You don't need a cloud job to get cloud experience. You need the right free option for the role you want, a plan for what to build before it expires, and a budget alert on day one. Most options need a card, most expire, and the one that needs no card at all (a lab environment) is gone when the lab ends. Use labs to learn safely, then use a trial or free tier to build something you own.
Every limit below was checked on the vendor's own page on 15 October 2026. Free tiers change, so open the linked page before you sign up.
🎯 Which free option for which role
Pick your row. Start with the first column, move to the second once you know what you want to build.
| Role | Start here (no card) | Then (your own environment) | What to build |
|---|---|---|---|
| Identity | CloudLearn Entra labs | Azure free account tenant on Entra ID Free; Microsoft 365 developer sandbox if you qualify | Users, groups, roles, security defaults; Conditional Access only where P1 is licensed |
| Cloud security | CloudLearn Key Vault and private endpoint labs | Azure free account | A locked-down storage account and Key Vault reached only over private endpoints |
| Security operations | Free CloudLearn Sentinel lab | Sentinel free trial on the Azure free account | A Sentinel workspace with free data sources, one custom analytics rule, one investigated incident |
| Platform engineering | CloudLearn Kubernetes and Container Apps labs | GitHub Free plus AKS Free tier on the Azure free account | A repo that deploys infrastructure as code through GitHub Actions to a small cluster |
| Data engineering | CloudLearn storage and Cosmos DB labs | Fabric trial or Databricks Free Edition | One end to end pipeline: raw files in, cleaned tables out, one report |
| AI cloud developer | CloudLearn Functions and managed identity labs | Azure free account or Azure for Students | A small app that calls a model with managed identity, no keys in code |
| General Azure admin | Free CloudLearn VM lab | Azure free account or Azure for Students | VNet, VM, NSG, storage and a budget, all in one resource group you can delete |
🧰 The free options at a glance
What each one is, what it costs you to start, and where it stops.
| Option | Card needed | How long | Main limit |
|---|---|---|---|
| CloudLearn labs | No | The length of the lab | Environment is removed when the lab ends; four labs are free |
| Azure free account | Yes, plus phone | Credit for the first 30 days, some services free for 12 months, 65+ always free | Subscription is disabled after 30 days unless you move to pay as you go |
| Azure for Students | No, school email | Credit for 12 months, renewable yearly while a student | Full-time university students only |
| Microsoft Entra ID Free | Comes with any tenant | Ongoing | No Conditional Access, no PIM, no ID Protection |
| Microsoft 365 developer sandbox | Not applicable | Up to 90 days, renews on real dev activity | Eligibility is restricted (see the identity section) |
| Microsoft Sentinel free trial | Uses your Azure subscription | 31 days | 10 GB a day of Analytics logs; automation still billed |
| Microsoft Fabric trial | Not stated by Microsoft | 60 days | No Copilot or AI features; trials can be off in your tenant |
| Databricks Free Edition | Not stated by Databricks | No time limit stated | Serverless only, daily quotas, no commercial use |
| AKS Free tier | Uses your Azure subscription | Ongoing | Control plane is free, nodes are not |
| GitHub Free, Actions | No | Monthly allowance | Free for public repos; private repos have a monthly minute allowance |
| Microsoft Learn practice assessments | No | Ongoing | Not every exam has one |
🔐 Identity
Identity work is mostly configuration, so a tenant is the experience. You get one free with any Azure account.
| Option | What you can practise | Where it stops |
|---|---|---|
| Microsoft Entra ID Free | User and group management, SSO to Azure, Microsoft 365 and SaaS apps, self-service password reset, basic reports | Conditional Access needs at least P1. PIM and ID Protection need P2 |
| Security defaults | Tenant-wide MFA, blocking legacy authentication | A Microsoft-managed baseline with no custom policies. Custom rules are what Conditional Access is for |
| Microsoft 365 developer sandbox | A Microsoft 365 E5 tenant with 25 user licences, which includes Entra ID P2 | Only for Visual Studio Professional or Enterprise subscribers, some partner program members, and Premier or Unified Support customers. A personal account on its own will see "you don't currently qualify" |
Build this: a tenant with three departments as groups, role assignments scoped to resource groups, a guest user invited and restricted, and security defaults on. Write down what you would do with Conditional Access and why security defaults are not enough. That paragraph is interview material.
