varies by selected service.
Keeping some databases on-premises while moving the web tier to Azure creates a hybrid architecture. Distributing only across two Azure regions does not itself make a deployment hybrid. Identify the actual locations, control boundaries and required connectivity.
Organize resources and choose a region
A tenant provides an identity boundary. Subscriptions organize billing and access scopes; resource groups gather related resources for management; management groups can coordinate governance across subscriptions. These are not interchangeable containers, and the correct RBAC assignment level depends on the responsibility granted.
The application needs a region that supports its services and satisfies business requirements around latency, residency and compliance. Availability zones can provide separation for supported deployments. Replication and disaster recovery require additional design; selecting a region name alone does not guarantee uptime or recovery.
Sketch the hierarchy, application components and supporting services, then label which team owns changes. A readable diagram with one explicit rule is more useful than several unlabeled clouds.
Compare compute categories rather than favorite products
An Azure VM suits software requiring operating-system control. Azure App Service can host supported web applications while managing parts of the platform. Azure Functions can handle event-driven processing. The best choice follows compatibility, runtime control, scaling requirements and team skills rather than an assumption that one option is always cheapest.
A ticket submitted through a website might trigger a background task to process an attachment. That can illustrate event-driven behavior without requiring a dedicated VM for every task. A continuously running server and a consumption-based execution model incur costs differently, but the bill depends on actual usage and configuration.
Elasticity, scalability, high availability and disaster recovery are separate design goals. Test what happens during a seasonal spike, a failed component and a regional outage; the response and needed controls may differ in each case.
Match networking and storage to access needs
A virtual network and subnets organize private addresses. Routing governs packet paths while network security rules control permitted traffic. A name resolved through DNS still requires a reachable endpoint and appropriate authorization. A network path functioning correctly does not prove a user may read a confidential ticket.
Blob storage suits unstructured objects such as attachments; Azure Files supports managed file shares; managed disks serve virtual machines. The access protocol, application compatibility and backup objectives determine the choice. More copies of data may protect against certain infrastructure failures without satisfying retention, deletion recovery or regulatory obligations.
If the main problem changes from slower downloads to accidental deletion, the preferred response can change from placement or performance tuning to backup, retention and restore testing. Learn that distinction instead of always selecting the highest-redundancy label.
Apply identity and security controls at the correct layer
Microsoft Entra ID can authenticate staff. Azure RBAC authorizes operations on Azure resources within a scope, while application-specific permissions can govern access to ticket records. A successful directory login alone is not permission to change a subscription or see sensitive customer data.
Azure Policy can evaluate supported resource configuration; Defender for Cloud provides security posture and workload-protection capabilities. A resource lock protects against some management changes but is not equivalent to identity authentication or a firewall. The zero-trust access model illustrates why permissions should be based on justified conditions rather than assumed network trust.
A well-designed system defines who may deploy, who may read business data and how those decisions are monitored. Treat those as different questions even when the same individual holds several responsibilities.
Govern deployments and observe actual outcomes
Azure Resource Manager templates or Bicep describe repeatable resource deployments; Azure Policy helps enforce selected governance rules. A template cannot replace every access permission or compliance control. Azure Blueprints once combined several related artifacts, but the preview service is retiring in phases through January 2027. Microsoft now recommends deployment stacks and template specs for relevant replacement capabilities.
The Azure Blueprints lifecycle is relevant when old training recommends Blueprints as a new default. For fundamentals, learn the purpose of declarative deployments, policy and authorization, not an obsolete setup walkthrough.
Azure Monitor collects service metrics and logs. Monitoring and alerting help diagnose reliability and usage, but an alert does not automatically enforce a security rule. Cost Management budgets can warn about spending while some metered charges continue.
Re-evaluate when a business condition changes
Suppose the company now requires that attachments remain within a specific geography. Region and storage choices become central; a generic scalability feature does not solve residency. If it later requires rapid restoration of deleted tickets, retention and tested recovery become critical. If it faces unauthorized users, identity and data permissions deserve priority.
The connections among AZ-900 skills help explain why a decision often involves more than one service. A candidate should be able to name the new constraint and identify which earlier assumption is no longer valid.
Use Microsoft’s current Practice Assessment to test those relationships. A Microsoft AZ-900 exam commercial page is separate from official issuer material and does not guarantee access to real questions. The durable result of preparation is the ability to justify cloud responsibility, service choice and governance under unfamiliar conditions.