TL;DR
AZ-900 gives you 45 minutes of exam time inside a 65-minute appointment, pass mark 700 on the 1000 scale, with Microsoft publishing no fixed question count. Three skill areas carry the weight: cloud concepts 25 to 30%, Azure architecture and services 35 to 40%, management and governance 30 to 35%. Four weeks at 30 to 45 minutes a day passes comfortably for anyone working in IT; newcomers to cloud should add a week. Fundamentals certifications do not expire. Plan: AZ-900 cert page.
The overstudying trap
AZ-900 is the most overstudied exam in this series. Candidates arrive with associate-level depth on virtual networks and leave points on basic definitions because fundamentals questions test vocabulary precision, not engineering judgment. The rule for all four weeks: learn what each thing IS and when to pick it, never how to configure it deeply. When a topic tempts you deeper (and virtual networking will), ask whether the official study guide bullet needs it; if not, move on. Microsoft publishes a free official study guide and free practice assessment for this exam, and the guide bullets are the syllabus. Anything outside them is hobby study. Pair this plan with the cloud exam-day checklist in week 4 so logistics never cost points.
Week 1: Cloud concepts (25 to 30%)
Definitions stated exactly. Cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service. Shared responsibility model: Microsoft secures the cloud (physical hosts, network controls of the platform), you secure what you put in it, with the line moving by service type. Cloud models: public (Microsoft-owned multi-tenant), private (single-tenant dedicated), hybrid (both, connected), with use-case matching as the tested skill. Consumption-based model and pay-as-you-go versus reserved capacity; CapEx versus OpEx framing for finance-flavored questions. Serverless: code runs without managing servers, billed per execution. Benefits vocabulary: high availability (uptime through redundancy), scalability (vertical scale up versus horizontal scale out), elasticity versus agility, reliability and predictability, security and governance, manageability. Service types with one-line use cases: IaaS (virtual machines, you manage the OS up), PaaS (managed platforms like App Service, you bring code), SaaS (finished software like Microsoft 365, you configure). Drill: for any workload described in one sentence, name the service type in under five seconds. This recognition speed pays off across the whole exam.
Week 2: Azure architecture and services (35 to 40%, the largest area)
Hierarchy first: management groups contain subscriptions, subscriptions contain resource groups, resource groups contain resources; policy and access flow downward. Geography: regions, region pairs (each region paired with another at least 300 miles away for disaster recovery), sovereign regions for government clouds, availability zones (physically separate datacenters in a region, three or more where supported) with zone-redundant versus zonal services. Compute options matched to needs: virtual machines with scale sets and availability sets for lift-and-shift, App Service for managed web apps, Functions for event-driven code, Container Instances and Kubernetes Service for containers, Virtual Desktop for remote desktops. Networking: virtual networks and subnets, peering connecting VNets privately, VPN Gateway for encrypted internet links, ExpressRoute for private dedicated links, public versus private endpoints. Storage: Blob for objects, Files for SMB shares, Queues and Tables for messaging and NoSQL, storage tiers Hot, Cool, Cold, Archive by access frequency, redundancy LRS (one datacenter), ZRS (zones), GRS and GZRS (second region). Identity and security: Microsoft Entra ID for directory and SSO, MFA and passwordless options, Conditional Access policies (if conditions, then controls), role-based access control roles (Owner, Contributor, Reader, User Access Administrator), Zero Trust principles (verify explicitly, least privilege, assume breach), defense in depth layers, Defender for Cloud for posture. Lab line: run the free Microsoft Learn sandbox exercises for resource groups, a VM, and a storage account; az group create --name lab --location westeurope plus az vm list --output table makes the hierarchy concrete in twenty minutes.
