AZ-900 · Domain 2 of 3

AZ-900 Domain 2: Describe Azure architecture and services

This is the largest AZ-900 group. It covers the building blocks of Azure: regions, resource groups, subscriptions and management groups, the compute, networking and storage services, and the identity, access and security features.

Exam format
35–40%
Official functional groups
4
Assessment estimate
15–22
Suggested study time estimate
10–15 hrs

About 10 min read Reviewed October 2026

Overview

Describe Azure architecture and services is the heaviest AZ-900 group, covering Azure's building blocks. It has four objective groups. The core architectural components cover regions, region pairs, sovereign regions, availability zones, datacenters, resources and resource groups, subscriptions, management groups and their hierarchy. Compute and networking cover virtual machines, scale sets, containers, functions, app hosting, virtual networks, peering, DNS, VPN Gateway, ExpressRoute and endpoints. Storage covers storage services, tiers, redundancy, account options and migration tools. Identity, access and security cover Microsoft Entra ID, authentication methods, Conditional Access, role-based access control, Zero Trust, defense in depth and Microsoft Defender for Cloud.

At 35–40%, this is the largest group and the most service-heavy. It is recognition-level: knowing what each component and service does and the hierarchy they form, not how to configure them. The exam rewards matching a need to the right Azure service.

How it's tested

AZ-900 questions in this group describe a need and ask which Azure component or service fits, at recognition level. Read the full scenario and all options before choosing, picking the service or term that most precisely matches what is described.

  • Place in the hierarchy

    A governance or scope need is described, and you choose management group, subscription, resource group or resource.

  • Match service to use case

    A compute, networking or storage need is described, and you choose the Azure service that fits.

  • Identity or access

    An authentication or permission need is described, and you choose Entra ID, MFA, Conditional Access or RBAC.

Reasoning it through

A company needs a dedicated, private, high-bandwidth connection from its on-premises datacenter to Azure that does not traverse the public internet. A VPN Gateway provides an encrypted tunnel over the internet, which does not meet the private, non-internet requirement. Azure ExpressRoute provides a dedicated private connection that bypasses the public internet with consistent bandwidth, which matches the requirement, so ExpressRoute is the service.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Describe the core architectural components of AzureRegions, availability zones, and the resource hierarchy.
What it means
This covers Azure regions, region pairs and sovereign regions, availability zones, datacenters, resources and resource groups, subscriptions, management groups, and the hierarchy of management groups, subscriptions, resource groups and resources.
What to understand
A region is a geographic area of datacenters, and availability zones are isolated locations within a region for high availability. The management hierarchy nests from management groups (top) through subscriptions and resource groups to individual resources, with governance applied at higher levels flowing down.
How it shows up
A governance scope or infrastructure concept is described, and you must place it in the hierarchy or identify the component.
Common confusion
Confusing the order of the resource hierarchy; management groups contain subscriptions, which contain resource groups, which contain resources.
2.2 Describe Azure compute and networking servicesVMs, scale sets, containers, functions, virtual networks, peering, VPN and ExpressRoute.
What it means
This covers compute types (virtual machines, containers, functions), VM options such as scale sets, availability sets and Azure Virtual Desktop, application hosting with web apps, containers and VMs, and virtual networking including virtual networks, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute and public and private endpoints.
What to understand
Virtual machines give full control, containers package applications, and functions run event-driven code serverlessly. Virtual networks isolate resources, peering connects them, VPN Gateway connects over the internet, and ExpressRoute provides a dedicated private link. Private endpoints give private access to services.
How it shows up
A compute or networking need is described, and you must choose the service, such as functions for event-driven code or ExpressRoute for a private link.
Common confusion
Confusing VPN Gateway with ExpressRoute; VPN Gateway is encrypted over the internet, while ExpressRoute is a dedicated private connection.
2.3 Describe Azure storage servicesStorage services, tiers, redundancy and migration tools.
What it means
This covers comparing Azure Storage services, storage tiers (hot, cool, archive), redundancy options (locally redundant, zone-redundant, geo-redundant), storage account options and types, file-movement tools such as AzCopy, Storage Explorer and Azure File Sync, and migration tools such as Azure Migrate and Azure Data Box.
What to understand
Storage tiers trade access cost against storage cost: hot for frequent access, cool for infrequent, archive for rarely accessed. Redundancy options protect data across hardware, zones and regions. Blob, file, queue and table are the main storage types. Data Box moves large data offline, and Azure Migrate assesses and migrates workloads.
How it shows up
A storage access, redundancy or migration need is described, and you must choose the tier, redundancy or tool.
Common confusion
Confusing storage tiers with redundancy options; tiers relate to access frequency, while redundancy relates to how many copies are kept and where.
2.4 Describe Azure identity, access, and securityMicrosoft Entra ID, authentication, Conditional Access, RBAC, Zero Trust and Defender for Cloud.
What it means
This covers directory services with Microsoft Entra ID and Entra Domain Services, authentication methods including single sign-on, multifactor authentication and passwordless, external identities, Conditional Access, Azure role-based access control, the Zero Trust model, defense in depth, and Microsoft Defender for Cloud.
What to understand
Microsoft Entra ID is Azure's identity and directory service. Authentication verifies who you are, with MFA and passwordless strengthening it, while role-based access control authorizes what you can do. Conditional Access applies policies based on signals. Zero Trust assumes breach and verifies explicitly, and defense in depth layers controls.
How it shows up
An identity or access need is described, and you must choose Entra ID, MFA, Conditional Access or RBAC.
Common confusion
Confusing authentication with authorization; authentication (MFA, SSO) verifies identity, while role-based access control grants permissions.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Region vs. availability zone

