UPDATED JAN 2026
AZ-900 Study Guide 2026
This guide covers what you need to know to pass AZ-900 in 2026 — the domain breakdown, what is actually tested in each area, how to study efficiently, and what changed in the January 2026 update.
⚠ If you are using prep material from before January 2026, you are missing 11 new exam objectives. See the full list of changes →
Exam overview
- Questions: 40–60 (exact number varies per test)
- Time: 45–60 minutes
- Passing score: 700 / 1000 (scaled scoring — aim for 80%+ on practice tests)
- Format: Multiple choice, drag-and-drop, scenario-based, case studies
- Retake policy: Wait 24 hours after first failure; restrictions apply after multiple fails
- Expiry: AZ-900 is a Fundamentals certification and does not expire
- Delivery: Online proctored or at a Pearson VUE test centre
Domain weights — the most important thing to understand
The three exam domains are not equally weighted. Most people who fail do so because they studied the wrong proportions.
| Domain | Weight | Study priority |
|---|---|---|
| Domain 1: Cloud Concepts | 25–30% | Solid foundation, but don't over-invest here |
| Domain 2: Azure Architecture & Services | 35–40% | Heaviest domain — go broad, know each service's use case |
| Domain 3: Management & Governance | 30–35% | Most under-studied — give it equal time to Domain 2 |
Domain 3 is nearly as heavy as Domain 2 and is the most commonly skipped. Cost management tools, Azure Policy, RBAC, monitoring, and SLAs cause more failures than any other content area.
Domain 1: Cloud Concepts (25–30%)
Domain 1
What the exam tests
- Cloud definition: The NIST 5 characteristics — on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service
- Shared Responsibility Model: Who manages what in IaaS, PaaS, and SaaS. Customer always owns data and user access. Microsoft always owns physical security.
- Service models: IaaS (you manage OS and above), PaaS (you manage app and data only), SaaS (you manage data and access only)
- Deployment models: Public (shared, OpEx), Private (dedicated, CapEx), Hybrid (connected), Multi-cloud (2+ providers)
- 8 cloud benefits: High Availability, Scalability, Elasticity, Reliability, Predictability, Security, Governance, Manageability
- CapEx vs OpEx: On-premises = CapEx. Cloud = OpEx. Know scenario-based questions.
- NEWServerless computing: Event-driven, scales to zero, pay per execution, no server management
- NEWHA vs DR / RTO vs RPO: High Availability minimises downtime; Disaster Recovery recovers from catastrophic failure. RTO = restore time. RPO = data loss window.
- NEW6 Rs of migration: Rehost, Refactor, Rearchitect, Rebuild, Replace (SaaS), Retire
Domain 2: Azure Architecture & Services (35–40%)
Domain 2 — Heaviest domain
Core infrastructure
- Regions, Availability Zones, Region Pairs — AZs protect DC failure; Region Pairs protect regional failure
- Management Groups → Subscriptions → Resource Groups → Resources. Rules flow down, billing flows up.
- NEWARM Templates (JSON) and Bicep: declarative IaC, idempotent, version-controlled. Bicep compiles to ARM JSON.
Compute
- Virtual Machines: deallocated ≠ stopped (stopped from OS still bills). Scale Sets for auto-scale.
- App Service: PaaS web hosting, no OS management
- Azure Functions: serverless, event-driven, pay per execution
- ACI: fastest way to run a container, no cluster needed. AKS: managed Kubernetes at scale.
Networking
- VNets, Subnets, NSGs (L4, lower number = higher priority)
- VPN Gateway: encrypted over internet. ExpressRoute: private line, NOT over internet.
- DDoS Basic (free). Standard (paid, per-VNet, ML-tuned).
- NEWAzure DNS: public zones (internet-facing) vs private zones (internal VNet resolution)
Storage
- Redundancy: LRS → ZRS → GRS → GZRS (most resilient)
- Blob tiers: Hot → Cool (30d min) → Cold (90d min) → Archive (180d min, hours to rehydrate)
Identity & Security
- Entra ID: cloud identity, SSO, MFA, Conditional Access
- NEWPasswordless authentication: Windows Hello, FIDO2, Microsoft Authenticator — co-equal with MFA and SSO
- NEWManaged Identity: System-Assigned (1 resource, deleted with it) vs User-Assigned (independent, shareable). No credentials in code.
- NEWEntra ID roles (directory) vs Azure RBAC roles (resources) — completely separate systems. Global Admin ≠ Owner.
