ERW AZ-900 Certification Bootcamp — Week 4: Management, governance and the exam

This week’s assessments: Pop Quiz 4 — Tools and Templates after Session 17 · Practice Exam 4 — Full Mock after Session 19 · The Marked Final in Session 20

Every session: the exact names Microsoft uses · one assignment marked against a published rubric · pass mark 70 · Certificate: capstone at 70+ and the marked Final at 700+

C · Describe Azure management and governance · 30–35%SESSION 16

Managing Azure: the portal, Cloud Shell, Azure CLI, Azure PowerShell

Session 16 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe the Azure portal
Describe Azure Cloud Shell, Azure CLI, and Azure PowerShell

Why This Matters

Everything you have done in the portal can also be done by typing, and the exam expects you to know which tool is which. Today covers the four on the outline: the Azure portal, Azure Cloud Shell, the Azure CLI and Azure PowerShell. The classic trap is treating Cloud Shell as a fourth language. It is not. It is a terminal in your browser where the other two run. At work, the portal is where you look and learn, and the command line is where you repeat and automate. An administrator at a Lagos bank who creates the same resource groups every quarter should not be clicking. You will run the same read-only questions in both languages and compare the answers.

IN YOUR SUBSCRIPTION

Creates: Track A only: an empty resource group, rg-az900-s16, created and deleted from Cloud Shell. Choose No storage account required so Cloud Shell itself creates nothing.
Cost: Learn says the machine hosting Cloud Shell is free, and an ephemeral session needs no storage account. Mounted storage carries regular storage costs. The resource group stays empty.
Clean-up: Run az group delete --name rg-az900-s16 and confirm. An ephemeral session deletes its own files. If you mounted storage by mistake, delete that storage account.

The 30-Minute Session

0:00 – 5:00

Four tools, two languages

An analogy: the portal is driving with the map on screen, while a command is a written route you can hand to anyone and repeat exactly. Cloud Shell is a car already parked at your door, with the tools in the boot.

Tool	What it is	Choose it when
Azure portal	A web-based, unified console with a graphical interface	You are exploring, learning, doing a one-off task or building a dashboard
Azure CLI	A cross-platform command-line tool; its commands start with `az`	You know Bash and want repeatable, scripted tasks
Azure PowerShell	Microsoft's official PowerShell modules for Azure; its commands are cmdlets	You know PowerShell and want repeatable, scripted tasks
Azure Cloud Shell	An interactive, authenticated, browser-accessible terminal offering Bash or PowerShell	You cannot or will not install anything locally

THE EXAM LINE
The Azure portal is a web-based, unified console with a graphical interface. The Azure CLI and Azure PowerShell are functionally equivalent; the main difference is command syntax. Cloud Shell is where either runs in a browser.

If an answer calls Cloud Shell a scripting language, cross it out.

5:00 – 10:00

The Azure portal

The Azure portal is a web-based, unified console for creating and managing all your Azure resources through a graphical interface, from a simple web app to a complex deployment. You can also build custom dashboards and share them.
It is built for resilience. The training unit says it has a presence in every Azure datacenter, updates continuously and needs no downtime for maintenance.
The parts you will use most are the portal menu, global search and the global controls, which include Cloud Shell and Notifications. The service menu and working pane change with the resource you open.
The portal's weakness is repetition. Clicks are hard to reproduce exactly, and the training unit notes that capturing commands in a script makes a process repeatable and automatable.

Use the portal to learn what a setting is called, then script it.

10:00 – 16:00

Azure CLI, Azure PowerShell and Cloud Shell

The Azure CLI connects to Azure and runs administrative commands, interactively or in a script. You can install it on Linux, macOS or Windows, run it in Cloud Shell, or run it in a Docker container.
Azure PowerShell is Microsoft's official set of PowerShell modules for Azure; the current version is the Az PowerShell module, and its commands are cmdlets. Trap: online examples using AzureRM belong to the deprecated previous generation.
The training unit frames the choice simply: Azure PowerShell uses PowerShell commands, the Azure CLI uses Bash commands, and the choice mainly comes down to which language you know.
Azure Cloud Shell needs no local installation and is already authenticated with your Azure credentials. At the time of writing, a session times out after 20 minutes without interactive activity. The Azure CLI, Azure PowerShell, AzCopy and the Bicep CLI come preinstalled.
THE EXAM LINE
Azure Cloud Shell is a browser-based, authenticated shell. You choose Bash for the Azure CLI or PowerShell for Azure PowerShell, with no local installation.
Storage. Learn's pages disagree. The Cloud Shell overview says a storage account is required; the newer features page and quickstart offer an ephemeral session without one, whose files are deleted when it ends. Mount storage only if files must persist.

Pick the language you already know. The exam does not prefer one.

16:00 – 26:00

Hands-on: the same questions in both languages

Cloud Shell needs the Microsoft.CloudShell resource provider registered once per subscription: Subscriptions, your subscription, Settings, Resource providers, search cloudshell, then Register.

bashCloud Shell (Bash)type it yourself

# Who am I, and which subscription am I in? (read-only)
az account show --output table

# Which resource groups exist? (read-only)
az group list --output table

# The assignment's three tasks, on an empty resource group
az group create --name rg-az900-s16 --location <your-region> --tags course=az900
az group list --tag course=az900 --output table
az group delete --name rg-az900-s16

powershellCloud Shell (PowerShell)type it yourself

# The same questions in Azure PowerShell (read-only)
Get-AzContext
Get-AzResourceGroup |
    Sort-Object Location,ResourceGroupName |
        Format-Table -GroupBy Location ResourceGroupName,ProvisioningState,Tags

# The same three tasks
New-AzResourceGroup -Name rg-az900-s16 -Location "<your-region>" -Tag @{course="az900"}
Get-AzResourceGroup -Tag @{'course'='az900'}
Remove-AzResourceGroup -Name rg-az900-s16

WHAT YOU SHOULD SEE

Name                                     Account             SubscriptionName    Environment         TenantId
----                                     -------             ----------------    -----------         --------
Subscription1 (xxxxxxxx-xxxx-xxxx-xxx... [email protected]    Subscription1       AzureCloud          xxxxxxxx-x...

TRACK A · YOUR AZURE ACCOUNT
- Open Cloud Shell from the portal's top navigation, choose Bash, select No storage account required, pick your subscription and select Apply.
- Run the Bash block. Use a region name from az account list-locations, such as your Session 6 choice. Answer y when the delete asks you to confirm. Screenshot the output.
- Select Switch to PowerShell in the Cloud Shell toolbar and run the PowerShell block. The output shown is Learn's example; yours will differ. Screenshot it.
TRACK B · NO PAYMENT CARD
- Open Learn's Choose the right Azure command-line tool and copy its side-by-side rows for creating and deleting a resource group.
- Screenshot Example 1 on the Get-AzContext reference and the az group list entry on the az group reference, with addresses visible.
- Cloud Shell needs a subscription, so you are reading these commands, not running them.
Compare the outputs: the same facts in two syntaxes, through the front door that Session 17 names.

Read a command before you run it, and never run a delete you have not read.

