AZ-900 Microsoft Azure Fundamentals Exam

Describe Azure Regions, Region Pairs, and Sovereign Regions

Azure Regions

An Azure region is a geographic area that contains multiple datacenters working together to deliver cloud services. Each region provides local access to Azure services, which helps reduce network latency and improve performance for users closest to that region. When you deploy resources in Azure, you choose which region they live in, and this choice affects both speed and compliance. Selecting a region near your users keeps resources nearby and improves response times, making applications feel faster and more reliable.

Region Pairs

Azure pairs each region with another region in the same geography to create region pairs for disaster recovery. If one region experiences an outage, services can automatically fail over to its paired region, keeping your applications running. Azure updates paired regions one at a time rather than simultaneously, which prevents both regions from being down at the same time. This pairing also ensures that data stays within specific geographic boundaries, helping organizations meet data residency requirements.

Sovereign Regions

Sovereign regions are specialized Azure deployments designed for governments or industries with strict regulatory needs. Examples include Azure Government in the United States and Azure operated by 21Vianet in China, which keeps data within those countries' borders. These regions provide isolated networks, dedicated support, and data residency controls to comply with local laws. Not all Azure services are available in sovereign regions, so organizations must check service availability before deploying.

Describe Availability Zones

Purpose and Benefits

Availability zones are physically separate datacenters within a single Azure region, each with its own power, cooling, and network systems. This separation means that a problem in one zone, such as a power outage or network failure, is less likely to affect the other zones. The main purpose of availability zones is to increase high availability and support disaster recovery plans for applications that cannot afford downtime.

How Zones Work

Azure builds availability zones several kilometers apart—far enough to avoid most local disasters but close enough to keep network connections fast. When you deploy resources across multiple zones, your application can survive the failure of an entire datacenter. Azure provides two ways to use zones: zone-redundant deployments automatically spread your resources across zones and handle replication and failover for you, while zonal deployments let you pin a resource to a specific zone, giving you more control but requiring you to manage redundancy yourself.

Service Availability and Trade-offs

Many Azure services like Virtual Machines, Azure Storage, and SQL Database offer zone-redundant options. When you select a zone-redundant service tier, Azure automatically replicates your data and handles failover if a zone fails, often with a higher SLA such as 99.99% availability. Using availability zones increases costs because you pay for duplicate resources running in each zone, but for mission-critical applications, this cost is usually justified to meet strict uptime requirements.

Describe Azure Datacenters

Physical Infrastructure

Azure datacenters are physical facilities operated by Microsoft across global regions, and they form the core of Azure's cloud platform. These facilities contain servers, storage devices, and networking equipment that work together to deliver cloud services efficiently. Microsoft implements multiple layers of security including physical security to protect hardware in restricted facilities, network architecture that uses segmentation and firewalls to prevent unauthorized access, and real-time monitoring to detect and respond to threats.

Global Network and Connectivity

Azure organizes datacenters into regions connected by a high-speed, low-latency network. Azure's global backbone network connects all regions and zones using private fiber-optic cables including undersea links, ensuring high-bandwidth connectivity between regions. Within each region, availability zones provide resilience by physically separating datacenters so that if one zone fails, workloads can fail over to another zone. Services like Azure Traffic Manager route user traffic to the nearest or healthiest endpoints based on performance.

Redundancy and High Availability

Azure divides infrastructure into fault domains and update domains to protect against hardware and software disruptions. Fault domains provide physical isolation to limit the impact of server or network failures, while update domains ensure maintenance operations occur in staggered groups to avoid simultaneous downtime. Azure uses multiple datacenters within a single region for redundancy, often pairing them with another region for disaster recovery where data is replicated between paired regions.

Describe Azure Resources and Resource Groups

Azure Resources

Azure resources are individual services you create and manage in the cloud to build and run applications. Common examples include virtual machines for compute workloads, storage accounts for data storage, and managed databases like Azure SQL Database. Every resource is deployed and maintained through Azure Resource Manager, which acts as a consistent management layer. Resources are uniquely identified by a resource ID, which is a hierarchical path detailing the subscription, resource group, and specific resource provider.