    A region is a geographic area; availability zones are isolated locations within it.

    Remember
    Zones provide high availability within a region.
    Tested as
    Architecture questions.
    Trap
    Confusing a region with a zone.

  • Resource hierarchy

    Management groups, subscriptions, resource groups, resources.

    Remember
    Governance at higher levels flows down.
    Tested as
    Governance questions.
    Trap
    Reversing the order.

  • Virtual machines vs. containers vs. functions

    Full control, packaged apps, and event-driven serverless code.

    Remember
    Functions suit event-driven workloads.
    Tested as
    Compute questions.
    Trap
    Using a VM where functions fit.

  • Virtual network and peering

    Isolated network and connections between networks.

    Remember
    Peering connects virtual networks.
    Tested as
    Networking questions.
    Trap
    Confusing peering with a VPN.

  • VPN Gateway vs. ExpressRoute

    Encrypted over the internet versus a dedicated private link.

    Remember
    ExpressRoute bypasses the public internet.
    Tested as
    Hybrid questions.
    Trap
    Confusing the two.

  • Private and public endpoints

    Private access within a network versus public access.

    Remember
    Private endpoints keep traffic off the internet.
    Tested as
    Networking questions.
    Trap
    Overlooking private endpoints.

  • Storage tiers

    Hot, cool and archive by access frequency.

    Remember
    Match the tier to access frequency.
    Tested as
    Storage questions.
    Trap
    Confusing tiers with redundancy.

  • Redundancy options

    LRS, ZRS, GRS and variants protecting copies.

    Remember
    More redundancy means more durability and cost.
    Tested as
    Storage questions.
    Trap
    Confusing redundancy with tiers.

  • Microsoft Entra ID

    Azure's identity and directory service.

    Remember
    It manages identities and authentication.
    Tested as
    Identity questions.
    Trap
    Confusing it with RBAC.

  • Authentication vs. RBAC

    Verifying identity versus granting permissions.

    Remember
    MFA and SSO authenticate; RBAC authorizes.
    Tested as
    Identity questions.
    Trap
    Confusing the two.

  • Zero Trust and defense in depth

    Verify explicitly, assume breach, and layer controls.

    Remember
    Zero Trust trusts nothing by default.
    Tested as
    Security questions.
    Trap
    Treating the network perimeter as sufficient.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Resource hierarchy from top to bottom

ConceptMeaningKey differenceCommon trap
Management group Groups subscriptions Top level for governance Placing it below subscriptions
Subscription Billing and access boundary Contains resource groups Confusing with a resource group
Resource group Container for related resources Groups resources for management Confusing with a subscription
Resource An individual Azure service instance The actual resource Treating it as a group

VPN Gateway vs. ExpressRoute

ConceptMeaningKey differenceCommon trap
VPN Gateway Encrypted tunnel over the internet Uses the public internet Using it where a private link is required
ExpressRoute Dedicated private connection Bypasses the public internet Confusing it with a VPN

VMs vs. containers vs. functions

ConceptMeaningKey differenceCommon trap
Virtual machines Full OS control Most control, most management Using them for event-driven code
Containers Packaged applications Portable, consistent Confusing with VMs
Functions Event-driven serverless code No server management Using them for long-running workloads

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Hierarchy reversed

    What candidates pick
    Place resource groups above subscriptions in the hierarchy.
    Why it looks right
    Both are containers.
    Why it's wrong
    Management groups contain subscriptions, which contain resource groups, which contain resources.

    Clue to watch for The question asks about governance scope order.

  2. VPN for private link

    What candidates pick
    Use a VPN Gateway for a dedicated private connection off the internet.
    Why it looks right
    Both connect on-premises to Azure.
    Why it's wrong
    VPN Gateway is encrypted over the internet; ExpressRoute is a dedicated private link that bypasses it.

    Clue to watch for The requirement is a private, non-internet connection.

  3. Tier is redundancy

    What candidates pick
    Choose a storage redundancy option to lower access cost for rarely used data.
    Why it looks right
    Both are storage settings.
    Why it's wrong
    Storage tiers relate to access frequency and cost; redundancy relates to how many copies are kept and where.

    Clue to watch for The need is cost for infrequently accessed data.

  4. MFA is authorization

    What candidates pick
    Use multifactor authentication to grant a user permissions to a resource.
    Why it looks right
    Both relate to access.
    Why it's wrong
    MFA authenticates identity; role-based access control grants permissions.

    Clue to watch for The need is to grant or limit what a user can do.

  5. VM for event code

    What candidates pick
    Run short event-driven code on an always-on virtual machine.
    Why it looks right
    VMs are a default compute choice.
    Why it's wrong
    Azure Functions runs event-driven code serverlessly without managing a VM.

    Clue to watch for The workload is short, event-driven code.

  6. Region is a zone

    What candidates pick
    Treat an Azure region and an availability zone as the same.
    Why it looks right
    Both are location terms.
    Why it's wrong
    A region is a geographic area containing multiple isolated availability zones.

    Clue to watch for The question distinguishes geographic area from isolated zones.

Answer framework

For any Domain 2 scenario, use these steps to find the answer AZ-900 expects.

  1. Identify whether the need is architecture and hierarchy, compute, networking, storage, or identity and security.
  2. For governance scope, place the item correctly in the hierarchy from management groups down to resources.
  3. For compute and networking, match the service to the need, using functions for event-driven code and ExpressRoute for a private link.
  4. For storage, choose the tier by access frequency and the redundancy by durability needs, and the right migration tool for the data size.
  5. For identity and access, distinguish authentication (Entra ID, MFA) from authorization (RBAC), and apply Conditional Access and Zero Trust principles. Where two options seem to fit, pick the one that most precisely matches the scenario.

Practice question

An organization needs a dedicated, private, high-bandwidth connection between its on-premises datacenter and Azure that does not travel over the public internet. Which Azure networking service should it use?

Want more like this? The AZ-900 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This is the largest and most service-heavy group, so build a service map and drill matching needs to services. Start with the core architecture: the resource hierarchy (management groups, subscriptions, resource groups, resources) and regions versus availability zones, which are frequent exam items.

Next, learn the compute and networking services, keeping VMs, containers and functions distinct and nailing the VPN Gateway versus ExpressRoute difference. Then cover storage, separating tiers (access frequency) from redundancy (copies and location). Finally, learn identity and security: Microsoft Entra ID, the authentication-versus-authorization distinction, Conditional Access, Zero Trust and Defender for Cloud.

Because coverage matters more than depth, make sure no major service is unfamiliar. Because AZ-900 is a recognition exam, flashcards and timed practice questions are more valuable than hands-on labs, and reviewing missed questions by group shows where to focus; the free Microsoft Learn Azure Fundamentals path maps directly to these objectives. Afterwards, move to Domain 3, management and governance.

FAQ

How much of AZ-900 is Domain 2?

Describe Azure architecture and services is 35–40% of the exam, the single largest group.

What is the order of the Azure resource hierarchy?

From top to bottom: management groups contain subscriptions, which contain resource groups, which contain individual resources. Governance applied higher up flows down.

What is the difference between VPN Gateway and ExpressRoute?

A VPN Gateway creates an encrypted tunnel over the public internet. ExpressRoute provides a dedicated private connection that bypasses the public internet with consistent bandwidth.

What is the difference between a region and an availability zone?

A region is a geographic area containing datacenters. Availability zones are physically isolated locations within a region that provide high availability.

What is the difference between storage tiers and redundancy?

Storage tiers (hot, cool, archive) relate to how often data is accessed and the cost trade-off. Redundancy (such as LRS, ZRS, GRS) relates to how many copies are kept and where.

What is the difference between authentication and RBAC?

Authentication, such as MFA and single sign-on, verifies who a user is. Azure role-based access control grants permissions, determining what the user can do.

How does Domain 2 connect to the rest of the exam?

The services and hierarchy here are governed and managed using the cost, policy and monitoring tools in Domain 3, and rest on the concepts from Domain 1.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered Azure architecture, compute, networking, storage and identity. Test whether you can match a need to the right Azure service under exam conditions.

Take the AZ-900 practice test Check your AZ-900 readiness

Keep going