26:00 – 30:00

Wrap-up and your assignment

Write down one line for each of the four tools, which language each command-line tool uses, and the difference between an ephemeral session and mounted storage.
THE EXAM LINE
Azure CLI commands start with az, as in az group list. Azure PowerShell commands are cmdlets, such as Get-AzResourceGroup. Both reach the same resources.
Track A: confirm rg-az900-s16 has gone. Your assignment shows three routine tasks in all three tools.

If you can do it twice by hand, you can script it once.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure portal`	service	Web-based, unified console for managing Azure through a graphical interface.	Learn →
`Azure Cloud Shell`	tool	Authenticated, browser-based terminal offering Bash or PowerShell.	Learn →
`Azure CLI`	tool	Cross-platform command-line tool for Azure; commands start with az.	Learn →
`Azure PowerShell`	tool	Microsoft's official PowerShell modules for managing Azure.	Learn →
`cmdlets`	concept	The commands you run in Azure PowerShell.	Learn →
`ephemeral session`	feature	Cloud Shell without a storage account; files are deleted when it ends.	Learn →
`az account show`	cli	Shows the details of your current subscription.	Learn →
`az group list`	cli	Lists resource groups.	Learn →
`az group create`	cli	Creates a resource group.	Learn →
`az group delete`	cli	Deletes a resource group.	Learn →
`Get-AzContext`	powershell	Shows the account, subscription and environment your cmdlets use.	Learn →
`Get-AzResourceGroup`	powershell	Gets resource groups in the current subscription.	Learn →
`New-AzResourceGroup`	powershell	Creates a resource group.	Learn →
`Remove-AzResourceGroup`	powershell	Removes a resource group and its resources.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Cmdlet

A command in Azure PowerShell. Cmdlets can run alone or be combined in a script.

Ephemeral session

A Cloud Shell session with no storage account; its files are deleted when it ends.

Resource provider

A service that supplies Azure resources and must be registered in a subscription before use.

Dashboard

A customisable portal view of the resources that matter most to you, which you can share.

Self-Check — Before You Submit

1. A logistics firm's administrator must run Azure PowerShell cmdlets from a borrowed laptop on which she may not install anything. What should she use?

A. The AzureRM module
B. A portal dashboard
C. Azure Cloud Shell
D. The Azure CLI installed locally

C. Azure Cloud Shell — Cloud Shell runs in the browser, needs no local installation and offers PowerShell. Installing the CLI locally is ruled out, and AzureRM is the deprecated previous generation.

2. Which statement about the Azure CLI and Azure PowerShell matches the training unit?

A. Only Azure PowerShell can automate tasks
B. They are functionally equivalent; the main difference is command syntax
C. The Azure CLI works only inside the portal
D. Azure PowerShell cannot run in Cloud Shell

B. They are functionally equivalent; the main difference is command syntax — The unit calls the Azure CLI functionally equivalent to Azure PowerShell, differing mainly in syntax. Both can script tasks, and both run in Cloud Shell.

3. Which command lists resource groups in the Azure CLI?

A. Get-AzResourceGroup
B. az account show
C. az group create
D. az group list

D. az group list — az group list lists resource groups. Get-AzResourceGroup is tempting, but it is the Azure PowerShell cmdlet, not an Azure CLI command.

Today’s Assignment

Show how three routine management tasks at an organisation you know are done in the Azure portal, the Azure CLI and Azure PowerShell, and choose a tool for each.

Choose three tasks an administrator at an organisation you know would repeat, including one that creates and one that removes something, such as creating, listing and deleting a tagged resource group.
Build a table with one row per task and three columns: the Azure portal path (menu names as the portal shows them), the Azure CLI command, and the Azure PowerShell cmdlet, such as az group create and New-AzResourceGroup, or az group delete and Remove-AzResourceGroup.
Say which tool you would choose for each task at that organisation, and why. Explain where Azure Cloud Shell fits, and whether you would use an ephemeral session or mounted storage.
Write 300–700 words, using the exact names from the names box, and mark any assumptions.

Evidence to include

Track A: a screenshot of Cloud Shell (Bash) showing az account show, az group list and the deletion of rg-az900-s16.
Track A: a screenshot of Cloud Shell (PowerShell) showing Get-AzContext and Get-AzResourceGroup output.
Track B: screenshots of Learn's command-line comparison page and the Get-AzContext example, with addresses visible.

Names your answer must use exactly
Azure portal Azure Cloud Shell Azure CLI Azure PowerShell az group create az group delete New-AzResourceGroup Remove-AzResourceGroup

Track B
Track B students build the same table from Learn's command-line comparison page, the az group and cmdlet reference pages, and Learn's page on managing resource groups in the portal, and submit screenshots of those pages.

How this is marked — the rubric

Each task has a correct portal path, Azure CLI command and Azure PowerShell cmdlet	35
Each tool choice, and the Cloud Shell storage choice, is justified from Microsoft's descriptions	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots show the commands and their output (A) or the Learn pages with addresses (B)	20
Total · pass mark 70	100

Submitting session 16
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 16 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

Skills Covered

Describe the Azure portalCloud Shell, CLI, PowerShellaz versus cmdletsChoose a management toolRead-only commands first

Tick it once you have submitted.Next: Session 17 →

C · Describe Azure management and governance · 30–35%SESSION 17

Azure Arc, infrastructure as code, ARM and ARM templates

Session 17 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe the purpose of Azure Arc
Describe infrastructure as code (IaC)
Describe Azure Resource Manager (ARM) and ARM templates

Why This Matters

Clicking builds an environment once. Code builds the same environment every time. Today you meet the ideas the exam groups together to make that possible: Infrastructure as code (IaC), Azure Resource Manager and its ARM templates, and Azure Arc, which carries Azure management to machines that are not in Azure at all. The trap is thinking Arc moves servers into Azure. It does not. It projects them into Azure Resource Manager so you can govern them where they are. At work, templates are how a hospital rebuilds its test environment identically, and Arc is how a manufacturer governs factory servers alongside its cloud estate. This session also opens your last pop quiz.

IN YOUR SUBSCRIPTION

Creates: Track A only: a resource group, rg-az900-s17, and one deployment of Learn's blank template, whose resources section is empty.
Cost: The blank template creates no resources, so nothing runs or stores data. The storage-account template in this session is for reading only; do not deploy it.
Clean-up: Run az group delete --name rg-az900-s17 and confirm, or open the group in the portal and select Delete resource group. Then check Resource groups.

The 30-Minute Session

0:00 – 6:00

Azure Resource Manager: one front door

An analogy: a council planning office, where every form goes to one desk that checks who you are and whether you may act, then passes it on.
Azure Resource Manager is the deployment and management service for Azure: the layer that creates, updates and deletes resources. Every request, from any tool, API or SDK, reaches it; it authenticates and authorises the request, then passes it to the service. That is why Session 16's two languages agreed.
It also lets you deploy a solution's resources as a group through declarative templates, define dependencies so they deploy in order, and apply RBAC and tags.
A resource provider is a service that supplies resources, such as Microsoft.Storage. The four levels of management scope are management groups, subscriptions, resource groups and resources, and lower levels inherit from higher ones.
THE EXAM LINE
Azure Resource Manager is the deployment and management service for Azure. Every request from the portal, CLI, PowerShell, APIs or SDKs passes through it, so results are consistent across tools.