Resource Groups

A resource group is a container that holds related resources for a specific cloud solution. You group resources based on what makes sense for your organization, such as grouping by purpose or lifecycle. When you create a resource group, you must select a location, which determines where the group's management metadata is physically stored. Control plane operations like creating or updating a resource are routed through this location to keep the group in a consistent state.

Managing Resource Groups

You can create and manage resource groups using the Azure portal, Azure CLI, or Azure PowerShell. Beyond creation, you can list groups, retrieve details, or delete them when no longer needed. Using resource groups provides several advantages: you can deploy and update resources together using templates, view costs collectively, enforce consistent tagging standards, and delete all resources in the group at the same time. Applying permissions at the resource group scope ensures all child resources automatically inherit the same security settings.

Describe Subscriptions

Purpose and Benefits

An Azure subscription is a logical container that holds the products and services you acquire in Azure. Subscriptions exist to help you organize, manage, and bill for your resources, and they come at no cost themselves. By grouping related services under a single subscription, you get a centralized view of everything you own in Azure. Multiple subscriptions let you delegate management and apply different security or compliance policies across teams, departments, or projects.

Subscription Structure

Azure subscriptions are part of a larger hierarchy that starts with the root management group, followed by management groups, then subscriptions, and finally resource groups containing individual resources. Subscriptions inherit policies and permissions from their parent management group, so rules applied at a higher level automatically flow down to all child subscriptions. Each subscription is tied to one Microsoft Entra ID tenant, ensuring consistent authentication and identity management across all resources.

Billing and Governance

Subscriptions are the primary billing containers, each linked to a billing account that tracks invoices, payments, and usage details. You can manage subscriptions using the Azure portal, Azure CLI, or Azure PowerShell. Role-Based Access Control lets you assign roles such as Owner, Contributor, or Reader at the subscription level, controlling who can make changes. Each subscription has limits and quotas that govern resource usage, and you can submit a support request to increase quotas when needed.

Describe Management Groups

Purpose and Benefits

Azure management groups are containers that organize multiple subscriptions into a hierarchy, sitting above subscriptions in the Azure hierarchy. They allow you to manage access, policies, and compliance from a single point, reducing complexity and increasing visibility across an organization. The main benefits include improved governance, consistent policy enforcement, and streamlined resource management by applying company-wide rules at the management group level.

Hierarchy and Structure

Management groups form a tree-like hierarchical structure with the root management group at the top containing all other groups and subscriptions. You can nest additional management groups under the root to reflect your organization's structure. Only two types of entities can be direct children: other management groups and subscriptions, and each child can have only one parent. When you place a subscription under a management group, it inherits all access permissions and policies from that parent, and this inheritance flows downward and cannot be bypassed.

Policy and Access Management

A key function of management groups is applying Azure Policy and role-based access control at a high level. When you set a policy or assign a role at the management group, all child subscriptions inherit those settings automatically. This ensures consistent compliance and uniform permissions across your entire environment without having to configure them on each individual subscription. To move a subscription between management groups, you need specific write permissions on the child, the current parent, and the target parent management group.

Describe the Hierarchy of Resource Groups, Subscriptions, and Management Groups

The Azure Hierarchy

Azure organizes its resources in a four-level hierarchy: management groups at the top, followed by subscriptions, then resource groups, and finally individual resources. All requests go through Azure Resource Manager, which serves as a consistent deployment and management layer. This structure ensures that policies and permissions flow down from higher levels to lower ones automatically.

How the Levels Work Together

Management groups sit at the top and organize multiple subscriptions for governance and compliance. Subscriptions serve as billing and access boundaries, each associated with a Microsoft Entra directory. Within subscriptions, resource groups hold related resources that share the same lifecycle, allowing you to deploy, update, or delete them together. Individual resources such as virtual machines, databases, and storage accounts inherit all policies, role assignments, and tags from their parent resource groups, subscriptions, and management groups.

Implementing Governance

Using this hierarchy, you can implement governance and compliance by applying Azure Policy at the management group level to enforce naming conventions and location rules across all subscriptions. Assigning RBAC roles at the subscription or resource group scope lets you follow the principle of least privilege. Resource groups store metadata in a specified region, ensuring data residency compliance when needed, and serve as a scope for applying tags, locks, and policies uniformly across resources.