Domain 1 of the AZ-900, Describe cloud concepts, is worth 25–30% of your score — the second-largest slice of the exam — and it is the one domain that trips up experienced engineers as often as beginners. The reason is subtle: this material is cloud-vendor-neutral. It is not “how Azure works.” It is “what cloud computing is,” and the exam tests whether you can take a plain-English business scenario and map it to the right concept. A question like “A retailer wants to avoid buying servers for a one-week holiday traffic spike and pay only for what they use — which benefit is this?” has nothing to do with knowing an Azure service name and everything to do with knowing the difference between scalability and elasticity.
This guide walks the whole Domain 1 story the way the AZ-900 frames it: the shared responsibility model, the three cloud service models (IaaS, PaaS, SaaS), the three deployment models (public, private, hybrid), the money concepts (CapEx vs OpEx and consumption-based pricing), and the cloud benefits the exam name-drops. Everything is fundamentals-level — what each concept means and when it applies, not how to configure anything. By the end you’ll have the mental model the rest of the exam sits on, plus a set of scenario cues that make the concept-matching automatic.
The Shared Responsibility Model: The Concept the Exam Builds On
Every AZ-900 conversation about cloud starts here, because the shared responsibility model reframes what “using the cloud” actually means. On-premises, you own everything: the building, the power, the network cables, the servers, the operating systems, the applications, and the data. In the cloud, that stack is split. Microsoft takes responsibility for the parts it can secure better at scale, and you keep responsibility for the parts only you can control.
The exam wants you to internalize three tiers:
- Always Microsoft’s responsibility, no matter which service you use: the physical layer — datacenters, physical hosts, and the physical network. You will never patch a hypervisor host or replace a failed disk in an Azure datacenter.
- Always your responsibility, no matter which service you use: your data, the devices (phones, laptops) that connect, and your accounts and identities. Microsoft cannot decide who in your company should have access — that is inherently your call.
- It depends on the service model for everything in between: the operating system, network controls, applications, and identity infrastructure shift between you and Microsoft depending on whether you’re using IaaS, PaaS, or SaaS.
Here is the mental table the exam rewards you for being able to draw:
| Responsibility | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Data & information | You | You | You | You |
| Accounts & identities | You | You | You | You |
| Devices (endpoints) | You | You | You | You |
| Applications | You | You | Shared | Microsoft |
| Operating system | You | You | Microsoft | Microsoft |
| Network controls | You | Shared | Microsoft | Microsoft |
| Physical hosts | You | Microsoft | Microsoft | Microsoft |
| Physical network | You | Microsoft | Microsoft | Microsoft |
| Physical datacenter | You | Microsoft | Microsoft | Microsoft |
Notice the pattern: the higher up the service model you move (IaaS → PaaS → SaaS), the more Microsoft takes on and the less you manage. The three rows at the very top — data, identities, devices — never leave your column. That single fact answers a large family of exam questions. When you see “In a SaaS model, who is responsible for protecting the data stored in the service?” the answer is you, always, and the shared responsibility model is why.
Exam cue: If a question mentions physical security, datacenter, or hardware, the answer is Microsoft. If it mentions data, user accounts, access, or the devices people use, the answer is you. If it says operating system patching, ask which service model — IaaS means you, PaaS/SaaS means Microsoft.
Cloud Service Models: IaaS vs PaaS vs SaaS
The service models describe how much of the stack the provider manages for you. The classic analogy is pizza: making it at home (on-premises) versus takeaway, delivery, and dining out — each step hands off more work. On the exam, you match a scenario to the model that gives the right balance of control versus convenience.
Infrastructure as a Service (IaaS)
IaaS gives you the raw building blocks — virtual machines, virtual networks, and storage — and leaves the operating system and everything above it to you. It is the model closest to running your own datacenter, minus the physical hardware. You choose the VM size, install and patch the OS, configure the network, and deploy your application.
- Azure examples: Azure Virtual Machines, Virtual Machine Scale Sets, Azure Virtual Network, managed disks.
- Use it when: you need maximum control, you’re lifting-and-shifting an existing server-based application, or you have specific OS-level requirements.
- You manage: OS, runtime, application, data. Microsoft manages: virtualization, physical hardware, datacenter.
Platform as a Service (PaaS)
PaaS removes the operating system and runtime from your plate. You bring your application code and data; Microsoft provides and maintains a managed platform to run it on — no OS patching, no server maintenance. This is the sweet spot for developers who want to ship features instead of babysitting servers.
- Azure examples: Azure App Service, Azure Functions, Azure SQL Database, Azure Container Apps.
- Use it when: you want to deploy an app or database quickly without managing infrastructure, and you’re comfortable working within the platform’s supported runtimes.
- You manage: application, data, and configuration. Microsoft manages: OS, runtime, scaling infrastructure, physical layer.
