Microsoft AZ-104: Azure Subscriptions, Governance and Cost Management — Study Guide

By Laurynas Brazys · 6 August 2026 · #microsoft #az-104 #certification #exam-prep #study-guide

Part of the Microsoft Azure Administrator Associate AZ-104 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Azure subscriptions, governance, and cost management define how you structure, secure, standardize, and pay for cloud resources at scale. A sound design starts with an organizational hierarchy (management groups and subscriptions), applies least-privilege access (RBAC), enforces standards and compliance (Policy, Blueprints, locks, and tags), and continuously optimizes spend (Cost Management and Advisor). Azure Resource Manager (ARM) underpins deployment, grouping, and lifecycle operations so that standards and controls are consistently applied from the root management group to individual resources.

Organizational Structure and Access Control

Management Groups are the top-level construct for organizing one or more subscriptions under a single root management group. You can nest management groups up to six levels deep (excluding the root) to mirror organizational or environment boundaries (for example, Corp > Prod/NonProd > Business Units). Both RBAC role assignments and Azure Policy assignments applied at a management group inherit to all child management groups, subscriptions, resource groups, and resources unless explicitly overridden at a lower scope. This inheritance is central to enforcing standards consistently; for example, a “Deny public storage” policy at the Production management group applies to every production subscription without per-subscription configuration.

Subscriptions are billing and deployment isolation boundaries. Common types include Pay-As-You-Go, Enterprise Agreement (EA), Microsoft Customer Agreement (MCA), CSP, and credit-based offers such as Visual Studio subscriptions. Subscriptions separate spending, quotas, and RBAC scopes and are the atomic unit for charges and budgets. Moving resources between subscriptions is often necessary during lifecycle transitions (e.g., dev to prod tenant, reorganizations). Resource move support is provider- and resource-specific; ARM-based resources such as VMs, managed disks, storage accounts, virtual networks, and even Recovery Services vaults can typically be moved with constraints. Prerequisites include having both source and target in the same Azure Active Directory tenant (cross-tenant moves are limited), registered resource providers in both subscriptions, compatible regions/SKUs, and no blocking locks/policies. Expect transient unavailability for some resources during the move; plan maintenance windows for stateful services. Classic (ASM) resources cannot be moved. Always verify support using the “Move” operation in the portal or the resource provider documentation.

Azure RBAC provides fine-grained, least-privilege access using role assignments at a specific scope. Scope can be a management group, subscription, resource group, or an individual resource; assignments inherit downward. The core built-in roles are:

• Owner: full access to all resources, including role assignments.
• Contributor: full create/update/delete on resources, except no permission to assign roles.
• Reader: read-only access. Custom roles let you specify allowed Actions and DataActions, excluding NotActions and NotDataActions, and are defined at or above the intended assignment scope. Deny assignments (created by certain services such as Blueprints or by locks) take precedence over allow assignments, preventing accidental privilege escalation.

Governance, Compliance, and Resource Guardrails

Azure Policy evaluates resource state at create/update time and at regular compliance scans. A policy definition expresses a rule (with optional parameters) and an effect. You group related definitions into initiatives to simplify large-scale assignment. Assignments attach a definition or initiative to a scope (management group, subscription, resource group, or resource) with parameter values and, for certain effects, a managed identity for remediation. Key effects to master:

• Deny: blocks non-compliant create/update operations at request time.
• Audit: allows the operation but records non-compliance for reporting.
• DeployIfNotExists: if a related resource or setting is missing, triggers a template deployment to bring the target into compliance (for example, deploy a diagnostic setting or a policy assignment). Other important effects include Append (adds fields such as tags on write) and Modify (patches properties). Policies can enforce allowed locations, SKU constraints, required tags, diagnostic settings, and encryption standards. For example, restricting Azure SQL Server locations ensures deployments occur only in approved regions or resource groups.

Azure Blueprints package governance-as-code by combining artifacts—policy assignments, role assignments, ARM templates, and resource group declarations—into a versioned blueprint. Assign blueprints to subscriptions or management groups to stamp environments consistently. Blueprint assignment can apply artifact-level locks with modes such as DoNotDelete or ReadOnly to protect deployed resources from drift. Use Blueprints to bootstrap new subscriptions with mandatory controls and baseline infrastructure.

Resource locks provide a last line of defense against accidental modification. Apply CanNotDelete to prevent deletion while allowing updates; apply ReadOnly to block write and delete operations. Locks inherit from higher scopes, so a ReadOnly lock on a resource group affects all contained resources (for example, stopping/starting a VM fails because those operations perform writes). Locks override RBAC permissions: even Owners cannot delete a locked resource without first removing the lock.

Tags are key-value pairs on resource groups and resources to categorize workloads (department, environment, cost center). Tag inheritance is not automatic; to guarantee tags on every resource, use Azure Policy (Append/Modify) to enforce or inherit tags from the resource group at create/update time. Tags drive tag-based cost reporting in Cost Management so departments are accurately charged back. For associating individual resources like virtual machines to departments, apply tags directly to each VM.

Cost Management and Optimization

Azure Cost Management + Billing gives you budgets, cost analysis, exports, and alerts. Budgets are defined at a scope (subscription or resource group) and can filter by resource group, service, or tag. Configure thresholds (e.g., 50%, 80%, 100%) to send alerts via action groups and optionally trigger automation (Logic App, Function) to scale down or shut off noncritical workloads; budgets themselves do not enforce spend. Cost analysis lets you pivot by time, resource, meter, resource group, subscription, and tag to understand drivers and trends; schedule exports to storage for ingestion to BI tools. Spending limits are available for credit-based offers (for example, free trial, Visual Studio) and, when reached, place the subscription into a disabled state to prevent further charges. Spending limits are not supported on Pay-As-You-Go or most EA/MCA offers; use budgets and automation instead.

