AZ-900 — Azure Fundamentals
Why this path exists
This is the first technical path. It gives a learner who has never used Azure a model for cloud responsibility, Azure’s resource hierarchy, common services, identity, governance, cost, and observability. It prepares the learner for administration without assuming that product names explain themselves.
Central mental model
An Azure workload is something a person or team owns. A tenant supplies identity; a subscription supplies billing and a resource boundary; resource groups organize deployed resources; Azure Resource Manager applies control-plane changes; services run the workload; identity, networking, data, monitoring, recovery, and cost controls surround it.
Map / Canvas
AZ-900 foundations relationship map
Ordered modules
- Start from zero — operating-system, network, HTTP, JSON, shell, and permission vocabulary.
- Cloud foundations — shared responsibility, deployment models, service models, capacity, availability, and reliability.
- Azure architecture and resource hierarchy — geography, failure boundaries, management scopes, ARM, and control/data planes.
- Core Azure services — compute, networking, storage, endpoints, and migration decisions.
- Management, governance, and observability — tools, IaC, identity, Policy, locks, tags, cost, health, and telemetry.
- Identity, security, governance, and cost — authentication, authorization, security layers, compliance, and cost decisions.
Important relationships and comparisons
- A tenant authenticates principals; a subscription scopes Azure resources and billing; Azure RBAC authorizes actions at a scope.
- IaaS leaves more operating-system responsibility with the customer; PaaS moves runtime responsibility to Azure; SaaS supplies the application.
- A region contains datacenters; an availability zone is a separated datacenter grouping within a region; a region pair supports regional design, not automatic application recovery.
- Azure DNS resolves names; endpoints and network controls determine whether traffic can reach the destination.
- Azure Policy evaluates desired governance rules; resource locks protect management operations; tags classify resources but do not enforce compliance.
Conceptual checkpoint
Given a small web workload, explain which responsibility remains with the customer, where its resources live, how a user authenticates, how Azure authorizes a change, how a name resolves, how the service is monitored, and which cost/governance control addresses each risk.
Next path
Continue to AZ-104 foundation and administration.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- AZ-900 study guide, skills measured 2026-07-20; checked 2026-08-31.
Re-audit when the study-guide effective date, course syllabus, or Azure service behavior changes.