ERW AZ-900 Certification Bootcamp — Week 2: Azure architecture: where it lives and what runs on it

This week’s assessments: Pop Quiz 2 — Where Azure Lives after Session 8 · Practice Exam 2 — Architecture and Services after Session 10

Every session: the exact names Microsoft uses · one assignment marked against a published rubric · pass mark 70 · Certificate: capstone at 70+ and the marked Final at 700+

B · Describe Azure architecture and services · 35–40%SESSION 6

Where Azure lives: regions, region pairs, sovereign regions, availability zones, datacenters

Session 6 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe Azure regions, region pairs, and sovereign regions
Describe availability zones
Describe Azure datacenters

Why This Matters

Every Azure resource you create lives somewhere, and the exam expects you to describe that somewhere precisely. Today covers the physical side of Azure: datacenters, regions, geographies, availability zones, region pairs and sovereign regions. I have watched candidates confuse an availability zone with a region pair, yet they protect against different failures. A zone protects you when part of a region goes down; a pair helps you recover when a whole region is in trouble. At work, the region is often the first decision in a project and one of the hardest to change, because it touches latency, data residency and resilience. Today you read the real region list and choose a region for an organisation you know.

The 30-Minute Session

0:00 – 6:00

Datacenters, regions and geographies

An analogy: a datacenter is a building, a region is a cluster of buildings in one city, an availability zone is a separately powered district, and a region pair is a distant twin city.
Azure starts with datacenters: facilities with racked servers and dedicated power, cooling and networking, like an on-premises datacenter but far larger. You never choose one. Azure groups them into regions and availability zones, and you choose those.
A region is a geographical area containing at least one, and potentially several, datacenters that are nearby and networked together with a low-latency network. Most resources ask for a region when you create them, as the Region list showed you in Session 2.
Regions sit inside a geography, which represents a data residency boundary, such as the United States or Europe, and contains one or more regions. If an organisation must keep its data within a country or bloc, choose regions in that geography.
THE EXAM LINE
A region is a geographical area with one or more nearby datacenters on a low-latency network. A geography is a data residency boundary that contains one or more regions.

When a scenario mentions a legal rule about where data sits, think geography first, then region.

6:00 – 12:00

Availability zones

Availability zones are physically separate datacenters, or groups of datacenters, within one region. Each zone has its own power, cooling and networking, so if one zone has an outage, the remaining zones keep the region's services running.
The Learn unit says every zone-enabled region has at least three zones. At the time of writing, the reliability documentation adds that zones are typically several kilometres apart and usually within 100 kilometres of each other.
Not every region has zones, and some services might not support zones even where they exist. The Azure regions list marks which regions have them.

Type	What it means	Examples from Learn
Zonal	You deploy the resource to a single zone that you select. For resilience, you run instances in two or more zones.	VMs, managed disks, IP addresses
Zone-redundant	The service replicates or distributes the resource across zones for you.	Zone-redundant storage, SQL Database
Non-regional	Always available from Azure geographies, resilient to zone-wide and region-wide outages.	—

THE EXAM LINE
Availability zones are physically separate datacenters within one region, each with independent power, cooling and networking. Zonal: you pick the zone. Zone-redundant: the service spreads the resource across zones for you.

A single VM in one zone is not zone-resilient. Resilience starts at two zones.

12:00 – 18:00

Region pairs and sovereign regions

Microsoft pairs some regions with another region, usually in the same geography, to form a region pair. Learn's examples are West US with East US, and Southeast Asia with East Asia. The Learn unit adds that most pairs are at least 300 miles apart.
What a pair gives you: in a geography-wide outage, one region in each pair is prioritised for recovery; planned updates are staggered across the pair; and almost all pairs share a geography, which supports data residency.
Two exceptions. Brazil South is paired in one direction only: its secondary is South Central US, outside its geography, but not the reverse. And many newer regions, such as Italy North and Poland Central, have no pair; these nonpaired regions rely on availability zones instead.
THE EXAM LINE
Region pairs: one region in each pair is prioritised for recovery, and planned updates are staggered across the pair. Pairs usually share a geography. Not every region has a pair.
Sovereign regions are instances of Azure isolated from the main instance, for compliance or legal purposes. Azure Government (for example US DoD Central and US Gov Virginia) serves US government agencies and partners from physically isolated datacenters in the US only. Microsoft Azure operated by 21Vianet (for example China East) is a physically separated instance in China, operated by 21Vianet rather than by Microsoft.
Trap: a pair does not copy your data for you. Where a service doesn't replicate automatically, the customer must configure replication.

Ask what the design must survive: a datacenter, a zone or a whole region. The answer names the feature.

18:00 – 26:00

Hands-on: read the real region list

Choose a primary region for an organisation you know. Illustrative example: a Lagos bank might consider South Africa North, listed with availability zones and paired with South Africa West, which Microsoft marks as restricted to specific scenarios such as disaster recovery.
TRACK A · YOUR AZURE ACCOUNT
- Open Cloud Shell from the portal's top navigation and choose Bash. In Getting started, select No storage account required, pick your subscription and select Apply. This ephemeral session stores nothing.
- Type the commands below. The first lists the regions your subscription can use. The second shows one region in full: find metadata.geography, metadata.pairedRegion and availabilityZoneMappings. Screenshot both.
- The Azure PowerShell equivalent is Get-AzLocation. Session 16 teaches both tools; today you only read.
TRACK B · NO PAYMENT CARD
- Open Learn's public Azure regions list, find your region, and screenshot its row with the address visible.
- Confirm the pair on Azure region pairs and nonpaired regions, and read the Azure geographies page on azure.microsoft.com.
- These are the facts the command returns. What you cannot see is which regions a given subscription may use; say so.

bashCloud Shell (Bash)type it yourself

# Regions available to your subscription (read-only)
az account list-locations --query "[].{Region:name}" --output table

# One region in full: use the programmatic name you chose
az account list-locations --query "[?name=='southafricanorth']"

Both tracks: record the display name, programmatic name, geography, zone support, pair (or N/A) and whether the pair is restricted.

Copy the programmatic name exactly as the list prints it. Later sessions use it in commands.

26:00 – 30:00

Wrap-up and your assignment

Write down a definition and an example for datacenter, region, geography, availability zone, region pair and sovereign region, plus the Brazil South exception.
THE EXAM LINE
Sovereign regions are isolated instances of Azure for compliance or legal needs: Azure Government for US government agencies and partners, and Microsoft Azure operated by 21Vianet in China.
Your assignment chooses a region and a resilience design for an organisation near you. Take every fact from a Microsoft page, because the list changes as Azure grows.

