AZ-104
Deep Dive
Azure's hierarchy (Management Groups → Subscriptions → Resource Groups → Resources) is the foundation of all governance. The AZ-104 tests locks, tags, policy inheritance, and the difference between scope levels.
Contents
Azure organizes resources into 4 levels. Policies and RBAC assigned at higher levels are inherited downward. A child cannot override what the parent imposes.
1. Management Group
Groups subscriptions. Up to 6 levels of depth + root MG. Max 10,000 MGs per tenant.
2. Subscription
Billing unit and limit boundary for some services. A subscription belongs to exactly 1 tenant.
3. Resource Group
Logical container for related resources. A resource belongs to exactly 1 RG. The RG has a region but its resources can be in other regions.
4. Resource
An individual instance of a service: VM, VNet, Storage Account, etc.
Management Groups let you organize subscriptions and apply governance at scale. The Root Management Group automatically exists in every tenant and contains all subscriptions.
Characteristics
Typical structure example
Elevating access to the Root MG
By default, not even the Global Admin has access to the Root MG. To manage policies at the tenant level, the Global Admin must go to Entra ID → Properties → Access management for Azure resources → Yes. This temporarily grants them User Access Administrator on the root MG.
The subscription is the primary billing unit and the boundary for some service quotas. Each subscription belongs to exactly 1 Entra ID tenant.
| Subscription type | Description |
|---|---|
| Free | 200 USD of credit for 30 days + 12 months of free services. Only 1 per account. |
| Pay-As-You-Go | Pay for what you use. No minimum commitment. The most common in production. |
| Enterprise Agreement (EA) | 3-year contract with volume discounts. For large enterprises. |
| CSP (Cloud Solution Provider) | Managed by a Microsoft partner. Billing goes through the partner. |
| Azure for Students | 100 USD of credit, no credit card required. Limitations on certain services. |
| Dev/Test | Reduced pricing for development environments. Requires a Visual Studio subscription. |
Important subscription limits
VNets per region
1,000
VMs per region
25,000 (soft)
Resource Groups per sub
980
Resources per RG
No official limit
Tags per resource
50
RBAC role assignments
4,000 per scope
A Resource Group is a logical container that groups related resources. It's the unit for lifecycle management: deleting the RG deletes all its resources.
Resource Group rules
RG organization strategies
By lifecycle
All resources for the same project in 1 RG. When the project ends, everything is deleted together.
By environment
rg-prod, rg-staging, rg-dev. Makes it easy to set different permissions per environment.
By resource type
rg-networking, rg-compute. Useful for specialized teams.
By region
rg-westeurope, rg-eastus. Helps group co-located resources.
Locks prevent users (even Owners and admins) from deleting or modifying critical resources by mistake. They apply to subscriptions, RGs, or individual resources.
CanNotDelete
Users can read and modify the resource, but CANNOT delete it.
✅ Allows:
🚫 Blocks:
ReadOnly
Users can only read. No write operation is allowed, even if they have the Owner role.
✅ Allows:
🚫 Blocks:
Lock inheritance behavior
• A lock on a Subscription → applies to all RGs and resources within it
• A lock on a Resource Group → applies to all resources in the RG
• A lock on a resource → only that resource
• To remove a lock, you need the Owner role or a role with the action Microsoft.Authorization/locks/delete
• A ReadOnly lock on an RG with a Storage Account even blocks listing the keys (because it's a POST action)
Tags are key-value pairs that let you organize, filter, and allocate costs for Azure resources. They are fundamental for cost management and governance in medium and large organizations.
Tag limits
Common tags in production
Tags are NOT inherited by default
If you assign a tag to an RG, the resources inside the RG do NOT automatically inherit that tag. To force inheritance you need an Azure Policy with a modify or append effect. This is a frequent exam gotcha.
Azure Cost Management lets you analyze, monitor, and control Azure spend. Budgets let you configure alerts when spend reaches defined thresholds.
Cost Analysis
A view of spend by service, resource, tag, region. Allows drill-down and historical comparison. Exportable to Excel/CSV.
Budgets
Spend alert thresholds. Doesn't block spend — only notifies. Can configure Action Groups to trigger automatic actions.
Advisor Recommendations
Cost optimization recommendations: underutilized VMs, reserved instances, etc. Integrated with Azure Advisor.
Cost Management scope
Can be viewed at: Tenant, Management Group, Subscription, Resource Group, or by tag. To see cross-subscription costs you need MG-level permissions or billing access.
Tags are not automatically inherited by the RG
A tag on a Resource Group is NOT copied to the resources within it. You need an Azure Policy with modify or append to force it. Many questions assume automatic inheritance.
ReadOnly lock blocks listing storage keys
With a ReadOnly lock on a Storage Account (or its RG), the "List Keys" operation fails because it's a POST action — Azure treats it as a write even though it only reads. This cuts off access to the keys without deleting the lock.
An Owner cannot override a Lock
An Owner can manage all resources, BUT to remove a lock they need SPECIFICALLY the Owner role or the Microsoft.Authorization/locks/delete action. A Contributor cannot delete locks.
The RG has a region, but its resources don't have to be in that region
The Resource Group's region only determines where the RG's metadata is stored. The resources inside can be in any Azure region.
A Budget does NOT block spend
A Budget only sends alerts or can trigger Logic Apps/Runbooks. It doesn't automatically stop resource creation when the threshold is exceeded. To block, you'd need to combine Budget + Action Group + Automation.
Did you get this topic?
Test what you just learned
An administrator with the Owner role on a subscription tries to delete a critical production Resource Group. The operation fails with a 'Conflict' error. What is the most likely cause and the solution?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.