Management and Governance
This chapter explains how to control costs, enforce standards, secure access, and monitor an Azure environment. You will learn the tools for estimating and managing spending, applying organizational rules through policy and tags and blueprints, granting least-privilege access with RBAC, protecting resources with locks, securing identity with Microsoft Entra ID and Zero Trust, and observing health with Azure Monitor. These capabilities keep an Azure deployment compliant, secure, and financially predictable.
Cost Management and Optimization
Because the cloud bills you for what you consume, controlling and predicting spend is a core discipline, and Azure provides a toolkit for estimating costs before you deploy and tracking and optimizing them afterward. Two calculators help you plan. The Azure Pricing Calculator lets you model a proposed architecture, selecting services, regions, tiers, and quantities, to estimate the monthly cost before you commit. The Total Cost of Ownership (TCO) Calculator compares the cost of running workloads on-premises against running them in Azure, accounting for hardware, electricity, and labor, so you can build a business case for migration. Once resources are running, Microsoft Cost Management is the service for tracking actual spend. Its cost analysis feature breaks spending down by service, resource group, region, or tag, revealing which resources drive your bill and how costs trend over time. To prevent surprises, you create budgets: you set a spending threshold for a scope such as a subscription or resource group, and Azure fires alerts when actual or forecasted spending approaches or exceeds the limit, so you can react before the month ends. Several levers reduce cost directly. Azure Reservations let you commit to a one- or three-year term for predictable, steady-state workloads such as always-on virtual machines in exchange for a substantial discount over pay-as-you-go pricing. Azure Savings Plans offer similar savings for a committed hourly spend across a flexible set of compute services. Spot virtual machines provide deep discounts on spare capacity for interruptible workloads such as batch processing, with the trade-off that Azure can reclaim them when it needs the capacity. Azure Hybrid Benefit lets organizations reuse existing Windows Server and SQL Server licenses to lower costs. Beyond these, right-sizing under-utilized resources, deleting orphaned disks and unused resources, choosing the correct storage tier, and shutting down non-production resources outside business hours all trim the bill. Finally, tags applied to resources let you attribute costs to departments, projects, or environments for accurate chargeback. The exam theme is that cost governance spans the whole lifecycle: estimate first, monitor continuously, alert on budgets, and optimize with reservations, right-sizing, and tagging.
Governance with Azure Policy, Tags, and Blueprints
Governance is about making sure every resource in a large environment is deployed and configured according to organizational standards, and Azure provides complementary tools that enforce rules, add organizing metadata, and package repeatable environments. Azure Policy is the enforcement engine. A policy definition expresses a rule, such as allowed regions, allowed VM sizes, a requirement that a specific tag be present, or a requirement that storage accounts use encryption. When you assign a policy to a scope (a management group, subscription, or resource group), Azure evaluates resources against it and takes the configured effect: it can deny a non-compliant deployment outright, audit and flag non-compliant resources without blocking them, append a required setting, or even deploy a remediation to fix them. Because policy focuses on the properties resources may have, it is how you keep a fleet consistent and compliant at scale. Tags are key-value pairs you attach to resources, resource groups, and subscriptions to add organizing metadata, for example CostCenter equals Finance, Environment equals Production, or Owner equals a team name. Tags do not enforce anything by themselves, but they power cost allocation, searching, and automation, and Azure Policy can require, append, or inherit tags automatically so that tagging stays consistent even when people forget. Azure Blueprints goes a level higher by bundling policies, role assignments, ARM templates, and resource groups into a single repeatable, versioned package that can stamp out a fully governed environment, which is valuable when you must spin up many subscriptions that all meet the same compliance baseline. A defining property that ties governance together is inheritance: a policy or role assigned at a management group or subscription flows down to every resource group and resource beneath it, so you set standards once at a high level and they apply broadly. Together, Azure Policy enforces the rules, tags organize and attribute resources, and Blueprints packages the whole governed environment for reuse, giving administrators consistent control over sprawling deployments.
