CertificationsMicrosoft Azure Fundamentals AZ-900Labs
Microsoft Azure Fundamentals AZ-900 hands-on labs
Azure fundamentals in the portal-shaped view: role assignments, network security groups, scope and encryption at rest.
33 labs you run in the browser: 16 guided, 11 assisted, 5 challenge, 1 capstone. About 4 hours of authored lab time. This set has no free taster yet; the free tier still carries the lessons and practice questions.
33
labs
16
guided
steps in order
6
goal only
challenge and capstone
0
free tasters
none in this set
What you practise
Exam facts and study plan- Cloud panel with the matching CLI line· you click33 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Turn on encryption for an evidence container
ProGuided · Quick · 3 min · Cloud panel with the matching CLI line
The audit workpapers are private and versioned, and Azure already encrypts them with Microsoft-managed keys. The audit standard asks for a key the firm controls, held in Key Vault…
storage accountencryption at restblob versioning
Give a contractor reader access instead of owner
ProGuided · Quick · 4 min · Cloud panel with the matching CLI line
A contractor account was given Owner on the whole subscription so the first week would go smoothly. The engagement only needs to read one resource group and its tag report…
role based access controlleast privilegerole assignment
Narrow a build identity to the image store
ProGuided · Quick · 4 min · Cloud panel with the matching CLI line
A container build identity pushes images into one registry and reads its build logs. At setup it was handed Contributor on the whole subscription, which reaches every resource group…
role based access controlleast privilegescope
Open a health probe port for the balancer
ProGuided · Quick · 4 min · Cloud panel with the matching CLI line
A web tier sits behind a load balancer and serves TLS to the balancer subnet at 10.90.0.0/24. The balancer has started marking both instances unhealthy because its probe on 8080 gets no…
network security groupinbound ruleload balancer probe
Bring a regional team back to its resource group
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
The regional operations team was given Contributor on the whole subscription so its first month would be quiet. The team works inside one resource group…
resource group scoperole assignmentleast privilege
Build a staging container for a file migration
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A file migration needs a staging account before Monday. The files are temporary and rewritten nightly, so the account must not keep versions…
blob storagestorage accountencryption at restanonymous access
Clear an owner assignment a policy audit flagged
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A governance audit lists every identity holding Owner on the subscription. The release approver was given Owner during a migration so it could unblock the cut over…
Azure Policygovernancerole assignmentscope
Cut anonymous downloads on a products group
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A downloads group serves product manuals and price sheets. Until last month anyone could fetch a file from the open internet…
cost factorsdata transferinbound rulepartner access
Limit both admin ports to one subnet
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
An operations group accepts remote desktop and shell connections from the whole private range 10.0.0.0/8. The admin subnet moved to 10.20.8.0/24 last quarter…
network security groupinbound ruleremote administration
Limit remote desktop to the office range
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A test virtual machine answers remote desktop from every address on the internet. Staff work from one office range, 10.4.0.0/16, and the web rule on port 443 serves a demo site.
network security groupinbound ruleremote access
Move a function identity off subscription owner
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A timer function writes thumbnails and sends a run summary to the monitoring workspace. Its identity was given Owner on the subscription to unblock a failed first deployment…
role assignmentscopeleast privilegemanaged identity
Narrow a pipeline role to blob writes
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A deployment pipeline writes build artefacts and sends job logs to a workspace. During setup the pipeline identity was given Contributor on the whole storage account…
role based access controlleast privilegeservice identity
Swap owner rights for blob reader on a reviewer
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A quality reviewer joined for six weeks and was given Owner on the subscription so the first day would be quick. The work is reading evidence blobs and checking the monitoring dashboards…
role based access controlleast privilegescope
Turn off anonymous access on a storage container
ProGuided · Quick · 5 min · Cloud panel with the matching CLI line
A marketing container was opened for launch week and never closed. The account still allows anonymous blob access and still accepts plain HTTP with TLS 1.0…
storage accountanonymous accessencryption at rest
Limit tunnel negotiation to the office firewall
ProGuided · Quick · 6 min · Cloud panel with the matching CLI line
A gateway terminates the encrypted tunnel to the branch office, which reaches the cloud over the internet. The office firewall is 203.0.113.0/24 and its address never changes…
VPN gatewaytunnel negotiationinbound rulenetwork security group
Tidy a training subscription before the next course run
ProGuided · In-depth · 28 min · Cloud panel with the matching CLI line
Course intake opens on Monday and the shared training subscription is still set up the way the pilot left it. The handouts container answers the open internet…
storage container accessencryption at restblob versioningnetwork security group