Keep your region's programmatic name to hand; you will use it for the rest of the week.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`availability zones`	concept	Separate groups of datacenters within one region, each with independent power, cooling and networking.	Learn →
`zonal`	concept	A resource deployed to a single availability zone that you select.	Learn →
`zone-redundant`	concept	A resource the service replicates or distributes across zones.	Learn →
`region pair`	concept	Two associated regions, usually in the same geography.	Learn →
`nonpaired regions`	concept	Regions without a pair, relying on availability zones instead.	Learn →
`geography`	concept	A data residency boundary containing one or more regions.	Learn →
`sovereign regions`	concept	Instances of Azure isolated from the main instance, for compliance or legal needs.	Learn →
`US DoD Central`	concept	An example sovereign region for US government agencies and partners.	Learn →
`Azure Government`	service	Dedicated cloud for US government agencies and partners, in the US only.	Learn →
`Microsoft Azure operated by 21Vianet`	service	Physically separated instance of Azure in China, operated by 21Vianet.	Learn →
`az account list-locations`	cli	Lists the regions supported for the current subscription.	Learn →
`Get-AzLocation`	powershell	Gets all locations and the resource providers each supports.	Learn →
`No storage account required`	portal	Cloud Shell option that starts an ephemeral session with nothing to store.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Datacenter

A facility of racked servers with dedicated power, cooling and networking. Azure groups datacenters into regions and zones.

Data residency

A requirement about where data is stored. In Azure, a geography is a data residency boundary.

Zone-resilient

Able to survive the loss of one availability zone, because the resource is zone-redundant or runs in several zones.

Programmatic name

A region's name as commands use it, such as southafricanorth.

Self-Check — Before You Submit

1. A hospital's patient portal runs on VMs in one region and must survive the failure of one separately powered group of datacenters there. What should it use?

A. A region pair
B. Availability zones
C. A sovereign region
D. A second geography

B. Availability zones — Availability zones are separate datacenters within one region, each with independent power, cooling and networking. A region pair targets region-wide problems, which is more than this requirement asks for.

2. Which statement about region pairs is correct?

A. Every Azure region has a pair
B. Pairing copies all your data automatically
C. Azure staggers planned updates across a region pair
D. Paired regions are always in different geographies

C. Azure staggers planned updates across a region pair — Microsoft staggers planned updates across a pair. Many newer regions have no pair, some services need replication configured by the customer, and pairs usually share a geography.

3. A partner of a US federal agency needs Azure services in physically isolated datacenters located only in the US. What should it use?

A. Azure Government
B. Microsoft Azure operated by 21Vianet
C. A zone-redundant deployment in East US
D. A nonpaired region

A. Azure Government — Azure Government serves US government agencies and their partners from physically isolated datacenters and networks in the US only. 21Vianet operates the separate instance in China.

Today’s Assignment

Choose a primary Azure region and a resilience design for a real organisation near you, backing every fact with a Microsoft page.

Describe the organisation, where its users are, and any rule about where its data must stay. Mark any assumptions.
Choose a primary region. Record its display name, programmatic name, geography and whether it offers availability zones, exactly as Microsoft lists them.
Name its region pair, or state that it is one of the nonpaired regions. If the pair is restricted, say what that means.
Propose a resilience design for one important workload: the failure it survives (datacenter, zone or region) and whether it uses zonal or zone-redundant resources, a second region, or both. Give one trade-off.
Say whether any sovereign regions would apply to this organisation, and why. Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of both az account list-locations commands and their output for your region.
Track B: screenshots of your region's row in the Azure regions list and its entry on the region pairs page, with the addresses visible.
Both tracks: a summary table of region, programmatic name, geography, zone support and pair.

Names your answer must use exactly
availability zones region pair geography zonal zone-redundant sovereign regions

Track B
Track B students take every region fact from the public Azure regions list and region pairs pages, and submit those screenshots instead of the command output.

How this is marked — the rubric

The region facts (geography, zone support, pair) match Microsoft's published lists	30
The resilience design names the failure it survives and uses zones and regions correctly	30
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots and summary table show the chosen region's facts	20
Total · pass mark 70	100

Submitting session 6
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 6 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

Skills Covered

Regions and geographiesAvailability zonesRegion pairsSovereign regionsRead the region list

Tick it once you have submitted.Next: Session 7 →

B · Describe Azure architecture and services · 35–40%SESSION 7

How Azure is organised: resources, resource groups, subscriptions, management groups

Session 7 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe Azure resources and resource groups
Describe subscriptions
Describe management groups
Describe the hierarchy of resource groups, subscriptions, and management groups

Why This Matters

Before you can govern, secure or pay for anything in Azure, you need to know where it sits. Today covers the four levels that organise every resource: resources, resource groups, subscriptions and management groups. The exam tests the rules at each level and how settings flow down the hierarchy. I have watched candidates attach policies at the wrong level and lose marks. At work, this hierarchy decides who sees what and who pays, and a poor design lasts for years. Today you create a tagged resource group, read your subscription ID and delete the group again.

IN YOUR SUBSCRIPTION

Creates: Track A only: one empty resource group, rg-az900-s07, with two tags.
Cost: The group holds no resources, so nothing in it runs or stores data. Your Session 1 budget remains the safety net; report anything unexpected the same day.
Clean-up: Run az group delete --name rg-az900-s07 --yes, or open the group in the portal, select Delete resource group, type its name and select Delete.

The 30-Minute Session

0:00 – 6:00

Resources and resource groups

An analogy: a resource is a document, a resource group is a folder, a subscription is a filing cabinet with its own bill and lock, and a management group is a room of cabinets under one set of rules.
A resource is the basic building block of Azure: anything you create, provision or deploy, such as a VM, a virtual network or a database. The Azure Resource Manager documentation counts resource groups, subscriptions, management groups and tags as resources too.
A resource group is a container for related resources. Every resource belongs to exactly one group at a time, though some can be moved; groups can't be nested or renamed. A group stores metadata about its resources, which may sit in other regions, although Microsoft recommends the same location.
Actions on a group apply to everything in it: delete the group and its resources go too; grant access to the group and it covers its resources. That is why a temporary environment or a project often gets its own group.
THE EXAM LINE
Each resource belongs to exactly one resource group at a time. Resource groups can't be nested or renamed, and deleting a group deletes every resource in it.
A resource provider supplies resource types, such as Microsoft.Compute for virtual machines.

Group resources that share a lifecycle, because they will be deleted together.

6:00 – 11:00

Subscriptions: billing and access boundaries

Using Azure requires an Azure subscription, a unit of management, billing and scale. It links to an Azure account, an identity in Microsoft Entra ID or a directory it trusts. An account can have several subscriptions but needs only one.
Learn names two boundaries. As a billing boundary, each subscription gets separate billing reports and invoices. As an access control boundary, access-management policies apply at the subscription level, so development and production can have different access rules and spending limits.
You might add subscriptions to separate environments, teams or workloads, or billing. Illustrative example: a logistics firm gives production and development their own subscriptions, so finance sees two invoices and developers cannot touch production.
THE EXAM LINE
A subscription is a billing boundary (separate billing reports and invoices for each subscription) and an access control boundary (access policies apply at the subscription level).

If a scenario needs separate invoices or separate access rules, the answer is usually another subscription, not another resource group.

11:00 – 17:00

Management groups and the hierarchy

Azure management groups sit above subscriptions. Governance conditions you apply to a group, such as access or policies, are inherited by every subscription beneath it.
Every Microsoft Entra tenant has one top-level Tenant Root Group, the root management group into which everything folds; it can't be moved or deleted. At the time of writing, a directory supports up to 10,000 management groups, a tree up to six levels deep (excluding the root and subscription levels), and one parent per management group or subscription.

