Azure Fundamentals · Services

Core Azure Services to Know for the Azure Fundamentals (AZ-900) Exam

The Microsoft Azure Fundamentals (AZ-900) exam tests core services at describe-the-service depth: compute (Virtual Machines, App Service, Azure Functions, containers), networking (virtual networks, VPN Gateway, ExpressRoute), storage (Blob, Disk, Files), and identity (Microsoft Entra ID), wrapped in the architecture vocabulary of regions, availability zones, subscriptions, and resource groups.

Last updated August 2026.

Where services sit in the exam

The AZ-900 study guide splits the exam into three domains, and Describe Azure architecture and services is the largest at 35 to 40% of the exam. It is also the only genuinely Azure-specific one: cloud concepts (25 to 30%) is vendor-neutral vocabulary, and management and governance (30 to 35%) is tools and policy. If services are where your knowledge is thinnest, that is the highest-weight gap on the paper.

The depth bar is low but wide. Task statements ask you to describe services and pick the right one for a stated need, never to configure, size, or script them. The right preparation is a one-line job description per service, plus the ability to separate close neighbours.

Domain names and weight ranges from the official Microsoft AZ-900 study guide.

The architecture vocabulary questions assume

Before the services themselves, AZ-900 expects the geography and hierarchy they live in:

Regions, region pairs, and availability zones: a region is a set of datacenters; availability zones are physically separate locations inside a region for surviving a datacenter failure; region pairs put a second region at distance for disaster recovery.
Subscriptions, resource groups, and management groups: resources deploy into resource groups, resource groups belong to a subscription (the billing boundary), and management groups organize many subscriptions for policy at scale. Questions love this hierarchy bottom to top.

The core catalogue, one line per service

Category	Service	The one-line job
Compute	Virtual Machines	Servers you size and manage yourself, infrastructure as a service
	App Service	Host web apps and APIs without managing the servers underneath
	Azure Functions	Run code on demand in response to events, serverless
	Containers	Azure Container Instances for single containers, Azure Kubernetes Service for orchestrating many
Networking	Virtual Network	Your logically isolated network inside Azure
	VPN Gateway	Encrypted connection to Azure over the public internet
	ExpressRoute	Private dedicated connection to Azure that never touches the internet
Storage	Blob Storage	Object storage for unstructured data, with access tiers that trade cost for retrieval speed
	Disk Storage	Block storage volumes attached to virtual machines
	Azure Files	Shared file storage many machines can mount at once
Identity	Microsoft Entra ID	Cloud identity and access management, formerly Azure Active Directory

The study guide's outline is longer, naming database, analytics, and IoT services at the same recognise-the-category level. The table is the set questions return to most; work the guide's own outline for full coverage.

The management and governance services

The management and governance domain is 30 to 35% of the exam, nearly as heavy as the services domain, and it names tools just as freely:

Cost tools: the pricing calculator estimates a workload before you build it, the total cost of ownership calculator compares cloud against on-premises, and Microsoft Cost Management analyzes what you actually spent.
Governance: Azure Policy enforces rules across resources, resource locks stop accidental deletion or change, and tags label resources for organization and cost attribution.
Deployment and monitoring: the Azure portal, Azure CLI, and Azure Cloud Shell for interacting with Azure; Azure Advisor for recommendations; Azure Monitor for metrics, logs, and alerts.

The pairings questions are built on

AZ-900 service questions are usually a disguised comparison between two plausible answers. These are the distinctions worth rehearsing:

Virtual Machines versus App Service versus Functions: the control spectrum. Full control of the operating system points at VMs, hosting a web app without server admin points at App Service, and running code only when an event fires points at Functions.
VPN Gateway versus ExpressRoute: both connect on-premises to Azure. Encrypted over the public internet is VPN Gateway; a private connection that avoids the internet entirely, for bandwidth or compliance, is ExpressRoute.
Blob versus Disk versus Files: objects for unstructured data, a disk for one virtual machine, a file share many machines mount. "Lift and shift an application that uses a file share" is Azure Files.
Azure Policy versus resource locks: Policy governs what resources are allowed to look like across a scope; a lock protects a specific resource from deletion or modification. "Prevent anyone deleting this" is a lock, not a policy.
Availability zones versus region pairs: zones survive a datacenter failure inside one region; region pairs survive a regional outage. High availability points at zones, disaster recovery points at the pair.

FAQ

Which Azure services do I need to know for the AZ-900 exam?

The core set is compute (Virtual Machines, App Service, Azure Functions, Container Instances, Azure Kubernetes Service), networking (virtual networks, VPN Gateway, ExpressRoute), storage (Blob, Disk, Azure Files), and Microsoft Entra ID for identity. Add the management tools: the cost calculators, Microsoft Cost Management, Azure Policy, resource locks, Azure Advisor, and Azure Monitor.

How deeply does AZ-900 test each Azure service?

At describe-and-identify depth: given a need, pick the service whose job matches. You will not configure, size, or script anything, so the right preparation is a one-line job description per service and the ability to separate close pairs like VPN Gateway versus ExpressRoute.

Is Microsoft Entra ID the same as Azure Active Directory?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID, and the current study guide uses the new name. Expect Entra ID on the exam, and treat any material still teaching "Azure AD" as dated but describing the same identity service.

What is the most tested topic in the AZ-900 services domain?

The comparisons: the compute control spectrum from Virtual Machines to Functions, the two on-premises connection options, the three storage types, and where regions, availability zones, and region pairs each fit. Questions are usually a scenario that fits one service noticeably better than its plausible neighbour.

Work from the official outline

The AZ-900 study guide lists every service and concept under its three domains, and exam questions are written from those task statements. It is the definitive checklist for this domain.

Open the AZ-900 study guide →