What the exam is and how it is scored

Microsoft Azure Fundamentals (AZ-900) is built around three skill areas. The weightings below are the skills measured as of July 20, 2026:

• Describe cloud concepts (25–30%)
• Describe Azure architecture and services (35–40%)
• Describe Azure management and governance (30–35%)

A score of 700 or greater is required to pass.

This guide covers the third area, which is worth between a little under a third and a little over a third of the exam. The area spans four topics: cost management, governance and compliance tools, tools for managing and deploying resources, and monitoring tools. Much of the material is about matching a need to the right tool, so the skill to build is telling similar-sounding tools apart. The source material is Microsoft Learn, licensed CC BY 4.0.

Cost management

What drives cost

Azure is consumption-based: you rent what you need and release it when you are done. The material lists six factors that affect cost:

• Resource type. The type, its settings and the region all matter. For a VM that includes operating system licensing, cores, attached storage and the network interface.
• Consumption. Under pay-as-you-go you pay for what you use in a billing cycle.
• Maintenance. Deprovisioning a VM may leave its storage and networking behind, and those keep costing money.
• Geography. Power, labour, taxes and fees differ by location, so the same resource can cost different amounts in different regions.
• Subscription type. Some subscriptions include usage allowances. A free trial gives credit to spend in the first 30 days, free access to certain products for 12 months, and more than 25 products that are always free.
• Azure Marketplace. You may pay for the Azure services plus the third-party vendor, and the vendor sets the billing structure.

Network traffic has its own rules. Some inbound transfers are free. Outbound transfers are priced by billing zone, which is a geographical grouping of regions used for data-transfer pricing. A billing zone is not an availability zone.

Pricing calculator versus Cost Management

These two are easy to confuse because both involve money.

• The pricing calculator estimates cost before you deploy. Nothing is provisioned and nothing is charged when you add resources to it. The Total Cost of Ownership (TCO) calculator has been retired.
• Cost Management analyses, monitors and controls cost after you deploy.

Cost analysis, a feature of Cost Management, shows spend by billing cycle, region, resource, subscription, resource group or service.

Alerts and budgets

Cost alerts collect three alert types: budget alerts, credit alerts and department spending quota alerts.

• Budget alerts fire when spending reaches or exceeds a threshold you define. In the Azure portal budgets are defined by cost. With the Azure Consumption API you can also define them by consumption usage.
• Credit alerts fire when an Azure Prepayment is consumed, automatically at 90% and 100% of the credit balance. Prepayment is for Enterprise Agreement (EA) customers.
• Department spending quota alerts are also specific to EA customers. They fire at fixed thresholds of a department's quota, such as 50 or 75 percent.

A budget is a spending limit you can set for a subscription, resource group, service type or other criteria. Budgets can also trigger automation, for example shutting down nonproduction resources when a threshold is reached.

Tags

A tag is a name and value pair of metadata on a resource. Tags support resource management, cost reporting and allocation, operations management (grouping by how critical availability is), security classification, governance and compliance, and workload automation.

Two rules matter for the exam:

• Resources do not inherit tags from their subscription or resource group.
• You do not have to tag everything. For example, only mission-critical resources might carry an Impact tag.

You manage tags in the portal, PowerShell, the Azure CLI, ARM templates or the REST API. Azure Policy can enforce tagging rules, such as requiring a tag on new resources or reapplying one that was removed.

Cost optimization options

The deciding word in a question is usually predictable, flexible or interruptible. Spot capacity can be evicted when Azure needs it back, so it suits fault-tolerant work only.

Governance and compliance

Azure Policy

Azure Policy lets you create, assign and manage policies that control or audit your resources so configurations stay compliant with your standards. Know these points:

• It evaluates resources and highlights those that are not compliant. It can also prevent noncompliant resources from being created.
• It evaluates existing resources too, including those created before the policy existed.
• An initiative is a group of related policy definitions that track compliance against a larger goal.
• Policies are set at the resource, resource group or subscription level and are inherited by everything beneath.
• Policy can sometimes remediate automatically, for example adding a missing tag. Resources can be marked as exceptions.

Resource locks

A resource lock prevents accidental deletion or change, even by people whose access would otherwise allow it. Locks can be applied to a resource, a resource group or a subscription, and they are inherited.

There are two types:

• Delete: authorized users can read and modify the resource but cannot delete it.
• ReadOnly: authorized users can read the resource but cannot update or delete it. It is similar to restricting users to the Reader role.

Locks apply regardless of RBAC permissions. Even an owner must remove the lock first, then perform the action.

Microsoft Purview

Purview is a family of data governance, risk and compliance solutions that gives a unified view of data across on-premises, multicloud and software-as-a-service sources. Its capabilities include automated data discovery, sensitive data classification and end-to-end data lineage. It has two main solution areas: risk and compliance, and unified data governance.