If a question asks what authenticates every management request, the answer is Resource Manager.

6:00 – 11:00

Infrastructure as code

Infrastructure as code (IaC) means managing infrastructure through code and templates instead of manual configuration. Microsoft's DevOps guidance compares it to source code: the same model generates the same environment every time it deploys.
Idempotence means a deployment always produces the same configuration, whatever the starting state. Without IaC, environment drift turns each environment into a unique "snowflake".

Approach	What you write	Example from this course
Imperative	The steps, in order	Session 16's `az group create` then `az group delete`
Declarative	The end state you want; Resource Manager works out the steps	An ARM template or a Bicep file

IaC can start with CLI or PowerShell scripts and grow into ARM templates and Bicep; Microsoft's guidance prefers declarative files where possible. Illustrative: a Lagos bank keeps a template in source control and rebuilds an identical test network on demand.
THE EXAM LINE
Infrastructure as code manages infrastructure through code and templates rather than manual configuration. ARM templates and Bicep files use declarative syntax: you state what you want, not the steps to create it.

Declarative describes the destination; imperative describes the journey.

11:00 – 17:00

ARM templates and Bicep

An ARM template is a JSON file that defines resources to deploy to a resource group, subscription, management group or tenant. Azure validates it, then creates resources in order, in parallel where it can.

Section	Required?	What it holds
`$schema`	Yes	The template language version
`contentVersion`	Yes	Your own version number for the template
`parameters`	No	Values supplied at deployment, so one template fits several environments
`variables`	No	Values reused inside the template
`resources`	Yes	The resources to deploy or update
`outputs`	No	Values returned after deployment

jsonazuredeploy.json (read only; do not deploy)type it yourself

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "storagePrefix": {
            "type": "string",
            "minLength": 3,
            "maxLength": 11
        },
        "storageSKU": {
            "type": "string",
            "defaultValue": "Standard_LRS",
            "allowedValues": ["Standard_LRS", "Standard_GRS", "Standard_ZRS"]
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]"
        }
    },
    "variables": {
        "uniqueStorageName": "[concat(parameters('storagePrefix'), uniqueString(resourceGroup().id))]"
    },
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2025-06-01",
            "name": "[variables('uniqueStorageName')]",
            "location": "[parameters('location')]",
            "sku": { "name": "[parameters('storageSKU')]" },
            "kind": "StorageV2",
            "properties": { "supportsHttpsTrafficOnly": true }
        }
    ],
    "outputs": {
        "storageEndpoint": {
            "type": "object",
            "value": "[reference(variables('uniqueStorageName')).primaryEndpoints]"
        }
    }
}

This is Learn's Add outputs tutorial template, reindented, with its SKU list cut from eight values to three. Find each section in it.
Bicep is a declarative, domain-specific language with the same capabilities as ARM templates and an easier syntax; each Bicep file is converted into an ARM JSON template during deployment. Trap: Bicep does not replace Resource Manager; it feeds it.

Three sections are required: $schema, contentVersion and resources.

17:00 – 22:00

Azure Arc

Azure Arc works with Azure Resource Manager to extend Azure's compliance and monitoring to hybrid and multicloud estates, giving one consistent management platform.
It projects existing non-Azure resources into Azure Resource Manager, so you can manage virtual machines, Kubernetes clusters and databases as if they ran in Azure, with familiar Azure services wherever they live.
At the time of writing, the unit lists these resource types outside Azure: servers, Kubernetes clusters, Azure data services, SQL Server, and virtual machines (preview). For servers, the feature is Azure Arc-enabled servers.
THE EXAM LINE
Azure Arc extends Azure management and governance to resources outside Azure, on-premises or in other clouds, by projecting them into Azure Resource Manager. It does not migrate them.
Illustrative: a manufacturer with factory servers and another public cloud applies consistent governance, policy and inventory tracking from Azure. Learn's overview lists some Arc-enabled servers features, such as tags and RBAC, at no extra cost; check the pricing page for the rest.

Arc manages things where they are. Azure Migrate, from Session 10, moves them.

22:00 – 27:00

Hands-on: deploy a blank template and read it back

jsonazuredeploy.json (blank template from Learn's tutorial)type it yourself

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": []
}

bashCloud Shell (Bash)type it yourself

# 1. A resource group for this session
az group create --name rg-az900-s17 --location <your-region> --tags course=az900

# 2. Open the Cloud Shell editor, paste the blank template above, save and close
code azuredeploy.json

# 3. Deploy it: Resource Manager validates it and creates nothing
az deployment group create \
    --name blanktemplate \
    --resource-group rg-az900-s17 \
    --template-file azuredeploy.json

# 4. Read the template back from the deployment history
az deployment group export --resource-group rg-az900-s17 --name blanktemplate

# 5. Delete the group (answer y)
az group delete --name rg-az900-s17

TRACK A · YOUR AZURE ACCOUNT
- In a Bash ephemeral session, run steps 1 to 4. code opens the Cloud Shell editor; paste the blank template and save before step 3.
- Before step 5, open the group in the portal, select the link under Deployments, then blanktemplate and Template. Screenshot it, then run step 5.
- For a group with resources, az group export or the portal's Export template captures its current state. PowerShell uses New-AzResourceGroupDeployment and Export-AzResourceGroup.
TRACK B · NO PAYMENT CARD
- Open Learn's tutorial Add outputs to your ARM template, copy its complete template into your document and label every section.
- Read Learn's Export template in the Azure portal and note that export is not guaranteed and most exported templates need adjusting. You are reading, not deploying.
The deployment history keeps an exact copy of what you sent.

A deployment with a clear name is easy to find in the history; name every one.

27:00 – 30:00

Wrap-up, Pop Quiz 4 and your assignment

Write down Resource Manager's definition, the four scopes, the required template sections, where Bicep fits, and what Arc does not do.
Pop Quiz 4 opens now: five questions in eight minutes on Sessions 16 and 17. Sit it closed book before the assignment.
Track A: confirm rg-az900-s17 has gone. Then write the assignment: a template explained section by section, and Arc applied to a real hybrid estate.

Explain each section in your own words; if you can't, reread its row in the table.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Resource Manager`	service	The deployment and management service every Azure request passes through.	Learn →
`Infrastructure as code (IaC)`	concept	Managing infrastructure through code and templates instead of manual configuration.	Learn →
`Bicep`	tool	Declarative language for Azure deployments; converted to an ARM template.	Learn →
`ARM template`	concept	A JSON file that defines resources to deploy.	Learn →
`declarative syntax`	concept	Stating what you want to create, not the commands to create it.	Learn →
`resource provider`	concept	A service that supplies Azure resources, such as Microsoft.Storage.	Learn →
`Azure Arc`	service	Extends Azure management and governance to resources outside Azure.	Learn →
`Azure Arc-enabled servers`	feature	Manages Windows and Linux machines hosted outside Azure.	Learn →
`az deployment group create`	cli	Deploys a template to a resource group.	Learn →
`az deployment group export`	cli	Saves the template used by a past deployment.	Learn →
`Export template`	portal	Portal command that exports resources as a template.	Learn →
`New-AzResourceGroupDeployment`	powershell	Deploys a template to a resource group in Azure PowerShell.	Learn →
`Export-AzResourceGroup`	powershell	Captures a resource group as a template file.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Idempotence

An operation always producing the same result, whatever the starting state.

