AZ-900 Deep Dive: Azure Architecture and Services — The Biggest Domain Explained

If you are studying for the AZ-900 Microsoft Azure Fundamentals exam, there is one domain that will make or break your score: Domain 2 — Describe Azure Architecture and Services. At 35-40% of the exam, it carries more weight than either of the other two domains. It is also the domain where questions shift from "understand the concept" to "know the specific service" — and that is where candidates who relied on general cloud knowledge start losing marks.

This guide is a deep dive into every major topic in Domain 2. We cover compute services with their IaaS/PaaS classifications, storage redundancy options, the identity trap that catches the most candidates, Conditional Access, networking fundamentals, and Azure Arc. Every section includes comparison tables designed for rapid exam review.

Why Domain 2 Is Where Candidates Fail

Domain 1 (Cloud Concepts, 25-30%) tests general cloud knowledge — IaaS vs PaaS vs SaaS, CapEx vs OpEx, shared responsibility. Most candidates find this intuitive. Domain 3 (Management and Governance, 30-35%) tests tools and pricing concepts that are easier to memorize with flashcards.

Domain 2 is different. It requires you to know specific Azure services by name, understand what category they belong to, and distinguish between services that sound similar but serve different purposes. "Which compute service runs containers without managing the underlying infrastructure?" has four plausible answers depending on whether you understand ACI vs AKS vs App Service vs Functions.

The math is simple: if Domain 2 is 40% of a 1000-point exam, that is 400 points. You need 700 to pass. If you perform poorly on Domain 2, you would need near-perfect scores on Domains 1 and 3 to compensate — which almost never happens.

Azure Compute Services Comparison

The AZ-900 tests six core compute services. You need to know what each one does, whether it is IaaS or PaaS, and when to use it. Here is the complete comparison:

Storage Redundancy: LRS, ZRS, GRS, GZRS

Azure storage redundancy is one of the most table-friendly topics on the AZ-900. You need to know four options, how many copies each creates, and what failure scenarios each protects against:

Storage Access Tiers

Alongside redundancy, the exam tests storage access tiers. These control cost and retrieval speed:

Microsoft Entra ID vs. Entra Domain Services — The #1 Identity Trap

This is the single most confused topic on the AZ-900. Candidates who studied with older materials that reference "Azure AD" struggle even more because the rebranding obscures the already-subtle difference.

Microsoft Entra ID (formerly Azure Active Directory)

Microsoft Entra ID is a cloud-based identity and access management service. It handles:

• Authentication (proving who you are) via passwords, MFA, passwordless methods
• Single Sign-On (SSO) to thousands of SaaS applications
• Conditional Access policies (discussed in the next section)
• Application registration and management
• B2B and B2C identity scenarios

Think of Entra ID as the modern, cloud-native identity platform. It uses protocols like OAuth 2.0, OpenID Connect, and SAML. It does NOT support legacy protocols like NTLM, Kerberos, or LDAP natively.

Microsoft Entra Domain Services (formerly Azure AD Domain Services)

Microsoft Entra Domain Services provides managed domain services that support legacy protocols:

• LDAP, NTLM, and Kerberos authentication
• Domain join for Azure VMs
• Group Policy management

Think of Entra Domain Services as a managed on-premises Active Directory replacement in the cloud. You use it when you have legacy applications that require domain join or LDAP — applications that cannot use modern OAuth/SAML protocols.

Conditional Access Explained

Conditional Access is a feature of Microsoft Entra ID that the January 2026 update added increased emphasis to. You need to understand what it is, what signals it evaluates, and how it differs from RBAC.

What Conditional Access Does

Conditional Access policies are "if-then" statements that evaluate signals during sign-in and enforce access decisions. When a user tries to authenticate, Conditional Access checks the context of that sign-in and decides whether to allow access, require additional verification, or block access entirely.

Signals Evaluated

Conditional Access vs. RBAC

This distinction is critical for the exam:

• Conditional Access controls authentication — it decides whether you can sign in at all, and under what conditions.
• RBAC (Role-Based Access Control) controls authorization — after you have signed in, it decides what resources you can access and what actions you can perform.

They work in sequence: Conditional Access first, then RBAC. A user could pass Conditional Access (signed in from a trusted location with MFA) but still be denied access to a specific resource group because they lack the required RBAC role.

Networking: VNet, VPN Gateway, ExpressRoute

Azure networking on the AZ-900 is tested at a conceptual level. You do not need to configure subnets or write routing rules, but you need to understand what each component does and when to use it.

Azure Virtual Network (VNet)

A VNet is the fundamental building block of networking in Azure. It enables Azure resources to communicate with each other, the internet, and on-premises networks. Key facts for the exam:

• VNets are scoped to a single region
• VNets can be connected to each other via VNet peering (even across regions — called global VNet peering)
• Subnets segment a VNet into smaller address ranges
• Network Security Groups (NSGs) filter traffic at the subnet or NIC level

VPN Gateway vs. ExpressRoute

Azure Arc: Extending Azure Beyond Azure

Azure Arc is a relatively new addition to the AZ-900 blueprint that gained more emphasis in the January 2026 update. It bridges the gap between Azure and non-Azure environments.

What Azure Arc Does

Azure Arc lets you project non-Azure resources into Azure Resource Manager. This means you can manage on-premises servers, Kubernetes clusters running anywhere, and even resources in AWS or GCP as if they were native Azure resources. Once a resource is Arc-enabled, you can:

• Apply Azure Policy for compliance
• Assign RBAC roles for access control
• Use Azure tags for organization and billing
• Monitor with Azure Monitor
• Deploy configurations with Azure Automation

What Arc Can Manage

Domain 2 Cheat Sheet

Use this quick-reference summary for your final review before the exam:

Master these distinctions and you will be well-prepared for Domain 2. Combined with solid preparation on Domains 1 and 3, this knowledge will get you past the 700-point threshold with room to spare.