Access Control with RBAC, Locks, and Zero Trust
Controlling who can do what, and protecting critical resources from accidental change, are central to secure operations, and Azure provides distinct mechanisms for each. Azure role-based access control (RBAC) governs identity-based permissions. You grant access by creating a role assignment, which combines three things: a security principal (a user, group, service principal, or managed identity), a role definition (a collection of allowed actions), and a scope (the management group, subscription, resource group, or individual resource where the access applies). Because assignments are inherited down the hierarchy, granting a role at a resource group applies to all resources within it. Common built-in roles anchor the exam: Owner has full access including the ability to grant access to others; Contributor can create and manage resources but cannot assign roles; Reader can view resources but change nothing; and User Access Administrator manages access without managing the resources themselves. The guiding principle is least privilege: give each identity only the minimum permissions needed for its task, which limits the damage a compromised or misused account can do. Distinct from RBAC are resource locks, which protect resources from accidental deletion or modification regardless of a user's permissions. A CanNotDelete lock allows reading and modifying a resource but blocks its deletion, while a ReadOnly lock blocks any change or deletion; a lock overrides RBAC, so even an Owner is stopped until the lock is removed. It is important not to confuse the two: RBAC controls who may act on resources, while Azure Policy controls what configurations resources may have, and locks guard against accidental change. Underpinning modern access design is the Zero Trust model, whose motto is verify explicitly, use least-privilege access, and assume breach. Rather than trusting anything inside a network perimeter, Zero Trust authenticates and authorizes every request based on all available signals. In Azure this is realized through Microsoft Entra ID with multifactor authentication (MFA), which requires a second proof of identity such as a phone approval, and conditional access policies, which grant or block access based on user, device, location, and risk. Together, RBAC, locks, and Zero-Trust identity form a layered defense.
Monitoring and Observability
Monitoring gives you visibility into the health, performance, and security of an Azure environment, and the exam expects you to know the pieces of the Azure Monitor family and what each one does. Azure Monitor is the umbrella service that collects, analyzes, and acts on telemetry from your resources and applications. It gathers two broad kinds of data: metrics, which are lightweight numeric values sampled over time such as CPU percentage or request count and are ideal for near-real-time dashboards and alerting; and logs, which are richer, timestamped records of events that you query for deeper analysis. Logs are sent to a Log Analytics workspace, a central store where you run queries in the Kusto Query Language (KQL) to investigate behavior across many resources at once, correlate events, and build reports. To decide what telemetry a resource emits and where it goes, you configure diagnostic settings, which route a resource's platform logs and metrics to destinations such as a Log Analytics workspace for analysis, a storage account for cheap long-term retention, or an event hub for streaming to external systems. Acting on data is the job of alerts: an alert rule watches a metric or a log query and fires when a condition is met, for example when CPU stays above 90 percent or when a specific error appears. When an alert fires, an action group defines the response, from sending an email or SMS to invoking a webhook, an Azure Function, or a Logic App to remediate automatically. For application developers, Application Insights extends Azure Monitor to track request rates, response times, failures, and dependencies inside web apps, helping diagnose performance problems. Azure Service Health and the personalized Service Health dashboard notify you about Azure platform issues, planned maintenance, and health advisories that affect your specific resources, while Resource Health reports the current availability of an individual resource. The exam-critical chain to remember is: Azure Monitor collects metrics and logs, Log Analytics stores and queries the logs, diagnostic settings route the data, and alerts with action groups drive the response, giving you the observability that reliable, secure operations require.
Recommendations, Security Posture, and Tools
Beyond raw monitoring, Azure offers advisory and security services that assess your environment and recommend improvements, plus the tools you use to manage everything day to day. Azure Advisor is a free, personalized recommendation engine that continuously analyzes your resource configuration and usage and offers actionable guidance across five categories: cost (for example, right-sizing or shutting down idle VMs), security (surfacing findings from Defender for Cloud), reliability (improving resiliency), operational excellence, and performance. Acting on Advisor recommendations is a quick way to improve an environment across all these dimensions. Microsoft Defender for Cloud is the dedicated security-posture and threat-protection service. It provides a Secure Score, a single measurable figure that reflects how well your environment follows security best practices, along with prioritized recommendations to raise it, and its enhanced tiers add threat detection, alerts, and protection for workloads such as servers, storage, containers, and databases, including resources running on-premises or in other clouds through Azure Arc. For proving adherence to standards, Azure Policy's compliance view shows which resources meet or violate the standards you assigned, and Microsoft Purview and the Service Trust Portal help with data governance and accessing Microsoft's own compliance certifications. To manage Azure, you have several interchangeable tools the exam names: the Azure portal is the graphical, browser-based console for point-and-click management; the Azure mobile app monitors resources from a phone; Azure Cloud Shell is a browser-based shell with tools preinstalled; the Azure CLI offers cross-platform command-line control using a concise syntax; and Azure PowerShell provides cmdlet-based control favored on Windows. For infrastructure as code, ARM templates and Bicep describe resources declaratively so environments deploy reproducibly. Finally, every Azure service carries a service-level agreement (SLA) stating Microsoft's uptime commitment, expressed as a percentage such as 99.9 percent, and combining components can change the composite SLA. The exam theme is that management and governance is a layered practice: Cost Management controls spend, Azure Policy and Blueprints enforce standards, RBAC and locks control access, Azure Monitor observes health, and Advisor and Defender for Cloud continuously recommend improvements, all reached through a consistent set of portal, CLI, and PowerShell tools.
Last updated: September 2026
Practice stays free. The full Microsoft Azure Fundamentals (AZ-900) study guide is the material itself, taught start to finish — a downloadable PDF + EPUB you keep.