Hardest Topics on AZ-900 in 2026 — And How to Tackle Them

Direct answer

The hardest AZ-900 topics consistently trip up candidates because they require understanding Azure’s specific implementation, not just general cloud concepts. Azure Resource Manager (ARM) hierarchies, cost optimization decisions, and Azure’s identity models cause the most failures. These topics appear in 60-70% of exam questions but get oversimplified in most study materials.

If you fail AZ-900, Microsoft allows unlimited retakes with a 24-hour waiting period between attempts. The retake fee is $99 USD (same as the original exam). Most candidates who fail struggle with scenario-based questions that test practical Azure decision-making, not memorized definitions.

Why some AZ-900 topics are harder than they look

AZ-900 candidates often approach this as a “memorize cloud definitions” exam. That’s wrong. Microsoft designs AZ-900 questions around business scenarios where you must choose the right Azure service or approach. The exam tests your ability to think like someone making Azure purchasing and architecture decisions.

The hardest topics share three characteristics:

Multiple correct answers exist — but only one fits the specific business constraint mentioned in the question. Azure Active Directory, Resource Manager hierarchies, and cost management all have this trap.

Microsoft’s terminology differs from industry standard — Azure uses specific terms that sound similar to generic cloud concepts but work differently. “Resource Groups” aren’t just containers. “Management Groups” aren’t just folders.

Real-world complexity gets compressed into simple scenarios — The exam presents enterprise-level decisions in 2-3 sentence questions. You need to understand the underlying business logic, not just the technical features.

Hard Topic 1: Azure Resource Manager (ARM) hierarchy and scope

ARM hierarchy is the single hardest AZ-900 topic because candidates think it’s simple organization, but it’s actually about permissions, billing, and governance scope. This appears in 15-20% of all AZ-900 questions across multiple domains.

Why it’s hard specifically on AZ-900: Unlike AWS or GCP, Azure’s hierarchy directly impacts billing, access control, and policy enforcement. The exam tests your understanding of what happens when you apply policies or permissions at different levels — not just what the levels are called.

How it appears in AZ-900 exam questions: “A company needs to ensure development teams cannot create virtual machines larger than Standard_B2s across all development subscriptions, but production teams need no restrictions. What should be implemented?” The answer requires understanding that Azure Policy applies at Management Group level, and subscription-level assignments would require multiple configurations.

Most common trap: Candidates memorize the hierarchy (Management Group > Subscription > Resource Group > Resource) but don’t understand inheritance rules. They think Resource Groups contain permissions, when permissions flow down from higher levels.

Specific study approach: Practice with the Azure portal’s IAM section. Create a free Azure account and examine how role assignments work at different levels. Focus on understanding when policies apply automatically versus when they need explicit configuration. Don’t just read about hierarchy — see how it behaves.

Hard Topic 2: Azure cost optimization and billing models

Azure’s pricing models confuse candidates because they’re not intuitive. Reserved instances, spot pricing, and hybrid benefits require understanding business scenarios, not just price comparisons. This topic appears in 20-25% of questions, especially in governance scenarios.

Why it’s hard specifically on AZ-900: Azure offers 5+ different ways to pay for the same virtual machine. The exam tests which payment model fits specific business constraints (budget predictability, workload patterns, existing licenses). Generic “cheaper is better” thinking fails here.

How it appears in AZ-900 exam questions: “A company runs batch processing jobs for 6 hours every Sunday night and needs to minimize costs. The jobs can be interrupted and restarted. What virtual machine option provides the lowest cost?” The answer is Spot VMs, but candidates often choose Reserved Instances because they think “batch processing” means “predictable workload.”

Most common trap: Candidates assume Reserved Instances are always cheapest for predictable workloads. They miss that Spot VMs can be 90% cheaper for interruptible workloads, even if they run predictably. They also confuse Azure Hybrid Benefit (bring existing Windows licenses) with Reserved Instance discounts.

Specific study approach: Use Azure’s pricing calculator for real scenarios. Price out the same workload using pay-as-you-go, 1-year reserved, 3-year reserved, and spot pricing. Understand when Azure Hybrid Benefit applies versus when it doesn’t. Focus on interruption tolerance as the key decision factor for spot pricing.

