AZ-900 Domain 2: Describe Azure architecture and services (35-40%) - Complete Study Guide 2026

Domain 2 at a Glance: Why This Section Carries the Most Weight

Of the three domains on the AZ-900 exam, Domain 2-Describe Azure architecture and services-is the heaviest hitter. Microsoft allocates 35-40% of the exam to this content area, meaning roughly one in three questions you encounter will trace back to something covered here. If you invest equal time across all three domains, you are systematically under-preparing for the section that will most determine whether you walk away with a 700 or above on Microsoft's 1-1000 scaled score.

The exam is administered through Pearson VUE authorized test centers or Pearson OnVUE online proctoring, and you have 45 minutes of actual exam time within a 65-minute seat time window. That constraint makes depth of knowledge critical: you cannot afford to pause on every Azure service name and reason through it from scratch. Domain 2 rewards candidates who have internalized the purpose and relationships between services, not just memorized a glossary.

For full context on how all three domains fit together and how Domain 2 compares in weight and difficulty to the others, see the AZ-900 Exam Domains 2026: Complete Guide to All 3 Content Areas.

Exactly What Domain 2 Tests: The Full Topic Breakdown

Microsoft's official skills outline for the AZ-900 (skills measured as of July 20, 2026) organizes Domain 2 into four major sub-areas. Each one is testable, and the exam does not telegraph which sub-area a question belongs to-you simply see a scenario and need to select the correct Azure concept or service.

The breadth here is deliberate. Microsoft wants AZ-900 candidates to demonstrate a working mental model of how Azure is assembled from the ground up-physical infrastructure first, services layered on top, secured at the identity and access layer. Understanding that flow makes individual service questions far easier to answer correctly under time pressure.

Azure Core Architecture Components

Regions, Pairs, and Sovereign Clouds

An Azure region is a geographical area containing at least one-typically multiple-data centers networked together with low-latency connections. Microsoft organizes regions into region pairs so that if one region experiences an outage, Azure can fail services over to the paired region. Candidates often confuse regions with availability zones; the AZ-900 exam exploits that confusion directly.

Availability zones are physically separate data centers within a single region. They each have independent power, cooling, and networking. Zone-redundant resources are replicated across at least three zones within a region. The key exam distinction: regions protect against regional failures; availability zones protect against individual data center failures within a region.

The Azure Organizational Hierarchy

Understanding the administrative structure of Azure is a reliable source of questions in Domain 2. The hierarchy from broadest to most granular is:

1. Management Groups - containers that help you manage access, policy, and compliance across multiple subscriptions
2. Subscriptions - billing boundaries and access control boundaries; every Azure resource belongs to exactly one subscription
3. Resource Groups - logical containers for Azure resources that share a lifecycle; deleting a resource group deletes everything in it
4. Resources - individual service instances such as a virtual machine or storage account

Compute and Networking Services

Compute Options You Must Be Able to Compare

Domain 2 expects you to know not just what each compute service does, but when to choose it. The AZ-900 frequently presents a business scenario and asks which service is the best fit. Here is how the major options differ:

Networking: The Concepts That Trip Candidates Up

Azure networking questions in Domain 2 focus heavily on Azure Virtual Networks (VNets), VNet peering, VPN Gateway, and Azure ExpressRoute. The classic exam scenario: a company needs a private, dedicated connection to Azure that does not travel over the public internet-the answer is ExpressRoute, not VPN Gateway. VPN Gateway uses an encrypted tunnel over the public internet; ExpressRoute is a private circuit through a connectivity provider.

Azure DNS and Azure Load Balancer appear regularly as well. Know that Azure DNS hosts your DNS domains in Azure and provides name resolution using Microsoft's infrastructure, but it cannot be used to buy domain names-that distinction is exam-testable.

Azure Storage Services

Storage Account Types and Redundancy

The storage section of Domain 2 is denser than many candidates expect. A core concept is storage redundancy-how Azure replicates data to protect against failures at different scales:

Azure Blob, Files, and Migration Tools

Azure Blob Storage is optimized for unstructured data-documents, images, videos, logs. Know the three access tiers: Hot (frequent access, higher storage cost), Cool (infrequent access, lower cost), and Archive (rarely accessed data, lowest cost with retrieval latency). The AZ-900 will test when each tier is appropriate.

Azure Files provides fully managed cloud file shares accessible via SMB or NFS protocols, making it a natural fit for lift-and-shift scenarios where applications rely on shared file systems.