Environment drift

Environments slowly becoming unique and impossible to reproduce automatically.

Parameter

A template value supplied at deployment, so one template serves several environments.

Deployment history

A resource group's record of deployments, each kept under its deployment name.

Self-Check — Before You Submit

1. A manufacturer runs servers in its factories and in another public cloud. It wants to apply Azure policies and tags to them without moving them. Which service fits?

A. Azure Migrate
B. Azure Arc
C. Bicep
D. Azure Cloud Shell

B. Azure Arc — Azure Arc projects non-Azure resources into Azure Resource Manager so Azure governance applies where they are. Azure Migrate is tempting, but it moves workloads.

2. Which section must every ARM template contain?

A. parameters
B. outputs
C. variables
D. resources

D. resources — Learn's syntax reference marks $schema, contentVersion and resources as required. Parameters, variables and outputs are optional.

3. An administrator creates a resource group with the Azure CLI. What handles the request before the resource is created?

A. Azure Resource Manager authenticates and authorises it
B. Azure Arc projects it into the portal
C. Cloud Shell stores it in a template
D. Bicep converts it into JSON

A. Azure Resource Manager authenticates and authorises it — Every request from any tool reaches Azure Resource Manager, which authenticates and authorises it before passing it to the service. Bicep only converts Bicep files.

Today’s Assignment

Explain an ARM template section by section, and show how Azure Arc would extend governance across a real hybrid estate you know.

Describe a hybrid or multicloud estate you know: what runs, or would run, in Azure, and what stays elsewhere. Mark assumptions.
Explain each section of this session's storage-account template in your own words, which sections are required, and what the deployment would create.
Explain what Azure Resource Manager does when the template is deployed, and why an ARM template uses declarative syntax and is an example of Infrastructure as code (IaC). Say in one sentence where Bicep fits.
Explain how Azure Arc, for example Azure Arc-enabled servers, would bring the non-Azure machines under the same policies, tags and role assignments.
Write 300–700 words, using the exact names from the names box.

Evidence to include

Track A: screenshots of the deployment result, its Template view in the portal, and the group's deletion.
Track B: a screenshot of Learn's template tutorial with the address visible, and your labelled copy of the template.

Names your answer must use exactly
Azure Resource Manager ARM template declarative syntax Infrastructure as code (IaC) Bicep Azure Arc Azure Arc-enabled servers

Track B
Track B students explain the same template from Learn's tutorial, base the Arc design on Learn's Azure Arc overview, and submit the labelled template and page screenshot.

How this is marked — the rubric

Each template section is explained correctly, including which sections are required	30
The Arc design fits the estate and reflects Arc's documented purpose, not migration	25
Resource Manager, IaC and Bicep are explained accurately using the exact names from the names box	25
Evidence: the screenshots show the deployment, its template and the deletion (A), or the labelled template and Learn page (B)	20
Total · pass mark 70	100

Submitting session 17
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 17 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

ASSESSMENT NOW OPEN

Pop Quiz 4 — Tools and Templates opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.

5 questions · 8 minutes · covers Sessions 16–17 · pass mark 70

Sit Pop Quiz 4 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.

Skills Covered

Azure Resource ManagerInfrastructure as codeARM template sectionsBicep in one linePurpose of Azure Arc

Tick it once you have submitted.Next: Session 18 →

C · Describe Azure management and governance · 30–35%SESSION 18

Monitoring: Azure Advisor, Service Health, Azure Monitor

Session 18 of 20 · 30-minute session

Skills measured — Microsoft’s wording

Describe the purpose of Azure Advisor
Describe Azure Service Health
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights

Why This Matters

Once something runs in Azure, three questions follow. Is Azure itself healthy? Is my setup sensible? What is my application actually doing? Microsoft gives each question its own tool, and the exam tests whether you choose the right one. Azure Service Health answers the first, Azure Advisor the second and Azure Monitor the third. I have watched candidates choose Monitor for an Azure outage and Advisor for a slow web page. Today you learn each tool's purpose and parts, then read real items from your own subscription or from Microsoft's public pages. At work, this is the difference between telling a hospital director "Azure had an incident in our region" and guessing.

The 30-Minute Session

0:00 – 7:00

Azure Advisor: what should I improve?

An analogy: a building surveyor's report. It inspects what you already have and lists improvements, but it does not do the work.
Azure Advisor analyses your resources' configuration and usage and recommends improvements: a personalised best-practices guide in the portal. You can act on a recommendation, postpone it or dismiss it, and get notified of new ones. Its dashboard covers all your subscriptions.

Category (as the AZ-900 unit lists them)	What it looks for
Reliability	Configuration risks to keeping applications running
Security	Threats and vulnerabilities that could lead to breaches
Performance	Changes that can speed up applications
Operational Excellence	Workflow and deployment improvements
Cost	Ways to reduce Azure spending

Advisor's own overview lists the same five in a different order, writing "Operational excellence".
THE EXAM LINE
Azure Advisor recommends improvements in five categories: Reliability, Security, Performance, Operational Excellence and Cost. It advises on your configuration; it does not report Azure outages or collect application telemetry.

Advisor gives advice. If the question says "recommend", start there.

7:00 – 13:00

Azure Service Health: is Azure all right?

An analogy: three zoom levels on a map, from the whole world to your city to your street.
Azure Status gives a global picture of Azure's health across all services and regions. Check it when you hear of a widespread outage.
Service Health focuses on the services and regions you actually use. Because you are signed in, it shows outages, planned maintenance and health advisories that affect you, and you can set alerts. Its portal panes include Service issues, Planned maintenance, Health advisories, Security advisories, Billing updates and Health history.
Resource Health zooms in on one resource, such as a virtual machine: is it running normally, and is a problem on Azure's side or yours? Open it from the resource's menu under Resource health.
THE EXAM LINE
Azure Service Health combines Azure Status (global), Service Health (the services and regions you use) and Resource Health (individual resources). Choose it when the question is whether Azure has a problem.

Outage, maintenance or advisory in the question? Think Service Health.

13:00 – 20:00

Azure Monitor: what are my systems doing?

Azure Monitor is a platform for collecting, analysing and acting on data from your resources and applications, in Azure, on-premises and in other clouds. It stores logs and metrics centrally for dashboards, queries and alerts.
Log Analytics is the portal tool for writing and running queries on that data, opened by selecting Logs. Its KQL mode uses Kusto Query Language, and the logs live in a Log Analytics workspace.
Azure Monitor alerts notify you when a condition you defined is met. You create an alert rule for the condition and an action group for who is notified and what happens next. Alerts can be metric-based (a VM's CPU stays high) or log-based (an error pattern). Action groups are reusable across Azure Monitor, Service Health and Azure Advisor.
Application Insights is Azure Monitor's application performance monitoring feature for web applications, wherever they run. It tracks request rates, response times, failures, dependencies, page loads and users. Availability tests send synthetic requests to check the app responds.
The Activity log records management operations, such as creating a VM or a failed deployment. At the time of writing, Azure keeps these events for 90 days at no charge. Other monitoring data can be billed; see the Azure Monitor pricing page.
THE EXAM LINE
Azure Monitor collects and analyses telemetry. Log Analytics queries it; alerts (an alert rule plus an action group) act on it; Application Insights monitors web application performance and usage.