Level	What it holds	What might attach here (illustrative)
Management group	Subscriptions and other management groups	Organisation-wide policies, such as allowed regions; access for central IT
Subscription	Resource groups	A separate invoice, environment-wide access, a budget
Resource group	Resources that share a lifecycle	Project access, tags, delete-together clean-up
Resource	Nothing below it	Access or settings for one item only

Azure Resource Manager describes four levels of management scope, and lower levels inherit from higher ones. A policy on a subscription reaches all its resource groups and resources; a policy on one resource group does not reach another.
THE EXAM LINE
The hierarchy, from top to bottom: management groups, subscriptions, resource groups, resources. Settings applied higher up are inherited below. Each management group and subscription has only one parent.
Learn's example: a policy on a Production management group limits VM locations, every subscription underneath inherits it, and a subscription owner can't override it. Access assignments flow down the same way; Session 12 covers them.

Trap: resources don't inherit the tags you apply to a resource group or subscription. Policies and access flow down; tags do not.

17:00 – 26:00

Hands-on: create, read and delete

TRACK A · YOUR AZURE ACCOUNT
- Portal route. Select Resource groups, then Create. Choose your Subscription, name the group rg-az900-s07, pick your Session 6 Region, select Review + Create and then Create. Open the group, select Add tags, add course = az900 and session = 7, and select Save.
- CLI route. In a Cloud Shell ephemeral session, as in Session 6, type the commands below. Use one route only.
- Search for Subscriptions and read the Subscription ID column, or use the az account show line. Screenshot the tagged group and the ID (you may blur all but the last four characters).
- Delete the group, refresh Resource groups, and screenshot the list without it.
TRACK B · NO PAYMENT CARD
- Screenshot the hierarchy diagram in the Learn unit Describe Azure management infrastructure, with the address visible.
- Read Learn's pages on managing resource groups in the portal and on getting subscription IDs, and write down the labels Track A selects. You are reading the flow, not running it.

bashCloud Shell (Bash)type it yourself

# Replace <region> with your Session 6 programmatic name
az group create --name rg-az900-s07 --location <region> --tags course=az900 session=7

# Read the group back, including its tags
az group show --name rg-az900-s07

# The ID of the subscription you are working in
az account show --query id --output tsv

# Delete the group and everything in it (--yes skips the prompt)
az group delete --name rg-az900-s07 --yes

Delete what you create. A group left behind today becomes a habit that costs money later.

Check the tags before you delete the group. Evidence first, clean-up second, both in the same session.

26:00 – 30:00

Wrap-up and your assignment

Write down the four levels in order, the resource group rules, the two subscription boundaries, the management group limits and the one-parent rule.
Track A: confirm that rg-az900-s07 no longer appears in Resource groups before you close the portal.
Your assignment designs the hierarchy for a real organisation with several departments, and says where policies, access and budgets attach, and why at that level.

Draw the tree before you write a word.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Resource Manager`	service	The deployment and management service for Azure.	Learn →
`resource group`	concept	A container that holds related resources for an Azure solution.	Learn →
`resource provider`	concept	A service that supplies Azure resources, such as Microsoft.Compute.	Learn →
`Azure subscription`	concept	A unit of management, billing and scale that gives access to Azure services.	Learn →
`Billing boundary`	concept	Each subscription gets separate billing reports and invoices.	Learn →
`Access control boundary`	concept	Access-management policies apply at the subscription level.	Learn →
`Azure management groups`	service	Containers above subscriptions whose governance conditions are inherited below.	Learn →
`Tenant Root Group`	concept	The single top-level management group in every Microsoft Entra tenant.	Learn →
`root management group`	concept	The group all management groups and subscriptions fold into; can't be moved or deleted.	Learn →
`Subscription ID`	portal	The identifier shown for each subscription on the Subscriptions page.	Learn →
`Add tags`	portal	Portal button for adding name-value tags to a resource or resource group.	Learn →
`az group create`	cli	Creates a resource group; takes --name, --location and optional --tags.	Learn →
`az group delete`	cli	Deletes a resource group and its resources; --yes skips the prompt.	Learn →
`az account show`	cli	Gets the details of the current subscription, including its ID.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Scope

The level at which a setting is applied: management group, subscription, resource group or resource.

Inheritance

Lower levels receiving settings, such as policies, that were applied at a higher level.

Tag

A name-value pair on a resource, group or subscription, used to organise assets. Resources don't inherit a group's tags.

Tenant

An organisation's Microsoft Entra directory. Its root management group sits at the top of the hierarchy.

Self-Check — Before You Submit

1. A manufacturer wants one policy restricting VM locations to cover all twelve of its subscriptions, including future ones under the same parent. Where should it assign it?

A. On each resource group
B. On a management group above the subscriptions
C. On each virtual machine
D. As a tag on each subscription

B. On a management group above the subscriptions — A management group's settings are inherited by every subscription beneath it, including new ones. Per-group or per-VM assignments miss new resources, and a tag is only a label.

2. Which statement about resource groups is correct?

A. Resource groups can be nested by department
B. A resource can belong to two resource groups at once
C. A resource group can be renamed after creation
D. Deleting a resource group deletes the resources in it

D. Deleting a resource group deletes the resources in it — Deleting a group deletes every resource inside it. Groups can't be nested or renamed, and each resource belongs to exactly one group at a time.

3. A company wants production and development costs on separate invoices, with different access rules for each. What should it create?

A. Two subscriptions
B. Two resource groups in one subscription
C. Two tags
D. Two regions

A. Two subscriptions — A subscription is both a billing boundary, with its own invoices, and an access control boundary. Two resource groups in one subscription still share that subscription's invoice.

Today’s Assignment

Design the Azure hierarchy for a real organisation with several departments, and say where policies, access and budgets would attach.

Describe an organisation you know with at least three departments and two environments, such as production and development. Mark any assumptions.
Set out its hierarchy as a tree or a table: the Tenant Root Group, the Azure management groups beneath it, each Azure subscription, and two or three example resource group names for each subscription.
For each subscription, say whether it exists as a Billing boundary, an Access control boundary, or both.
Say where you would attach one policy, one access assignment and one budget, and why. Name one setting that is inherited and one that is not.
Describe your hands-on: Track A, what you created, read and deleted; Track B, what the diagram shows at each level. Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of the tagged resource group, your Subscription ID (blurred except the last four characters if you wish), and the Resource groups list after deletion.
Track B: a screenshot of the Learn hierarchy diagram with the address visible.
Both tracks: the hierarchy tree or table.

Names your answer must use exactly
Azure management groups Tenant Root Group Azure subscription resource group Billing boundary Access control boundary

Track B
Track B students design the same hierarchy from the Learn pages and submit the diagram screenshot instead of the portal screenshots.

How this is marked — the rubric

The hierarchy is valid: correct order, one parent each, and no nested resource groups	30
Policy, access and budget placements are justified, and inheritance (including tags) is described correctly	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots show the tagged group, the ID and the deletion (A) or the Learn diagram (B)	25
Total · pass mark 70	100

Submitting session 7
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 7 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

Skills Covered

Resources and resource groupsSubscriptions as boundariesManagement groupsThe four-level hierarchyCreate and delete a group

Tick it once you have submitted.Next: Session 8 →

B · Describe Azure architecture and services · 35–40%SESSION 8

Compute: containers, VMs, functions, VM options and app hosting

Session 8 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Compare compute types, including containers, virtual machines, and functions
Describe virtual machine options, including Azure virtual machines, Azure Virtual Machine Scale Sets, availability sets, and Azure Virtual Desktop
Describe the resources required for virtual machines
Describe application hosting options, including web apps, containers, and virtual machines

Why This Matters

Compute is where workloads run, and AZ-900 asks you to choose between the options quickly. Today compares virtual machines, containers and functions, covers the VM options (scale sets, availability sets, Azure Virtual Desktop), lists what a VM needs, and maps application hosting to specific services. I have watched candidates choose a VM for every scenario because it feels familiar, when the scenario asked for the least management. At work, the compute choice decides who patches what, and what you pay for while nothing is happening. Today you walk the VM create page without creating anything. This session also opens your second pop quiz.

The 30-Minute Session

0:00 – 7:00

Three ways to run code: VMs, containers, functions

An analogy: a VM is a flat you furnish yourself; a container is a fitted room you can move between buildings; a function is a taxi that charges only for the trip.

Compute type	What you manage	How it runs	Fits when
Virtual machines (IaaS)	The operating system and everything above it	Must be running for the app to work; you choose size and number	You need full control, a lift-and-shift, or custom software
Containers	Your app and its container, not the operating system	Lightweight; created, scaled out and stopped dynamically	You package apps to run and move easily, often as microservices
Functions (serverless)	Only your code	Wakes on an event, scales automatically, billed for CPU time while running	Work happens in response to an event, a timer or a message

Containers are a virtualisation environment, but unlike a VM you don't manage their operating system. Azure supports Docker, one of the most popular container engines.
Functions are stateless by default. Stateful functions, called Durable Functions, receive a context that tracks earlier activity.
THE EXAM LINE
VMs give the most control (IaaS). Containers are lightweight and you don't manage their operating system. Functions run code only when triggered, scale automatically and charge for CPU time used.

"No servers to manage" and "runs when triggered" point to Azure Functions.

7:00 – 13:00

Virtual machine options

Azure Virtual Machines run virtualised servers as IaaS, for testing and development, cloud application hosting, datacenter extension, disaster recovery, and lift and shift migration. Prebuilt images already include an operating system and tools.
Azure Virtual Machine Scale Sets manage a group of load-balanced VMs whose number can rise or fall automatically with demand or a schedule.
Availability sets are logical groupings that reduce the chance of related VMs failing together. They spread VMs across fault domains (VMs sharing a power source and network switch) and update domains (VMs that can be restarted together). At the time of writing, a set can have up to three fault domains and twenty update domains.
Microsoft's current guidance: for more reliability than availability sets offer, use availability zones; for high availability with the widest features, use scale sets with flexible orchestration mode.
THE EXAM LINE
Scale sets: a group of load-balanced VMs that scales automatically. Availability sets: VMs spread across fault domains and update domains. Neither adds a charge of its own; you pay for the VMs.
Azure Virtual Desktop is a desktop and app virtualisation service that runs on Azure. Users reach Windows desktops and apps from many devices while apps and data stay in Azure, with Microsoft Entra ID for identity. Its Windows 11 and Windows 10 Enterprise multi-session capability, exclusive to Azure Virtual Desktop, greatly reduces the number of VMs you need.

Trap: an availability set limits failures from shared power or maintenance restarts. It does not add VMs or cover a whole region.

13:00 – 18:00

What a VM needs, and where apps can live

Learn lists the VM resources you decide on: size (purpose, number of processor cores and amount of RAM), storage disks, and networking (a virtual network, a public IP address and port configuration).
The Virtual Machines documentation lists the parts a VM uses: a virtual network; a network interface card (NIC), with no separate cost; a private and sometimes a public IP address; a Network security group (NSG) that allows or blocks ports, with no additional charge; an OS disk and possibly data disks; and sometimes an operating system licence.
For hosting an application, Learn names three routes. Azure App Service hosts web apps, API apps, WebJobs and mobile apps with less operational effort. Containers run in Azure Container Instances (the simplest way, with no VMs to manage), Azure Container Apps (built-in load balancing and scaling) or Azure Kubernetes Service (AKS), for container orchestration. VMs give maximum control.
THE EXAM LINE
Hosting spectrum: VMs give maximum control; containers let you isolate and manage parts of a solution separately; App Service hosts web apps, API apps, WebJobs and mobile apps with the least operational effort.

Read the scenario for the word control or the word effort. It tells you which end of the spectrum to choose.

18:00 – 26:00

Hands-on: walk the VM create page, create nothing

Illustrative scenario: a manufacturer wants one Windows server in Azure for an old stock application. Record every resource it would need, without paying for any.
TRACK A · YOUR AZURE ACCOUNT
- Open Virtual machines, then select Create and Virtual machine. On Basics, enter a new resource group name, a VM name and your Session 6 region, then read Availability options, Image and Size. Fill the administrator fields with throwaway values you use nowhere else. Screenshot the page.
- Open Disks, then Networking, and record the proposed Virtual network, Subnet, Public IP and NIC network security group. Screenshot each tab.
- Open Review + create and read the summary. Do not select Create. Close the page; nothing was deployed. Check Resource groups to confirm no new group appeared.
TRACK B · NO PAYMENT CARD
- Open the Learn unit Describe Azure virtual machines and screenshot its list of VM resources (size, storage disks, networking) with the address visible.
- Read Learn's Windows VM portal quickstart and the parts-of-a-VM table on Virtual machines in Azure, and record the same resources. You are reading about the create page, not seeing your own.
Both tracks: list the resources the VM would need and, for each, whether Microsoft says it carries its own charge.
Then decide in one sentence whether the manufacturer's new supplier web portal belongs on a VM, in a container service or on App Service.

If Review + create shows a validation error, read it and move on. The point is the list of resources, not a working VM.

26:00 – 30:00

Wrap-up, Pop Quiz 2 and your assignment

Write down the three compute types with one fit for each, the four VM options, the three VM resource areas, and the three hosting routes with their service names.
Pop Quiz 2 opens now: five questions in eight minutes on Sessions 6 to 8. Sit it closed book before you start the assignment.
Your assignment chooses compute for three workloads. Name the exact service each time: "a container" is not an answer, but Azure Container Apps is.

Choose the option that needs the least management while still meeting every requirement.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Virtual Machines`	service	Virtualised servers in Azure, delivered as IaaS.	Learn →
`Azure Virtual Machine Scale Sets`	service	A group of load-balanced VMs that can scale automatically.	Learn →
`availability sets`	feature	Logical groupings of VMs that reduce correlated failures.	Learn →
`fault domains`	concept	VMs that share a common power source and network switch.	Learn →
`update domains`	concept	VMs and hardware that can be restarted at the same time.	Learn →
`Azure Virtual Desktop`	service	Desktop and app virtualisation service that runs on Azure.	Learn →
`multi-session`	feature	Windows Enterprise capability, exclusive to Azure Virtual Desktop, that reduces the VMs needed.	Learn →
`Azure Container Instances`	service	The fastest and simplest way to run a container, with no VMs to manage.	Learn →
`Azure Container Apps`	service	Container hosting with built-in load balancing and scaling.	Learn →
`Azure Kubernetes Service (AKS)`	service	A container orchestration service.	Learn →
`Azure App Service`	service	PaaS hosting for web apps, API apps, WebJobs and mobile apps.	Learn →
`WebJobs`	feature	App Service feature for running a program or script with an app.	Learn →
`Durable Functions`	feature	Stateful functions that track earlier activity.	Learn →
`Network security group (NSG)`	concept	Manages network traffic to and from a VM by allowing or blocking ports.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Image

A template that already includes an operating system and tools, used to deploy VMs quickly.

