Describe Azure Management and Governance – AZ-900 Study Guide
This domain accounts for 30–35% of the exam and covers four clusters: cost management, governance and compliance tooling, deployment/management tools, and monitoring. The exam pattern here is tool selection: a one-sentence need → the one service built for it. Most wrong answers are real Azure services applied to the wrong job, so this guide leans on sharp one-line job descriptions and the confusion pairs the exam exploits.
Cost Management
What drives Azure costs:
- Resource type, size/tier, and region — the same VM size is priced differently across regions.
- Consumption — compute bills while allocated/running; storage bills by GB; some services bill per execution or per transaction.
- Network egress — data leaving Azure (or crossing regions) costs money; inbound is generally free. A classic "hidden cost" question.
- Licensing model — pay-as-you-go vs. bring-your-own via Azure Hybrid Benefit (reuse existing Windows Server/SQL Server licenses).
Cost reduction levers: Reservations (1–3 year commitment for steady workloads), Hybrid Benefit, Spot pricing (interruptible batch), right-sizing/deallocating idle VMs, picking cheaper regions where residency allows.
The three cost tools — keep them straight:
| Tool | Job | When in the lifecycle |
|---|---|---|
| Pricing Calculator | Estimate monthly cost of a planned architecture | Before deployment |
| TCO analysis | Compare multi-year on-premises cost (power, cooling, space, labor, hardware refresh) vs. Azure | Before migration |
| Cost Management (+ Budgets) | Analyze actual spend, set budgets, alert at thresholds (e.g., 80%) | After deployment |
Tags — name/value metadata (dept=finance, cost-center=1234) attached to resources, groups, or subscriptions. They power cost grouping and chargeback in cost analysis. Tags do not inherit automatically — but Azure Policy can require or inherit them. "Attribute spend to departments" → tags + policy enforcement.
Governance and Compliance
Azure Policy — defines and enforces organizational rules on resource configuration: allowed regions, allowed VM SKUs, required tags, HTTPS-only storage. Policies audit (report violations), deny (block non-compliant deployments), or remediate (auto-fix). Assigned at a scope (management group / subscription / resource group) and inherited downward. Groups of policies = initiatives.
Resource locks — protection against accidents, applied on a resource, group, or subscription:
- CanNotDelete — can read and modify, cannot delete.
- ReadOnly — can only read; blocks modification and deletion.
Locks apply to everyone, including Owners — an Owner must remove the lock first (that's the safety, and an exam favorite). Locks inherit from their scope.
Microsoft Purview — unified data governance: discovers and catalogs data across Azure, on-premises, and other clouds; classifies sensitive data; tracks lineage. The answer to "understand/govern our data estate" — not resource configuration (that's Policy).
The governance confusion triangle:
| Need | Tool |
|---|---|
| Enforce resource configuration rules | Azure Policy |
| Prevent accidental deletion/change | Resource locks |
| Govern & classify data | Microsoft Purview |
| Control who can do what | RBAC (previous domain) |
| Decide sign-in conditions | Conditional Access (previous domain) |
Unlock with a paid plan
3 more sections (about 555 words) continue below. Every paid plan unlocks all AZ-900 study guides, the full question bank and mock exams, from $4.97/month.