Reviewing the AZ-900 outline

Four weeks before his exam, Theo books the boardroom for an hour on his own and works through the AZ-900 outline on the whiteboard, one skill area at a time, saying each objective aloud and explaining it to an empty room. Renata walks in halfway through the governance section and listens for a minute. "Good," she says. "Now do it again in three weeks, faster, and with the things you got wrong in the practice assessment." This lesson is Theo's whiteboard session in written form: a structured review of the AZ-900 skills outline dated July 20, 2026, with the key ideas in each area, the distinctions the exam likes to test, and original practice items. It assumes you have studied MSAZ-101 and MSAZ-102 and uses them as the reference for detail.

Area 1: Describe cloud concepts (25 to 30)

The first area asks you to explain what cloud computing is, why organizations use it and the main ways it is offered. You should be able to describe the shared responsibility model: the cloud provider is always responsible for the physical datacenter, network and hosts, the customer is always responsible for their data, identities and devices, and the split for everything in between depends on the service type. You should be able to compare public, private and hybrid clouds, and to describe the consumption-based model, in which you pay for what you use instead of buying capacity in advance. That model shifts spending from capital expenditure, money spent up front on assets, to operational expenditure, money spent on services as they are used.

The benefits objectives cover high availability, scalability, reliability, predictability, security, governance and manageability. The exam likes the difference between availability and scalability. High availability means a service stays up despite failures, usually through redundancy. Scalability means a service can handle more or less load by adding or removing resources: scaling out or in adds or removes instances, and scaling up or down changes the size of an instance. Elasticity is scalability that happens automatically as demand changes. The service type objectives ask you to tell IaaS, PaaS and SaaS apart and to match each to scenarios. Harrow & Finch's virtual machines are IaaS, the App Service trial of the website is PaaS, and the HR and payroll system is SaaS.

Area 2: Describe Azure architecture and services (35 to 40)

This is the largest area. Core architectural components include regions, region pairs and sovereign regions, availability zones, datacenters, and the management structure of resources, resource groups, subscriptions and management groups. Theo can recite Harrow & Finch's own design: primary region Central US, with three availability zones, paired with East US 2, management groups under the tenant root, and separate subscriptions for connectivity, identity, production workloads and non-production. Know that a resource belongs to exactly one resource group, that resource groups cannot be nested, that a subscription can hold many resource groups, and that management groups organize subscriptions and can be nested.

The compute and networking objectives cover virtual machines and their options for availability, such as availability sets and scale sets; Azure Virtual Desktop; containers, including Azure Container Instances and Azure Container Apps, and Azure Kubernetes Service; Azure Functions; and application hosting such as App Service. Networking covers virtual networks and subnets, peering, Azure DNS, VPN Gateway, ExpressRoute and the idea of public and private endpoints. The storage objectives cover storage accounts, redundancy options from locally redundant to geo-zone-redundant, the storage services (Blob, Files, Queue, Table and Disks), access tiers, and migration tools such as Azure Migrate and Data Box. The identity, access and security objectives cover Microsoft Entra ID, authentication methods, external identities, Conditional Access, Azure role-based access control, Zero Trust, the defense-in-depth model and Microsoft Defender for Cloud.

Area 3: Describe Azure management and governance (30 to 35)

The cost objectives cover the factors that affect cost (resource type and size, region, data leaving Azure, reservations, savings plans and the Azure Hybrid Benefit), the pricing calculator, and Cost Management's budgets, alerts and analysis, and the purpose of tags. As MSAZ-102 explained, Microsoft Learn now says the older Total Cost of Ownership calculator has been retired, so be careful with study material that still teaches it. The governance and compliance objectives cover Microsoft Purview, Azure Policy and resource locks. The management and deployment objectives cover the Azure portal, Azure Cloud Shell, the Azure CLI and Azure PowerShell, Azure Arc, infrastructure as code, Azure Resource Manager and ARM templates. The monitoring objectives cover Azure Advisor, Azure Service Health and Azure Monitor, including Log Analytics, alerts and Application Insights.