Other services tested
- NEWMessaging: Service Bus (reliable delivery) vs Event Hubs (high-throughput streaming) vs Event Grid (event routing)
- NEWAzure AI Foundry (renamed from Azure AI Studio): build and deploy AI models including GPT-4
- Azure SQL DB (PaaS, new apps) vs SQL Managed Instance (near-100% compat, lift-and-shift) vs Cosmos DB (globally distributed NoSQL)
Domain 3: Management & Governance (30–35%)
Domain 3 — Most under-studied, nearly as heavy as Domain 2
Cost tools — the most-tested three-way distinction
| Tool | When to use it |
|---|---|
| Pricing Calculator | BEFORE deploying — estimate future costs |
| TCO Calculator | BEFORE migrating — compare on-prem vs Azure |
| Cost Management + Billing | AFTER deploying — track actual spend |
| Azure Advisor | Anytime — free recommendations across 5 pillars |
Cost reduction
- NEWSavings Plans: flexible (any compute, commit $/hr). Up to 65% savings.
- Reservations: specific VM SKU + region, 1 or 3 years. Up to 72% savings.
- Hybrid Benefit: bring existing Windows/SQL licences. Up to 85% savings.
- Spot VMs: spare capacity, 90% discount — can be evicted with 30s notice.
Governance
- Azure Policy effects: Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, Disabled
- Resource Locks: CanNotDelete and ReadOnly. Override RBAC — even Owner cannot delete a locked resource.
- Tags: max 50 per resource, not inherited by children, enforce via Policy
- Blueprints: versioned, bundled RG + ARM + RBAC + Policy. Tracked assignments.
RBAC
- Roles: Owner > Contributor > Reader > User Access Administrator
- NEWEntra ID roles manage the directory. Azure RBAC roles manage resources. Separate systems, no automatic overlap.
Monitoring
- Azure Monitor: Metrics (93 days) + Logs (2 years) + Alerts + Action Groups
- Azure Service Health: personalised alerts for your services and regions
- Azure Status (status.azure.com): global public page, not personalised
- Resource Health: health of your specific resource instance
SLAs — know these numbers
| SLA | Max monthly downtime | Example |
|---|---|---|
| 99% | 7.3 hours | Some free services |
| 99.9% | 43 minutes | Single VM |
| 99.95% | 22 minutes | Availability Set |
| 99.99% | 4 minutes | Availability Zones |
Composite SLA (services in series) = multiply individual SLAs. 99.9% × 99.9% = 99.8%. Free and Preview services have no SLA.
Compliance
- Microsoft Trust Center: public overview of Microsoft's compliance and security practices
- Service Trust Portal: download actual third-party audit reports (login required)
- Microsoft Purview: data governance across all cloud environments
How to study efficiently
The method that works: Read a topic once, then immediately do 10–15 practice questions on that topic. Use wrong answers to identify gaps and go back to those specific sections only. Do not re-read passively — test actively.
Recommended study schedule (4 weeks)
- Week 1: Domain 1 — cloud concepts, service models, shared responsibility, CapEx/OpEx, cloud benefits, serverless, HA/DR
- Weeks 2–3: Domain 2 — go through each service area (compute, networking, storage, identity). Domain 2 is the widest; don't rush it.
- Week 3–4: Domain 3 — cost tools, policy, RBAC, monitoring, SLAs. This is the most commonly under-studied domain.
- Final 2–3 days: Full timed practice tests. Aim for 80%+ before booking. Focus Wrong Only and Weak Spots modes.
What the exam actually tests
AZ-900 questions are scenario-based. You will not be asked "define IaaS." You will be asked: "A company needs to run a web application without managing the OS or runtime. Which Azure service fits?" The answer is App Service (PaaS). Knowing the definition of IaaS is not enough — you need to know which Azure service maps to which scenario.
Practice this actively: for every service you study, ask yourself — what problem does it solve? When would I use this instead of a similar service?
Frequently asked questions
How long does it take to study for AZ-900?
2 to 8 weeks depending on your background. Someone with IT experience spending 1.5 hours/day typically passes in 3 to 4 weeks. No technical background: allow 6 to 8 weeks. Consistent daily practice matters more than long single sessions.
What score do you need to pass AZ-900?
700 out of 1000. Aim for 80%+ on practice tests before you book — the real exam is slightly harder than most practice sets.
Is AZ-900 hard?
It is passable for anyone who studies consistently, but it is not trivial. Candidates who only read theory without doing practice questions often fail despite understanding the content. The January 2026 update added 11 new objectives that older courses may not cover.
Which domain is hardest?
Domain 3 (Management and Governance) causes the most failures. It is 30–35% of the exam and covers cost tools, Azure Policy, RBAC, monitoring, and SLAs — less exciting than compute and networking but heavily tested. Give it at least as much study time as Domain 2.
Ready to practice?
595 flashcards and 540 practice questions — all weighted to these domain proportions, all updated for January 2026.
See the full bundle at az900prep.com →