The two labs below cover both halves: the free-tier basics, then the P1 policies you can't turn on in your own free tenant.
| Lab | Covers |
|---|---|
| Create users, groups and assign roles in Entra ID | The everyday work of an identity admin |
| Configure Conditional Access policies and MFA | The P1 feature your free tenant can't run |
🛡️ Cloud security
Cloud security experience is mostly about closing things off: secrets out of code, services off the public internet.
| Option | What it gives you | Watch for |
|---|---|---|
| Azure free account | Credit for the first 30 days to try paid services such as private endpoints and Key Vault | Private endpoints and firewalls bill by the hour once you are past the credit |
| CloudLearn labs | The same services in an environment that is removed for you | Not your own environment, so it doesn't replace a project you own |
Build this: a storage account and SQL database with public access off, reached only through private endpoints, and an app that reads its secret from Key Vault with a managed identity.
| Lab | Covers |
|---|---|
| Deploying and managing Azure Key Vault | Secrets, access policies and RBAC |
| Private endpoints to lock down storage and SQL | Taking services off the public internet |
| Securing web apps with managed identity and Key Vault | No secrets in app settings |
🚨 Security operations
You need logs to practise on, and logs cost money to ingest. The Sentinel trial is the one window where they don't.
| Detail | What Microsoft states |
|---|---|
| Trial length | 31 days from enabling Sentinel on a Log Analytics workspace |
| What is free | The first 10 GB a day ingested on the Analytics logs plan, both ingestion and Sentinel analysis |
| Still billed | Automation (Logic Apps playbooks), bring your own ML, and Sentinel data lake charges |
| Limit | 20 trial workspaces per tenant |
| Always free data | Azure Activity logs, Office 365 audit logs, and security alerts from the Defender products |
Source: Microsoft Sentinel billing, free trial.
Build this: a workspace fed by Azure Activity logs, one custom analytics rule written in KQL, and one incident you triggered on purpose, investigated and closed with notes. That is the job, scaled down.
Start with the free lab, then the two that take you from data to an incident.
Deploying Your First Microsoft Sentinel Workspace on Azure
Free, no card, and nothing left running. Learn the workspace before your 31-day trial clock starts.
| Next lab | Covers |
|---|---|
| Introduction to KQL in Log Analytics | The query language every SOC role uses |
| Custom analytics rules and investigating incidents in Sentinel | Detection to incident, end to end |
🏗️ Platform engineering
Platform work is pipelines and clusters. Pipelines can be free indefinitely; clusters are free only at the control plane.
| Option | What it gives you | Where it stops |
|---|---|---|
| GitHub Free, Actions | Standard GitHub-hosted runners are free for public repos | Private repos get a monthly minute allowance (2,000 minutes on GitHub Free when checked). Without a payment method, Actions stop when you hit it |
| AKS Free tier | Free cluster management, all AKS features, meant for learning and dev | You pay for the node VMs, disks and networking. No uptime SLA. Recommended under 10 nodes |
| Azure free account | Credit for the first 30 days to cover the nodes | After that, every node is billed |
Build this: a public repo with Bicep or Terraform for a resource group, a container registry and a small cluster, deployed by a GitHub Actions workflow using OIDC, not a stored secret. Make the repo public: it keeps the minutes free and it is the portfolio piece.
The labs below cover the cluster and pipeline skills without a node bill.
| Lab | Covers |
|---|---|
| Inspect, create and debug your first pod with kubectl | Kubernetes basics |
| Container Apps canary release | Safe rollouts without running a cluster |
| Bicep deployments with a GitHub Actions pipeline | Infrastructure as code through CI/CD |
📊 Data engineering
The two platforms that data jobs ask for both have a free way in. Pick one and finish a project, rather than half of each.
| Option | What it gives you | Where it stops |
|---|---|---|
| Microsoft Fabric trial | 60 days of a trial capacity with all Fabric workloads (Data Factory, Data Engineering, Data Science, Real-Time Analytics, Power BI), pipelines, notebooks, up to 1 TB in OneLake | No Copilot or AI features. Your tenant admin can turn trials off. When it ends, non Power BI items go inactive and you have 7 days to move them to a paid capacity |
| Databricks Free Edition | No-cost Databricks for learning: notebooks, one small SQL warehouse, jobs, pipelines | Serverless only and quota-limited. Go over the quota and compute shuts down for the rest of the day. Not for commercial use. Inactive accounts may be deleted |
Limits for Databricks are on its Free Edition limitations page.
