AZ-900 Core Solutions and Management Tools on Azure: A Beginner-Friendly Guide

Introduction

When I teach AZ-900, I tell people this objective is really about recognition: can you match a business or technical need to the right Azure service or management tool?

You’re definitely not being asked to become a full-blown architect or administrator overnight.

You are being asked to understand what Azure offers, what each tool is for, and where beginners commonly mix things up.

This guide focuses on the AZ-900 topic Core Solutions and Management Tools on Azure. I’ll keep this focused on the exam, but I’m not going to gloss over the technical truth either.

I’ll use the current Azure names wherever I can, so you don’t end up memorizing old terminology by mistake.

Now here’s the thing—Microsoft changes Azure pretty often, and the exam focus can shift a bit too, so it’s definitely worth checking the latest AZ-900 skills outline before you go too deep.

If you see older study materials, remember that some names have changed, such as Microsoft Entra ID, which was formerly Azure Active Directory (Azure AD).

Let’s start with the Azure basics you’ll want in your back pocket for this topic.

Start with four ideas: shared responsibility, service models, consumption pricing, and scaling.

In Azure, who handles what really depends on the service model you’re using. With IaaS like Azure Virtual Machines, Microsoft manages the physical datacenter, physical servers, storage fabric, and hypervisor platform.

You’re still on the hook for the guest operating system, patching, app configuration, identity settings, data, and a lot of the network controls inside your subscription.

With PaaS like Azure App Service or Azure SQL Database, Microsoft manages more of the platform, so you focus more on the app and data. With SaaS, you mostly manage users, settings, and data.

Azure also uses a consumption-based model for many services.

That flexibility is great, honestly, but it can also bite you if someone leaves resources running and nobody cleans them up.

And Azure supports scalability and elasticity, meaning services can grow or shrink with demand, sometimes automatically.

AZ-900 memory aid: IaaS = most control, most responsibility.

PaaS is that managed platform layer where Azure takes care of a lot of the heavy lifting.

SaaS is basically the finished application you consume and use.

Now let’s talk about how Azure is organized under the hood.

An Azure region is a set of datacenters deployed within a latency-defined area and connected by a regional network.

Picking the right region matters because it can affect latency, compliance, data residency, and even which services you’re able to deploy.

A region pair is part of Azure’s resiliency design, but do not assume every service automatically fails over across a pair. You still need service-specific disaster recovery planning, because Azure doesn’t magically solve every failover scenario for you.

Availability zones are separate physical locations within some Azure regions, with independent power, cooling, and networking. They improve resiliency within a region, but not every region or every service supports zones.

For organization, the hierarchy is the part I’d really want you to remember:

• Management groups organize subscriptions.
• Subscriptions are billing and governance scopes where RBAC and policy can be assigned.
• Resource groups organize related resources inside a subscription.

When you delete a resource group, Azure usually tries to remove the resources inside it too, although locks and dependencies can change the outcome.

Next up: the core Azure solutions you’ll want to recognize on sight.

Let’s start with the compute services, because these show up all the time in exam scenarios.

Azure Virtual Machines are the right answer when you need maximum control.

With a VM, you’re the one choosing the image, VM size, disk type, network placement, authentication method, and security rules.

In the real world, that also means you’ve got to think about public versus private IPs, network security groups, backups, patching, and monitoring.

Managed disks are the standard disk model for Azure VMs.

Azure App Service is a strong choice for web apps and APIs when you do not want to manage the OS.

The big ideas to recognize with App Service are App Service plans, scaling, deployment slots, custom domains, TLS/SSL, and monitoring integration.

If the scenario is “host a website quickly with lower operational overhead,” App Service is usually the answer.

AKS is for container orchestration.

With AKS, Microsoft manages the Kubernetes control plane, but you’re still responsible for node pools, workloads, container images, networking choices, upgrade strategy, and the day-to-day cluster ops.

AKS usually bills for worker nodes and associated resources rather than the managed control plane itself. For AZ-900, remember: AKS is not just “containers”; it is container orchestration.

Azure Functions is serverless compute, meaning server management is abstracted away. It supports HTTP triggers, timers, storage events, queue messages, and more. It can run on different hosting plans, so it is not always simply “pay only when code runs.” It also supports more advanced workflows through Durable Functions. If the workload is event-driven, automation-focused, or triggered by messages or file uploads, Functions is a very strong candidate.

Now let’s switch gears to networking services you’ll want to recognize.

Azure Virtual Network (VNet) is the core private networking boundary in Azure.

You can put resources directly into a VNet, and some managed services can hook into one too.

The big concepts around VNets are subnets, NSGs, routing, DNS, peering, public IPs, and private endpoints.

VPN Gateway is the answer for encrypted internet-based hybrid connectivity. ExpressRoute is the answer for private dedicated connectivity, often used when predictable performance or private network integration matters.

Exam shortcut: WAF or web routing usually points to Application Gateway. Global web acceleration points to Front Door. DNS-based distribution points to Traffic Manager. Regional Layer 4 balancing points to Load Balancer.

Let’s move on to storage and data services.

Azure Storage is built around a storage account, which can provide multiple storage services. Durability depends on the replication option you choose, such as LRS, ZRS, GRS, GZRS, RA-GRS, or RA-GZRS.

