AZ-900
Deep Dive
Policies, locks, tags, and compliance. Governance is how an organization maintains control, visibility, and compliance over all its Azure resources, especially at scale.
Contents
Cloud governance is the set of processes, policies, and tools that ensure Azure resources are used in a controlled, secure, consistent way that's aligned with business and regulatory requirements.
Without governance: every team deploys whatever it wants, wherever it wants, without tags, without encryption, without cost control. With governance: every resource follows the rules automatically.
Problem without governance
Governance tools
Result with governance
Management Groups let you organize multiple subscriptions into a hierarchy and apply policies and RBAC to the entire hierarchy with a single assignment.
Complete Azure hierarchy
Real case: multinational company
Root MG: policy "all resources must have a cost-center tag" → applies to the ENTIRE company
MG Europe: policy "data only in European regions" → GDPR compliance for EU divisions
MG Production: policy "Premium SKUs only, mandatory encryption" → only affects prod
Subscription Dev: inherited policy + "allow basic SKUs for testing" → dev is more flexible
Azure Policy defines rules that resources must follow. They're evaluated in real time and can audit, deny, or automatically remediate non-compliant resources.
Policy effects
Rejects the operation if it doesn't comply with the rule. The resource is not created.
Logs the non-compliance but does NOT block it. Useful for visibility before enforcing.
Adds fields to the resource automatically (e.g., add a missing tag).
Deploys a supporting resource if it doesn't exist (e.g., enable logging automatically).
Modifies resource properties to make it compliant (e.g., enable encryption).
Real-world policy examples
Mandatory encryption on Storage
If storage without encryption → Deny
Case: GDPR, HIPAA, ISO 27001 compliance
VMs only in approved regions
If region ∉ {WestEurope, NorthEurope} → Deny
Case: European data residency
Mandatory tags
If resource without "environment" tag → Deny
Case: Billing by project/environment
Approved VM SKUs
If VM SKU ∉ {B-series, D-series} → Deny
Case: Cost control: block expensive VMs
Logging enabled
If VM without diagnostics → DeployIfNotExists logging
Case: Mandatory observability and auditing
Mandatory HTTPS on App Service
If App Service accepts HTTP → Modify to HTTPS-only
Case: Security in transit
Initiative (Policy Set)
An Initiative is a group of related policies that are assigned together. Example: "PCI-DSS Compliance" = 30 individual policies (encryption, logging, access, etc.) grouped into a single initiative. You assign the initiative once and it applies all the policies.
Resource Locks protect resources against accidental deletion or modification, regardless of the user's RBAC permissions. Even an Owner can't delete a locked resource without first removing the lock.
CanNotDelete
Users with access can read and modify the resource, but CANNOT delete it. The delete operation fails even if the user is an Owner.
Use cases
ReadOnly
Users can only read the resource. They can't modify or delete it. Similar to assigning Reader to everyone, but at the resource level.
Use cases
Lock inheritance
Locks are inherited downward. A lock on a Resource Group protects all resources within that RG. A lock on a Subscription protects all RGs and resources in that Subscription.To remove a lock: the user needs a specific permission on Microsoft.Authorization/locks/delete. This is intentional — even an Owner can't skip the explicit process of removing the lock.
Tags are key-value pairs assigned to Azure resources. They don't affect functionality, but they're essential for organization, billing, automation, and auditing.
Standard tags — Contoso company
What are tags for?
Billing and chargeback
Cost Management filters by tag. "How much did the finance team spend this month?" → filter by cost-center=123-accounting.
Automation
Azure Automation scripts look up resources by tag. "Shut down VMs with tag environment=dev after 8pm" → automatic savings.
Auditing and compliance
Show auditors which resources handle PCI-DSS data. Filter by compliance=pci-dss.
Team alerts
Alert rule: "if VM with tag team=backend has CPU > 90% → email the owner tag's owner".
Tag limitations — know these for the exam
Apply a key-value tag to a Resource Group and understand how they're used for billing, automation, and auditing.
+1 more...
Azure has more than 90 compliance certifications. You inherit many of them by using Azure, but shared responsibility means you also need to configure things correctly.
ISO 27001
International standard for information security management. Applies to almost every industry.
Applies to: Universal
SOC 1 / SOC 2 / SOC 3
System and organization audit controls. SOC 2 evaluates security, availability, integrity, confidentiality, and privacy.
Applies to: SaaS, financial services
GDPR
General Data Protection Regulation of the European Union. Applies to data of European citizens, regardless of where the company is located.
Applies to: EU / European data
HIPAA
Health Insurance Portability and Accountability Act. Protection of health data in the US. Requires a BAA (Business Associate Agreement) with Microsoft.
Applies to: Healthcare (USA)
PCI DSS
Payment Card Industry Data Security Standard. For companies that process, store, or transmit credit/debit card data.
Applies to: E-commerce, fintech, retail
FedRAMP
Federal Risk and Authorization Management Program. For cloud services used by the US federal government.
Applies to: US Government
Microsoft Purview Compliance Portal
Central compliance dashboard in Azure. Shows the Compliance Score: a score from 0-100 that indicates how well your tenant complies with the selected frameworks.
Compliance Score
Overall score + breakdown by framework
Assessment details
Which controls pass/fail and why
Improvement actions
Concrete steps to raise the score
Learn to protect critical resources from accidental deletion using Resource Locks. Locks work independently of RBAC permissions and are a key concept in the AZ-900 governance domain.
+1 more...
Configure a policy that requires tags on every resource in the subscription. Azure Policy is Azure's main governance mechanism and a frequent topic on the AZ-900 exam.
+1 more...
Did you get this topic?
Test what you just learned
Which Azure tool lets you define rules that prevent creating resources without department tags across the whole organization?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.