Software as a Service (SaaS)
SaaS is a finished product you consume over the internet. You don’t manage code, runtime, or servers — you sign in and use it. Your only responsibilities are your data, your accounts, and access control.
- Azure/Microsoft examples: Microsoft 365, Dynamics 365, Microsoft Teams.
- Use it when: a ready-made application already solves your problem and you don’t need to build or customize infrastructure.
- You manage: data and identity/access. Microsoft manages: essentially everything else.
| Dimension | IaaS | PaaS | SaaS |
|---|---|---|---|
| You manage | OS + up | App + data | Data + access |
| Control | Highest | Medium | Lowest |
| Maintenance burden | Highest | Medium | Lowest |
| Azure example | Virtual Machines | App Service | Microsoft 365 |
| Typical user | Infra/ops teams | Developers | End users |
Exam cue: “Full control over the OS” → IaaS. “Deploy code without managing servers/OS” → PaaS. “Use a ready-made application, no deployment” → SaaS.
Cloud Deployment Models: Public, Private, Hybrid
Where the service models describe how much the provider manages, the deployment models describe where the infrastructure lives and who has access to it.
- Public cloud — resources are owned and operated by a third-party provider (like Microsoft) and delivered over the internet. You have no capital expense, you pay for what you use, and you share the underlying physical infrastructure (securely isolated) with other tenants. This is what most people mean by “the cloud.” Azure itself is a public cloud.
- Private cloud — cloud infrastructure used exclusively by a single organization. It can live in your own datacenter or be hosted for you, but it is not shared with other tenants. It offers the most control and can help with strict regulatory or data-residency requirements, but you carry more of the cost and management.
- Hybrid cloud — a combination of public and private that lets workloads move between them. You might keep a sensitive database on-premises (private) while running a public-facing web tier in Azure (public), connected together. Hybrid gives flexibility: keep what must stay on-premises where it is, and burst or extend into the public cloud for everything else.
You’ll occasionally see multi-cloud (using more than one public cloud provider) mentioned as a concept, but the AZ-900 focuses on public, private, and hybrid.
| Model | Who uses it | Control | Cost model | Example scenario |
|---|---|---|---|---|
| Public | Shared, multi-tenant | Lower | Pay-as-you-go | A startup running everything in Azure |
| Private | Single organization | Highest | Mostly CapEx | A bank with strict data-residency rules |
| Hybrid | Mix of both | Flexible | Mixed | On-prem database + Azure web front end |
Exam cue: “Must keep some data on-premises for compliance but use the cloud for the rest” → hybrid. “Dedicated to one organization, not shared” → private. “Delivered over the internet, pay for what you use, shared infrastructure” → public.
The Money Concepts: CapEx, OpEx & Consumption-Based Pricing
A meaningful chunk of Domain 1 is about how cloud changes the economics of IT, and the exam expects you to speak the finance vocabulary at a basic level.
- Capital Expenditure (CapEx) is money spent up front on physical assets you own — buying servers, storage arrays, and networking gear for a datacenter. It’s a large one-time outlay that then depreciates over years. This is the traditional on-premises model.
- Operational Expenditure (OpEx) is money spent on services you consume as an ongoing cost — like a monthly Azure bill. There’s no big upfront purchase; you expense it as you go. The cloud shifts IT spending from CapEx to OpEx.
- Consumption-based pricing is the pricing mechanism that makes OpEx work in the cloud: you pay only for the resources you actually use, and only while you use them. Turn off a virtual machine and you stop paying for its compute. This eliminates waste from over-provisioning and removes the guesswork of buying capacity years in advance.
Closely related is economies of scale — because a provider like Microsoft buys hardware and power at enormous volume, it can offer resources more cheaply than any single organization could achieve alone, and it passes some of that saving on to customers.
Exam cue: “Minimize upfront hardware spend / no large capital purchase / pay only for what you use” → the answer is OpEx and/or consumption-based pricing. “Buying and owning servers for a datacenter” → CapEx.
The Cloud Benefits the Exam Name-Drops
Domain 1 lists a set of benefits and expects you to distinguish between them — especially the pairs that sound similar. These come up constantly as one-line scenario questions.
| Benefit | What it means | Scenario cue |
|---|---|---|
| High availability | The service stays up and accessible despite failures, often via redundancy | ”minimize downtime,” “keep the app accessible” |
| Scalability | Add or remove capacity to meet demand (scale up/vertical or out/horizontal) | “handle growth,” “add more capacity” |
| Elasticity | Automatically add capacity when demand rises and remove it when demand falls | ”automatically,” “spike then return to normal” |
| Reliability | The system recovers from failures and keeps working correctly | ”recover from failure,” “dependable” |
| Predictability | Predictable performance and cost as you scale | ”forecast cost,” “consistent performance” |
| Agility | Deploy and change resources quickly to respond to business needs | ”quickly,” “respond to the market” |
| Disaster recovery | Restore service and data after a major outage or regional failure | ”recover after an outage/disaster” |
| Security & governance | Built-in tools to protect resources and enforce standards | ”meet compliance,” “enforce policies” |
The two the exam loves to contrast are scalability and elasticity. Scalability is the ability to change capacity; elasticity is doing so automatically in response to demand. If a question emphasizes the word automatically or describes capacity that grows during a spike and shrinks again afterward, the answer is elasticity. If it just says “we need to be able to add capacity as we grow,” that’s scalability.
