Exam guide for cloud switchers · Fundamentals

AZ-900 for AWS engineers: Microsoft Azure Fundamentals

AZ-900 checks that you can describe cloud concepts and the core Azure services, governance and management tools.

If you already know AWS, most of the cloud-concept domain is review, and the work is learning Azure names and the Azure resource hierarchy.

Last verified: Oct 27, 2026 against the official AZ-900 study guide · Edit on GitHub · Report an error

Exam at a glance

Exam	AZ-900: Microsoft Azure Fundamentals
Certification	Microsoft Certified – Azure Fundamentals (Fundamentals)
Status	current
Skills measured as of	Jul 20, 2026
Passing score	700 or greater (per the study guide)
Closest AWS cert	CLF-C02

Exam prices vary by country and are set on the exam page, so none are quoted here. Microsoft doesn't publish pass rates.

Who it's for

Engineers who know AWS and need a fast, broad map of Azure before a role-based exam.
Managers, architects and sales engineers who work across both clouds and need the vocabulary.
Anyone starting the Azure Administrator (AZ-104) or Solutions Architect (AZ-305) path. AZ-900 is not a prerequisite for them.

Domains and how they map to AWS

Domain (official)	Weight	Compare pages
Describe cloud concepts	25–30%	4
Describe Azure architecture and services	35–40%	21
Describe Azure management and governance	30–35%	7

1. Describe cloud concepts 25–30%

Official skill areas: Describe cloud computing · Describe the benefits of using cloud services · Describe cloud service types

From AWS: This domain is about cloud concepts, not about Azure, so it transfers almost entirely from AWS. Shared responsibility, IaaS/PaaS/SaaS, consumption pricing and serverless mean the same things. Learn the Microsoft framing: public, private and hybrid cloud models, and comparing pricing models (pay-as-you-go, reservations, savings plans, spot).

Compare pages to study (4):

2. Describe Azure architecture and services 35–40%

Official skill areas: Describe the core architectural components of Azure · Describe Azure compute and networking services · Describe Azure storage services · Describe Azure identity, access, and security

From AWS: This is the biggest domain and has the most new vocabulary. Map AWS accounts to subscriptions and Organizations OUs to management groups. Resource groups are new. Then map the services: EC2 to Virtual Machines, Auto Scaling to Virtual Machine Scale Sets, Lambda to Azure Functions, Elastic Beanstalk to App Service, VPC to Virtual Network, Direct Connect to ExpressRoute, S3 to Blob Storage, IAM Identity Center to Microsoft Entra ID, and GuardDuty/Security Hub to Microsoft Defender for Cloud.

Compare pages to study (21):

3. Describe Azure management and governance 30–35%

Official skill areas: Describe cost management in Azure · Describe features and tools in Azure for governance and compliance · Describe features and tools for managing and deploying Azure resources · Describe monitoring tools in Azure

From AWS: Governance is where Azure differs most from AWS. Azure Policy covers ground that AWS splits between SCPs and Config rules. Resource locks and tags apply at any scope. Cost Management + Billing plays the role of Cost Explorer and Budgets, and Azure Advisor the role of Trusted Advisor and Compute Optimizer. ARM and Bicep are the CloudFormation equivalents. Azure Monitor (with Log Analytics and Application Insights) covers CloudWatch and X-Ray.

Compare pages to study (7):

Concepts that trip AWS engineers up

Resource groups have no AWS equivalent

Every Azure resource lives in exactly one resource group inside a subscription. Resource groups are a lifecycle and access boundary: you can assign RBAC, policy and locks at the resource-group level, and deleting the group deletes everything in it. The hierarchy is management group → subscription → resource group → resource.

Identity lives outside the subscription

A Microsoft Entra ID tenant is the identity directory. Subscriptions trust a tenant, and one tenant can back many subscriptions. AWS IAM, by contrast, is per account. Entra roles (for managing the directory) and Azure RBAC roles (for managing resources) are two separate role systems.

Permissions are role assignments, not attached policies

Azure RBAC grants access by assigning a role definition to a security principal at a scope, and that access is inherited downward. You don't attach JSON policy documents to users the way you do with IAM. Azure Policy is a different thing: it governs resource properties, not who can act.

Regions come in pairs (mostly)

Many Azure regions have a designated paired region that Microsoft uses for sequenced platform updates and prioritized recovery. Some regions have no pair. AWS has no concept of region pairs.

Storage redundancy is a setting you choose

An Azure storage account holds blobs, files, queues and tables, and you choose its redundancy: LRS, ZRS, GRS or GZRS (plus read-access variants). In S3 the storage class sets the durability and AZ placement, and cross-region copies need replication rules.

Resource locks

CanNotDelete and ReadOnly locks can be applied at subscription, resource group or resource level and override RBAC permissions. AWS has no general-purpose equivalent, only per-service features such as EC2 termination protection.

Closest AWS certification

AWS Certified Cloud Practitioner CLF-C02: Same level and purpose: broad, conceptual, no hands-on tasks. Italian and German versions retire after Dec 31, 2026.

FAQ

What does AZ-900 cover, and how is it weighted?

AZ-900 (Microsoft Azure Fundamentals) has 3 domains: Describe cloud concepts (25–30%); Describe Azure architecture and services (35–40%); Describe Azure management and governance (30–35%). Weights are from the official Microsoft Learn study guide (skills measured as of Jul 20, 2026).

What is the closest AWS certification to AZ-900?

AWS Certified Cloud Practitioner (CLF-C02): Same level and purpose: broad, conceptual, no hands-on tasks.

Is AZ-900 a current exam?

As of Oct 27, 2026, Microsoft Learn lists AZ-900 as current.