Hard Topic 3: Azure Active Directory (Azure AD) vs traditional Active Directory

Azure AD identity concepts fail candidates because they assume it works like traditional Active Directory. The differences in authentication, federation, and hybrid scenarios create the most confusion. This appears in 10-15% of questions but has high failure rates.

Why it’s hard specifically on AZ-900: Azure AD isn’t “Active Directory in the cloud” — it’s a completely different identity system. The exam tests scenarios where companies need both systems, how they connect, and which handles what authentication tasks. Candidates who know traditional AD often get these wrong.

How it appears in AZ-900 exam questions: “A company wants employees to use their corporate credentials to access both on-premises applications and Office 365. What should be implemented?” The answer involves Azure AD Connect for hybrid identity, but candidates often choose “migrate everything to Azure AD” because they think cloud-first is always correct.

Most common trap: Thinking Azure AD replaces traditional AD completely. In hybrid scenarios, both systems run simultaneously with specific roles. Candidates also confuse authentication (proving identity) with authorization (granting access) in Azure AD scenarios.

Specific study approach: Understand the three identity scenarios: cloud-only, hybrid, and on-premises-only. Focus on what Azure AD Connect actually does (syncs identities, enables single sign-on) versus what it doesn’t do (doesn’t migrate group policies, doesn’t replace domain controllers). Practice identifying when companies need hybrid versus cloud-only identity.

Hard Topic 4: Azure service categories and appropriate use cases

Choosing the right Azure service for specific scenarios requires understanding subtle differences between similar services. Platform-as-a-Service versus Software-as-a-Service decisions, and compute service selection, trip up most candidates.

Why it’s hard specifically on AZ-900: Azure offers 200+ services with overlapping capabilities. The exam tests your ability to choose the most appropriate service based on specific business constraints — not just technical requirements. App Service versus Azure Functions versus Virtual Machines all run applications, but each fits different scenarios.

How it appears in AZ-900 exam questions: “A company needs to host a web application that scales automatically based on demand and requires minimal administrative overhead. The application processes user uploads every few minutes. What should be used?” Candidates often choose Azure Functions because “automatic scaling” sounds like serverless, but App Service with autoscaling is correct because the workload is continuous web hosting, not event-driven processing.

Most common trap: Choosing services based on buzzwords rather than workload patterns. “Serverless,” “container,” and “microservices” in questions don’t automatically mean specific Azure services. The business scenario determines the right service.

Specific study approach: Create a decision tree for compute services based on workload characteristics: always-on versus event-driven, code-only versus full applications, Windows versus Linux requirements. Practice identifying the primary workload pattern in scenario questions before looking at service options.

Hard Topic 5: Azure governance tools and when to use each

Azure’s governance tools (Policy, Blueprints, Resource Locks, RBAC) overlap in functionality, creating confusion about which tool addresses specific compliance scenarios. This appears across all exam domains but especially in management and governance questions.

Why it’s hard specifically on AZ-900: Each governance tool has a specific purpose, but they can appear to do similar things. Azure Policy enforces rules, RBAC controls access, Resource Locks prevent deletion, and Blueprints deploy standard configurations. The exam tests which tool solves specific governance problems most effectively.

How it appears in AZ-900 exam questions: “A company must prevent anyone from deleting production storage accounts, but authorized users should be able to modify storage account settings. What should be implemented?” The answer is Resource Locks (specifically ReadOnly or CanNotDelete locks), but candidates often choose RBAC restrictions because they focus on “authorized users” rather than “prevent deletion.”

Most common trap: Trying to solve all governance problems with RBAC. Candidates think role-based access control handles all compliance scenarios, missing that some requirements need proactive enforcement (Policy) or deletion protection (Resource Locks) rather than permission management.

Specific study approach: Map each governance tool to its primary purpose: RBAC for “who can do what,” Policy for “what configurations are allowed,” Resource Locks for “what cannot be changed/deleted,” and Blueprints for “standardized deployments.” Practice identifying the core problem in governance scenarios before selecting tools.

Hard Topic 6: Azure support plans and SLA calculations

Azure support plans and Service Level Agreements (SLAs) trip candidates because they involve business mathematics, not just technical features. Understanding composite SLAs and support plan limitations requires careful reading of scenario constraints.

Why it’s hard specifically on AZ-900: Azure’s SLA calculations compound across services, creating lower availability than individual service SLAs suggest. Support plans have specific limitations on who can contact support and for what issues. The exam tests practical business decisions about acceptable downtime and support requirements.