Fault domain

A group of VMs that share a common power source and network switch.

Update domain

A group of VMs and hardware that can be restarted at the same time during maintenance.

Orchestration

Coordinating the deployment and running of many containers, the job AKS does.

Self-Check — Before You Submit

1. A logistics firm must resize each delivery photo as it is uploaded, with nothing running between uploads. Which option fits best?

A. Azure Virtual Machines
B. Azure Functions
C. Azure Virtual Desktop
D. An availability set

B. Azure Functions — Functions run when an event triggers them and deallocate when finished, charging only for CPU time used. A VM must keep running between uploads to respond.

2. What does an availability set do?

A. Replicates VMs to a paired region
B. Adds VMs automatically when demand rises
C. Spreads VMs across fault domains and update domains
D. Delivers Windows desktops to users

C. Spreads VMs across fault domains and update domains — Availability sets distribute VMs across fault and update domains to reduce correlated failures. Adding VMs with demand describes scale sets, and desktops describe Azure Virtual Desktop.

3. A hospital wants staff to open Windows apps from shared and personal devices while keeping patient data off those devices. Which service fits?

A. Azure Virtual Desktop
B. Azure Container Instances
C. Azure App Service
D. Azure Virtual Machine Scale Sets

A. Azure Virtual Desktop — Azure Virtual Desktop delivers Windows desktops and apps from Azure, so apps and data can stay in Azure-hosted sessions. The other services host workloads, not user desktops.

Today’s Assignment

Choose and justify a compute option for three real workloads at an organisation you know, using exact Azure service names.

Describe three workloads at an organisation you know: an existing server application, a new web or API application, and a task that runs only when something happens.
For each, choose one specific service, such as Azure Virtual Machines, Azure Virtual Machine Scale Sets, Azure Container Instances, Azure Container Apps, Azure Kubernetes Service (AKS), Azure App Service or Azure Functions.
Justify each in four to six sentences: what the organisation still manages, how it scales, and why the nearest alternatives fit less well.
For the VM-based workload, list the resources the VM needs, from your hands-on, and say whether availability sets, availability zones or a scale set would protect it, and against what.
Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of the Basics, Networking and Review + create pages, and of Resource groups showing nothing new was created.
Track B: screenshots of the Learn VM resources list and the parts-of-a-VM table, with the addresses visible.
Both tracks: a summary table of workload, service, what the customer manages, and the reason.

Names your answer must use exactly
Azure Virtual Machines Azure Virtual Machine Scale Sets availability sets Azure App Service Azure Container Apps

Track B
Track B students make the same choices from the Learn pages and submit screenshots of them instead of the portal.

How this is marked — the rubric

Each workload is matched to a specific service that fits Microsoft's description of it	35
Justifications cover management, scaling and the nearest alternatives, and the VM resource list is complete	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots and summary table are present, and Track A shows nothing was created	20
Total · pass mark 70	100

Submitting session 8
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 8 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

ASSESSMENT NOW OPEN

Pop Quiz 2 — Where Azure Lives opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.

5 questions · 8 minutes · covers Sessions 6–8 · pass mark 70

Sit Pop Quiz 2 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.

Skills Covered

VMs, containers, functionsVM optionsResources a VM needsApp hosting optionsWalk the create page

Tick it once you have submitted.Next: Session 9 →

B · Describe Azure architecture and services · 35–40%SESSION 9

Networking: virtual networks, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute, endpoints

Session 9 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
Define public and private endpoints

Why This Matters

Almost every Azure design question involves a network. Today covers the purpose of Azure virtual networks and subnets, how peering joins networks, what Azure DNS does, how Azure VPN Gateway and ExpressRoute connect an office to Azure, and the difference between public and private endpoints. The classic trap is VPN Gateway versus ExpressRoute: both connect on-premises networks to Azure, but only ExpressRoute keeps that traffic off the public internet. At work, you will be asked how a branch office reaches a system in Azure safely, and you should answer with a named service and a reason. Today Track A builds a virtual network with two subnets, then deletes it.

IN YOUR SUBSCRIPTION

Creates: Track A only: resource group rg-az900-s09 holding one virtual network with two subnets. No VPN gateway, no public IP address and no peering.
Cost: Azure's Virtual Network pricing page says Azure Virtual Network is free of charge. Peering traffic, IP addresses and gateways are charged; today creates none of them.
Clean-up: Run az group delete --name rg-az900-s09 --yes, or open the group in the portal, select Delete resource group, type its name and select Delete.

The 30-Minute Session

0:00 – 7:00

Virtual networks, subnets and peering

An analogy: a virtual network is a private office floor, subnets are its rooms, peering is a private corridor to another floor, and a VPN or ExpressRoute link is the way in from outside.
Azure Virtual Network lets Azure resources such as VMs, web apps and databases communicate with each other, with internet users and with on-premises computers. Learn lists isolation and segmentation, internet communications, communication with Azure and on-premises resources, routing and filtering traffic, and connecting virtual networks.
A virtual network has a private IP address space, divided into named subnets. Microsoft recommends the RFC 1918 ranges, such as 10.0.0.0 to 10.255.255.255. A virtual network is limited to one region, and Azure reserves five addresses in each subnet.
Network security groups filter traffic between subnets; route tables and user-defined routes (UDR) steer it.
Two virtual networks can be linked with virtual network peering, even in separate regions. Traffic between peered networks is private and travels on the Microsoft backbone network, never entering the public internet.
THE EXAM LINE
A virtual network lives in one region and is divided into subnets. Virtual network peering connects virtual networks, even across regions, over the Microsoft backbone rather than the public internet.

Peering joins Azure networks to each other. It does not connect your office.

7:00 – 13:00

Reaching Azure from outside: VPN Gateway and ExpressRoute

A VPN uses an encrypted tunnel within another network, typically the public internet. Azure VPN Gateway is a type of virtual network gateway, deployed in a dedicated subnet, one per virtual network. It supports site-to-site (an on-premises datacenter), point-to-site (one device) and network-to-network (another virtual network) connections.
A VPN gateway is policy-based (statically specifying which packets each tunnel encrypts) or route-based (tunnels modelled as a network interface); point-to-site and network-to-network connections need route-based. By default a gateway runs as two instances, active/standby.
Azure ExpressRoute extends your on-premises network into the Microsoft cloud over a private connection, with the help of a connectivity provider, and doesn't go over the public internet. Learn lists connectivity across all regions in the geopolitical region, dynamic routing with BGP, built-in redundancy in every peering location, and global connectivity with ExpressRoute Global Reach.

Question	Azure VPN Gateway	Azure ExpressRoute
Path	Encrypted tunnel across an untrusted network, typically the public internet	Private connection through a connectivity provider
Connects	On-premises sites, single devices, other virtual networks	On-premises networks to the Microsoft cloud
Choose it when	An encrypted link over the internet meets the requirement, including remote users	Traffic must not travel over the public internet

THE EXAM LINE
ExpressRoute uses a private connection through a connectivity provider and doesn't go over the public internet. VPN Gateway encrypts traffic in a tunnel that crosses the internet.
Trap: even with ExpressRoute, DNS queries, certificate revocation list checks and Azure Content Delivery Network requests still use the public internet. A VPN gateway can serve as a failover path for ExpressRoute.

"Must not cross the internet" means ExpressRoute. "Encrypted over the internet" means VPN Gateway.

13:00 – 18:00

Azure DNS and endpoints

Azure DNS is a hosting service for DNS domains, providing name resolution on Microsoft Azure infrastructure, with private domains for virtual networks and alias records. Trap: you can't use Azure DNS to buy a domain name.
Public endpoints have a public IP address and can be reached from anywhere in the world. Private endpoints exist within a virtual network, with a private IP address from its address space.
The mechanism: a private endpoint is a network interface with a private IP address from your virtual network, connecting you privately to a service powered by Azure Private Link. It brings the service into your virtual network.
THE EXAM LINE
Public endpoint: a public IP address, reachable from anywhere. Private endpoint: a network interface with a private IP address from your virtual network, connecting privately to a service through Azure Private Link.
Illustrative example: a Lagos bank's loan system reaches its storage account through a private endpoint, on a private address inside the bank's virtual network.

If the scenario says a service must not be reachable from the internet, look for a private endpoint.

18:00 – 26:00

Hands-on: a virtual network with two subnets

Illustrative design: a hospital wants separate subnets for its web and data tiers, so it can filter traffic between them later.
TRACK A · YOUR AZURE ACCOUNT
- In a Cloud Shell ephemeral session, type the commands below. They create the group and a virtual network with snet-web, add snet-data, list both, then delete everything.
- Before the delete line, open Virtual networks in the portal, select vnet-s09, and screenshot the page that shows both subnets.
- Run the delete line, refresh Resource groups, and screenshot the list without rg-az900-s09.
TRACK B · NO PAYMENT CARD
- The networking module has no exercise unit, so read Learn's Quickstart: Create an Azure Virtual Network (Basics, Security, IP Addresses) and record what a subnet needs: a name, a starting address and a size.
- Screenshot the endpoints and peering text in the Learn unit Describe Azure virtual networking, with the address visible, and write down ranges for the two subnets.

bashCloud Shell (Bash)type it yourself

# Replace <region> with your Session 6 programmatic name
az group create --name rg-az900-s09 --location <region>

# A virtual network with its first subnet
az network vnet create --resource-group rg-az900-s09 --name vnet-s09 \
    --address-prefixes 10.0.0.0/16 \
    --subnet-name snet-web --subnet-prefixes 10.0.0.0/24

# A second subnet in the same address space
az network vnet subnet create --resource-group rg-az900-s09 \
    --vnet-name vnet-s09 --name snet-data --address-prefixes 10.0.1.0/24

# Both subnets, as a table
az network vnet subnet list --resource-group rg-az900-s09 \
    --vnet-name vnet-s09 --output table

# Delete the group and everything in it
az group delete --name rg-az900-s09 --yes

Both tracks: note which subnet a web server and a database server would sit in, and what you would later use to filter traffic between them.

Screenshot before you delete. A deleted network is hard to evidence.

26:00 – 30:00

Wrap-up and your assignment

Write down what virtual networks, subnets and peering do, the three VPN Gateway connection types, how ExpressRoute differs, what Azure DNS can't do, and the two kinds of endpoint.
Track A: confirm the group has gone. Delete what you create, every time.
Your assignment designs private connectivity for an office. The choice between VPN Gateway and ExpressRoute must rest on a stated requirement, backed by Learn's wording, not on preference.

Write the requirement first, then the service it forces.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Virtual Network`	service	Private networking in Azure; one virtual network is limited to a single region.	Learn →
`subnets`	concept	Named parts of a virtual network's IP address space.	Learn →
`virtual network peering`	feature	Links virtual networks privately over the Microsoft backbone, even across regions.	Learn →
`Public endpoints`	concept	Have a public IP address and can be reached from anywhere in the world.	Learn →
`private endpoint`	concept	A network interface with a private IP address from your virtual network.	Learn →
`Azure Private Link`	service	Powers the services a private endpoint connects to privately.	Learn →
`Azure VPN Gateway`	service	Virtual network gateway for encrypted site-to-site, point-to-site and network-to-network links.	Learn →
`site-to-site`	concept	A VPN connection from an on-premises datacenter to a virtual network.	Learn →
`point-to-site`	concept	A VPN connection from an individual device to a virtual network.	Learn →
`Azure ExpressRoute`	service	Private connection to the Microsoft cloud through a connectivity provider.	Learn →
`ExpressRoute Global Reach`	feature	Global connectivity to Microsoft services across all regions.	Learn →
`Azure DNS`	service	Hosting service for DNS domains; it can't buy a domain name.	Learn →
`az network vnet create`	cli	Creates a virtual network, optionally with a first subnet.	Learn →
`az network vnet subnet create`	cli	Creates a subnet in an existing virtual network.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Address space

The private IP address range given to a virtual network and divided into subnets.

Connectivity provider

The partner whose private connection ExpressRoute uses to reach the Microsoft cloud.

Network security group

An Azure resource holding inbound and outbound security rules that filter traffic.

BGP

Border Gateway Protocol, which exchanges routes between on-premises networks and Azure.

Self-Check — Before You Submit

1. A manufacturer's head office needs a connection to Azure through its telecoms provider that doesn't go over the public internet. Which service fits?

A. Azure VPN Gateway with a site-to-site connection
B. Virtual network peering
C. Azure ExpressRoute
D. Azure DNS

C. Azure ExpressRoute — ExpressRoute uses a private connection through a connectivity provider. A site-to-site VPN is encrypted, but its tunnel still crosses the internet.

2. What does a private endpoint provide?

A. A public IP address reachable from anywhere
B. A network interface with a private IP address from your virtual network
C. A way to buy a domain name
D. An encrypted tunnel for one laptop

B. A network interface with a private IP address from your virtual network — A private endpoint is a network interface with a private IP address from your virtual network. A tunnel for one laptop is a point-to-site VPN.

3. Which statement about virtual network peering is correct?

A. Traffic between peered networks travels on the Microsoft backbone network
B. Peered networks must be in the same region
C. Peering connects an on-premises office to Azure
D. Peering replaces the need for subnets

A. Traffic between peered networks travels on the Microsoft backbone network — Peering keeps traffic private on the Microsoft backbone and works across regions. Connecting an office needs VPN Gateway or ExpressRoute instead.

Today’s Assignment

Design private connectivity from a real office to Azure, choosing between VPN Gateway and ExpressRoute with reasons from Learn.

Describe an office you know: its size, what it needs to reach in Azure, and any requirement about traffic, speed or reliability. Mark any assumptions.
Design one Azure Virtual Network with named subnets and address ranges, and say whether you need virtual network peering.
Choose Azure VPN Gateway, naming the connection type, or Azure ExpressRoute. Quote the Learn wording that decides it, and explain why the other fits less well.
Name one service to reach through a private endpoint, and say what Azure DNS would and would not do in your design.
Describe your hands-on result. Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of the command output listing both subnets, the virtual network in the portal, and the Resource groups list after deletion.
Track B: screenshots of the Learn quickstart's subnet settings and of the networking unit, with the addresses visible.
Both tracks: a table of subnet names and address ranges.