Service Trust Portal

The Service Trust Portal provides content, tools and resources about Microsoft security, privacy and compliance practices, including how Microsoft implements controls that protect its cloud services and customer data. Access to some resources requires signing in with a Microsoft Entra work or school account and accepting the Microsoft non-disclosure agreement for compliance materials.

The contrast to remember: Purview governs your data, while the Service Trust Portal documents Microsoft's practices.

Managing and deploying resources

Portal, Cloud Shell, PowerShell and CLI

• The Azure portal is a web-based graphical console. It is resilient because it has a presence in every Azure datacenter, and it updates without downtime.
• Azure Cloud Shell is a browser-based shell that needs no local installation. It is already authenticated to your credentials and supports both Azure PowerShell and the Azure CLI.
• Azure PowerShell runs cmdlets, which call the Azure REST API.
• Azure CLI is functionally equivalent to PowerShell, and the main difference is syntax. The CLI uses Bash commands.

Both can be installed on Windows, Linux and Mac. Choosing between them mainly comes down to which language you know.

Azure Arc

Azure Arc extends Azure management, compliance and monitoring to hybrid and multicloud environments. It works with Azure Resource Manager by projecting non-Azure resources into it, so you can manage them as if they were running in Azure.

Resource types it can manage outside Azure:

• Servers
• Kubernetes clusters
• Azure data services
• SQL Server
• Virtual machines (preview)

Azure Resource Manager, ARM templates and Bicep

Azure Resource Manager (ARM) is the deployment and management service for Azure. Every request from any tool, API or SDK goes through it. It authenticates and authorizes the request, then passes it to the service, which is why results are consistent across tools.

An ARM template is declarative JSON: you define the desired end state and ARM works out dependency order and deploys in parallel where it can. Bicep is also a declarative language that deploys through ARM, but it is simpler and more concise than JSON. Bicep deployments are idempotent and can be organized into modules.

The key contrast is declarative (what you want) against imperative (step-by-step commands in a script).

Monitoring

Azure Advisor

Advisor evaluates your resources and recommends improvements in five categories: Reliability, Security, Performance, Operational Excellence and Cost. Each recommendation can be acted on, postponed or dismissed.

Azure Service Health

Service Health combines three views that narrow in scope:

• Azure Status: global health across all services and regions.
• Service Health: the services and regions you actually use, including outages, planned maintenance and advisories.
• Resource Health: one resource, such as a single VM, and whether a problem is on Azure's side or yours.

Azure Monitor

Azure Monitor collects and analyses data from Azure, on-premises and multicloud environments. Three parts are covered:

• Log Analytics is where you write and run queries against collected data.
• Alerts notify you when a condition you defined is met. An alert rule sets the condition and an action group sets who is notified. Alerts can be metric-based or log-based, and action groups are reusable across Azure Monitor, Service Health and Azure Advisor.
• Application Insights monitors the performance and usage of web applications, wherever they run. It tracks request rates, response times, failures and dependencies, and can run availability tests.

Common traps

• Estimating versus tracking. Pricing calculator is before deployment, and Cost Management is after.
• Inheritance mix-ups. Policies and locks are inherited. Tags are not.
• Locks and RBAC. A lock beats permissions. Even an owner must remove it first.
• Delete versus ReadOnly. Delete still allows modification, and ReadOnly does not.
• Billing zone versus availability zone. Billing zones exist only for data-transfer pricing.
• Reservation versus savings plan. A reservation commits to specific resources, and a savings plan commits to hourly spend.
• Spot for critical work. Spot capacity can be evicted, so it is never the answer for a workload that cannot be interrupted.
• Purview versus Service Trust Portal. One governs your data and the other documents Microsoft's compliance.
• Advisor versus Service Health. Advisor recommends improvements to your setup, and Service Health reports the health of Azure and your resources.
• Azure Status versus Service Health versus Resource Health. Think global, your services, one resource.
• Imperative versus declarative. Scripts in PowerShell or CLI are imperative. ARM templates and Bicep are declarative.

How to study

1. Learn the four topics as pairs and trios of look-alikes, since that is where questions are decided. Write each pair with one sentence on how it differs. 2. Memorize the small fixed facts: the three cost alert types, the two lock types, the five Advisor categories, the three Service Health views and the list of Arc resource types. 3. For every tool, ask what problem it solves. If you can say "I need to stop an accidental delete" and answer Delete lock, you can handle scenario questions. 4. Build a small example for each commitment option. A 24/7 production database, a mixed web and API workload, and a restartable batch job map to Reservations, a savings plan and Spot. 5. Practise with questions, then review every wrong answer against the rule it broke.

Practise

When you can explain these distinctions without notes, test yourself under question conditions with the AZ-900 practice questions.

Practise this with Microsoft Azure Fundamentals (AZ-900) questions

More of this guide