Azure Advisor continuously evaluates your resources and produces actionable recommendations across cost, security, reliability, performance, and operational excellence. Cost recommendations include rightsizing/ shutting down underutilized VMs, buying reservations or savings plans, and eliminating idle public IPs or disks. Reliability includes availability sets/zones and backup configurations; performance covers compute/storage optimizations; security integrates with Defender for Cloud; operational excellence highlights best-practice configurations. Use Advisor Score to track progress, and integrate recommendations into backlog or automated remediation where appropriate.

Deployment and Lifecycle with Azure Resource Manager

ARM is the control plane for Azure, enabling declarative, idempotent deployments and consistent management. Resource groups are logical containers for lifecycle and RBAC boundaries; group resources that share lifecycle, permissions, and location dependencies. RBAC and policy assignments at the resource group scope govern all contained resources, and group-level locks and tags inherit unless overridden by policy or resource-level operations.

ARM templates (and Bicep as a higher-level language) define resources, parameters, variables, outputs, and dependencies. They enable repeatable deployments and ensure governance artifacts (e.g., policies, role assignments) and workloads are applied together. Use template specs to version and share templates across the organization. Deployment modes matter:

• Incremental: creates/updates resources in the template; does not remove existing resources not in the template.
• Complete: after deployment, deletes resources in the target scope that are not defined in the template—use with caution to enforce strict desired state within the resource group. Deployment history is scoped by resource group, subscription, or management group. When multiple resources are deployed by a single template, you view the deployment and its template from the target scope’s Deployment blade—commonly the resource group—to audit changes and troubleshoot.

Practical Problem Scenario

Starbucks acquires a regional chain and needs to onboard three new subscriptions while enforcing global security policies, enabling department-level chargeback, and migrating several shared services into a consolidated “Corp-IT” subscription without service disruption.

1. Build the management group hierarchy

• Action: Create a root-aligned hierarchy Starbucks > Prod/NonProd > BusinessUnits (Retail, SupplyChain, CorpIT).
• Why: Management groups provide hierarchical RBAC and Policy inheritance so that global controls (e.g., security baselines) flow to every new subscription automatically.

2. Baseline access with RBAC

• Action: At BusinessUnits, assign Reader to Audit, Owner to the central platform team in CorpIT, and Contributor to delegated BU admins at their respective scopes. Create a custom “Tag-Editor” role that permits Microsoft.Resources/tags/write.
• Why: Least-privilege at the correct scope prevents overreach while still enabling BU autonomy; a custom role avoids granting full write to achieve tag maintenance.

3. Enforce governance using Policy and Blueprints

• Action: Author an initiative that includes policies for allowed locations, required tags (CostCenter, Department, Environment), diagnostic settings on key services, and “Deny public access” on storage. Package it into an Azure Blueprint with artifacts: the initiative assignment, RBAC role assignments, ARM templates for a shared log analytics workspace and DDoS plan, and a standard resource group layout. Assign the blueprint to each new subscription with DoNotDelete locks on baseline resources.
• Why: Blueprints deliver a versioned, repeatable landing zone with locks to prevent accidental deletion; Policy ensures every resource is compliant at creation and remediates drift via DeployIfNotExists.

4. Apply tags and guarantee inheritance

• Action: Use a Modify policy to inherit tags from resource groups and an Append policy to add missing tags at resource create/update time. Require CostCenter values that map to Starbucks’ finance system.
• Why: Native inheritance is not automatic; Policy ensures all resources carry the metadata needed for tag-based cost reporting.

5. Set up Cost Management and alerts

• Action: Create budgets at each subscription and critical resource group scope, filtered by tags where appropriate, with alerts at 50/80/100% to an action group that triggers a Logic App to notify BU leads and optionally scale down Dev/test resources. Configure Cost Analysis dashboards by tag and export daily to storage.
• Why: Budgets and alerts provide early warning and trigger near-real-time corrective actions; tag pivots enable accurate chargeback.

6. Migrate shared services safely between subscriptions

• Action: Validate move support for the target resources (VMs, managed disks, VNets, storage, Recovery Services vaults). Remove blocking locks, ensure resource providers are registered in source/target, confirm region/SKU compatibility, and schedule a maintenance window. Use the Move operation from the resource group scope to move to the Corp-IT subscription; revalidate diagnostics and policies post-move.
• Why: Moving at the resource group boundary preserves dependencies and minimizes downtime; prechecks avoid failed moves due to policy or provider mismatches.

7. Protect critical resources with locks

• Action: Apply CanNotDelete to foundational networking and monitoring resources; apply ReadOnly to a golden image resource group.
• Why: Locks override RBAC to prevent accidental deletion or mutation of baseline assets while permitting normal operations elsewhere.

8. Continuously optimize with Advisor

• Action: Review Advisor recommendations weekly; accept cost recommendations to rightsize underutilized VMs and purchase reservations for steady workloads; track progress with Advisor Score.
• Why: Advisor operationalizes ongoing optimization across cost, security, reliability, performance, and operational excellence, sustaining governance beyond initial deployment.

← Azure Active Directory and Identity Management · All domains · Azure Virtual Machines and Compute →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →