An on-demand, scalable computer in the cloud where you control the operating system (IaaS).
Azure Virtual Machines are an Infrastructure-as-a-Service (IaaS) offering that deploys Windows or Linux instances with full control over the operating system, installed software, and network configuration. Because you manage the guest OS — patching, hardening, and runtime config — VMs place more operational responsibility on you than PaaS options. The common exam confusion is Azure App Service, a PaaS where Microsoft manages the OS so you only deploy code. Choose VMs for a specific OS version, custom kernel, or legacy software. For high availability, pair VMs with Availability Sets or Availability Zones, separate from the VM itself.
A serverless compute service that runs small pieces of code in response to events.
Azure Functions is a serverless compute service that runs small pieces of code in response to triggers such as HTTP requests, timer schedules, queue messages, or Blob Storage events, with Azure managing the underlying infrastructure so developers focus on logic rather than servers. The exam distinction: App Service hosts long-running web apps and APIs on a persistent plan, while Functions handle short, stateless, event-driven workloads billed only during execution. The default Consumption plan scales automatically to zero, eliminating idle costs, though Functions can also run on an App Service plan for always-on behavior.
A service to run containers on demand without managing servers or orchestrators (ACI).
Azure Container Instances (ACI) is a serverless service that runs individual Docker containers in Azure without provisioning virtual machines or managing a container runtime. Containers start in seconds, and you pay only for the CPU and memory consumed while running, making ACI ideal for short-lived or bursty workloads such as batch jobs, event-driven tasks, and build steps. The key exam distinction is ACI versus Azure Kubernetes Service (AKS): ACI runs single isolated containers with minimal setup, while AKS orchestrates clusters of many containers with auto-scaling, rolling updates, and service discovery. Choose ACI for simplicity and fast startup; choose AKS for multi-container coordination at scale.
A managed Kubernetes service (AKS) for deploying and orchestrating containers at scale.
Azure Kubernetes Service (AKS) is a managed container orchestration platform that offloads the operational burden of running Kubernetes. Microsoft provisions, scales, and upgrades the Kubernetes control plane at no additional charge; customers pay only for the agent nodes that run their workloads. AKS suits applications composed of multiple interdependent containers needing service discovery, rolling updates, auto-scaling, and self-healing. For AZ-900, contrast AKS with Azure Container Instances (ACI), the serverless option for running a single container quickly with no cluster management, while AKS targets production-grade, multi-container apps requiring orchestration. AKS integrates with Microsoft Entra ID for role-based access control and Azure Monitor for cluster observability.
A managed PaaS platform for hosting web apps, REST APIs, and mobile back ends.
Azure App Service is a fully managed Platform as a Service (PaaS) for hosting web applications, RESTful APIs, and mobile back ends. Because Azure manages the underlying operating system, runtime patches, load balancing, and auto-scaling, developers focus on application code. It supports multiple runtimes including .NET, Java, Node.js, Python, and PHP, and integrates natively with GitHub and Azure DevOps for continuous deployment. A common AZ-900 confusion is treating App Service like a virtual machine. With a VM (IaaS) the customer controls the OS; with App Service that responsibility shifts to Microsoft. App Service plans define the compute tier and capacity, and one plan can host multiple apps, so scaling the plan scales every app running on it.
A logically isolated private network in Azure (VNet) that connects Azure resources securely.
Azure Virtual Network (VNet) provides a logically isolated private network where Azure resources such as virtual machines communicate without traffic crossing the public internet. Administrators segment a VNet into subnets, control routing with route tables, and enforce traffic rules using Network Security Groups at the subnet or NIC level. A common exam confusion is treating VNet peering and VPN Gateway as interchangeable. VNet peering connects two VNets privately over Microsoft’s backbone with no gateway needed, while VPN Gateway encrypts traffic over the public internet, typically connecting an on-premises network to Azure. These are distinct solutions for distinct scenarios.
A gateway that sends encrypted traffic between Azure and on-premises networks over the public internet.
Azure VPN Gateway is a managed service that establishes encrypted IPsec/IKE tunnels over the public internet between an Azure virtual network and on-premises locations or remote clients. It supports site-to-site (entire on-premises network to Azure), point-to-site (individual devices to Azure), and VNet-to-VNet connections. For AZ-900, the key contrast is with ExpressRoute: VPN Gateway sends encrypted traffic over the internet, making it cheaper and faster to provision but subject to variable latency. ExpressRoute uses a private, dedicated circuit that bypasses the internet, offering predictable performance and higher reliability for throughput-sensitive or regulatory scenarios.
A private, dedicated connection between on-premises and Azure that bypasses the public internet.
ExpressRoute establishes a private, dedicated circuit between an on-premises network and Microsoft’s cloud through a connectivity provider, so traffic never traverses the public internet. This delivers more predictable latency, higher bandwidth options, and greater isolation than any internet-based connection, making it the preferred choice for regulated industries or workloads with strict performance requirements. The key exam distinction is ExpressRoute versus VPN Gateway: both connect on-premises to Azure, but VPN Gateway encrypts traffic over the public internet while ExpressRoute uses a private, provider-managed circuit. ExpressRoute also reaches Microsoft 365 and other Microsoft cloud services, not just Azure.
Object storage for unstructured data such as images, video, backups, and logs.
Azure Blob Storage is the platform’s object storage service, designed for unstructured data such as images, videos, log files, backups, and static website assets. It lives inside a Storage Account and organizes data into containers, each holding an unlimited number of blobs. Because it exposes an HTTP/HTTPS endpoint, it integrates naturally with applications, CDNs, and Azure Data Lake Storage Gen2 (Blob Storage with hierarchical namespace enabled). Blob Storage is not for structured relational data or for files mounted as a drive—Azure Files handles SMB/NFS file shares. The hot, cool, and archive access tiers tune cost to access frequency, but archive blobs must be rehydrated before reading.
A container that groups Azure Storage services — blobs, files, queues, and tables — under one namespace.
An Azure Storage account is the top-level resource grouping four storage services — Blob Storage, Azure Files, Queue Storage, and Table Storage — under a single unique namespace. Every piece of data in Azure Storage must live inside an account, and settings such as access tier and network rules apply across its services. A common exam trap is treating Blob Storage and a storage account as the same thing; they are not — the account holds Blob Storage among others. Redundancy options like LRS, ZRS, and GRS are set at the account level, a key choice for durability and availability.
A fully managed relational database service (PaaS) based on the SQL Server engine.
Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles the virtual machines, OS, patching, automated backups, and built-in high availability, so you focus on schema and queries instead of infrastructure. For AZ-900, place it against Azure SQL Managed Instance (near-full SQL Server compatibility for lift-and-shift) and SQL Server on Azure VMs (IaaS). SQL Database is the most abstracted option and omits some features. For a greenfield cloud app with no legacy compatibility needs, choose Azure SQL Database.