AZ-900
Deep Dive
Geographies, regions, availability zones, region pairs, and how to choose where to deploy. One of the topics with the most questions on the AZ-900.
Contents
From largest to smallest — how Azure's global infrastructure is physically organized.
Geography
A large geopolitical area containing multiple Azure regions. Defines the boundaries of data residency and compliance.
Examples
Important for the exam
Data does NOT leave the geography unless you explicitly move it.
Region
A geographic area with at least 3 Availability Zones. It's the primary deployment unit in Azure. Latency < 2ms between AZs within the same region.
Examples
Important for the exam
60+ active regions. Not every service is available in every region.
Availability Zone (AZ)
One or more physically separate datacenters within a region. Independent power, cooling, and networking.
Examples
Important for the exam
If one AZ fails (power outage, hardware failure), the other 2+ keep operating. Failover in milliseconds.
Datacenter
A physical building with thousands of servers, cooling, redundant power (backup diesel generators). There can be several datacenters per AZ.
Examples
Important for the exam
You never see or access the datacenter directly. It's the most abstract layer for the customer.
Physical server / rack
The individual hardware running the Hyper-V hypervisor that virtualizes your VMs. Resource pooling: multiple VMs from different customers on the same physical server.
Examples
Important for the exam
You CANNOT choose which physical server your VM uses. But you can use Dedicated Hosts for exclusive hardware.
Current numbers
Main regions for LATAM
Only active region in South America. LGPD compliance.
New region in 2024. First region in Mexico.
Azure's largest region. Maximum service availability.
Pair of East US. For DR/Failover.
Data residency in Canada. PIPEDA compliance.
Pair of Canada Central.
Not every service is available in every region
Azure launches new services first in East US and West Europe, then expands. Services like Azure OpenAI, some Cosmos DB tiers, or specialized services may not yet be available in Brazil South or Mexico Central. Always check availability at azure.microsoft.com/global-infrastructure/services.
Exact definition (Microsoft)
"Availability Zones are physically separate locations within an Azure region. Each availability zone is made up of one or more datacenters equipped with independent power, cooling, and networking."
Zonal (Pinned)
You deploy the resource in a specific AZ. You control where.
Example
VM in Zone 1 specifically. If Zone 1 fails, your VM goes down. But you choose the zone.
When to use
When you need explicit co-location (e.g., a DB cluster with nearby VMs)
Zone-Redundant
Azure automatically distributes the resource across multiple AZs.
Example
Zone-redundant Azure SQL: replicas in Zone 1, 2, and 3. If Zone 1 goes down, automatic failover.
When to use
For automatic high availability without managing the zones yourself
Non-regional
Services that are automatically resilient to AZ and region failures.
Example
Microsoft Entra ID, Azure DNS, Azure Front Door. Not tied to a specific region.
When to use
Global services you always need available
What failures do AZs protect against? (and which they DON'T)
DO protect against:
DO NOT protect against:
For protection against regional failures → you need Multi-Region with Region Pairs.
Every Azure region is paired with another region in the same geography. This pairing is chosen by Microsoft using specific criteria and has unique disaster recovery benefits.
Why do region pairs exist?
Sequential updates
Microsoft never updates both regions of a pair simultaneously. If the update fails in Region A, Region B keeps working. This gives time to roll back.
Priority recovery
If there's a massive disaster, Microsoft restores at least one region of the pair first. Between region A and region B, they prioritize the pair's primary.
Native replication
Services like Azure Storage with GRS (Geo-Redundant Storage) automatically replicate to the paired region. No additional configuration.
