Study Hub / Microsoft Azure Fundamentals (AZ-900) / Domain 3.0
Microsoft Azure Fundamentals (AZ-900) Domain 3.0: Describe Management & Governance — Explained
Domain 3.0 is about control at scale: how organizations keep hundreds of Azure resources organized, compliant, and affordable. It is the most "real job" of the three AZ-900 domains — and entirely conceptual.
Organizing: groups, tags, and hierarchy
- Management groups → subscriptions → resource groups → resources — the hierarchy. Policies and RBAC assigned higher up inherit downward.
- Resource groups — logical containers for resources that share a lifecycle (one app's VM + database + storage). Delete the group, delete everything in it. A resource lives in exactly one group.
- Tags — name/value labels (Environment: Production, Owner: Finance) for organization and cost tracking. Tags answer "which resources belong to which cost center?"
- Subscriptions — billing and access boundaries. Separate subscriptions for dev/test/prod is a standard pattern.
Enforcing: Policy, RBAC, and locks
- Azure Policy — rules that resources must follow, evaluated at creation and continuously. "Only allow VMs in East US" or "require a CostCenter tag" — non-compliant resources get flagged or denied.
- RBAC (role-based access control) — who can do what, where. Built-in roles: Owner (everything incl. access management), Contributor (manage resources, not access), Reader (view only). Assign at the narrowest scope that works — least privilege.
- Resource locks — CanNotDelete (prevent accidental deletion; you can still modify) and ReadOnly (no changes at all). Locks are the answer to "how do I stop someone deleting the production database?"
- Policy vs. RBAC vs. locks — Policy governs what resources may exist; RBAC governs who may act; locks govern what actions are blocked regardless of who. Three different questions, three different answers.
Cost control: seeing and limiting spend
- Pricing Calculator — estimate costs before deploying. The "before" tool.
- Cost Management + Billing — analyze actual spend: break down by resource group, tag, or service. The "after" tool.
- Budgets and alerts — set spending thresholds; get notified (or trigger automation) when crossed. Alerts don't stop spending by themselves.
- Azure Advisor — personalized recommendations across cost, security, reliability, and performance — including "this VM is oversized, right-size it."
- Reservations and Hybrid Benefit — commit to 1–3 years for discounts; bring existing Windows/SQL licenses to Azure to avoid paying twice.
- Service Level Agreements (SLAs) — the uptime commitment (e.g., 99.9%). More nines cost more; know that SLAs describe provider commitments, not guarantees of perfection.
The must-memorize table: Policy vs. RBAC vs. locks
Three controls, three different jobs.
| Control | Answers | Example |
|---|---|---|
| Azure Policy | "What resources are allowed to exist?" | Deny VM sizes over 4 vCPUs; require tags |
| RBAC | "Who is allowed to act?" | Reader role for auditors on the subscription |
| Resource lock | "What is blocked no matter who?" | CanNotDelete on the production database |
| Management group | "Where do I apply this broadly?" | Policy at the group covers all subscriptions below |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An auditor needs read-only visibility into all Azure resources but must not change anything. What is the correct assignment?
- A. A. Owner role at the management group
- B. B. Reader role at the subscription scope
- C. C. Contributor role on each resource group
- D. D. A CanNotDelete lock on the subscription
Show answer & reasoning
B. Reader = view everything, change nothing — exactly the requirement — and subscription scope covers all resource groups beneath it. Owner (A) is wildly excessive; Contributor (C) allows changes; a lock (D) blocks deletion but isn't an access grant at all.
2. The company requires every VM to carry an "Owner" tag and forbids VMs in regions outside the US. Which control enforces both?
- A. A. RBAC — assign the Tag Contributor role
- B. B. Resource locks on each VM
- C. C. Azure Policy — tag requirements and allowed-location rules
- D. D. A separate subscription per region
Show answer & reasoning
C. Both requirements are about what resources may exist — Azure Policy's exact job, evaluated at deployment and continuously. RBAC (A) governs who acts; locks (B) block actions on specific resources; subscriptions (D) are billing boundaries, not rule engines.
3. A production database must be protected against accidental deletion, but administrators still need to modify its configuration. Which lock fits?
- A. A. ReadOnly — blocks all changes
- B. B. CanNotDelete — blocks deletion, allows modification
- C. C. An Azure Policy denying all writes
- D. D. Removing all RBAC assignments
Show answer & reasoning
B. CanNotDelete is precisely "you may change it, you may not destroy it." ReadOnly (A) would block the needed config changes. A policy (C) is the wrong tool for per-resource protection; removing RBAC (D) just breaks legitimate administration.
4. Before requesting budget for a new Azure deployment, the team needs a monthly cost projection. Which tool?
- A. A. Cost Management — analyze current spend
- B. B. The Pricing Calculator — estimate planned costs
- C. C. Azure Advisor — right-size existing VMs
- D. D. Budgets — alert on thresholds
Show answer & reasoning
B. The Pricing Calculator is the "before" tool: model the planned architecture, get a monthly estimate. Cost Management (A) and Advisor (C) analyze existing spend; Budgets (D) watch ongoing thresholds. Before → Calculator, every time.
This was one domain. The simulator drills all 3.
This free preview covered Describe Azure Management & Governance (Domain 3.0). Not covered here: Describe Azure Architecture & Services (Domain 2.0). The largest domain — every Azure service, region, and architecture detail — stays in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full AZ-900 Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy