A platform that collects, analyzes, and acts on telemetry from Azure and on-premises resources.
Azure Monitor is the unified observability platform that ingests metrics (numerical time-series data) and logs (structured records) from Azure resources, on-premises systems, and other clouds. It stores logs in a Log Analytics workspace, where Kusto Query Language (KQL) queries power dashboards, workbooks, and alert rules; metric alerts fire near-real-time while log alerts run on scheduled queries. The exam distinction is that Azure Monitor is the umbrella service, with Log Analytics, Application Insights, VM Insights, and the Alerts engine as components within it. Azure Service Health, by contrast, reports Microsoft’s infrastructure status rather than your own resource telemetry.
A service that gives personalized alerts and guidance on Azure service issues and planned maintenance.
Azure Service Health is a dashboard in the Azure portal that delivers personalized notifications about outages, planned maintenance, and health advisories scoped to the Azure regions and services you actually use. It surfaces three feeds: Service Issues (active disruptions), Planned Maintenance (upcoming changes that may affect availability), and Health Advisories (actions you should take to avoid degradation). The key exam distinction is that Service Health reports on the health of the Azure platform itself, whereas Azure Monitor tracks the health and performance of the resources you deploy. A classic trap conflates the two: a data-center networking problem triggers Service Health, while a virtual machine’s CPU spiking is Azure Monitor territory.
A tool in Azure Monitor to query and analyze collected log and performance data.
Log Analytics is a feature within Azure Monitor that provides a centralized workspace for collecting, storing, and querying log and performance data from Azure resources, on-premises systems, and other clouds. Data is ingested into a Log Analytics workspace, where it is queried using Kusto Query Language (KQL) to surface trends, troubleshoot issues, and support alerting rules. A common AZ-900 confusion is treating Log Analytics and Azure Monitor as separate products: Log Analytics is the query and analysis engine inside Azure Monitor, not a standalone service, while the workspace is the storage and query layer the platform relies on.
Microsoft's cloud identity and access management service, formerly Azure Active Directory.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service, providing authentication, single sign-on (SSO), and authorization for Azure resources, Microsoft 365, and thousands of third-party SaaS apps. It manages users, security groups, and app registrations and enforces policies such as multi-factor authentication and conditional access. For AZ-900, remember it is not a direct replacement for on-premises Windows Server Active Directory Domain Services: it uses modern protocols like OAuth 2.0, OpenID Connect, and SAML rather than Kerberos and LDAP, and is built for cloud and web scenarios rather than domain-joined machines and Group Policy. Organizations running both typically synchronize them with Microsoft Entra Connect.
A system that grants users only the permissions they need by assigning roles to scopes.
Azure Role-Based Access Control (RBAC) enforces least privilege by assigning built-in or custom roles to security principals — users, groups, managed identities, or service principals — at a specific scope. Scopes form a hierarchy of management group, subscription, resource group, and individual resource, with permissions inherited downward. The key exam distinction is that RBAC governs who can perform actions on Azure resources, while Azure Policy governs what configurations resources may have. A user with Owner RBAC rights can still be blocked from deploying non-compliant resources by a deny-effect Policy, since the two controls operate independently and are often layered together in governance designs.
Requiring two or more verification factors to sign in, such as a password plus a phone prompt.
Multifactor Authentication (MFA) requires at least two independent verification factors before granting access — typically something you know (password), something you have (an authenticator app or hardware token), or something you are (biometric). In Azure, MFA is managed through Microsoft Entra ID, the renamed Azure AD, and can be enforced broadly or through Conditional Access policies that trigger step-up authentication only when risk signals appear. For the exam, remember that Conditional Access decides when MFA is required while MFA is the challenge mechanism itself. Enabling MFA is one of the highest-impact controls against credential-based attacks.
A cross-platform command-line tool for managing Azure resources with commands and scripts.
Azure CLI is a cross-platform command-line tool that lets administrators and developers create, configure, and manage Azure resources by running az commands in a shell or scripts. It runs on Windows, macOS, and Linux, and is also available in Azure Cloud Shell, letting teams automate repetitive tasks without the portal. The key exam distinction is between Azure CLI and Azure PowerShell: both are scripting tools that can do nearly everything the portal can, but CLI uses az commands with Bash-friendly syntax while PowerShell uses cmdlets like New-AzResourceGroup. Choosing between them comes down to preference and existing scripting skills, not capability.
A set of PowerShell cmdlets for managing Azure resources from the command line.
Azure PowerShell is a module (the Az module) that adds Azure-specific cmdlets to the PowerShell environment, letting administrators and developers create, configure, and delete Azure resources through scripted commands rather than the portal. Because it runs inside PowerShell, it fits naturally with existing Windows automation, scheduled tasks, and CI/CD pipelines. The key AZ-900 distinction is between Azure PowerShell and the Azure CLI: both accomplish nearly the same tasks, but PowerShell uses verb-noun cmdlets (for example, Get-AzVM) while the CLI uses hyphenated commands. Neither replaces Azure Resource Manager — both send requests through ARM. Azure Cloud Shell runs either tool from a browser without local installation.
A browser-based shell offering Bash and PowerShell with Azure tools pre-installed.
Azure Cloud Shell is an interactive, browser-based command-line environment offering either Bash or PowerShell, with the Azure CLI, Azure PowerShell module, and common developer tools pre-installed and kept up to date by Microsoft. Authentication is handled automatically through your Azure portal session, so there is nothing to configure locally before running commands against a subscription. The key exam distinction is persistence: Cloud Shell requires an Azure Storage account and file share to retain files between sessions, so it incurs a small storage cost even though the compute itself is free. Locally installed Azure CLI or Azure PowerShell has no such storage dependency.
A tool that strengthens security posture and protects workloads across Azure, hybrid, and multicloud.
Microsoft Defender for Cloud is a cloud-native application protection platform that continuously monitors Azure, on-premises, and multicloud environments for misconfigurations and active threats. It produces a Secure Score — a numeric measure of current security posture — and surfaces prioritized recommendations to close gaps, making it the primary tool for gauging how hardened an Azure environment is. A common exam confusion is treating it as a SIEM or log-analytics tool; that role belongs to Microsoft Sentinel. Defender for Cloud focuses on posture management and workload protection (servers, containers, databases), while Sentinel handles threat detection and incident response across collected log data.