Queue Storage is simple messaging. Do not confuse it with Azure Service Bus, which supports more advanced enterprise messaging features like topics, subscriptions, and dead-lettering.

Here’s the database view at a glance.

Azure SQL Database is the usual exam answer for “managed relational database.” Cosmos DB is the answer when the question emphasizes global distribution, NoSQL, multiple APIs or models, or configurable consistency levels.

There are also a few other solution categories worth recognizing.

Azure AI services provide prebuilt capabilities such as vision, speech, language, and document intelligence. Azure Machine Learning is for building and training models. Azure Synapse Analytics is a recognizable analytics platform, and Azure IoT Hub is the key IoT service to know for device connectivity and management. Azure Arc extends Azure management to supported non-Azure servers, Kubernetes clusters, and selected data services.

Now let’s look at the Azure management and deployment tools.

For local command-line work, you usually authenticate first with az login or Connect-AzAccount. Example commands:

az login
az group create --name rg-demo --location eastus
Connect-AzAccount
New-AzResourceGroup -Name rg-demo -Location eastus

ARM versus ARM templates versus Bicep matters. ARM is the Azure control plane and management framework. ARM templates are JSON files used to declaratively deploy resources through ARM. Bicep is a simpler Microsoft-authored language that compiles to ARM templates.

Resource Graph is useful when the environment is too large to inspect manually. A typical use case is finding all virtual machines or all resources with a specific tag across multiple subscriptions.

Marketplace can speed up deployment, but it also introduces licensing, vendor trust, and governance concerns. In real environments, I’d definitely pair Marketplace with RBAC, Policy, and some kind of approval process.

Let’s talk about monitoring, health, cost, and optimization, because this is where a lot of beginners get tangled up.

Azure Monitor is the main monitoring platform. It collects metrics, logs, alerts, and visualizations. Two names commonly tied to Azure Monitor are Log Analytics and Application Insights.

Log Analytics helps you query and analyze collected log data.

Application Insights focuses on application performance, failures, requests, and dependencies.

Azure Advisor provides recommendations across cost, reliability, performance, security, and operational excellence. Think of Advisor as recommendation guidance, not live telemetry.

Azure Service Health gives a personalized view of Azure issues and maintenance affecting your subscriptions. Azure Status provides a public view of broad platform status information. Another related concept is Resource Health, which helps you understand the health of a specific resource.

Azure Cost Management + Billing is the management tool for cost analysis, budgets, forecasting, and spend visibility.

For AZ-900, that’s definitely not something you want to overlook.

If the question is about tracking costs, setting budgets, or analyzing spend, your first thought should be Cost Management.

Troubleshooting decision tree:

• App is slow or failing: Azure Monitor and possibly Application Insights.
• Need improvement recommendations: Azure Advisor.
• Suspect Azure incident affecting your subscription: Azure Service Health.
• Need broad platform status visibility: Azure Status.
• Budget or unexpected spend issue: Cost Management + Billing.

Now let’s cover governance, identity, and security basics.

Azure Policy enforces standards.

It can audit resources, deny noncompliant deployments, append settings, and generally check whether resources follow your rules.

For example, you might use Policy to allow only approved regions or require specific tags. RBAC controls who can do what.

You can assign roles at the management group, subscription, resource group, or individual resource scope.

Owner can manage access; Contributor can manage resources but cannot grant access; Reader can view.

Microsoft Entra ID is the cloud identity service formerly known as Azure AD.

It handles identities and authentication.

Azure RBAC uses those identities to control who’s authorized to do what in Azure resources.

For security awareness, also recognize MFA, Conditional Access, Key Vault for secrets, keys, and certificates, and Microsoft Defender for Cloud for security posture and recommendations.

Tags support organization and cost reporting. Resource locks such as CanNotDelete and ReadOnly help prevent accidental changes.

Important correction: Azure Blueprints is deprecated and should not be treated as the modern recommended governance approach. Today, think in terms of Azure Policy, ARM/Bicep, template-based standardization, and related IaC practices.

Security note: ExpressRoute provides private connectivity, but private does not automatically mean encrypted in the same way as a VPN tunnel. Also, Policy and RBAC solve different problems: Policy governs what can exist, while RBAC governs who can act.

Now for hybrid management with Azure Arc.

Azure Arc extends Azure management to supported resources outside Azure, especially servers, Kubernetes clusters, and some data services.

It helps with inventory, governance, and keeping management consistent across mixed environments.

It does not mean the workload has been migrated into Azure. If the exam says “manage on-premises or multicloud resources through Azure,” think Azure Arc.

Exam scenario decoder

Common traps: ARM is not the same as an ARM template. Service Health is not the same as Azure Status. Policy is not RBAC. Azure Arc is not migration. ExpressRoute is not just “a faster VPN.”

Conclusion

The AZ-900 core solutions and management tools objective gets much easier once you stop treating Azure like a giant product list and start recognizing patterns. Compute means choosing between control and abstraction. Networking means matching the connectivity or traffic requirement to the right service.

Monitoring, governance, and cost management each solve a different operational problem, even though they often get talked about in the same conversation.

Hybrid management brings non-Azure resources into the management story through Azure Arc.

If you remember the major service distinctions, the common exam clue words, and the most confused pairs, you will be in good shape for this part of the exam. Focus on purpose, not memorizing every setting. That is exactly the level AZ-900 is looking for.