A set of datacenters deployed within a defined geographic area and connected by a low-latency network.
An Azure region is a geographic area containing one or more datacenters networked together with a low-latency connection. When deploying a resource, you choose a region, and that choice governs where data physically resides — critical for compliance with regulations like GDPR. For the exam, distinguish a region from an Availability Zone and a Region Pair. Availability Zones are physically separate datacenters within a single region, giving intra-region fault isolation. Region Pairs are two regions within the same geography that Microsoft designates for cross-region replication and prioritized recovery during outages. Not all regions support Availability Zones — a common exam trap.
A physically separate datacenter within a region, with independent power, cooling, and networking.
An Availability Zone is a physically separate datacenter within an Azure region, with its own independent power, cooling, and network infrastructure. Each region that supports zones contains at least three of them, and Azure services built for high availability replicate data and compute across these zones. The key exam distinction is from Availability Sets: zones protect against an entire datacenter failure within a region, whereas Availability Sets only spread VMs across fault and update domains inside a single datacenter. “Zone-redundant” services spread automatically; “zonal” services are pinned to one chosen zone.
Two Azure regions paired at least 300 miles apart for replication and disaster recovery.
An Azure region pair is two regions within the same geography that Microsoft designates as each other’s recovery partner, typically separated by at least 300 miles. Platform updates roll out to only one region in a pair at a time, and during a broad outage Microsoft prioritizes restoring at least one region in every pair. Region pairs differ from Availability Zones, which protect against failures inside a single region using physically separate datacenters. Because a pair stays within one geopolitical boundary, data residency is preserved for compliance.
A logical container that holds related Azure resources for a solution.
A resource group is a logical container within an Azure subscription that holds related resources for one solution, such as virtual machines, storage accounts, and networks. Resources in a group typically share a lifecycle, so deploying them together is easy, and deleting the group removes them all. The key exam distinction is that a resource group is a management boundary, not a billing or security boundary. Role-Based Access Control (RBAC) permissions assigned at the group level are inherited by its resources. Resource groups do not enforce spending limits; cost is tracked by subscription or tag.
A logical unit of Azure services linked to an account, used for billing and access boundaries.
An Azure subscription is a logical container that groups Azure resources together for billing and access-control purposes. Every resource — a virtual machine, a storage account, a database — belongs to exactly one subscription, and all charges for those resources roll up to that subscription’s invoice. Each subscription also trusts exactly one Microsoft Entra ID tenant for authenticating users. The exam tests the distinction from resource groups, which organize resources for lifecycle management within a subscription but create no separate billing boundary. Management groups sit one level above subscriptions, letting organizations govern multiple subscriptions together.
A container above subscriptions used to apply governance and policy across many subscriptions at once.
Management groups are containers that sit above subscriptions in the Azure hierarchy, letting organizations manage governance at scale. When Azure Policy or role-based access control (RBAC) is applied to a management group, every subscription and resource beneath it inherits those settings automatically, avoiding per-subscription configuration. The key exam distinction is from resource groups: resource groups hold resources within a single subscription, while management groups span multiple subscriptions. Management groups can be nested, and a single root management group exists at the top of each Microsoft Entra ID tenant.
The deployment and management layer (ARM) that creates, updates, and deletes Azure resources.
Azure Resource Manager (ARM) is the unified control plane between every client and the Azure platform — the Azure portal, Azure CLI, Azure PowerShell, and REST API all translate their requests into ARM calls before anything is provisioned or changed. This means access control, audit logs, and policy enforcement happen consistently in one place, regardless of how a resource is managed. ARM templates (JSON files) and the newer Bicep language let teams declare the desired state of infrastructure, enabling repeatable, version-controlled deployments. A key exam distinction: ARM is the management layer, while a resource group is simply a logical container that ARM operates on.
A grouping of VMs across fault and update domains within a datacenter to improve uptime.
An availability set groups virtual machines within a single datacenter across two dimensions: fault domains (separate physical racks with independent power and networking, so a hardware failure affects only one group) and update domains (staggered sets that Azure reboots one at a time during planned maintenance, keeping the others running). Together they protect against both unplanned hardware outages and planned maintenance. The exam often tests sets versus availability zones: sets guard against failures inside one datacenter, while zones spread VMs across physically separate facilities within a region. For a datacenter-level outage, zones are the right answer, not sets.
A discrete market, often a country, containing one or more regions for data residency and compliance.
An Azure geography is a discrete market, typically aligned to a country or group of countries, that groups one or more Azure regions under a shared data-residency and compliance boundary. Organizations under strict regulatory frameworks — such as GDPR or national data-sovereignty laws — choose resources within a geography to keep data inside sovereign borders. The key exam nuance is that a geography is not the same as a region or a region pair. A geography contains multiple regions, and those regions are typically paired within the same geography for disaster-recovery replication, so failover stays inside the compliance boundary rather than crossing it.
The web-based graphical interface for managing Azure resources.
The Azure Portal is a browser-based console at portal.azure.com that provides a graphical interface for creating, configuring, and monitoring Azure resources. It presents each resource’s settings through context-sensitive blades (panels) and supports customizable dashboards so teams can surface the metrics most relevant to their work. For AZ-900, the key distinction is that the Portal is the visual, point-and-click tool, while Azure CLI and Azure PowerShell perform the same tasks through commands and Cloud Shell brings both into the browser. The Portal suits one-off tasks and exploration; repetitive or automated work favors the command-line tools.