Monitor tells you what your own systems are doing, not whether Azure is healthy.

20:00 – 26:00

Hands-on: one real item from each tool

TRACK A · YOUR AZURE ACCOUNT
- Search for Advisor. Record one recommendation and its category, or screenshot the dashboard if there are none.
- Open Service Health. Check Service issues, Planned maintenance and Health advisories, record one item or note that there are none, then open Health history. Screenshot it.
- Open Monitor and select Activity log. Find your Session 16 or 17 resource group operations and screenshot one. Look at Alerts, but create no alert rule and no Log Analytics workspace today.
TRACK B · NO PAYMENT CARD
- Open the public Azure Status page, linked from Learn's Service Health overview, and screenshot it with the address visible.
- From the Learn units, screenshot the Advisor dashboard image and the Azure Monitor alerts image. Read Learn's Service Health portal page and list its panes.
- Read the Application Insights overview. You cannot see your own recommendations, notices or activity log without a subscription, and your write-up should say so.
Whichever track you are on, turn each item into a question and name the tool that answers it.
A fresh subscription may show nothing. An honest "none today" screenshot is good evidence.

Write the question first, then the tool. The exam works the same way.

26:00 – 30:00

Wrap-up: which tool answers which question

The question (illustrative)	The tool
Is Azure having a problem in a region we use?	Azure Service Health: Service Health
Is this VM down because of Azure or because of us?	Azure Service Health: Resource Health
How could we cut spending on idle resources?	Azure Advisor: Cost
Email us when a VM's CPU stays high	Azure Monitor: an alert rule and an action group
Why is the booking site slow for customers?	Azure Monitor: Application Insights
Who deleted that resource group?	Azure Monitor: Activity log

Write down Advisor's five categories, Service Health's three views, and Monitor's parts: Log Analytics, alerts, Application Insights and the Activity log.
Your assignment is a monitoring plan for one real application. Next session is the full review.

Three tools, three questions: advice, Azure's health, your telemetry.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Advisor`	service	Recommends improvements to your Azure resources.	Learn →
`Operational Excellence`	concept	Advisor category for workflow and deployment improvements.	Learn →
`Azure Service Health`	service	Keeps you informed about the health of Azure and your resources.	Learn →
`Azure Status`	feature	Global view of Azure's health across all services and regions.	Learn →
`Resource Health`	feature	Health of an individual resource, such as one VM.	Learn →
`Service issues`	portal	Service Health pane for problems affecting you now.	Learn →
`Health advisories`	portal	Service Health pane for changes that need your attention.	Learn →
`Azure Monitor`	service	Collects, analyses and acts on data from resources and applications.	Learn →
`Log Analytics`	tool	Portal tool for writing and running queries on monitoring data.	Learn →
`Kusto Query Language`	concept	The query language used in Log Analytics' KQL mode.	Learn →
`alert rule`	concept	Defines the condition that triggers an Azure Monitor alert.	Learn →
`action group`	concept	Defines who is notified and what happens when an alert fires.	Learn →
`Application Insights`	feature	Azure Monitor feature for web application performance and usage.	Learn →
`Activity log`	portal	Record of management operations on your resources.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Telemetry

Data such as logs and metrics that systems emit about what they are doing.

Planned maintenance

Upcoming Azure work that could affect the availability of your services.

Availability test

Synthetic requests sent to an app to check it responds, even with little traffic.

Control plane operation

A management action on a resource, such as creating or deleting it, recorded in the Activity log.

Self-Check — Before You Submit

1. A Lagos bank's customers report that its web app is slow. The team wants response times and failure rates per request. What should it use?

A. Azure Advisor
B. Azure Status
C. Application Insights
D. Resource Health

C. Application Insights — Application Insights monitors web application performance, including response times and failure rates. Advisor is tempting, but it recommends configuration improvements rather than measuring requests.

2. Which is NOT one of Azure Advisor's recommendation categories?

A. Compliance
B. Operational Excellence
C. Cost
D. Performance

A. Compliance — Advisor's five categories are Reliability, Security, Performance, Operational Excellence and Cost. Compliance is not one; Azure Policy handles compliance with your rules.

3. Which part of Azure Service Health tells you whether one specific virtual machine is affected by a problem?

A. Azure Status
B. Health advisories
C. Log Analytics
D. Resource Health

D. Resource Health — Resource Health reports on individual resources, such as a single VM. Azure Status is the global view, and Log Analytics belongs to Azure Monitor.

Today’s Assignment

Write a monitoring plan for one application at an organisation you know, naming the Azure tool that answers each question.

Describe one application you know: what it does, who uses it, and where it runs or would run in Azure. Mark assumptions.
List at least six questions its owners need answered, covering Azure's health, a resource's health, best-practice configuration, cost, application performance and failures, and who changed what.
For each question, name the tool and the part: Azure Service Health (and which view, such as Resource Health), Azure Advisor (and which category), or Azure Monitor (Log Analytics, an alert rule with an action group, Application Insights or the Activity log).
Design two alerts: the condition and who the action group notifies. Explain one trap you avoided, such as expecting Advisor to report an outage.
Include a summary table of question, tool and reason. Write 300–700 words, using the exact names.

Evidence to include

Track A: screenshots of one item, or the empty view, from Advisor, Service Health and the Activity log.
Track B: screenshots of the public Azure Status page and the Learn Advisor dashboard image, with addresses visible.
Both tracks: the summary table of question, tool and reason.

Names your answer must use exactly
Azure Advisor Azure Service Health Resource Health Azure Monitor Log Analytics alert rule action group Application Insights

Track B
Track B students write the same plan from the Learn units and product pages, and submit the Azure Status and Learn screenshots in place of the portal ones.

How this is marked — the rubric

Each question is matched to the right tool and part, with a correct reason	35
The two alerts are complete and realistic, and the trap is explained correctly	25
Uses the exact names from the names box, spelled and capitalised as Microsoft prints them	20
Evidence: the screenshots show the three portal views (A) or the public and Learn pages (B), and the table is present	20
Total · pass mark 70	100

Submitting session 18
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 18 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

Skills Covered

Purpose of Azure AdvisorAzure Service Health viewsAzure Monitor and Log AnalyticsAlerts and action groupsApplication Insights

Tick it once you have submitted.Next: Session 19 →

Review · every domainSESSION 19

Every name on one page: full-outline drill and exam technique

Session 19 of 20 · 30-minute session

Why This Matters

You have now met every bullet on Microsoft's outline. Today you prove it. We walk the official study guide domain by domain, all 57 bullets, and you answer each one aloud with the exact names before you check the cheat sheet. Then we cover exam technique from Microsoft's own pages: how long you have, what the question formats look like and how scoring works. I have watched candidates who knew the material lose marks to the clock and to one small word such as not. This session opens the full mock at the real length. Treat it as a rehearsal, not a verdict, and use its results to build the register that steers your final preparation.

The 30-Minute Session

0:00 – 4:00

How the drill works

Keep the cheat sheet face down. For each session row, answer the prompt aloud using the exact names, then check.
Mark each row green (right, exact names), amber (right idea, loose name) or red (could not answer). Ambers cost marks too, because options often differ by one word.
The outline (skills measured as of 20 July 2026) has 57 bullets: 15 in cloud concepts, 27 in architecture and services, and 15 in management and governance. Sessions 1 to 18 teach every one.
THE EXAM LINE
Microsoft weights the domains at 25–30% for cloud concepts, 35–40% for architecture and services, and 30–35% for management and governance. Spend revision time in that proportion.

Say it aloud. Recognising a name is easier than producing it.

4:00 – 10:00

Domain A drill: Describe cloud concepts (15 bullets)

Session	Bullets	Say it without notes
1	2	Learn's definition; what always stays yours
2	2	Public, private, hybrid; how multicloud differs
3	3	CapEx versus OpEx; the four pricing options; what serverless removes
4	4	Scaling up versus out; SLAs; management of versus in the cloud
5	4	Who manages the OS in IaaS, PaaS and SaaS; a use case for each

The Domain A pair to watch: Azure Reservations discount a specific resource, size and region for a one- or three-year term, while a Savings plan for compute commits to an hourly spend applied across eligible services and regions.
Reread an amber row's exam lines before opening anything new.

A definition you can say in one breath is a definition you own.

10:00 – 17:00

Domain B drill: Azure architecture and services (27 bullets)

Session	Bullets	Say it without notes
6	3	What a region pair gives you; whether every region has zones
7	4	The four hierarchy levels, and what inherits from what
8	4	Containers, VMs, functions; scale sets versus availability sets
9	2	Subnets, peering, Azure DNS; public versus private endpoint
10	6	Tiers; redundancy options; AzCopy or File Sync; Migrate or Data Box
11	4	SSO, MFA, passwordless; what Conditional Access decides
12	4	RBAC scope; Zero Trust principles; defense-in-depth layers

Azure VPN Gateway sends encrypted traffic over the public internet; Azure ExpressRoute uses a private connection through a connectivity provider that doesn't go over the public internet.
Microsoft Entra ID is cloud identity and access management; Microsoft Entra Domain Services adds managed domain join, group policy, LDAP and Kerberos/NTLM without your own domain controllers.

This is the heaviest domain. A red row here costs more than a red row anywhere else.

17:00 – 22:00

Domain C drill: management and governance (15 bullets)

Session	Bullets	Say it without notes
13	2	What changes a bill; what the calculator estimates
14	2	Budgets and alerts; what tags are for
15	3	The two lock types; that locks apply regardless of RBAC
16	2	The four tools; `az` versus cmdlets
17	3	What Arc does not do; the required template sections
18	3	Five categories; three views; Monitor's parts

Azure Policy checks resource state against your rules, whoever made the change; Azure role-based access control (Azure RBAC) controls which user actions are allowed at which scope.
Microsoft Purview governs data, risk and compliance; Microsoft Defender for Cloud manages security posture and threat protection. Azure Advisor advises, Azure Service Health reports Azure's health, and Azure Monitor collects your telemetry.

When two names both sound right, ask what each one acts on: people, resources, data or telemetry.

22:00 – 27:00

Exam technique, from Microsoft's own pages

Time. At the time of writing, Microsoft lists fundamentals exams at 45 minutes' exam duration and 65 minutes' seat time, which adds instructions, the candidate agreement and comments.
Format. Microsoft says most exams contain 40–60 questions, though the number varies, and it doesn't identify question types in advance. Its exam sandbox shows samples: active screen, build list, case studies, drag and drop, hot area, multiple choice, labs, mark review and the review screen.
Breaks. Five minutes are built into exam time for breaks, and the clock keeps running. After a break you cannot return to questions viewed before it. Microsoft Learn is not available during fundamentals exams.
THE EXAM LINE
Microsoft scores exams on a scale of 1 to 1,000 and 700 or greater passes; being scaled, it may not equal 70%. No points are deducted for incorrect answers, and unscored questions aren't identified. Answer every question.
My technique. Read the question's last line first, circle qualifiers such as NOT or least, eliminate options that name a different kind of thing, and never leave a blank.
TRACK A · YOUR AZURE ACCOUNT
- Before the mock, open Resource groups and confirm nothing from any earlier session remains. Open Budgets and screenshot your Session 1 budget.
TRACK B · NO PAYMENT CARD
- Before the mock, open the exam sandbox from Microsoft's AZ-900 study guide, try each question type once, and screenshot one.

Multi-part questions can earn partial points, so answer every part you know.

27:00 – 30:00

Wrap-up, Practice Exam 4 and your register

Practice Exam 4 opens now: the full mock, 40 questions in 45 minutes on Sessions 1 to 18, the same length as the marked Final. Sit it in one go, timed and closed book, using today's technique.
Afterwards, note each question you missed or guessed, and why.
Your assignment turns those notes, your drill colours and my letters into a weak-spot register, with the Learn page that repairs each gap.

A register with honest reds is worth more than a mock score.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`Azure Reservations`	feature	One- or three-year commitment discounting a specific resource.	Learn →
`Savings plan for compute`	feature	Hourly spend commitment applied across eligible compute usage.	Learn →
`Azure VPN Gateway`	service	Encrypted connection between networks over the public internet.	Learn →
`Azure ExpressRoute`	service	Private connection to Microsoft cloud via a connectivity provider, not over the internet.	Learn →
`Microsoft Entra ID`	service	Microsoft's cloud-based identity and access management service.	Learn →
`Microsoft Entra Domain Services`	service	Managed domain join, group policy, LDAP and Kerberos/NTLM without domain controllers.	Learn →
`Azure Policy`	service	Checks resource state against your rules, whoever made the change.	Learn →
`Azure role-based access control (Azure RBAC)`	feature	Controls which user actions are allowed at which scope.	Learn →
`Microsoft Purview`	service	Data governance, risk and compliance solutions for a unified view of data.	Learn →
`Microsoft Defender for Cloud`	service	Security posture management and threat protection.	Learn →
`Azure Advisor`	service	Recommends improvements to your resources in five categories.	Learn →
`Azure Service Health`	service	Health of Azure and of the services and resources you use.	Learn →
`Azure Monitor`	service	Collects, analyses and acts on telemetry from resources and applications.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Scaled score

A score reported on Microsoft's 1 to 1,000 scale, which may not equal a percentage.

Seat time

The total time to allow for an exam, including instructions, the agreement and comments.

Qualifier

A word such as NOT, least or most that changes which option is correct.

Weak-spot register

A table of your gaps, the evidence for each and the page that repairs it.

Self-Check — Before You Submit

1. During the exam, a candidate has two questions marked for review and wants a break. What does Microsoft say will happen?

A. The clock pauses until she returns
B. She cannot return to questions she viewed before the break
C. Marked questions are scored as correct
D. The break adds ten minutes to the exam

B. She cannot return to questions she viewed before the break — Microsoft says that once a break starts you cannot return to questions viewed before it, even if marked for review, and the clock keeps running.

