Microsoft
🇺🇸
·
9 min read
AZ-900 Exam Cheat Sheet: Complete Quick-Reference Guide 2026
The ultimate AZ-900 cheat sheet: all Azure services organized by domain, Microsoft Entra ID essentials, pricing and support, Responsible AI principles, 10 exam traps, and last-minute tips for the January 2026 update.
How to Use This Cheat Sheet
This page is your last-day review reference. Read it 24 hours before your exam. Every table and list is distilled from the January 2026 AZ-900 exam objectives. Bookmark it on your phone for the morning of exam day.
Exam At a Glance
| Questions | Time Limit | Passing Score | Cost (USD) | Last Updated |
| 40–60 | 85 minutes | 700 / 1000 | ~$165 | January 14, 2026 |
Domain Weights
| Domain | Weight | Key Focus Areas |
|---|---|---|
| Domain 1: Cloud Concepts | 25–30% | Service models, deployment models, cloud benefits, consumption-based pricing, sustainability |
| Domain 2: Azure Architecture & Services | 35–40% | Global infrastructure, compute, storage, networking, databases, AI/ML services |
| Domain 3: Management & Governance | 30–35% | Cost tools, support plans, Entra ID, Azure Policy, Zero Trust, Defender for Cloud, monitoring tools |
Domain 1: Cloud Concepts
Cloud Service Models
| Model | You Manage | Azure Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, network, virtualization | Azure VMs, Azure Disks |
| PaaS | Apps, data | OS, runtime, hardware, network | Azure App Service, Azure SQL Database, Azure AI Services |
| SaaS | Data you put in, user access | Everything | Microsoft 365, Dynamics 365, Intune |
Cloud Deployment Models
| Model | Description | Azure Services |
|---|---|---|
| Public | Resources shared in Azure datacenters; customer logic isolated | Standard Azure (global regions) |
| Private | Cloud infrastructure dedicated to one organization, on-premises or hosted | Azure Stack Hub, Azure Stack HCI |
| Hybrid | Mix of public cloud and private/on-premises, connected | Azure Arc, Azure VPN Gateway, ExpressRoute |
Cloud Benefits (Know All 8)
High availability, Scalability, Elasticity, Agility, Geo-distribution, Disaster recovery, CapEx → OpEx shift, Consumption-based pricing.
CapEx vs OpEx
CapEx = pay upfront for hardware (on-premises). OpEx = pay as you use (cloud). Cloud shifts IT spend from CapEx to OpEx. Consumption-based = pay only for what you use.
Domain 2: Azure Architecture & Services
Global Infrastructure
| Concept | Definition |
|---|---|
| Region | Geographic area with one or more datacenters. 60+ regions worldwide. |
| Availability Zone (AZ) | Physically separate datacenters within a region (typically 3 per region). Protects against datacenter failure. |
| Region Pair | Two regions paired for disaster recovery. Azure replicates some services automatically across pairs. |
| Geography | Market boundary (e.g., US, Europe, Asia Pacific) that defines data residency requirements. |
| Sovereign Clouds | Azure Government (US federal/state), Azure China 21Vianet — isolated from global Azure. |
Compute Services
| Service | Type | Use Case |
|---|---|---|
| Azure Virtual Machines | IaaS | Full OS control, lift-and-shift migrations |
| VM Scale Sets | IaaS | Auto-scale VMs based on demand |
| Azure App Service | PaaS | Web apps, REST APIs, mobile backends |
| Azure Functions | Serverless (PaaS) | Event-driven code execution, pay per execution |
| Azure Container Instances (ACI) | PaaS | Run single containers without orchestration |
| Azure Kubernetes Service (AKS) | PaaS | Managed Kubernetes for container orchestration |
| Azure Virtual Desktop | PaaS | Cloud-hosted Windows desktops and apps |
Storage Services
| Service | Data Type | Key Detail |
|---|---|---|
| Azure Blob Storage | Unstructured (files, images, videos, backups) | Tiers: Hot / Cool / Cold / Archive (increasing latency, decreasing cost) |