Names your answer must use exactly
Azure Virtual Network subnets Azure VPN Gateway Azure ExpressRoute private endpoint Azure DNS

Track B
Track B students design the same network from the Learn pages and submit those screenshots instead of the command output.

How this is marked — the rubric

The connectivity choice matches the stated requirement and is supported by quoted Learn wording	35
The network design (subnets, ranges, peering, endpoints, DNS) is valid and explained	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots show both subnets and the deletion (A) or the Learn pages (B)	20
Total · pass mark 70	100

Submitting session 9
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 9 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

Skills Covered

Virtual networks and subnetsPeeringVPN Gateway vs ExpressRouteAzure DNSPublic and private endpoints

Tick it once you have submitted.Next: Session 10 →

B · Describe Azure architecture and services · 35–40%SESSION 10

Storage: services, tiers, redundancy, accounts, moving files, migration

Session 10 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Compare Azure Storage services
Describe storage tiers
Describe redundancy options
Describe storage account options and storage types
Identify options for moving files, including AzCopy, Azure Storage Explorer, and Azure File Sync
Describe migration options, including Azure Migrate and Azure Data Box

Why This Matters

Storage questions reward precision: exact names for services, tiers, redundancy options, account types, and the tools that move and migrate data. The traps are small and costly. The archive tier is offline, the cold tier exists, and read access to a geo-redundant copy is a separate choice. I have watched candidates pick geo-redundant storage and assume they could read the secondary copy at any time; they cannot. At work, a storage plan sets what data costs and what survives a disaster. Today Track A creates an LRS storage account, uploads a file, changes its tier and deletes everything. This session also closes Week 2.

IN YOUR SUBSCRIPTION

Creates: Track A only: resource group rg-az900-s10 with one general-purpose v2 storage account (Standard_LRS), a private container and a tiny text file.
Cost: Storage is billed for data and operations; see the Azure Blob Storage pricing page. Moving the file to cool, then deleting it today, triggers a prorated early deletion charge, so upload only a tiny file.
Clean-up: Run az group delete --name rg-az900-s10 --yes, or open the group, select Delete resource group, type its name and select Delete.

The 30-Minute Session

0:00 – 6:00

Storage services and storage accounts

Service	What it is	Illustrative use
Azure Blobs	Massively scalable object store for text and binary data	Scans, images, backups
Azure Files	Managed file shares for cloud or on-premises use	A department drive
Azure Queues	Messaging store between application components	Orders awaiting processing
Azure Disks	Block-level storage volumes for Azure VMs	A VM's OS disk
Azure Tables	NoSQL store for structured, non-relational data	Device settings

A storage account gives your data a unique namespace, reachable over HTTP or HTTPS. Its name is 3 to 24 numbers and lowercase letters, unique within Azure, and appears in each endpoint, such as https://<storage-account-name>.blob.core.windows.net.
Standard general-purpose v2 covers blobs, file shares, queues and tables and is recommended for most scenarios. Premium block blobs, premium file shares and premium page blobs use solid-state drives for low latency. General-purpose v1 and Blob Storage accounts are legacy types.
THE EXAM LINE
Azure Blobs (objects), Azure Files (file shares), Azure Queues (messages), Azure Disks (VM disks), Azure Tables (NoSQL). Standard general-purpose v2 is recommended for most scenarios.

Match the noun in the scenario: objects, files, messages, disks or tables.

6:00 – 11:00

Access tiers

Blob tiers trade storage cost against access cost, like a desk drawer, a filing room and an off-site archive.

Tier	Online or offline	Minimum stay	Fits
Hot	Online	None	Frequently accessed data
Cool	Online	30 days	Infrequent access, such as invoices
Cold	Online	90 days	Rare access, fast retrieval
Archive	Offline	180 days	Rare access, hours of latency, such as long-term backups

A new general-purpose v2 account defaults to hot. At the time of writing, archive data can take up to 15 hours to rehydrate. Deleting or moving a blob before its minimum stay incurs a prorated early deletion charge.
Newer than the training unit: smart tier, generally available for zone-redundant accounts, moves data between hot, cool and cold automatically based on usage. Learn the four classic tiers first.
THE EXAM LINE
Access tiers: hot, cool (30 days), cold (90 days) and archive (180 days, offline, hours to rehydrate). Hot, cool and cold can be an account's default; archive can't.

Trap: archive is not simply a cheaper cool tier. Data there is offline until it is rehydrated.

11:00 – 17:00

Redundancy options

Azure Storage always keeps copies; the question is where. Locally redundant storage (LRS) replicates within a single datacenter in the primary region. Zone-redundant storage (ZRS) copies synchronously across three or more availability zones there.
Geo-redundant storage (GRS) adds an asynchronous copy in a secondary region on top of LRS; Geo-zone-redundant storage (GZRS) does the same on top of ZRS. The secondary is the paired region, fixed by your choice of primary: Session 6 pays off here.
With GRS or GZRS, the secondary copy can't be read unless there is a failover. For read access, choose read-access geo-redundant storage (RA-GRS) or read-access geo-zone-redundant storage (RA-GZRS).
Option Primary region Secondary copy
LRS One datacenter None
ZRS Three or more zones None
GRS / RA-GRS LRS Readable after failover / at any time
GZRS / RA-GZRS ZRS Readable after failover / at any time
THE EXAM LINE
LRS: one datacenter. ZRS: three or more zones. GRS and GZRS add an asynchronous copy in the secondary region, readable only after failover unless you choose RA-GRS or RA-GZRS.
Archive isn't supported for ZRS, GZRS or RA-GZRS accounts. Microsoft recommends GZRS for high availability plus disaster recovery.

Option	Primary region	Secondary copy
LRS	One datacenter	None
ZRS	Three or more zones	None
GRS / RA-GRS	LRS	Readable after failover / at any time
GZRS / RA-GZRS	ZRS	Readable after failover / at any time

If the scenario says the copy must be readable during an outage, the answer starts with RA.

17:00 – 21:00

Moving files and migrating

AzCopy is a command-line utility for copying blobs or files to or from a storage account; its synchronisation is one-direction. Azure Storage Explorer is a standalone graphical app for files and blobs on Windows, macOS and Linux, using AzCopy behind the scenes.
Azure File Sync centralises file shares in Azure Files while keeping a Windows file server's flexibility and compatibility. Cloud tiering keeps frequently accessed files local.
Azure Migrate helps you plan and carry out a migration to Azure, from assessment onwards. Azure Data Box is a physical migration service: a shipped storage device that moves terabytes of data into or out of Azure.
Trap: Data Box is a device, not a network tool. When the network is too slow for the volume, think Data Box.

Scripting a copy: AzCopy. Clicking through one: Storage Explorer. Keeping an office file server: Azure File Sync.

