Azure Management and Governance is the domain that covers how to organize, secure, and control your Azure resources at scale. Think of it as the 'operating system' for your cloud environment—it includes tools for managing multiple subscriptions, applying policies to enforce compliance, tracking costs, and ensuring your cloud stays secure and well-organized. For example, you might use Azure Policy to automatically block the creation of virtual machines in certain regions, or Azure Cost Management to set budgets and get alerts when spending exceeds a threshold. This domain is crucial because without proper governance, cloud environments can quickly become chaotic, expensive, and insecure. In real-world IT, a company might have hundreds of subscriptions and thousands of resources; governance tools help administrators maintain control, meet regulatory requirements, and optimize costs. On the AZ-900 exam, this domain tests your understanding of these management and governance services, not their deep technical implementation. You'll need to know what each service does, when to use it, and how they relate to each other. Common topics include Azure Blueprints, Azure Policy, Role-Based Access Control (RBAC), resource locks, tags, Azure Cost Management, and the Microsoft Cloud Adoption Framework. To study effectively, focus on the purpose and use cases of each service rather than memorizing steps. Use Microsoft's free documentation and the Azure portal to explore these tools in a trial subscription. Create a resource group, apply a policy, set up a budget, and assign roles—this hands-on practice will solidify your understanding and help you answer scenario-based questions on the exam.
AZ-900 Describe Azure management and governance — Key Topics
Azure Management and Governance covers the tools and practices for organizing, securing, and controlling Azure resources, including Azure Policy, RBAC, resource locks, tags, cost management, and the Cloud Adoption Framework.
Azure Policy – creating and assigning policies to enforce compliance rules
Role-Based Access Control (RBAC) – assigning roles like Owner, Contributor, Reader to users/groups
Resource locks – preventing accidental deletion or modification of resources
Tags – organizing resources with metadata for cost tracking and management
Azure Cost Management – setting budgets, analyzing costs, and using pricing calculator
Azure Blueprints – packaging policies, RBAC, and resource groups for repeatable deployments
Common exam traps
Where candidates lose marks on Describe Azure management and governance
⚠Confusing Azure Policy with Azure RBAC: Policy enforces rules on resources (e.g., 'must have a tag'), while RBAC controls who can access resources
⚠Thinking resource locks prevent all changes: Read-only lock prevents modification but not deletion; Delete lock prevents deletion but allows modification
⚠Assuming tags are inherited by default: Tags are not automatically inherited from resource groups to resources; you must apply them explicitly or use Azure Policy to enforce inheritance
AZ-900 Describe Azure management and governance — Practice Questions
30 questions from this objective · 33% of your AZ-900 exam
A company uses Azure Resource Manager templates to deploy and manage infrastructure. They need to ensure that resources are deployed in a consistent, repeatable manner across environments. Which two benefits does using ARM templates provide? (Choose two.)
A company has multiple Azure subscriptions. The IT team wants to apply common policies and role assignments across all subscriptions automatically when a new subscription is created. Which Azure service should they use?
A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?
A company wants to ensure a specific resource group cannot be deleted, but they also need to be able to delete it temporarily during maintenance windows. Which approach allows the most granular control?
A company has a resource group named 'RG-Prod' that contains critical virtual machines, a SQL database, and a storage account. The infrastructure team needs to ensure that no one can accidentally delete this resource group or any of its resources. However, users must still be able to create, update, and delete individual resources within the group as needed for normal operations. Which type of Azure Resource Lock should the team apply to 'RG-Prod'?
A company has an Azure Policy assigned at the root management group that denies the creation of resources without a 'Department' tag. The IT team needs to deploy a temporary set of resources in a specific resource group under a child management group. These resources will not have the required tag. The team must not alter the original policy definition or the policy assignment. What should the team create to allow this deployment?
A large enterprise has multiple Azure subscriptions for different business units. The governance team wants to apply a set of Azure Policy initiatives, such as allowed locations and required tags, to all subscriptions in the organization. They also want to set up role-based access control for the compliance team at the root level so that they can monitor compliance across all subscriptions. Which Azure feature should they use to achieve this?
A company runs a development subscription in Azure. The finance team wants to set a monthly spending limit of $5,000 for this subscription and receive email alerts when spending reaches 80% and 100% of that limit. The team must also be able to review historical spending trends. Which Azure tool should the finance team use to configure these alerts and track spending?
A company has a critical resource group named 'Prod-Databases' that contains Azure SQL databases and virtual machines used by a production order-processing system. The database administrator wants to prevent any user, including administrators, from accidentally deleting or modifying resources in this resource group. The operations team needs a safeguard that requires an explicit action to be taken before any changes become possible, without affecting the ability to manage resources in other resource groups. Which Azure feature should the team implement?
A company has a management group hierarchy with a root management group that contains all subscriptions. The governance team assigns a built-in Azure policy definition 'Allowed Locations' to the root management group with the 'Deny' effect, restricting resource deployment to East US and West US only. After six months, a new regulatory requirement forces the marketing department's subscription (placed under the root) to deploy resources in North Europe for a specific pilot project. The governance team must allow this exception without changing the original policy assignment and without allowing any other subscription to deploy to North Europe. What should the governance team do?
A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?
Which Azure service helps you manage and automate the deployment of virtual machines at scale across development, testing, and production environments?
Which Azure portal feature enables you to manage multiple Azure cloud environments (Azure Commercial, Azure Government, Azure China) from a single location?
An organization wants to ensure new Azure subscriptions always have specific resources (policies, RBAC roles, resource groups, and ARM templates) deployed automatically. Which Azure service is BEST suited?
A company has multiple Azure subscriptions for different departments. They want to enforce consistent policies across all subscriptions regarding allowed virtual machine sizes and require compliance reporting. Which Azure feature should they use?
A company uses Azure and wants to ensure that their IT team receives alerts when virtual machines are deallocated unexpectedly. Which Azure service should they use to create a rule that triggers an action when a VM is deallocated?
A company needs to track and optimize costs across multiple Azure subscriptions. They want to allocate budgets and receive notifications when spending exceeds forecasted amounts. Which Azure tool should they use?
A global company wants to organize its Azure resources by department and project. They need to enforce cost allocation and apply governance policies consistently across all subscriptions. Which two Azure features should they use together? (Select two.)
A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?
A company has multiple Azure subscriptions for different departments. They want to receive budget alerts when spending in any subscription exceeds 80% of the allocated amount. Which Azure feature enables them to set up these alerts?
A company wants to ensure that whenever a new Azure subscription is created, it automatically inherits a set of baseline policies, role assignments, and resource groups. Which Azure tool should they use to package and deploy these governance components consistently?
A company wants to deploy a standardized environment that includes Azure Policy assignments, RBAC roles, and resource group templates. They need to version these components and apply them to multiple subscriptions. Which Azure service should they use?
A company has multiple Azure subscriptions. The finance team needs to analyze spending trends and create budgets to prevent cost overruns. Which Azure tool should they use to visualize historical spending and set budget alerts?
A company uses Azure Policy to enforce that all virtual machines must be from an approved list of SKUs. They want to ensure that any non-compliant VMs that already exist are automatically remediated by changing the VM size to a compliant SKU. Which policy effect should they use?
More Describe Azure management and governance questions available in the full practice test.