Microsoft AZ-900: Governance & Compliance — Study Guide

By Laurynas Brazys · 22 July 2026 · #microsoft #az-900 #certification #exam-prep #study-guide

Part of the Microsoft Azure AZ-900 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Governance in Azure aligns cloud usage with business, security, and regulatory requirements through a layered set of controls: organizational structure, policy, standardized deployments, protection against accidental change, and continuous auditing. These capabilities operate natively in the Azure Resource Manager control plane and scale from a single subscription to large multi-tenant estates. Good governance reduces drift, enforces consistency, and provides evidence of compliance without impeding developer velocity. Compliance depends on strong inventory and change history. Azure provides near-real-time visibility of resources across subscriptions, prescriptive regulatory mappings, and data discovery to locate and classify sensitive information. The result is a defensible cloud posture where standards are defined once, automatically enforced, evidenced continuously, and corrected at scale.

Azure Policy: definitions, initiatives, location controls, and remediation

Azure Policy defines guardrails that evaluate resource configurations during create/update (and regularly thereafter) and enforce desired states. A policy definition uses conditions and effects to evaluate resource properties exposed by resource providers. Core effects include Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, and Disabled. Policies can be assigned at the management group, subscription, resource group, or resource scope, and inheritance ensures broader assignments flow down unless excluded via notScopes. Initiatives group related policy definitions into a single package with parameters for consistent, repeatable assignment. For example, a security baseline initiative can include policies that require diagnostic settings, restrict public endpoints, enforce tagging, and audit missing backup. Assigning the initiative applies all included policies with one action and yields a single compliance view. The Allowed locations built-in policies restrict where resource groups and resources can be created, preventing deployment to unapproved regions and helping with data residency and sovereignty. When a create request targets a forbidden region, the Deny effect blocks the operation before it reaches the resource provider, ensuring strict compliance. When drift is discovered, remediation tasks bring resources back into compliance at scale. For DeployIfNotExists and Modify policies, a policy assignment’s managed identity is used to reconfigure noncompliant resources (for example, enabling diagnostic settings on storage accounts or appending required tags). Remediation jobs can be scoped narrowly or run across entire subscriptions, and compliance results surface per-policy and per-resource for audit tracing.

• Purpose
  • Policy Definition: Single rule evaluating resource properties
  • Initiative (Policy Set): Bundle of policy definitions with shared parameters
  • Assignment Scope: Management group, subscription, resource group, or resource
  • Common Effects: Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists
  • Remediation Requirements: Managed identity on assignment; applicable to Modify/DeployIfNotExists
• Use case
  • Policy Definition: Enforce SKU, TLS, tags, private endpoints
  • Initiative (Policy Set): Apply a security or governance baseline
  • Assignment Scope: Broad enforcement with inheritance and exclusions
  • Common Effects: Hard enforcement or evidence-only auditing
  • Remediation Requirements: Permissions sufficient to change target resources

Azure Blueprints: packaging standards with policy, RBAC, resource groups, and templates

Azure Blueprints package governance artifacts so organizations can stamp compliant environments consistently. A blueprint definition can include policy assignments, Azure role-based access control (RBAC) assignments, resource group definitions, and deployment artifacts such as ARM templates (including Bicep) to provision standard infrastructure. Parameters allow tailoring per assignment while preserving a single versioned source of truth. Blueprints help separate “what must exist and who can do what” from workload code. For example, a baseline blueprint may create spoke resource groups, assign Reader to audit teams and Contributor to platform teams, deploy a hub-and-spoke network template, and assign initiatives for diagnostics and security. Assigning the blueprint to one or more subscriptions applies all artifacts in the correct order and records compliance state. Versioning supports controlled updates, and artifact locking can protect critical components post-deployment.

• Primary focus
  • Azure Policy: Configuration and compliance guardrails
  • ARM/Bicep Templates: Declarative resource deployment
  • Azure Blueprints: Packaging and governing standards across subscriptions
• Includes RBAC
  • Azure Policy: No (separate assignment)
  • ARM/Bicep Templates: No (separate assignment)
  • Azure Blueprints: Yes (role assignments as artifacts)
• Includes Policy
  • Azure Policy: N/A
  • ARM/Bicep Templates: No (can deploy policy resources, not assign)
  • Azure Blueprints: Yes (policy assignments as artifacts)
• Creates Resource Groups
  • Azure Policy: Can require/enforce naming/tags
  • ARM/Bicep Templates: Can deploy into or create via nested deployments
  • Azure Blueprints: Yes (define RG artifacts as part of the blueprint)
• Typical use
  • Azure Policy: Restrict SKUs, enforce diagnostics, tags
  • ARM/Bicep Templates: Provision VNets, Key Vaults, App Services
  • Azure Blueprints: Stamp compliant landing zones with policy + RBAC + infra