21:00 – 27:00

Hands-on: an LRS account, one file, one tier change

TRACK A · YOUR AZURE ACCOUNT
- In a Cloud Shell ephemeral session, run the first three commands below with a unique account name. Note --sku Standard_LRS: the CLI's default is Standard_RAGRS.
- In the portal, open the account and select Data storage → Containers → + Container. Name it s10, keep Private (no anonymous access), select Create, then Upload a tiny text file with no personal data.
- Select the file, Change tier to cool and Save; screenshot it. Under Data management, screenshot Redundancy showing LRS.
- Run the last two commands and screenshot Resource groups without the group. If the upload is refused, delete the group anyway and send me the error the same day.
TRACK B · NO PAYMENT CARD
- Screenshot the redundancy options and tier list in the Learn storage units, with the addresses visible.
- Read Learn's Set a blob's access tier steps and record what Track A would see. You cannot create an account without a subscription; say so.

bashCloud Shell (Bash)type it yourself

# Replace the <placeholders>; use your Session 6 region
az group create --name rg-az900-s10 --location <region>

# Is the account name valid and free?
az storage account check-name --name <storage-account-name>

# General-purpose v2 with locally redundant storage
az storage account create --name <storage-account-name> \
    --resource-group rg-az900-s10 --location <region> \
    --sku Standard_LRS --kind StorageV2

# After the portal steps: confirm location, SKU and kind
az storage account show --name <storage-account-name> \
    --resource-group rg-az900-s10 --query "[location, sku, kind]"

# Delete the group, the account and the file
az group delete --name rg-az900-s10 --yes

Both tracks: write one line on what would change with Standard_RAGZRS, including whether archive would still be available.

The CLI default is read-access geo-redundant. Always state the SKU you mean.

27:00 – 30:00

Wrap-up, Practice Exam 2 and your assignment

Write down the five services, four tiers, six redundancy names, the account type, and the five movement and migration tools.
Week 2 is complete. Practice Exam 2 opens now: twenty questions in twenty-four minutes on Sessions 1 to 10, closed book. The pass mark is 70.
Your assignment is a storage plan: for each data class, a service, a tier and a redundancy option, with a reason.

A plan that names a tier and a redundancy option for every data class beats a long essay.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Standard general-purpose v2`	tier	Storage account type recommended for most scenarios.	Learn →
`Locally redundant storage (LRS)`	setting	Replicates data within one datacenter in the primary region.	Learn →
`Zone-redundant storage (ZRS)`	setting	Copies data synchronously across three or more zones.	Learn →
`Geo-redundant storage (GRS)`	setting	LRS plus an asynchronous copy in a secondary region.	Learn →
`Geo-zone-redundant storage (GZRS)`	setting	ZRS plus an asynchronous copy in a secondary region.	Learn →
`read-access geo-redundant storage (RA-GRS)`	setting	GRS with read access to the secondary region.	Learn →
`read-access geo-zone-redundant storage (RA-GZRS)`	setting	GZRS with read access to the secondary region.	Learn →
`Cold tier`	tier	Online tier for rarely accessed data; 90-day minimum.	Learn →
`Archive tier`	tier	Offline tier; 180-day minimum, hours to rehydrate.	Learn →
`AzCopy`	tool	Command-line utility for copying blobs or files.	Learn →
`Azure Storage Explorer`	tool	Standalone graphical app for managing files and blobs.	Learn →
`Azure File Sync`	service	Centralises file shares in Azure Files, keeping Windows file servers.	Learn →
`Azure Migrate`	service	Helps you plan and carry out a migration to Azure.	Learn →
`Azure Data Box`	service	Ships a storage device for large data transfers.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Rehydration

Bringing a blob out of the offline archive tier so it can be read.

Failover

Switching to the secondary region when the primary region becomes unavailable.

Early deletion charge

A prorated fee for deleting or moving a blob before its tier's minimum stay.

Cloud tiering

Azure File Sync keeping frequently accessed files local and the rest in the cloud.

Self-Check — Before You Submit

1. A public agency keeps scanned records for ten years. They are almost never opened, and a wait of hours is acceptable. Which tier fits best?

A. Hot
B. Cool
C. Cold
D. Archive

D. Archive — Archive suits rarely accessed data that can wait hours. Cold is tempting, but it is an online tier for data needing fast retrieval.

2. A bank wants zone redundancy in its primary region and a secondary copy it can read at any time. Which option fits?

A. Geo-redundant storage (GRS)
B. read-access geo-zone-redundant storage (RA-GZRS)
C. Zone-redundant storage (ZRS)
D. Geo-zone-redundant storage (GZRS)

B. read-access geo-zone-redundant storage (RA-GZRS) — RA-GZRS combines ZRS in the primary region with a readable secondary copy. Plain GZRS can't be read there without a failover.

3. A company must move a very large archive into Azure, and its internet link is too slow for the volume. What should it use?

A. Azure Data Box
B. AzCopy
C. Azure File Sync
D. Azure Storage Explorer

A. Azure Data Box — Azure Data Box ships a storage device for large transfers. AzCopy and Storage Explorer copy over the network, which is the bottleneck.

Today’s Assignment

Write a storage plan for a real organisation's data, naming a service, tier and redundancy option for each class.

Describe an organisation you know and four classes of its data, such as active documents, department files, application messages and long-term records.
For each, name the service, the access tier where one applies, and a redundancy option such as Locally redundant storage (LRS), Zone-redundant storage (ZRS) or Geo-redundant storage (GRS), with a reason.
Name the account type, and the primary and secondary regions for any geo-redundant choice. Say whether the Archive tier works with your redundancy.
Choose how the data gets there (AzCopy, Azure Storage Explorer, Azure File Sync, Azure Migrate or Azure Data Box) and say why.
Name one risk, such as an early deletion charge, and how the plan handles it. Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of the az storage account show output, the changed tier, the Redundancy page and the Resource groups list after deletion.
Track B: screenshots of the Learn redundancy and storage services units, with the addresses visible.
Both tracks: a table of data class, service, tier, redundancy and reason.

Names your answer must use exactly
Standard general-purpose v2 Locally redundant storage (LRS) Zone-redundant storage (ZRS) Geo-redundant storage (GRS) Archive tier

Track B
Track B students write the same plan from the Learn pages and submit those screenshots instead of the portal and command output.

How this is marked — the rubric

Each data class has a service, tier and redundancy option that fit its access and resilience needs	35
Account type, regions, transfer tool and risk are justified correctly	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: screenshots show the account, tier, LRS and deletion (A) or the Learn pages (B)	20
Total · pass mark 70	100

Submitting session 10
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 10 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

ASSESSMENT NOW OPEN

Practice Exam 2 — Architecture and Services opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.

20 questions · 24 minutes · covers Sessions 1–10 · pass mark 70

Sit Practice Exam 2 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.

Skills Covered

Compare storage servicesAccess tiersRedundancy optionsStorage account typesMove and migrate dataLRS account lab

Tick it once you have submitted.Next: Session 11 →

AZ-900 CERTIFICATION BOOTCAMP

Microsoft Azure Fundamentals — Know the cloud. Name it exactly.

Why This Matters

The exact names

Datacenter

Data residency

Zone-resilient

Programmatic name

Today’s Assignment

Why This Matters

The exact names

Scope

Inheritance

Tag

Tenant

Today’s Assignment

Why This Matters

The exact names

Image

Fault domain

Update domain

Orchestration

Today’s Assignment

Why This Matters

The exact names

Address space

Connectivity provider

Network security group

BGP

Today’s Assignment

Why This Matters

The exact names

Rehydration

Failover

Early deletion charge

Cloud tiering

Today’s Assignment