Likewise, don’t confuse high availability (staying up despite component failures, day to day) with disaster recovery (getting back up after a large-scale outage). Availability is about avoiding downtime; disaster recovery is about recovering from a serious event.
Putting It Together: A Scenario Walk-Through
Consider a question in the AZ-900’s favorite style:
A company runs an e-commerce site that sees traffic surge 10x during seasonal sales and drop back afterward. They want to avoid paying for idle capacity during quiet periods and don’t want to buy hardware for the peak. They also want their development team to deploy the web application without managing operating systems. Which concepts apply?
Break it into its cues:
- “Surge then drop back… avoid paying for idle capacity” → elasticity and consumption-based pricing.
- “Don’t want to buy hardware for the peak” → shift from CapEx to OpEx, enabled by the public cloud.
- “Deploy the web application without managing operating systems” → PaaS.
One scenario, four Domain 1 concepts. That is exactly how the exam bundles them — and why building the mental model matters more than memorizing definitions in isolation.
How to Study Domain 1 Efficiently
Domain 1 is the cheapest domain to master because there are no services to memorize — just concepts and the language that signals them. A high-yield approach:
- Learn the shared responsibility table cold. Be able to say, for any layer and any service model, who owns it.
- Drill the confusable pairs: scalability vs elasticity, high availability vs disaster recovery, CapEx vs OpEx, public vs private vs hybrid.
- Practice with scenario questions, not flashcards. The skill being tested is translation — business language into cloud concept. Reading a definition ten times doesn’t build that; answering scenario questions does.
That last point is where timed practice pays off. Sailor.sh’s AZ-900: Azure Fundamentals Mock Exam Bundle gives you full-length mock exams that mirror the real exam’s format, passing bar, and scenario style, with a detailed explanation on every question — so a cloud-concepts question you miss becomes a lesson that sticks. Use the free material here to build the model; use the mocks to make the scenario-to-concept mapping reflexive under time pressure.
Frequently Asked Questions
Is Domain 1 the hardest part of the AZ-900?
It’s not the hardest, but it’s the most deceptively easy. The concepts are simple to read and easy to confuse under exam pressure — especially scalability vs elasticity and high availability vs disaster recovery. Treat it as a scoring opportunity: master it and you bank 25–30% of the exam with pure conceptual understanding.
Do I need to know the exact percentages Microsoft manages in each service model?
No. You need the direction — that moving from IaaS to PaaS to SaaS hands more responsibility to Microsoft — and you need to know which three things (data, identities, devices) are always yours. There’s no math to memorize.
What’s the difference between scalability and elasticity again?
Scalability is the capacity to grow or shrink your resources. Elasticity is doing that automatically in response to real-time demand. All elastic systems are scalable, but not everything scalable is elastic. Watch for the word “automatically” in the question stem.
Is Azure a public, private, or hybrid cloud?
Azure is a public cloud platform. It can participate in hybrid and even private-cloud scenarios (for example, extending Azure services to on-premises environments), but on its own, Azure is the textbook example of public cloud.
How does Domain 1 connect to the rest of the exam?
It’s the foundation. The shared responsibility model reappears when you study identity and governance; the service models frame every compute and database service; and the cost concepts underpin the management-and-governance domain. Nail Domain 1 first and the rest of the syllabus has somewhere to attach.
Conclusion & Next Steps
Domain 1 rewards understanding a small set of concepts and the language that points to each one. Get the shared responsibility model into muscle memory, keep the confusable pairs straight, and read every scenario for its cue words — that’s the entire skill the AZ-900 is testing here.
From here, build outward into the rest of the blueprint. Pair this with the sibling guides on Azure Compute for AZ-900, Azure Storage for AZ-900, and Azure Identity, Access & Security for AZ-900. Start with the AZ-900 exam guide for 2026 for logistics and the full blueprint, schedule your prep with the 30-day AZ-900 study plan, and pressure-test yourself with AZ-900 practice questions. If you’re weighing Azure’s fundamentals against the AWS equivalent, AZ-900 vs AWS Cloud Practitioner lays out how the two compare, and if you’re still deciding whether to sit the exam at all, read is the AZ-900 worth it in 2026.