How it appears in AZ-900 exam questions: “An application uses Azure App Service (99.95% SLA) and Azure SQL Database (99.99% SLA). What is the composite SLA for the application?” The answer is 99.94% (0.9995 × 0.9999), but candidates often choose the lower individual SLA (99.95%) because they don’t understand SLA multiplication.

Most common trap: Adding SLAs together instead of multiplying them, or assuming the composite SLA equals the lowest individual SLA. For support plans, candidates assume Developer plan provides 24/7 support for all issues, when it only covers billing and subscription support during business hours.

Specific study approach: Practice SLA calculations with real scenarios. Understand that composite availability = SLA₁ × SLA₂ × SLA₃. For support plans, memorize what each plan covers and response time guarantees. Focus on the business impact of different SLA levels rather than just the percentage numbers.

How AZ-900 turns hard topics into scenario questions

Microsoft wraps technical concepts in business scenarios to test practical decision-making, not memorization. Understanding this question pattern helps with all hard topics.

Every AZ-900 scenario question follows this structure:

1. Business context — company size, industry, current situation
2. Technical requirement — what needs to be accomplished
3. Business constraint — budget, timeline, compliance, or operational limitation
4. Question — which Azure service/approach meets all requirements

The constraint trap: How AZ-900 makes easy topics difficult

AZ-900’s hardest questions aren’t about obscure Azure features — they’re about identifying the real business constraint hidden in scenario questions. Microsoft embeds multiple constraints in each question, but only one determines the correct answer.

The pattern every hard question follows: A scenario describes a company needing Azure services, lists several requirements, then asks which solution to choose. The trap is focusing on the obvious technical requirement while missing the critical business constraint.

Example constraint hierarchy from actual AZ-900 patterns:

1. Compliance requirements override cost considerations
2. Existing investments (licenses, skills, infrastructure) override “best practice” solutions
3. Operational constraints (maintenance windows, staffing) override pure technical capabilities
4. Timeline constraints override feature completeness
5. Budget limits override performance optimization

How to identify the real constraint: Read scenario questions twice. First time, identify what the company wants to accomplish. Second time, identify what prevents them from using the “obvious” solution. The preventing factor is usually the constraint that determines the correct answer.

Practice realistic AZ-900 scenario questions on Certsqill — with detailed explanations that show exactly why each answer is right or wrong.

Most common constraint mistakes:

• Choosing Azure Functions for any “automatic scaling” requirement, ignoring that the workload might be continuous rather than event-driven
• Selecting Premium support plans for any “critical application” scenario, missing that the question asks about development environments
• Recommending full cloud migration when hybrid solutions better fit existing infrastructure investments

AZ-900’s business-focused question style

Unlike technical certification exams that test implementation details, AZ-900 tests business decision-making with Azure services. This makes it harder for technical professionals who think primarily about features rather than business fit.

Why business focus makes questions harder: Technical people often choose solutions based on capabilities rather than constraints. AZ-900 scenarios typically have multiple technically correct solutions, but only one fits the business context described.

The business decision framework AZ-900 tests:

1. What business problem needs solving? (not what technical requirement needs meeting)
2. What organizational constraints limit solution options? (budget, timeline, compliance, existing investments)
3. What operational model fits the organization? (self-managed, fully managed, hybrid)
4. How does this decision impact other business areas? (security, compliance, other teams)

Example of business versus technical thinking: A company needs to run a web application with predictable traffic patterns. Technical thinking focuses on compute options (Virtual Machines vs App Service vs Container Instances). Business thinking first asks: Does the company have existing Windows Server licenses? Do they have in-house VM management expertise? What’s their tolerance for maintenance overhead? These business factors determine whether Azure Hybrid Benefit with VMs or fully managed App Service makes more sense.

How to develop business thinking for AZ-900: Before studying Azure services, understand why companies choose specific cloud approaches. Read Microsoft’s customer case studies to see how business constraints influenced technical decisions. Focus on the “why this solution” rather than “how this solution works.”

Study strategies that actually work for hard AZ-900 topics

Most AZ-900 study approaches fail because they treat it like a technical exam requiring feature memorization. The hard topics require understanding business scenarios and decision-making frameworks.