2. A public agency must stop anyone, including its owners, from creating resources outside two approved regions. Which service fits?

A. Azure Advisor
B. Microsoft Purview
C. Azure RBAC
D. Azure Policy

D. Azure Policy — Azure Policy enforces rules on resource state regardless of who makes the change. Azure RBAC is tempting, but it controls what users may do, not where resources go.

3. How does Microsoft report certification exam scores?

A. On a scale of 1 to 1,000, with 700 or greater to pass
B. As a percentage, with 70% to pass
C. As pass or fail only, with no score
D. Out of the number of questions answered

A. On a scale of 1 to 1,000, with 700 or greater to pass — Microsoft reports technical exam scores from 1 to 1,000 with 700 or greater to pass, and notes a scaled score may not equal 70% of the points.

Today’s Assignment

Build a personal weak-spot register from your own paper results, drill and marked letters, with the Learn page that repairs each gap.

Sit Practice Exam 4 first. Then gather all your pop quiz and practice exam results from your progress page, and reread my letters.
Build a register of at least eight rows: the outline bullet, copied exactly from the study guide; its domain; the evidence of the gap (paper, drill colour or letter comment); the Learn page that repairs it, with its address; and the date you will reread it.
Order the rows by exam weight and severity, so a red architecture row comes before an amber cloud-concepts row.
Add a confused-pairs section: one sentence telling apart each pair in the names box, plus Azure Advisor, Azure Service Health and Azure Monitor. Mark any pair you got wrong on a paper.
Finish with what you will reread before Session 20. Write 300–700 words, using the exact names.

Evidence to include

A screenshot of your progress page showing your paper scores, including Practice Exam 4.
Your drill sheet (a photo or a table) showing a colour for every session from 1 to 18.
Track A: the Resource groups and Budgets screenshots. Track B: the exam sandbox screenshot.

Names your answer must use exactly
Azure VPN Gateway Azure ExpressRoute Azure Policy Azure role-based access control (Azure RBAC) Microsoft Purview Microsoft Defender for Cloud Azure Advisor Azure Service Health

Track B
Track B students build the same register from the same papers, letters and drill, and submit the exam sandbox screenshot in place of the portal screenshots.

How this is marked — the rubric

Every register row traces to real evidence and quotes the outline bullet exactly	30
Each gap links to a Learn page that teaches that bullet, and rows are ordered by weight and severity	25
The confused pairs are told apart correctly, using the exact names from the names box	25
Evidence: the screenshots show every paper score including Practice Exam 4, and the drill sheet is attached	20
Total · pass mark 70	100

Submitting session 19
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 19 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

ASSESSMENT NOW OPEN

Practice Exam 4 — Full Mock opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.

40 questions · 45 minutes · covers Sessions 1–18 · pass mark 70

Sit Practice Exam 4 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.

Skills Covered

Full-outline drillConfused name pairsTiming and scoringPractice Exam 4Weak-spot register

Tick it once you have submitted.Next: Session 20 →

Review · every domainSESSION 20

Final review: practice exam debrief and weak-spot repair

Session 20 of 20 · 30-minute session

Why This Matters

This is the last session, and it asks you to do what the job asks: take one real organisation and propose how it should use Azure, naming every choice exactly. The capstone covers all three domains, from cloud model to monitoring, so it is the best test I know of whether the names have become yours. First we debrief the full mock and repair what it exposed. Then you write the proposal, and once it is submitted you sit the marked Final. Pass both, the capstone at 70 or above and the Final at 700 or above, and the certificate is yours. After that, the real AZ-900 is a booking away, and I will show you where to make it.

The 30-Minute Session

0:00 – 6:00

Debrief Practice Exam 4

Open your Practice Exam 4 result beside your Session 19 register.
Sort every miss by cause. Didn't know: reread the Learn page. Confused a pair: redo the pairs drill. Misread: circle qualifiers. Short of time: practise pace, since 40 questions in 45 minutes allows about a minute each.
Repair two red rows now. Read the Learn page, then say the bullet aloud with the exact names, as in Session 19.
THE EXAM LINE
On the real exam, no points are deducted for incorrect answers, and multi-part questions can earn some of their points. A blank answer can never score.

Fix the cause, not the question; the same question will not come back.

6:00 – 12:00

The capstone brief

Choose a real small organisation you know, such as a clinic, a school, a family firm or a local agency. Use facts you may share, mark assumptions, and leave out anything confidential.

Area	Decide, and name exactly	Sessions
Cloud model and service type	Public, private or hybrid; IaaS, PaaS or SaaS for each workload	1–5
Region and resilience	The region, its pair, and whether it has availability zones	6
Hierarchy	Management groups, subscriptions, resource groups and tags	7, 14
Compute, networking, storage	The services, tiers and redundancy option	8–10
Identity and access	Microsoft Entra ID, sign-in methods, Conditional Access, Azure RBAC roles and scopes	11–12
Governance and security	Azure Policy, resource locks, Microsoft Purview, Microsoft Defender for Cloud	12, 15
Cost	A pricing calculator estimate, budgets and the cost factors	3, 13–14
Management and monitoring	Tools, templates, Azure Arc if hybrid, Advisor, Service Health, Azure Monitor	16–18

Every area needs a decision, an exact name, a reason and a Microsoft page, gathered in a summary table.

Small is fine. A proposal for a five-person clinic can still touch every area.

12:00 – 20:00

Writing it: the rules that earn the marks

Start with the organisation's constraints: budget, regulation, skills and existing systems, and trace each decision to one. Illustrative: a clinic that must keep records in-country says so when it chooses a region.
Use the exact name every time. Write Azure role-based access control (Azure RBAC), not "permissions", and Azure Monitor, not "Azure monitoring". A loosely named service counts as not named.
THE EXAM LINE
Availability zones are physically separate datacenters within an Azure region, and not every region supports them. Most regions are paired with another region in the same geography.
Apply least privilege at the narrowest sensible scope beneath your management groups. Remember: Azure Policy governs resources; RBAC governs people.
Estimate cost in the Azure pricing calculator and design a budget in Microsoft Cost Management; every figure comes from your estimate. Pose one monitoring question each for Service Health, Advisor and Azure Monitor.

If a sentence has no exact name and no reason in it, cut it.

20:00 – 26:00

Hands-on: gather the evidence

TRACK A · YOUR AZURE ACCOUNT
- Sign in to the Azure pricing calculator, build and export your estimate, and screenshot its summary.
- Screenshot the portal's Region list showing your region, and the Resource groups list showing nothing left from the course. Create nothing new.
TRACK B · NO PAYMENT CARD
- Build the same estimate in the public Azure pricing calculator without signing in, and export or share it.
- Take your region, pair and zone facts from Microsoft's public pages and screenshot them. You are describing, not deploying; say so.
Both tracks: build the summary table with five columns: area, decision, exact name, reason and Microsoft source.
Check the proposal against the brief table; an area without an exact name is unfinished.

Evidence beats description. A screenshot settles what a paragraph cannot.