Data residency
Pairs are always in the same geography (Europe → Europe, Americas → Americas). Data never crosses geopolitical borders without your permission.
| Primary Region | Secondary Region (Pair) | Distance | Geography |
|---|---|---|---|
| East US | West US | ~3,200 km | United States |
| East US 2 | Central US | ~1,500 km | United States |
| Brazil South | South Central US | ~7,600 km* | Brazil → USA* |
| Canada Central | Canada East | ~3,000 km | Canada |
| Mexico Central | South Central US | ~1,000 km | LATAM |
| North Europe | West Europe | ~1,500 km | Europe |
| West Europe | North Europe | ~1,500 km | Europe |
| France Central | France South | ~500 km | France |
*Brazil South is the only case where the pair is in another geography (USA) because there is no other region in South America.
You don't choose a region at random. There are 4 critical factors the AZ-900 tests.
Proximity to users (latency)
The most important technical factor. The speed of light imposes physical limits — roughly 1ms per 100km of fiber optic cable. A user in São Paulo accessing East US (Virginia) has ~110ms of base latency. Accessing Brazil South = ~10ms.
Practical rule
Deploy in the region geographically closest to most of your users.
Data residency and compliance
Many regulations require data to be stored in a specific jurisdiction. GDPR (EU) requires that data of European citizens stay in the EU or in countries with an "adequate level" of protection. LGPD (Brazil) is similar. Regulated financial sector data often requires in-country storage.
Practical rule
If you have data residency regulatory requirements, choose a region in the correct jurisdiction before any other factor.
Service availability
Not every Azure service is available in every region. Azure OpenAI is in few regions. Some Cosmos DB tiers, some AI/ML services, Azure Stack HCI — depend on regional availability.
Practical rule
Verify that the service you need is available in your target region before committing.
Price
Azure prices vary between regions. East US is usually the cheapest (more datacenter capacity). Brazil South is significantly more expensive (30-60% more) due to smaller scale and local costs. West US 2 and East US 2 are economical. Europe tends to be 10-20% more expensive than the US.
Practical rule
If you have no strict latency or compliance requirements, East US or East US 2 are typically the cheapest with maximum service availability.
These are instances of Azure physically isolated from Azure's public cloud. Designed for specific government compliance or national data sovereignty requirements.
Azure Government (US)
For US federal government agencies and their contractors. Meets FedRAMP High, DoD IL2/IL4/IL5, ITAR.
Access
Only eligible US government entities and verified contractors.
Azure China 21Vianet
Operated by 21Vianet (a Chinese company), not directly by Microsoft. Complies with China's internet regulations (ICP license required).
Access
Only for entities with legal presence in China.
Azure Confidential (future)
Azure dedicates regions for confidential computing workloads with specific TEE (Trusted Execution Environment) hardware.
Access
Confidential computing use cases — data never exposed even to Microsoft.
For the exam
Sovereign regions are physically separate from public Azure. You can't use your normal Azure account to access Azure Government. They are distinct subscriptions and portals. This matters: not everything public Azure offers is available in Azure Government (though the gap is closing).
Startup in Mexico City with users across LATAM
Requirements
Solution
Primary region: Mexico Central (low latency for Mexico). Secondary region (DR): South Central US (Mexico Central's pair). Multi-AZ in Mexico Central for HA.
Why
Mexico Central gives the best latency for users in Mexico and northern LATAM. South Central US as DR is the official pair.
Healthcare company in Brazil with patient data
Requirements
Solution
Primary region: Brazil South (São Paulo). Zone-redundant for all critical services within Brazil South. Azure Site Recovery replicating to South Central US (pair) as a last-resort DR.
Why
LGPD requires data in Brazil → Brazil South is mandatory. Zone-redundant delivers 99.99% within the region. The pair to the USA is the only DR option available (no second region in South America).
Global e-commerce app with users across 4 continents
Requirements
Solution
Active-active multi-region: East US, West Europe, Southeast Asia, Australia East. Azure Front Door to route users to the nearest region. Cosmos DB with multi-region write.
Why
Active-active across 4 regions guarantees low latency globally. Front Door acts as geolocated DNS. Cosmos multi-write eliminates data conflicts between regions.
Did you get this topic?
Test what you just learned
Which Azure component guarantees that applications keep running if a physical datacenter fails within the same city?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.