Effective study approach for hard topics:

1. Scenario-based practice over feature lists Instead of memorizing that Azure Functions supports multiple programming languages, practice scenarios where serverless makes sense versus where it doesn’t. Work through questions that compare Azure Functions, Logic Apps, and App Service for different workload patterns.

2. Cost calculation practice with real numbers Use Azure’s pricing calculator to compare actual costs for different scenarios. Practice calculating composite SLAs with multiplication (not addition). Understand when Reserved Instance savings offset the upfront commitment versus when pay-as-you-go flexibility matters more.

3. Hands-on experimentation with free Azure account Create resources in different hierarchies to see how permissions and policies inherit. Try setting up Azure AD Connect in a test environment to understand hybrid identity scenarios. Experience the governance tools rather than just reading about them.

4. Business constraint identification drills Practice reading AZ-900 scenario questions specifically to identify constraints. Create a checklist: budget limitations, compliance requirements, existing investments, operational preferences, timeline pressures. Train yourself to spot these before looking at answer choices.

5. Decision tree creation for overlapping services Build flowcharts for choosing between similar services. For compute: Is it event-driven? → Functions. Continuous web app? → App Service. Need OS control? → Virtual Machines. For storage: Structured data? → SQL Database. File shares? → Azure Files. Backup/archive? → Blob Storage.

The most effective practice method: Take practice exams that explain why wrong answers are wrong, not just why right answers are correct. Understanding why “Azure Functions” is wrong for a continuous web application scenario teaches more than knowing “App Service” is correct.

Common study mistakes that guarantee failure:

• Using brain dumps or memorizing specific questions (Microsoft regularly updates question pools)
• Focusing only on Azure service features without understanding business use cases
• Skipping hands-on practice because “it’s just a fundamentals exam”
• Studying generic cloud concepts instead of Azure-specific implementations

Frequently Asked Questions

Q: How many questions on AZ-900 come from these hard topics? A: These six hard topic areas appear in roughly 65-70% of AZ-900 questions. ARM hierarchy questions appear in 15-20% of exams. Cost optimization scenarios show up in 20-25% of questions. Azure AD versus traditional AD concepts appear in 10-15% of questions. Service selection scenarios are in nearly every domain. The governance and support topics appear in 10-15% of questions each, but have high failure rates when they appear.

Q: Can I pass AZ-900 by just memorizing Azure service definitions? A: No. Microsoft specifically designs AZ-900 questions around business scenarios that require choosing the right service for specific constraints. Memorizing that “Azure Functions is serverless compute” won’t help you determine when Functions is wrong for a scenario requiring continuous processing. You need to understand when and why to use each service, not just what each service does.

Q: What’s the difference between failing because of hard topics versus failing because of poor preparation? A: Hard topic failures show up as wrong answers on scenario questions where you understood the technical requirement but missed the business constraint. Poor preparation failures show up as wrong answers on definitional questions about what services do. If you’re getting questions wrong about basic service categories or obvious cost comparisons, you need more fundamental preparation. If you’re missing complex scenarios involving governance, identity, or service selection, you’re hitting the genuinely hard topics.

Q: Should I skip hands-on practice for AZ-900 since it’s a fundamentals exam? A: Absolutely not. The hardest AZ-900 topics require understanding how Azure works in practice, not just in theory. You can’t understand ARM hierarchy inheritance without seeing how policies and permissions flow down levels. You can’t grasp cost optimization without using the pricing calculator for real scenarios. Azure offers free accounts specifically for this learning. Candidates who skip hands-on practice consistently struggle with scenario questions.

Q: How do I know if I’m ready for the hard AZ-900 topics versus needing more basic preparation? A: Take a practice exam that covers all domains. If you’re scoring 60-70% with wrong answers mostly on complex scenarios involving multiple services or business constraints, you’re ready to focus on hard topics. If you’re scoring below 60% with wrong answers on service definitions or basic cloud concepts, spend more time on fundamentals before tackling the advanced scenario-based topics.

Related Articles

• I Failed Microsoft Azure Fundamentals (AZ-900): What Should I Do Next?
• Can You Retake AZ-900 After Failing? Retake Rules Explained (2026)
• AZ-900 Score Report Explained: What Your Result Really Means
• How to Study After Failing AZ-900: Your Recovery Plan for the Retake
• Why Do People Fail AZ-900? 7 Common Mistakes to Avoid