26:00 – 30:00

Wrap-up: The Marked Final, the certificate, the gift and the real exam

The Marked Final opens now; sit it after you submit the capstone. It is served and marked on the server, with a fresh draw every sitting: 40 questions in 45 minutes, scored out of 1000, with 700 to pass. No answers come back; the letter names sessions to revisit. Resit as often as you like; your best score counts.
The certificate. You earn it when your capstone is marked at 70 or above and your marked Final is 700 or above. My reference letter comes with it. It is an ERW credential, not a Microsoft certification.
The gift. When your capstone passes, I email you the claim link for The Intelligent Barrel, the full book, and its three bonus PDFs: The Reader’s Toolkit, The 90-Day AI Pilot Charter & Playbook and The Value–Risk Map & Autonomy Playbook. The code works only for existing customers, so check out with the email address you used to buy this course.
THE EXAM LINE
AZ-900 gives you 45 minutes. Microsoft scores it from 1 to 1,000, and 700 or greater passes. Passing it earns Microsoft Certified: Azure Fundamentals.
Booking the real exam. On the Microsoft Certified: Azure Fundamentals page on Microsoft Learn, select Schedule exam through Pearson VUE, or through Certiport if you are a student or educator. The price depends on your country or region; check it there. Microsoft strongly recommends registering with a personal Microsoft account, since records under a work or school account are lost if you leave.
It has been a pleasure to teach you. Send me the capstone.

Book the real exam while the names are fresh.

The exact names

As Microsoft prints them — the exam and the marker both expect these, letter for letter.

`public cloud`	concept	Cloud built and run by a third-party provider and open to anyone to buy.	Learn →
`platform as a service (PaaS)`	concept	You deploy apps without managing VMs or operating systems.	Learn →
`availability zones`	concept	Physically separate datacenters within an Azure region.	Learn →
`region pairs`	concept	Regions paired within the same geography for resilience.	Learn →
`management groups`	concept	Containers above subscriptions that apply governance to all beneath them.	Learn →
`Microsoft Entra ID`	service	Microsoft's cloud-based identity and access management service.	Learn →
`Azure role-based access control (Azure RBAC)`	feature	Grants people access through roles at a chosen scope.	Learn →
`Azure VPN Gateway`	service	Encrypted connection between an office network and Azure.	Learn →
`Azure Policy`	service	Creates, assigns and manages policies that control or audit resources.	Learn →
`Azure pricing calculator`	tool	Turns anticipated usage into an estimated cost.	Learn →
`Microsoft Cost Management`	service	Microsoft's tools for analysing, budgeting and optimising cloud costs.	Learn →
`Azure Monitor`	service	Collects, analyses and acts on data from resources and applications.	Learn →

Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).

Key Terms

Capstone

The final assignment: one proposal that uses the whole course.

Constraint

A fixed condition, such as budget, law or skills, that a design must respect.

Least privilege

Granting only the access a task needs, and no more.

Assumption

Something you believe but have not confirmed, marked as such in the proposal.

Self-Check — Before You Submit

1. A clinic's proposal must stop staff creating resources outside its chosen region, and let the practice manager view resources without changing them. Which pair meets both needs?

A. Microsoft Purview and Azure Advisor
B. Resource locks and Azure Monitor
C. Azure Policy and an Azure RBAC Reader role assignment
D. Microsoft Entra ID and Azure Service Health

C. Azure Policy and an Azure RBAC Reader role assignment — Azure Policy can prevent noncompliant resources such as the wrong region, and the Reader role lets someone view resources. Locks are tempting, but they restrict everyone on a resource, not one person.

2. Which statement about availability zones matches Learn?

A. They are physically separate datacenters within an Azure region
B. Every Azure region has them
C. They are regions paired across geographies
D. They are a pricing option for virtual machines

A. They are physically separate datacenters within an Azure region — Learn defines availability zones as physically separate datacenters within a region, and says not every region supports them. Region pairs are a different concept.

3. Before anything is deployed, which tool gives the clinic an estimated monthly cost for its proposal?

A. Microsoft Cost Management
B. Azure pricing calculator
C. Azure Advisor
D. The Activity log

B. Azure pricing calculator — The Azure pricing calculator turns anticipated usage into an estimate. Microsoft Cost Management analyses and budgets actual spending once resources exist.

Today’s Assignment

Write an Azure proposal for a real small organisation that makes, and justifies with exact names, a decision in every area across all three exam domains.

Introduce the organisation (sector, size, locations and current systems) and its three most important constraints. Mark assumptions, and leave out anything confidential.
Cover every area in the brief table, including the region's pair and availability zones, management groups, Microsoft Entra ID, Azure role-based access control (Azure RBAC), Azure Policy and Azure Monitor.
For every decision, give the exact name, one reason tied to a constraint, and the Microsoft page that supports it.
Include your Azure pricing calculator estimate (export or share link) and a budget design with alert thresholds in Microsoft Cost Management. Invent no figures.
Finish with the two biggest risks and what you would confirm with the organisation first. Write 500–700 words, plus the summary table: area, decision, exact name, reason and source.

Evidence to include

The pricing calculator export or share link, and a screenshot of its summary.
The summary table, with a Microsoft source link in every row.
Track A: screenshots of your chosen region in the portal and of your Resource groups list at the end of the course. Track B: screenshots of the public pages you cite for region, pair and availability zones.

Names your answer must use exactly
availability zones management groups Microsoft Entra ID Azure role-based access control (Azure RBAC) Azure Policy Azure pricing calculator Microsoft Cost Management Azure Monitor

Track B
Track B students write the same proposal from Microsoft's public pages, build the estimate in the public pricing calculator without signing in, and state plainly that nothing was deployed.

How this is marked — the rubric

Every area in the brief has a decision that fits the organisation's constraints and Microsoft's descriptions	35
Exact names are used correctly across all three domains, each with a supporting Microsoft source	25
Cost and monitoring are concrete: a real calculator estimate, a budget design, and a question for each monitoring tool	20
Evidence: the estimate export or link, the summary table and the track screenshots are present	20
Total · pass mark 70	100

Submitting session 20
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line Session: 20 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.

Download the Word template My progress & marks

Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.

THE MARKED FINAL

The marked Final is sat in this session. It is served and marked on the server, weighted the way Microsoft weights the exam, and it can be resat — each sitting is a new draw and the best score counts. Sit it after your capstone is submitted.

40 questions · 45 minutes · a fresh paper every sitting · scored out of 1000 · pass 700

Sit the marked Final →Sign in first: the Final is marked against your record.

Skills Covered

Debrief the full mockCapstone proposalAll three domainsThe Marked FinalBook AZ-900

Tick it once you have submitted.Sit the marked Final →

AZ-900 CERTIFICATION BOOTCAMP

Microsoft Azure Fundamentals — Know the cloud. Name it exactly.

Why This Matters

The exact names

Cmdlet

Ephemeral session

Resource provider

Dashboard

Today’s Assignment

Why This Matters

The exact names

Idempotence

Environment drift

Parameter

Deployment history

Today’s Assignment

Why This Matters

The exact names

Telemetry

Planned maintenance

Availability test

Control plane operation

Today’s Assignment

Why This Matters

The exact names

Scaled score

Seat time

Qualifier

Weak-spot register

Today’s Assignment

Why This Matters

The exact names

Capstone

Constraint

Least privilege

Assumption

Today’s Assignment