Build this: raw CSV or JSON files landed in storage, cleaned into tables with a notebook, loaded on a schedule, and one report or query on top. Keep the dataset small so you stay inside the quota.
CloudLearn doesn't have a Fabric or Databricks lab. Use the labs for the Azure services every data platform sits on.
| Lab | Covers |
|---|---|
| Azure storage account basics | Where the raw files land |
| Deploy and query Cosmos DB with the NoSQL API | Operational data stores |
🤖 AI cloud developer
AI apps on Azure are mostly normal cloud apps with a model call in the middle. Learn the app part free, then spend credit on the model part.
| Option | What it gives you | Where it stops |
|---|---|---|
| Azure for Students | Credit for 12 months, no card, renewable each year while you are a student | Full-time university students only. Credit can't be spent on Marketplace offers |
| Azure free account | Credit for the first 30 days, usable on model deployments and AI Search | Credit not spent in 30 days is lost |
Build this: an Azure Function that calls a deployed model using its managed identity, with no API key anywhere. 5 AI Projects a Cloud Engineer Can Ship in a Weekend has five of these with code.
| Lab | Covers |
|---|---|
| Create and deploy Functions with Core Tools | The app host most AI demos use |
🖥️ General Azure admin
The broadest role and the easiest to start free.
| Option | What it gives you | Where it stops |
|---|---|---|
| Azure free account | Credit for 30 days, free monthly amounts of 20+ services for 12 months, 65+ always-free services | Card and phone needed. Free monthly amounts don't roll over |
| Free services on any subscription | Includes three small burstable VM sizes for up to 750 hours a month in the first 12 months | Only those sizes. A bigger VM, a second region or a paid tier bills at normal rates |
Check the current list on the Azure free services page before you build on any of it.
Build this: one resource group with a VNet, two subnets, an NSG, a VM with auto-shutdown, a storage account and a budget. Then delete the group and rebuild it from a script. The rebuild is the part that shows experience.
Creating Your First Virtual Machine in Azure Cloud
Free, no card, and nothing left running. The VM is the resource most likely to bill you in your own subscription, so learn it here first.
| Next lab | Covers |
|---|---|
| Implement NSGs and ASGs | Network filtering |
| Connect virtual networks with VNet peering | Networking that is easy to leave billing |
| Secure VM access with Azure Bastion | Bastion bills hourly in your own subscription |
🧾 How not to get a surprise bill
Set these up before your first resource. None of them take long.
| Guardrail | What it does | What it doesn't do |
|---|---|---|
| Budget with alerts | Emails you at 50, 80 and 100 percent of an amount you choose | Stop anything. Cost data arrives 8 to 24 hours late and budgets are checked once a day |
| One resource group per experiment | One delete removes everything in it | Protect anything else you put in the same group |
| VM auto-shutdown | Stops a forgotten VM at night | Cover disks, public IPs, gateways or Bastion |
| Spending limit | On by default for the free account and credit offers; disables resources when credit is used up | Exist on pay as you go. Upgrading removes it |
Delete the whole experiment when you finish a session:
az group list --query "[].name" -o tsv
az group delete --name rg-practice-lab --yes --no-wait⏳ What happens when a trial ends
| Offer | At the end | The trap |
|---|---|---|
| Azure free account | After 30 days or when the credit is gone, the subscription is disabled unless you move to pay as you go | If you upgrade a disabled subscription, the paid resources in it come back on and start billing |
| Azure for Students | Disabled when the credit runs out or the 12 months end | Renew each year with your school email while you are still a student |
| Sentinel trial | Ingestion bills at normal rates after 31 days | The workspace keeps collecting unless you disconnect the data |
| Fabric trial | Non Power BI items go inactive; 7 days to move them | After that they can be removed |
| Databricks Free Edition | No end date stated; compute pauses when you hit the daily quota | Long inactivity can mean the account is deleted |
📝 Free exam practice, every role
Microsoft Learn practice assessments are free and you can retake them as many times as you like. Each one gives a score report with the rationale for every answer. Not every exam has one, so check the exam's page under "Schedule exam". Use them to find gaps after the project is built, not instead of it.
Experience is what you build and can talk about. Pick your row, run the lab, then build the project in an environment you own and write a README for it. Cloud Portfolio Projects covers what to put in it.