Azure Migrate and Azure File Sync round out this sub-area. Azure Migrate is a hub of tools for assessing and migrating on-premises servers, databases, and web apps. Azure File Sync extends on-premises Windows file servers to Azure, enabling cloud tiering of infrequently accessed files.

Identity, Access, and Security

Microsoft Entra ID (Formerly Azure Active Directory)

Microsoft rebranded Azure Active Directory to Microsoft Entra ID-and the AZ-900 exam updated to reflect this. Entra ID is Microsoft's cloud-based identity and access management service. It is not the same as Windows Server Active Directory; it is built for cloud and multi-tenant SaaS applications. Key features to know: single sign-on (SSO), multi-factor authentication (MFA), and Conditional Access policies.

Azure RBAC and Zero Trust

Azure Role-Based Access Control (RBAC) is the authorization system for managing access to Azure resources. Roles are assigned to security principals (users, groups, service principals) at a scope. Three built-in roles the exam loves to reference: Owner, Contributor, and Reader-know exactly what each can and cannot do.

Zero Trust is a security model, not a specific Azure service. Its core principle: never assume trust, always verify. Domain 2 expects you to recognize Zero Trust components-verify explicitly, use least privilege access, assume breach-and connect them to Azure features that implement them.

Microsoft Defender for Cloud provides unified security management and advanced threat protection across hybrid cloud workloads. The AZ-900 level of knowledge required is conceptual: understand what it does and when you would use it, not how to configure it at a technical depth.

How Domain 2 Questions Are Actually Written

The AZ-900 is a proctored, computer-based exam and Microsoft reserves the right to include interactive components-the exact item types are not pre-announced. In practice, Domain 2 questions typically follow three patterns:

• Scenario-to-service mapping: "A company needs to run containerized workloads without managing underlying infrastructure. Which service should they use?" The correct answer requires you to distinguish between AKS (cluster management involved) and Azure Container Instances (no cluster management).
• Feature-to-requirement matching: "Which storage redundancy option provides the highest durability and protects against both zone and regional failures?" Answer: GZRS.
• Concept identification: "A security team wants to ensure that no user or device is trusted by default, even inside the corporate network. Which security model does this describe?" Answer: Zero Trust.

There is no penalty for guessing on the AZ-900. If you are uncertain, eliminate obviously wrong answers and commit to the most likely option. Leaving an answer blank guarantees zero points; guessing gives you a chance at a correct score.

Microsoft also notes that Microsoft Learn access is not available during Fundamentals exams-you must know the material cold. Practicing with realistic, scenario-based questions before exam day is one of the most effective ways to build that recall. The AZ-900 practice tests available on this site are structured around the same domain weighting Microsoft uses, with Domain 2 questions proportionally represented at 35-40%.

For a full breakdown of what to expect across all question types, see Best AZ-900 Practice Questions 2026: What to Expect on the Exam.

A Domain-Specific Study Schedule for Domain 2

Given Domain 2's size and breadth, it warrants dedicated time in any study plan. Below is a focused schedule that respects the proportional weight of each sub-area within Domain 2 itself. This is not a complete AZ-900 study plan-for that, see the AZ-900 Study Guide 2026: How to Pass on Your First Attempt.

Registration, Fees, and Exam Mechanics

The AZ-900 costs $99 USD in the United States. Pricing is based on the country or region where the exam is proctored, so if you are outside the US, verify the current fee on the Microsoft certification page before registering. For a full breakdown of pricing variables, discounts, and retake policies, see AZ-900 Certification Cost 2026: Complete Pricing Breakdown.

Scheduling is handled through Pearson VUE-either at an authorized test center or via Pearson OnVUE online proctoring. Certiport scheduling is available for students or educators in applicable programs. The exam window is 65 minutes of seat time with 45 minutes allocated to actual questions. The additional time covers check-in, instructions, and survey items.

One logistical detail that surprises candidates: if the exam is not available in your preferred language, Microsoft may offer a 30-minute language accommodation, bringing your total to 75 minutes of exam time. This is worth requesting if English is not your primary language and you qualify.

Unlike role-based Azure certifications, the AZ-900 has no prerequisites-you can register and sit the exam at any point. And once you pass, you never need to renew it. Microsoft Fundamentals certifications do not expire. That permanence makes the credential especially valuable as a career foundation, particularly when explored alongside broader questions like whether the AZ-900 is worth pursuing given your specific career goals.

For more on how candidates experience the exam's overall difficulty and what commonly trips people up across all domains, see How Hard Is the AZ-900 Exam? Complete Difficulty Guide 2026.

Frequently Asked Questions