| Azure Files | File shares (SMB/NFS) | Replace on-premises file servers; mountable from Windows/Linux/macOS |
| Azure Disks | Block storage for VMs | Standard HDD, Standard SSD, Premium SSD, Ultra Disk |
| Azure Queue Storage | Message queues | Decouples application components; async messaging |
| Azure Table Storage | NoSQL key-value | Simple structured data; low cost; part of Azure Storage accounts |
Database Services
| Service | Type | Key Detail |
|---|---|---|
| Azure SQL Database | Relational (SQL) — PaaS | Fully managed SQL Server engine. No OS management. |
| Azure Cosmos DB | NoSQL — PaaS | Globally distributed, multi-model (document, key-value, graph, column) |
| Azure DB for PostgreSQL / MySQL | Relational — PaaS | Managed open-source databases; no OS patching |
| Azure Cache for Redis | In-memory cache — PaaS | Sub-millisecond read latency for frequently accessed data |
| Azure Synapse Analytics | Analytics — PaaS | Unified analytics for big data warehousing and data integration |
Networking Services
| Service | Purpose |
|---|---|
| Azure Virtual Network (VNet) | Private network in Azure for resource isolation and communication |
| VNet Peering | Connect two VNets privately (same or different regions) |
| Azure VPN Gateway | Encrypted site-to-site tunnel over the public internet (on-prem to Azure) |
| Azure ExpressRoute | Private dedicated circuit to Azure — does NOT go over the public internet |
| Azure Load Balancer | Layer 4 (TCP/UDP) load distribution across VMs |
| Azure Application Gateway | Layer 7 (HTTP/HTTPS) load balancer with WAF capabilities |
| Azure Firewall | Managed, stateful network firewall for VNet traffic control |
| Azure CDN | Cache static content at edge locations worldwide for low latency |
| Azure Traffic Manager | DNS-based global traffic routing across regions |
| Azure Bastion | Secure RDP/SSH to VMs over the Azure Portal — no public IP on VM required |
AI / ML Services (2026 Addition)
| Service | Use Case |
|---|---|
| Azure OpenAI Service | GPT-4, DALL-E, Whisper with Azure compliance & data residency |
| Azure AI Foundry | Build and deploy generative AI apps with Prompt Flow, model catalog |
| Azure AI Search | AI-powered vector + semantic search; backbone of RAG architectures |
| Azure Machine Learning | MLOps platform — AutoML, Designer, custom model training and deployment |
| Azure AI Services (umbrella) | Pre-built APIs: Vision, Speech, Language, Translator, Document Intelligence, Bot Service, Content Safety |
| Microsoft Copilot in Azure | AI assistant for Azure management tasks in the Portal, CLI, and PowerShell |
Domain 3: Management & Governance
Microsoft Entra ID (Formerly Azure Active Directory)
| Concept | Description |
|---|---|
| Tenant | Dedicated Entra ID instance for an organization. Created when you sign up for Microsoft cloud services. |
| Single Sign-On (SSO) | One set of credentials gives access to multiple applications |
| Multi-Factor Authentication (MFA) | Requires two or more verification methods (password + phone app) |
| Conditional Access | Policies that enforce access controls based on user, device, location, and risk signals |
| B2B | Invite external users (guests) from other organizations to your tenant |
| B2C | Consumer-facing identity management for external customers (social login, custom UX) |
Exam Trap: Entra ID ≠ On-Premises Active Directory
Microsoft Entra ID is a cloud identity service. It does NOT provide domain join, Group Policy Objects (GPOs), Kerberos, or LDAP like on-premises Active Directory Domain Services. If a question describes cloud-based user authentication and SSO, the answer is Entra ID. If it describes domain-joined computers with GPOs, that is on-premises AD DS.
Azure Resource Hierarchy
Management Groups → Subscriptions → Resource Groups → Resources. Policies and RBAC applied at any level inherit downward.