Week 3: Management and governance (30 to 35%)
Cost management: factors affecting cost (region, resource type, usage meters, bandwidth, licensing), Pricing calculator for estimates, Total Cost of Ownership calculator for migration business cases, Cost Management budgets and alerts, tags enabling cost allocation and automation. Governance tools: Azure Policy (assign definitions, audit and deny effects, initiatives as bundles), resource locks (CanNotDelete versus ReadOnly), Microsoft Purview for data governance. Deployment and management: portal, Cloud Shell with Bash or PowerShell, CLI versus PowerShell syntax recognition (az commands versus Az cmdlets), Azure Arc extending management to hybrid resources, infrastructure as code with ARM templates and Bicep, Resource Manager as the deployment layer. Monitoring: Advisor recommendations (cost, security, reliability, operational excellence, performance), Service Health (personalized outage and maintenance views), Monitor with Log Analytics, alerts, and Application Insights. Drill: match every tool to its one-line job (Policy enforces rules, locks prevent accidents, Advisor recommends, Monitor observes, Defender for Cloud secures posture). Tool-confusion questions are the week-3 staple, and the one-line-job method kills them.
The pairs that confuse everyone
Fundamentals exams separate candidates on near-identical pairs, so drill these explicitly. Virtual machines versus App Service versus Functions versus containers: VMs give full control of the OS, App Service hosts web apps without server management, Functions run single pieces of event-driven code, containers package apps with dependencies for consistent deployment. Storage redundancy: LRS keeps copies in one datacenter, ZRS spreads them across zones, GRS copies to a second region, GZRS does both. Storage tiers: Hot for frequent access, Cool for infrequent, Cold for rare, Archive for almost never, with retrieval cost rising as storage cost falls. Policy versus locks versus RBAC: Policy enforces rules and compliance at scale, locks prevent accidental deletion or change on specific resources, RBAC grants people the right permissions. VPN Gateway versus ExpressRoute: encrypted tunnel over the internet versus private dedicated connection. Advisor versus Monitor versus Service Health: recommendations for your resources, observability into performance and logs, personalized view of Azure outages. SSO versus MFA: one login for many apps versus proving identity with two or more factors. Run each pair as a five-minute flash round until the distinction is instant.
Week 4: Simulate, rehearse, book
One full practice assessment under 45-minute timing early in the week, then patch-only review of missed skill areas. Rehearse the exact exam behaviors: no penalty for guessing means answer everything, some items are unscored trials mixed invisibly so a strange question means nothing, and case-style Yes/No sets cannot be revisited once submitted so commit per question. Memorize the SLA ladder (99.9% allows about 43 minutes monthly downtime, 99.95% about 21, 99.99% about 4) since availability math appears in exactly this form. Re-read the service-type and hierarchy notes from weeks 1 and 2 the night before; they are the highest-frequency questions on the paper. Retake policy is gentle (24 hours after a first failed attempt), but at 99 dollars per attempt the plan still aims at one sitting. Book through the Microsoft scheduling flow at Pearson VUE or Certiport when a timed practice run clears your comfort zone, confirm the 65-minute appointment and ID rules from the cloud exam-day checklist, and stop studying new material the evening before. Compare next steps on the SC-500 8-week plan or the SAA 8-week plan once this is banked.
Practise with labs and PBQs
AZ-900 rewards recognition, and recognition is built by clicking, not by reading a glossary. The pack holds 33 labs and no performance-based questions, which fits a fundamentals exam: the questions are multiple choice, so the labs are there to make the vocabulary concrete rather than to rehearse a format (counts from the live catalogue).
One lab per study day is enough. Week 1 gets the resource-group and subscription tasks, which exist to teach scope. Week 2 gets the compute, storage and networking tasks, and this is the block where a lab beats a slide: create the resource, watch which blade shows the property, delete it, and note what was billed. Week 3 gets the governance tasks — policy, tags, cost views — because management and governance is 30 to 35% of the exam and the least practised. Week 4 is practice assessments only.
The AZ-900 lab catalogue sorts by objective, and the AZ-900 versus Cloud Practitioner comparison is the alternative if you are choosing a first cloud exam.
Who wrote this
SecLern Editorial. Weights, timing, scoring, and skill bullets were read from the Microsoft AZ-900 study guide and certification pages on 2026-10-18. The anti-overstudy rule reflects our practice data: AZ-900 misses come from imprecise vocabulary, not shallow depth.