Organization and standards: management groups, subscriptions, resource groups, naming and tags

Azure’s management hierarchy enables governance to scale. Management groups sit above subscriptions and provide a place to apply policy and RBAC that inherit to all child subscriptions. Subscriptions define billing, service quotas, and a security boundary for most controls. Resource groups hold resources with aligned lifecycle, permissions, and deployment logic; each resource belongs to exactly one resource group and one subscription. Naming and tagging standards translate governance intent into operational clarity. Names should encode resource type abbreviations, workload, environment, and region (for example, kv-payroll-prod-eus2) within service limits. Tags add business context across resources for cost allocation, ownership, data classification, and automation keys (for example, costCenter=FIN, owner=ops-team@contoso.com, dataSensitivity=Confidential). Azure Policy with Modify and Append effects enforces tag presence and value patterns, and can inherit tags from resource groups to resources. Consistency here drives reliable cost reporting, access reviews, and lifecycle automation.

• Management Group
  • Purpose: Govern at scale across subscriptions
  • Common Uses: Apply policies, RBAC, and initiatives to business units or environments
  • Can Contain: Child management groups and subscriptions
  • Key Notes: Up to 6 levels deep (excluding root); inheritance flows downward
• Subscription
  • Purpose: Billing and service boundary
  • Common Uses: Workload isolation, cost segregation, quota management
  • Can Contain: Resource groups and resources
  • Key Notes: Policy/RBAC assignments here affect all contained resource groups
• Resource Group
  • Purpose: Lifecycle and permission boundary for resources
  • Common Uses: Deploy, update, and delete related resources together
  • Can Contain: Resources
  • Key Notes: Resource can exist in only one RG; moves across RGs/subscriptions have service-specific constraints

Resource locks and accidental deletion prevention

Resource locks provide a last line of defense against unintended changes. Locks are applied at the subscription, resource group, or resource scope and inherit downward. Two lock types exist: CanNotDelete prevents deletion but allows read and write operations, and ReadOnly restricts all write and delete operations (effectively allowing only read operations). Locks protect against actions from the portal, CLI, PowerShell, ARM/Bicep, and third-party IaC tools. Use CanNotDelete on shared or critical infrastructure—virtual networks, route tables, DNS zones, production Key Vaults—so maintenance can continue while deletes are blocked. Use ReadOnly sparingly for artifacts that must remain completely static, such as archived storage accounts or regulatory evidence containers; many services require writes for normal operation and will fail under ReadOnly. Only principals with sufficient permissions (for example, Owner with Microsoft.Authorization/locks/*) can remove a lock, and removing a lock is itself an auditable operation in the Activity Log.

• CanNotDelete
  • Reads: Allowed
  • Writes/Updates: Allowed
  • Deletes: Blocked
  • Typical Use Cases: Protect VNets, route tables, prod Key Vaults, critical RGs
  • Considerations: Allows configuration changes; delete operations fail until lock is removed
• ReadOnly
  • Reads: Allowed
  • Writes/Updates: Blocked
  • Deletes: Blocked
  • Typical Use Cases: Preserve evidence stores, archival storage, immutable configs
  • Considerations: Many services break under ReadOnly; updates and scaling are blocked

Auditing, inventory, and regulatory compliance: Resource Graph, Activity Log, Defender for Cloud, and Microsoft Purview

Azure Resource Graph provides fast, at-scale inventory and posture queries across subscriptions and management groups using Kusto Query Language (KQL). It enables answering questions like which storage accounts lack encryption, which VNets expose public IPs, and which resources are out of policy. Results feed dashboards, CMDB synchronization, and remediation pipelines. Resource Graph can also surface policy compliance states, tag distributions, and cost attribution dimensions when combined with Cost Management data. The Azure Activity Log records control-plane operations against resources, including who did what and when, with a default retention of 90 days. Forward Activity Log to Log Analytics, Azure Storage, or Event Hubs for long-term retention, correlation, and SIEM ingestion. Change history analysis pinpoints configuration drift, supports incident response, and provides evidence for audits. Microsoft Defender for Cloud translates technical posture into regulatory views by mapping assessments to standards such as Azure Security Benchmark, ISO/IEC 27001, NIST SP 800-53, PCI DSS, and CIS. The Regulatory compliance dashboard shows pass/fail controls, affected resources, and remediation guidance. Enabling auto-provisioning integrates agents and policies where needed, and secure score offers a prioritization lens. Microsoft Purview discovers, classifies, and catalogs data across Azure, multicloud, and on-premises sources. Scans identify sensitive data (for example, financial, PII, health) in Azure Storage, SQL, Synapse, Power BI, and many more, applying built-in or custom classifiers. The Purview Data Map and Catalog provide lineage, ownership, and sensitivity labeling that integrate with Microsoft Information Protection, enabling data loss prevention and access policy decisions aligned with regulatory obligations.

