Azure Architecture and Core Services
This chapter covers the physical and organizational structure of Azure along with its most important services. You will learn how Azure organizes datacenters into regions and availability zones, how resources are grouped into resource groups and subscriptions and management groups, and the core compute, storage, networking, database, and identity services you will use to build solutions. As the largest exam domain, mastering these building blocks is central to Azure fundamentals.
Azure Global Infrastructure: Regions and Availability Zones
Azure runs on a worldwide network of datacenters that Microsoft organizes into a hierarchy designed to deliver performance, resilience, and compliance, and the AZ-900 exam expects you to know the vocabulary. The largest unit is a geography, a discrete market such as the United States or Europe that typically aligns with a country's borders and its data-residency and compliance requirements. Within a geography are regions, and a region is the concept you work with most. An Azure region is a set of datacenters deployed within a defined area and connected by a dedicated low-latency network. When you create a virtual machine or a storage account, you choose the region it lives in, and you pick that region to be close to your users, to satisfy data-residency laws, and based on which services and prices are available there. Not every service or every VM size is offered in every region, so availability itself influences placement. Inside many regions are availability zones, which are physically separate datacenters, each with independent power, cooling, and networking, located far enough apart to avoid a shared local failure but close enough for low-latency replication. By spreading a workload across two or three availability zones, you protect it against the failure of a single datacenter and can qualify for higher availability SLAs. Regions are also organized into region pairs: most regions are paired with another region in the same geography, and Microsoft uses these pairs for platform updates (rolled out to one region at a time) and for geo-redundant storage that replicates your data to the paired region for disaster recovery. Finally, Azure offers sovereign and specialized clouds, such as Azure Government and clouds operated in specific countries, that are isolated from the global public cloud to meet strict regulatory needs. The exam-critical distinctions are these: a region is a place you deploy to; availability zones protect against datacenter-level failure inside a region; and region pairs support recovery and coordinated updates across a geography.
The Azure Resource Hierarchy and Azure Resource Manager
Azure organizes everything you create into a four-level management hierarchy, and understanding it is essential because it determines how you apply access control, policy, and billing, and how those settings are inherited. At the bottom is the resource: a single manageable item such as a virtual machine, a storage account, a database, or a public IP address. Every resource is of a particular type and lives in exactly one region and one resource group. A resource group is a logical container that holds related resources, typically ones that share a lifecycle so that you can deploy, update, and delete them together. A resource group is also a scope: you can assign permissions and policies to it, and a resource can belong to only one resource group at a time. Above resource groups are subscriptions. A subscription groups resource groups for the purposes of billing, access management, and quota or limit boundaries; costs roll up to the subscription, and many service limits are enforced per subscription, so organizations often use separate subscriptions to separate environments such as production and development or to divide costs among departments. At the top are management groups, which sit above subscriptions and let you organize many subscriptions into a tree so that you can apply governance, such as an Azure Policy or a role assignment, once and have it apply across all the subscriptions beneath it. The single most important property of this hierarchy is inheritance: a setting applied at a higher level flows downward to everything below it. A policy assigned at a management group applies to all its subscriptions, their resource groups, and their resources. The engine that makes all of this work is Azure Resource Manager (ARM), the deployment and management layer that receives every request, whether it comes from the portal, the CLI, PowerShell, or a REST call, and consistently applies authentication, authorization, policy, and tagging. ARM templates and Bicep let you describe your resources declaratively so an entire environment can be deployed reproducibly.
Core Compute Services
Compute is where your code and workloads actually run, and Azure offers a spectrum of options that trade control against operational overhead. The exam expects you to match a scenario to the right service. At the most hands-on end are Azure Virtual Machines, the flagship IaaS offering. A VM is a complete server you rent by the second, where you choose the operating system, install any software, and retain full control, along with full responsibility for patching and configuration. VMs suit lift-and-shift migrations and workloads that need a specific OS or custom software. To make groups of VMs resilient and scalable, Azure provides availability sets, which spread VMs across fault and update domains so hardware failures and maintenance affect only a subset, and Virtual Machine Scale Sets, which manage a group of identical VMs that autoscale behind a load balancer. Moving toward managed platforms, Azure App Service is a PaaS offering for hosting web applications, REST APIs, and mobile back ends without managing the underlying servers or patching the OS; it handles scaling, load balancing, and deployment slots for you. For event-driven work, Azure Functions provides serverless compute: you write a small piece of code triggered by an event such as an HTTP request, a timer, or a message on a queue, and you are billed only while it runs, with scaling handled automatically. Containers offer a middle path that packages an application with its dependencies so it runs consistently anywhere. Azure Container Instances (ACI) runs a single container quickly without any server management, ideal for simple or burst tasks, while Azure Kubernetes Service (AKS) orchestrates many containers across a cluster for complex, scalable microservice applications, managing the Kubernetes control plane for you. Azure Virtual Desktop rounds out the set by delivering cloud-hosted Windows desktops and apps to users anywhere. The unifying idea for the exam is the control-versus-convenience trade-off: choose VMs for maximum control, App Service or Functions to eliminate server management, and containers when you need portability and consistent environments.
Storage and Databases
Azure separates storage into services tuned for different kinds of data, and it offers a family of managed databases so you do not have to run the database engine yourself. The foundation is the Azure Storage account, which contains several data services. Azure Blob Storage holds unstructured object data such as images, video, backups, logs, and documents at massive scale, and it offers access tiers (hot, cool, cold, and archive) that let you trade retrieval speed against storage cost, so rarely touched backups can sit cheaply in archive. Azure Files provides fully managed file shares accessible over the industry-standard SMB and NFS protocols, so they can be mounted by cloud VMs and on-premises machines alike, which makes them ideal for a shared drive that must move to the cloud. Azure Queue Storage holds messages for decoupling application components, and Azure Table Storage and Azure Disk Storage round out the account for NoSQL key-value data and VM disks respectively. A crucial exam topic is redundancy, which determines how many copies of your data Azure keeps and where. Locally redundant storage (LRS) keeps copies within a single datacenter; zone-redundant storage (ZRS) spreads copies across availability zones in a region to survive a datacenter loss; and geo-redundant storage (GRS) additionally replicates to a paired region far away to survive a regional disaster. On the database side, Azure SQL Database is a fully managed relational database built on the SQL Server engine, handling patching, backups, and high availability for you, and it suits structured, transactional data. Azure Cosmos DB is a globally distributed, multi-model NoSQL database that delivers single-digit-millisecond latency and turnkey replication across regions, suited to worldwide applications and flexible schemas. Azure also offers managed open-source databases such as Azure Database for PostgreSQL and MySQL. For moving data in, the Azure Migrate hub and tools like Azure Data Box (a physical appliance for shipping large datasets) help. The exam theme is matching the data (structured, unstructured, or file-based) and the durability you need to the right service and redundancy option.
Networking and Identity
Networking connects your Azure resources to each other, to your on-premises environment, and to the internet, while identity controls who is allowed to sign in and reach them; together they form the connectivity and access foundation of every solution. The core networking building block is the Azure Virtual Network (VNet), a logically isolated private network in the cloud where your resources communicate securely. A VNet is divided into subnets that segment its address space so you can group and isolate resources, and VNets in the same or different regions can be joined with virtual network peering. To control traffic, Network Security Groups (NSGs) hold a prioritized list of allow and deny rules based on source, destination, port, and protocol, filtering traffic to subnets and network interfaces, while Azure Firewall provides a managed, stateful firewall for centralized protection. For getting traffic to the right place, Azure Load Balancer distributes traffic at Layer 4 (TCP/UDP) across healthy instances, and Azure Application Gateway operates at Layer 7 with URL-based routing and an optional Web Application Firewall; Azure DNS hosts your domains and Azure Front Door and Traffic Manager route users globally. Connecting to on-premises networks uses two options the exam contrasts: a VPN Gateway creates an encrypted tunnel over the public internet, which is quick and inexpensive, while ExpressRoute provides a private, dedicated connection through a connectivity provider that never touches the public internet, offering higher bandwidth, lower latency, and more consistent reliability. On the identity side, Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud identity and access management service. It authenticates users and applications and controls what they can access, providing single sign-on across cloud apps, multifactor authentication for stronger security, conditional access policies, and managed identities that let Azure resources authenticate to each other without stored credentials. Entra ID is the identity layer that role-based access control builds on, so it underpins nearly every security decision in Azure. The exam pairing to remember: VNets, NSGs, and gateways move and filter traffic; Entra ID decides who you are and what you may do.
Last updated: September 2026
La práctica sigue gratis. La guía completa de Microsoft Azure Fundamentals (AZ-900) es el material en sí, explicado de principio a fin — un PDF + EPUB descargable que conservas.