Three governance tools are often confused, and AZ-900 tests the difference. Azure role-based access control decides who can do what on which scope. Azure Policy decides what resources may look like, for example which regions are allowed or which tags are required, and can deny, audit or modify. A resource lock prevents deletion or change of a resource regardless of permissions, until the lock is removed. Harrow & Finch uses all three: roles for the operations team, a policy that allows only US regions, and delete locks on the connectivity and identity resource groups after a near miss in October.

A worked calculation: composite availability

Fundamentals exams rarely ask for arithmetic, but one calculation helps you reason about availability. When a solution depends on several services in a chain, the chance that all of them are up at once is the product of their individual availabilities. If a web app is available 99.95 out of every 100 minutes and its database 99.99, the pair together is available a little less than either. The code multiplies them using example figures. The figures are illustrations, not Microsoft's current service level agreements, which differ by service and configuration.

web = 0.9995      # example availability of a web app
db = 0.9999       # example availability of a database
both = web * db
minutes_per_month = 30 * 24 * 60
print("combined availability:", round(both * 100, 3), "out of 100")
print("expected downtime per month:", round((1 - both) * minutes_per_month), "minutes")

combined availability: 99.94 out of 100
expected downtime per month: 26 minutes

The lesson for the exam is qualitative: adding dependencies lowers availability, and adding redundancy, such as running instances across availability zones, raises it. If a question asks how to improve the availability of a solution, look for options that add redundancy across failure boundaries rather than options that make a single component bigger.

Original practice items

Try each of these before reading the answer. (1) A company wants to pay only for the compute it uses each month instead of buying servers every five years. Which model describes this? The consumption-based model, which moves spending from capital to operational expenditure. (2) A team needs to ensure that nobody, even an owner, can accidentally delete a production resource group. What should they apply? A delete lock. (3) A solution must survive the loss of a single datacenter in its region with no data loss. Which feature fits best? Availability zones, with zone-redundant services. (4) True or false: tags applied to a resource group are automatically applied to the resources in it. False; tags are not inherited, although Azure Policy can be used to copy them. (5) Which tool would recommend shutting down an idle virtual machine to save money? Azure Advisor, in its cost category.

(6) A company wants a dedicated private connection from its head office to Azure that does not travel over the public internet. Which service? ExpressRoute. (7) Which service type leaves the customer responsible for patching the operating system: IaaS, PaaS or SaaS? IaaS. (8) A developer wants to run a small piece of code whenever a file arrives, without managing servers. Which service? Azure Functions. Writing your own items like these, as Lesson 4 suggested, is the most effective way to review this outline.

Questions that cross areas

Many AZ-900 items mix areas, because real decisions do. A question about storage redundancy may really be asking about cost: geo-redundant storage keeps copies in the paired region, which improves resilience but costs more than locally redundant storage. A question about virtual machines may really be about shared responsibility: on a virtual machine, the customer patches the operating system, whereas on App Service, Microsoft does. A question about a policy that restricts regions may really be about compliance and data residency. When you review, practice asking of each item: which areas does this touch, and which requirement in the question decides between them?

Harrow & Finch supplies plenty of cross-area examples. Moving the 9 terabytes of file shares to Azure Files touches storage services, redundancy options, cost and identity, because staff must keep their existing permissions. Moving StockLine touches compute choices, availability zones, networking to the hub, governance through policy and tags, and monitoring once it is live. Theo writes one cross-area practice item for each Skylight workload, and finds them harder, and more useful, than single-topic items.

A one-page summary

In the last week, Theo condenses everything into one page per skill area, written from memory and then checked against his notes. Each page has three parts: the key terms with one-line definitions, the pairs and triples that are easy to confuse, and the five practice items he got wrong most often. Writing the pages is itself a strong retrieval exercise, and the result is a short document he can review in fifteen minutes on the morning of the exam without starting anything new. He keeps the pages to plain words, avoids copying sentences from Microsoft Learn, and tests himself on each page by covering the definitions and saying them aloud.

At the end of his session, Theo photographs the whiteboard and adds three entries to his mistakes log: the storage redundancy options, which he keeps mixing up; the difference between Azure Container Instances and Azure Container Apps; and the retirement of the TCO calculator, which his video course still teaches.