• Primary function
  • Azure Resource Graph: Inventory and posture queries at scale
  • Activity Log: Control-plane audit trail of operations
  • Defender for Cloud (Regulatory): Map posture to standards and prioritize fixes
  • Microsoft Purview: Data discovery, classification, catalog, lineage
• Scope
  • Azure Resource Graph: Across MGs/subscriptions
  • Activity Log: Per tenant with routing to LA/Storage/Event Hub
  • Defender for Cloud (Regulatory): Per subscription/tenant with initiative assignments
  • Microsoft Purview: Across data sources (Azure, M365, on-prem, multicloud)
• Typical outputs
  • Azure Resource Graph: KQL query results, dashboards, exports
  • Activity Log: Who/what/when, status, error codes
  • Defender for Cloud (Regulatory): Control compliance status, secure score, recommendations
  • Microsoft Purview: Data assets, sensitivity labels, schema, lineage graphs

Practical Problem: Standardizing compliant landing zones at Fabrikam Retail Group

Scenario: Fabrikam Retail Group operates in North America and the EU with strict data residency and PCI DSS obligations. Multiple application teams deploy workloads monthly, and prior ad-hoc deployments led to inconsistent tagging, resources in unapproved regions, and occasional deletion of shared networking. Leadership requires standardized, compliant landing zones, continuous evidence of control effectiveness, and discovery of sensitive data across storage and analytics platforms.

Challenge: Design and implement an Azure governance approach that enforces region restrictions, standardizes deployments with policy and RBAC, prevents accidental deletion of core infrastructure, maintains inventory and change history, reports against ISO 27001 and PCI DSS, and discovers/classifies sensitive data.

Recommended Approach:

1. Create a management group hierarchy: /Fabrikam root; children /Corp (shared services), /NA, and /EU; under each, add /Prod and /NonProd. Move subscriptions into the appropriate management groups.
2. Author policy initiatives at the management group level: (a) Allowed locations per geography, (b) Required tags (costCenter, owner, dataSensitivity) with Modify/Append, (c) Enforce diagnostic settings to Log Analytics for core services, (d) SKU and public network restrictions for PaaS services. Assign initiatives to /NA and /EU with region-appropriate parameters and exclude break-glass subscriptions via notScopes.
3. Package a blueprint for the standard landing zone: artifacts include creation of hub and app resource groups, RBAC assignments (Network Contributor to platform team, Reader to audit), policy assignments for diagnostics and tags, and ARM templates to deploy vNETs, peering, Key Vault, and Log Analytics. Version the blueprint and assign it to all Prod and NonProd subscriptions.
4. Apply resource locks: CanNotDelete on hub VNets, route tables, shared DNS zones, and Log Analytics workspaces; ReadOnly on an archival storage account for regulatory exports. Validate that Owners of shared services subscriptions can remove locks with owned approvals when changes are planned.
5. Enable Activity Log export from all subscriptions to a central Log Analytics workspace and archive to a storage account with immutable (time-based) retention for seven years. Build Resource Graph dashboards that list noncompliant resources, missing tags, and assets by region and dataSensitivity tag.
6. Enable Microsoft Defender for Cloud across the tenant. Select ISO/IEC 27001 and PCI DSS as regulatory standards, turn on auto-provisioning, and review recommendations. Create work items from high-severity findings and track secure score improvements per subscription.
7. Deploy Microsoft Purview in the /Corp shared services subscription. Register Azure SQL, Storage, Synapse, and Power BI as data sources. Configure scheduled scans with built-in sensitive information types and classify datasets. Publish the data catalog and assign data owners. Export discovered sensitivity labels to inform conditional access and DLP.

Azure Rationale: This approach starts with management group scoping so policy and RBAC inherit predictably, then enforces core controls with Azure Policy and initiatives to prevent noncompliance at deployment time. The blueprint packages policy, RBAC, resource groups, and infrastructure templates to stamp consistent landing zones while allowing parameterization by region and environment. Resource locks protect critical shared services from accidental deletion without impeding day-to-day configuration where appropriate. Centralized Activity Log retention and Resource Graph deliver reliable inventory and change evidence. Defender for Cloud provides a live regulatory control map and prioritized remediation, while Microsoft Purview discovers and classifies sensitive data to support PCI DSS and data residency controls across Fabrikam’s analytics estate.

← Cost Management · All domains · Monitoring →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →