Regions, region pairs, availability zones and datacentres
How Azure divides the world into geographies, regions, availability zones and datacentres, which failure each level isolates, and why a paired region and an availability set are answers to two completely different questions.
Lesson 1 of 11 in objective architecture-and-services. Azure architecture and services, part of Microsoft Certified: Azure Fundamentals (AZ-900).
Geography, region, zone, datacentre
A geography is a market with its own data-residency and compliance boundary — the sort of line a regulator draws — and it contains at least two regions. A region is a group of datacentres close enough together to be treated as one place: Azure picks the boundary so that traffic between them stays inside a tight latency budget, and joins them with a network of its own. When you create almost anything in Azure, the region is the first question you are asked, and it is a decision that is awkward to reverse.
Inside a region, an availability zone is one or more datacentres with independent power, cooling and networking, far enough apart that the same flood or the same substation failure is unlikely to reach two of them. A region that offers zones offers at least three, which is what makes a quorum-based design possible without leaving the region at all. Two spellings are worth keeping apart: a ZONAL resource is pinned to one named zone, and a ZONE-REDUNDANT one is spread across several by the platform without you placing it.
Below that, and easy to miss, is the availability set — which is not a geography level but a placement instruction inside a single datacentre. Azure spreads a set's members across fault domains, which are groups sharing a power supply and a top-of-rack switch, and across update domains, which are rebooted in turn during planned host maintenance. That covers a broken rack and a maintenance window. It does not cover the building, which is exactly the distinction the exam is built on.
Region pairs: distance, and updates one side at a time
Every region is paired with another by Microsoft, and you do not choose the partner — you choose only whether to use an option that replicates to it. The pair buys two things. The first is distance: the two are several hundred miles apart wherever the geography allows, so a single flood, fire or grid failure is unlikely to reach both. The second is staged maintenance: planned platform updates go to one region of a pair at a time, so a faulty rollout cannot land on your primary and your recovery target in the same window.
A pair normally sits inside the same geography, and that is not trivia — it is what keeps a data-residency commitment intact after a failover. Brazil South is the exception everybody is taught, because its partner lies in another geography. The other property worth remembering is that cross-region replication is asynchronous, because the distance that makes the pair useful is the same distance that makes a synchronous write impossible.
Sovereign regions are a different cloud, not a special label
Azure Government in the United States and Azure operated by 21Vianet in China are separate instances of Azure with their own regions, their own portals, their own service endpoints and their own operations staff. A subscription in the commercial cloud cannot simply reach across into one of them. When a requirement says physically and logically isolated from commercial tenants, or names a government accreditation, the answer is a sovereign cloud — not a region, not a zone, and certainly not a resource group.
Region choice is a design input, not a formality
Regions are not interchangeable. Availability zones, individual services, individual virtual machine sizes and prices all vary between them, which is why "we will pick the region later" produces a design that cannot be built. The four inputs to weigh are data residency and sovereignty, latency to the people and systems that will use it, whether every service and size the design needs is actually offered there, and cost.
The consequence worth internalising: when a region turns out not to offer a capability the design assumed, there is no switch to flip. Zones in particular are a property of the region, so the only honest options are to deploy somewhere that has them or to knowingly drop the requirement — and a question offering to enable zones in a region that lacks them is offering something that does not exist.
Worth carrying in
- Geography
- A residency and compliance market holding two or more regions.
- Region
- A set of datacentres treated as one location, joined by a low-latency network.
- Region pair
- The partner region Microsoft fixed for this one. Distance, plus staged platform updates.
- Availability zone
- Physically separate datacentres inside a region, with independent power, cooling and network.
- Zonal
- Pinned to one named zone. You chose which.
- Zone-redundant
- Spread across zones by the platform, without you placing it.
- Availability set
- Placement across fault and update domains INSIDE one datacentre.
- Sovereign cloud
- A separate instance of Azure — Azure Government, or Azure operated by 21Vianet.
What the exam does with this
- Match the failure in the stem to the level that isolates it: a rack or a host reboot is an availability set, a whole datacentre is availability zones, a whole region is the pair. The scenario always names one of the three.
- Availability sets and availability zones are offered side by side in nearly every question on this objective. Sets live inside one datacentre; zones ARE separate datacentres.
- "The data may not leave the region" kills every cross-region option in one phrase, including region pairing and geo-redundant storage.
- You never choose the paired region. You choose whether to use an option that replicates to it, which is a different sentence.
- A resource group is offered here as a fault-isolation answer more often than anywhere else on the paper. It is a management container with no physical meaning at all.
- Objective
- architecture-and-services. Azure architecture and services
- Share of the exam
- 38.46% (the whole objective)
- Questions in this lesson
- 4
- Signed for by a person
- 0
Partly checked. None of the 4 questions here has been read against the cited source by a person. 4 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.
Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.
Questions in this lesson
- A payment API must keep serving requests if one datacentre in its Azure region loses power. Legal advice is that the data may not leave the region. Which arrangement satisfies both constraints? machine-checked
- Your storage account replicates to its region's pair. A compliance reviewer asks what pairing actually guarantees about where the second copy sits, and about how Microsoft applies planned platform updates. Which answer is accurate? machine-checked
- A US federal agency requires that its workloads run in an instance of Azure that is physically and logically isolated from the commercial cloud, with its own endpoints and its own operations staff. What do you point them at? machine-checked
- Your design calls for every tier to be zone redundant. Part way through the build you discover the region the business picked does not offer availability zones. What is the correct response? machine-checked
Drill this lesson
A lesson is one sitting: the trainer draws a short run from these questions alone and spaces the ones you get wrong.
Practise Regions, region pairs, availability zones and datacentres
The rest of objective architecture-and-services
- Regions, region pairs, availability zones and datacentres — you are here
- Resources, resource groups, subscriptions and management groups
- Virtual machines, containers and functions compared
- Virtual machine options, and what a virtual machine needs
- Hosting an application: web apps, containers and virtual machines
- Virtual networks, subnets, peering and Azure DNS
- Reaching Azure privately: VPN Gateway, ExpressRoute and endpoints
- Storage accounts, storage services, tiers and redundancy
- Moving files and migrating workloads into Azure
- Microsoft Entra ID, authentication and role-based access control
- Zero Trust, defence in depth and Defender for Cloud