So here we are again - another certification in the books. Fresh off my Security+ win, I decided to dip my toes into the cloud waters with Microsoft's AZ-900. It felt more like a vocabulary quiz than anything else, but hey, a pass is a pass.
As someone coming from digital forensics, I'm seeing more and more cases involving cloud infrastructure. Figured it was time to understand what all the Azure buzz was about beyond just "it's Microsoft's cloud thing."
The choice between Azure and AWS was pretty easy - my employer is a Microsoft client, so Azure made more sense from a practical standpoint. Why learn AWS when I'm surrounded by Azure environments at work?
Plus, after Network+ and Security+, I was curious to see how a vendor-specific exam would feel compared to the CompTIA approach.
The thing about AZ-900 - if you've been doing high tech criminal investigations for any length of time, most of the underlying concepts aren't new. Data governance? Chain of custody taught me that. Access controls and identity management? Yeah, we've been dealing with that stuff forever in law enforcement systems. The tricky part was learning Microsoft's specific way of naming everything. What I know as "access controls" becomes "Azure Active Directory" and "Conditional Access." Same concept, different wrapper. It felt like learning a new dialect of a language I already spoke. The exam questions were straightforward once you decoded the Azure-speak. No crazy scenarios or gotcha questions - just "what does this Azure service do?" and "which tool would you use for X?" Pretty manageable if you put in some study time.
I kept things basic this time around. Went through Microsoft's own learning path (they're free, so why not?),that's it! Coming from a forensics background, the governance and compliance sections clicked immediately. The technical architecture stuff required more focus, but nothing that a couple evenings of study couldn't handle.
Our investigative background actually helps more than you'd think. AZ-900 just puts an Azure label on concepts we deal with daily. We're already used to:
AZ-900 wasn't the most challenging exam I've taken, but it served its purpose. Now I can actually follow along when people start throwing around terms like "resource groups" and "Azure Functions" without feeling completely lost. Is it essential for digital forensics work? Probably not immediately. But as more evidence lives in the cloud, understanding how these platforms work is becoming pretty valuable. Even though I am a huge proponent for locally run services and F.O.S.S, the reality is most people don't have the will or knowledge to self-host. I think in the long run, these subscription cloud models will be common place for everything from large enterprises to the lone client. Plus, it's a nice foundation if you want to dive deeper into Azure security later. The certification train keeps rolling - just with a brief stop in Microsoft land this time.