Stop keeping versions of a build cache
ProAssisted · Quick · 4 min · Cloud panel with the matching CLI line
The monthly cost review names the build cache. Blob versioning is an account setting, so a cache that must not keep history lives in its own account, stbuildcacheweu…
cost managementstorage tiersblob versioning
Stop one container from keeping every version
ProAssisted · Quick · 4 min · Cloud panel with the matching CLI line
Storage is the fastest growing line. The package cache and the release artefacts need different history, and versioning is an account setting, so they sit in two accounts…
cost managementstorage costblob versioning
Put a container pull identity at the registry
ProAssisted · Quick · 5 min · Cloud panel with the matching CLI line
A test cluster pulls images from a private registry with a dedicated identity. During setup the identity was given Contributor on the whole subscription because unrelated resources kept…
role assignmentscopeleast privilegecontainer registry
Put an archive container on a proper footing
ProAssisted · Quick · 5 min · Cloud panel with the matching CLI line
The claims archive has answered anonymous reads since a migration and keeps no earlier copy of a file. Encryption at rest was never off: Azure encrypts every storage account…
blob versioningdata redundancystorage access
Route a supplier portal through its gateway only
ProAssisted · Quick · 5 min · Cloud panel with the matching CLI line
A supplier portal serves businesses, not the public, and every supplier reaches it through a partner gateway at 10.60.12.0/24. The group still allows 443 from every address…
network security groupinbound ruleprivate connectivity
Close an internal API that moved behind a private endpoint
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
An order API used to be published on a public address so the mobile team could reach it during the build. It now has a private endpoint and callers inside the virtual network at…
private endpointvirtual networkinbound rulebastion host
Close the extra doors on a front-end group
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A front-end group grew three internet rules during testing: TLS, plain HTTP and a management port. Visitors only need TLS…
inbound rulesvirtual networkweb traffic
Take directory write away from a support identity
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A support identity answers tickets about application errors. During setup it was given Contributor on the identity resource group so it could reset a test managed identity…
role based access controlleast privilegezero trust
Tidy the ports in front of a web firewall
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
Customers reach the storefront through a web firewall, which inspects each request and forwards the ones it likes…
application gatewayweb application firewallinbound rulenetwork segmentation
Tidy three internet rules on a gateway group
ProAssisted · Quick · 6 min · Cloud panel with the matching CLI line
A gateway group grew three rules during a pilot. Visitors need TLS on 443 from anywhere. The shell port should answer the admin jump subnet at 10.8.0.0/16 and nowhere else…
network security groupinbound ruleremote administration
Refresh the audiobook service before the new season
ProAssisted · In-depth · 29 min · Cloud panel with the matching CLI line
A regional library network moves its audiobook service onto the shared subscription before the winter season. The shelf container answers the open internet…
storage container accessencryption at restblob versioningnetwork security group
Close both management ports on a sandbox group
ProChallenge · Quick · 4 min · Cloud panel with the matching CLI line
A sandbox group still lets remote desktop and shell traffic in from every address. Administrators now connect through a managed bastion on the internal network…
network security groupinbound rulebastion access
Audit two groups in front of the estate
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
A monthly review covers two groups. The database group serves the application subnet at 10.120.0.0/16 on 1433, and it also answers 1433 from every address…
network security groupinbound ruleexposed database port
Fix the one container in three that fails review
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
A storage review covers three containers in one account. One serves public product images by design, one holds unreleased artwork, and one holds signed audit evidence…
blob storageanonymous accessencryption at restblob versioning
Trim a deploy bot and spare the break glass account
ProChallenge · Quick · 7 min · Cloud panel with the matching CLI line
Two identities came out of the same access review. The deploy bot publishes artefacts and writes job output…
role assignmentleast privilegescopeemergency access
Close an evidence container and fix its reader
ProChallenge · Quick · 9 min · Cloud panel with the matching CLI line
Case evidence sits in a container that answers anonymous reads and uses Microsoft-managed keys. The only account that reads it holds Owner on the subscription…
storage accountanonymous accessencryption at restrole based access control
Get a food bank platform ready for the winter appeal
ProCapstone · In-depth · 32 min · Cloud panel with the matching CLI line
A regional food bank opens its winter appeal next week. The thank-you letters container answers the internet, the grant returns account is private but uses Microsoft-managed keys…
storage container accessencryption at restblob versioningnetwork security group
Where to go next
Every certification with labsAZ-900 lab questions
There are 33 labs: 16 guided, 11 assisted, 5 challenge, 1 capstone. Together they carry about 4 hours of authored lab time, and none of them is a free taster yet.
Practise AZ-900 the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.