Chapter 3 of 334% of exam

Management and Governance

This chapter explains how to control costs, enforce standards, secure access, and monitor an Azure environment. You will learn the tools for estimating and managing spending, applying organizational rules through policy and tags, granting least-privilege access with RBAC, protecting resources with locks, and observing health with monitoring services. These capabilities keep an Azure deployment compliant, secure, and financially predictable.

Cost Management and Optimization

Azure provides tools to estimate spending before deployment and to track and optimize it afterward. Effective cost governance prevents surprises and identifies savings. These tools support both planning and ongoing financial control.

Pricing and TCO calculators estimate cost
The Pricing Calculator estimates service costs before deployment, while the TCO Calculator compares on-premises versus Azure costs to build a migration case.
Cost Management tracks and analyzes spend
Microsoft Cost Management provides cost analysis, breaking spending down by service, resource group, or tag to reveal cost drivers.
Budgets and alerts control spending
Budgets set spending thresholds for a scope and trigger alerts when actual or forecasted costs approach the limit.
Reservations and Spot reduce VM cost
Reserved instances discount predictable, long-running workloads for a one- or three-year term, while Spot pricing offers deep discounts for interruptible workloads.

Governance with Policy, Tags, and Blueprints

Governance tools ensure resources are deployed and configured according to organizational standards. Policy enforces rules, tags add organizing metadata, and blueprints package repeatable environments. Together they keep large environments consistent and compliant.

Azure Policy enforces standards
Policies define rules such as allowed regions or required tags, and can deny non-compliant deployments or automatically remediate them.
Tags add organizing metadata
Tags are key-value pairs that enable cost allocation and resource organization by department, project, or environment.
Policy and tags work together
Azure Policy can require, append, or inherit tags automatically, enforcing consistent tagging across the environment.
Blueprints package governance
Azure Blueprints bundles policies, role assignments, and resource templates into a repeatable, enforceable package for new environments.
Inheritance flows downward
A policy assigned at a subscription or management group is inherited by all resource groups and resources beneath it.

Access Control with RBAC and Locks

Controlling who can do what, and protecting critical resources from accidental change, are core to secure operations. RBAC governs identity-based permissions while locks guard against unintended deletion or modification. These mechanisms complement policy-based governance.

RBAC grants scoped permissions
Role-based access control assigns roles at a scope (management group, subscription, resource group, or resource) to grant only needed access.
Common built-in roles
Owner has full access including assigning roles, Contributor manages resources but cannot assign roles, and Reader has view-only access.
Least privilege is the goal
Grant users the minimum permissions necessary for their tasks to limit risk from compromised or misused accounts.
Resource locks prevent accidents
A CanNotDelete lock blocks deletion while allowing edits, and a ReadOnly lock blocks any change or deletion, overriding RBAC permissions.
RBAC and Policy are distinct
RBAC controls who can act on resources, while Azure Policy controls what configurations resources may have.

Monitoring and Observability

Monitoring gives visibility into the health, performance, and security of your Azure environment. Azure Monitor and related services collect telemetry, raise alerts, and provide recommendations. This observability is essential for reliable, secure operations.

Azure Monitor collects telemetry
Azure Monitor gathers metrics and logs from resources and applications to visualize and analyze health and performance.
Log Analytics stores and queries logs
A Log Analytics workspace centralizes log data so you can run queries and analyze it across many resources.
Alerts and action groups drive response
Alerts fire when a monitored condition is met, and action groups define the notifications and automated actions to run in response.
Diagnostic settings route data
Diagnostic settings send resource logs and metrics to destinations like Log Analytics, storage, or event hubs for analysis and retention.

Recommendations and Security Posture

Beyond raw monitoring, Azure offers advisory services that assess your environment and recommend improvements. These help optimize cost, reliability, performance, and especially security. Acting on their guidance strengthens overall operational excellence.

Azure Advisor gives recommendations
Azure Advisor analyzes configuration and usage to recommend improvements across cost, security, reliability, performance, and operational excellence.
Defender for Cloud scores security
Microsoft Defender for Cloud provides a secure score and actionable recommendations to improve security posture and detect threats.
Compliance reporting proves adherence
Azure Policy's compliance view shows which resources meet or violate standards, helping track and demonstrate governance.
Combine tools for governance
Cost Management, Policy, RBAC, monitoring, and advisory services together provide comprehensive management and governance.
Test your knowledge
Practice questions on Management and Governance
Practice now →
← Previous
Azure Architecture and Core Services

Last updated: July 2026

Report