Cost Management Tools
| Tool | Purpose |
|---|---|
| Azure Pricing Calculator | Estimate costs for planned Azure deployments before purchasing |
| TCO Calculator | Compare cost of running workloads on-premises vs Azure over time |
| Azure Cost Management + Billing | Analyze, monitor, and set budgets and alerts for actual Azure spending |
| Resource Tags | Metadata key-value pairs on resources for cost allocation, chargeback, and filtering in billing reports |
Support Plans
| Plan | Cost | Sev A Response | Best For |
|---|---|---|---|
| Basic | Free | No technical support | Trials, non-production |
| Developer | $29/mo | Business hours only | Trial and non-production workloads |
| Standard | $100/mo | <1 hour (24/7) | Production workloads |
| Professional Direct | $1,000/mo | <1 hour (24/7) + proactive | Business-critical workloads |
| Premier | Custom | <15 minutes | Enterprise, dedicated TAM |
SLA Quick Reference
| Scenario | SLA |
|---|---|
| Single VM with Premium SSD | 99.9% |
| VMs in Availability Set (2+ VMs) | 99.95% |
| VMs across Availability Zones (2+ zones) | 99.99% |
| Free tier VMs / single VM with Standard HDD | 0% (no SLA) |
Governance Tools
| Tool | Purpose |
|---|---|
| Azure Policy | Enforce organizational standards — audit, deny, or auto-remediate non-compliant resources |
| Azure Blueprints | Package policies, RBAC, and ARM templates into reusable governance packages (being deprecated) |
| RBAC (Role-Based Access Control) | Grant least-privilege access to Azure resources via built-in or custom roles |
| Resource Locks | Prevent accidental deletion or modification — CanNotDelete or ReadOnly lock types |
Security Tools
| Tool | Purpose |
|---|---|
| Microsoft Defender for Cloud | Cloud security posture management (CSPM) + threat protection for Azure, hybrid, and multi-cloud |
| Azure Key Vault | Store and manage secrets, encryption keys, and certificates securely |
| Zero Trust | Security model: Verify explicitly (always authenticate), Use least privilege, Assume breach (limit blast radius) |
Monitoring and Management Tools
| Tool | Purpose |
|---|---|
| Azure Monitor | Centralized platform for metrics, logs, alerts, and dashboards |
| Log Analytics | Query and analyze log data using KQL (Kusto Query Language) |
| Application Insights | APM for web apps — performance monitoring, request tracing, error tracking |
| Azure Advisor | Personalized recommendations for cost, security, reliability, performance, and operational excellence |
| Azure Service Health | Status of Azure services in your regions — incidents, planned maintenance, health advisories |
| Azure Arc | Extend Azure management and services to on-premises, multi-cloud, and edge environments |
Deployment and Infrastructure-as-Code Tools
Azure Portal (GUI) | Azure CLI (cross-platform command line) | Azure PowerShell (PowerShell module) | Azure Cloud Shell (browser-based CLI/PowerShell) | ARM Templates (JSON IaC) | Bicep (simplified ARM syntax) | Terraform (third-party, HashiCorp, multi-cloud IaC)
Responsible AI — 6 Principles
| Principle | Core Meaning | Exam Scenario Clue |
|---|---|---|
| Fairness | Treat all people equally; avoid bias | Model performs differently across demographic groups |
| Reliability & Safety | Perform consistently; fail safely | AI system behaves unpredictably in edge cases |
| Privacy & Security | Protect data; secure systems | Training data contains sensitive personal information without consent |
| Inclusiveness | Empower everyone; accessible to all | AI tool doesn't work for users with disabilities |
| Transparency | Be understandable; explainable decisions | Users cannot understand why the AI made a decision |
| Accountability | Humans responsible for AI outcomes | No process exists for users to appeal AI decisions |
10 Exam Traps to Avoid
- Microsoft Entra ID ≠ on-premises Active Directory. Entra ID is cloud identity — no domain controllers, no GPOs, no LDAP. "Cloud identity management" = Entra ID.
- Availability Zones ≠ Availability Sets. Zones protect against full datacenter failure (separate buildings). Sets protect against rack/update-domain failure within one datacenter.
- Azure SQL Database is PaaS — no OS or SQL Server patching. SQL Server on Azure VM is IaaS — you manage the OS and SQL Server.
- Archive storage tier has retrieval latency. Moving data out of Archive takes hours. Hot and Cool are instant. Archive = cheapest storage, slowest access.
- ExpressRoute is private — it does not go over the internet. VPN Gateway is encrypted but travels over the public internet. ExpressRoute = dedicated private circuit.
- Azure Cosmos DB is NoSQL, not a relational database. It is globally distributed and multi-model (document, key-value, graph, column-family).
- Azure Blueprints is being deprecated. Know it conceptually (packages policies, ARM, RBAC) but do not expect deep configuration questions about it.
- Zero Trust "assume breach" is a design principle, not a claim that you will be breached. It means architect systems to limit blast radius as if an attacker is already inside.
- Free-tier VMs have 0% SLA. A single VM with Standard HDD also has no SLA. You need Premium SSD for 99.9%, Availability Zones for 99.99%.
- Azure OpenAI Service requires application approval. You cannot use it immediately after creating an Azure account — Microsoft reviews and approves each request.
Test Your Knowledge on CertLand
CertLand's AZ-900 practice exam has 380 questions across all three domains, including the January 2026 AI content. Use the cheat sheet above to identify weak areas, then drill those questions.
Start Practicing Free →🎯 Free readiness check
Are you ready for AZ-900: Microsoft Azure Fundamentals?
Free diagnostic scores your weak domains and builds a personalized study plan.
📝 Practice exam
AZ-900: Microsoft Azure Fundamentals
questions · Medium
Comments
No comments yet. Be the first!
Comments are reviewed before publication.