Manage Identities and Governance
This domain covers how Azure controls who can do what and how organizations enforce standards across their cloud estate. You will work with Microsoft Entra ID for identity, Azure RBAC for resource access, and governance tools such as Azure Policy, locks, tags, and management groups. Mastering the distinction between identity roles and resource roles is central to the exam.
Microsoft Entra ID: Users, Groups, and Roles
Microsoft Entra ID is Azure's cloud identity and directory service where user and group objects live. You create users (member or guest), organize them into security or Microsoft 365 groups, and assign Entra roles like User Administrator or Global Administrator to manage directory functions. Dynamic groups update their membership automatically based on user attributes such as department. Assigning roles to a group lets many users inherit access through a single assignment.
Azure RBAC versus Entra Roles
Azure role-based access control (RBAC) governs access to Azure resources like VMs, storage, and networks, using roles such as Owner, Contributor, and Reader assigned at management group, subscription, resource group, or resource scope. Entra roles instead govern directory objects and services. These are two separate permission systems, and a common exam trap is choosing an RBAC role when the task involves managing users or the directory. RBAC assignments are inherited downward through the scope hierarchy.
Azure Policy
Azure Policy enforces organizational rules by evaluating resources against defined conditions and applying effects like deny, audit, or append. For example, a policy can deny creation of resources outside approved regions or require a specific tag. Policies can be grouped into initiatives and assigned at management group or subscription scope for broad enforcement. Unlike RBAC, which controls who can act, Policy controls what configurations are allowed.
Locks and Tags
Resource locks prevent accidental changes: a CanNotDelete lock blocks deletion while allowing modification, and a ReadOnly lock blocks both deletion and modification. Locks applied at a higher scope are inherited by contained resources. Tags are name-value metadata pairs used for organization, cost reporting, and automation, but they do not enforce or restrict anything on their own.
Management Groups and Subscriptions
Subscriptions are billing and management boundaries that contain resource groups and resources. Management groups sit above subscriptions and let you apply policies and RBAC assignments that all contained subscriptions inherit. This hierarchy enables consistent governance across many subscriptions from a single point. Structuring management groups by business unit or environment is a common enterprise pattern.