Microsoft AZ-104 - Microsoft Azure Administrator - Manage Azure Identities and Governance - Manage Azure Subscriptions and Governance

Manage Azure Subscriptions and Governance

• Implement and manage Azure Policy

• Configure resource locks

• Apply and manage tags on resources

• Manage resource groups

• Manage subscriptions

• Manage costs by using alerts, budgets, and Azure Advisor recommendations

• Azure management groups

Implement and manage Azure Policy

Azure Policy evaluates resource configurations against organizational requirements. A definition contains conditions and an effect, such as auditing a missing tag or denying deployment in an unapproved region. Assigning the definition makes it applicable at a chosen scope.

How Azure Policy evaluates deployments

The deployment method does not bypass applicable policy. For example, an allowed-locations policy can reject an unapproved region whether the request comes from the portal or Bicep. DeployIfNotExists operates after successful resource provisioning and its configured evaluation delay, so remediation can occur after the resource initially exists.

Effect	Typical requirement
Audit	Report resources missing a required tag.
Deny	Prevent deployment in unapproved regions.
Modify	Add or replace a supported tag or property.
AuditIfNotExists	Report a missing related configuration.
DeployIfNotExists	Deploy a missing related configuration using an ARM template.

Test new requirements using Audit or an assignment with enforcement disabled before introducing blocking behavior into production.

Definitions, initiatives, assignments, and exemptions

A definition describes a rule. An initiative groups definitions for a shared purpose. An assignment selects the scope and parameter values. Assignments at management group scope apply down the hierarchy, including subscriptions subsequently placed beneath that group. Inheritance is automatic, while compliance evaluation and remediation take time.

If a policy disrupts a critical application, create a narrowly scoped exemption for the affected resource or resource group, tied to the relevant assignment. Record the justification and, where appropriate, an expiration date. Other resources remain subject to the policy, and other applicable policies still apply to the application.

Remediate missing configuration

For existing resources, a compliance scan identifies the gap. A remediation task performs the deployment using the policy assignment’s managed identity. That identity needs the permissions required by the template. Creating an assignment alone does not immediately repair every existing resource.

For VM backup, built-in DeployIfNotExists policies can enable protection using an appropriate Recovery Services vault and backup policy. The selected backup policy defines the schedule and retention settings. Verify its parameters and supported VM scenarios before assignment.

Several supplied scenarios need these qualifications:

Scenario	Accurate implementation
Storage or Key Vault network configuration	DeployIfNotExists can deploy a template that configures supported settings. Choose an appropriate built-in definition or carefully authored custom policy. Modify may fit supported properties, while Deny can prevent unsafe configurations at deployment time.
Windows security baselines	Azure Machine Configuration, formerly Guest Configuration, can audit or apply operating-system settings. Apply and Autocorrect corrects drift for configurations that support enforcement. Plan and test baseline-version updates explicitly.
Delegate assignments without allowing definition changes	Use a custom RBAC role permitting required assignment operations and definition reads. Resource Policy Contributor also permits definition management, so it is broader than the stated requirement.
Require approved infrastructure-as-code deployments	Restrict resource write permissions to approved automation identities and govern pipeline changes. Policy evaluates resource properties and cannot generally establish that a request originated from approved source code merely because it used ARM.
Require MFA based on location or device	Configure Microsoft Entra Conditional Access. Model trusted locations and compliant-device requirements carefully when designing exclusions and grant controls.
Control external users’ application access	Use Entra application assignments and Conditional Access targeting the appropriate users and applications. An application filter selects which applications a policy covers. Access to other applications requires its own controls.

The configuration examples depend on supported policy effects and resource properties. Machine Configuration enforcement modes, delegation permissions, and Conditional Access operate through their respective configuration models.

*Policy inheritance flows from management groups to subscriptions.

Configure resource locks

Azure resource locks protect infrastructure from accidental deletion or modification. Apply them to a subscription, resource group, or individual resource, such as a VM. Child resources inherit parent locks, including resources added later.

Lock type	Effect on management operations
Delete — CanNotDelete	Allows authorized reads and updates. Blocks deletion.
Read-only — ReadOnly	Allows reads. Blocks updates, deletion, and operations such as starting or restarting VMs.

In the example, the VM and storage account remain protected even when the caller is Owner. An authorized administrator must remove the applicable lock before deleting them. A child lock cannot weaken an inherited restriction. Microsoft Learn

How locks fit into governance

Control	Purpose	Example
Azure RBAC	Grants permissions to identities.	Allow an operations group to manage VMs.
Resource locks	Protect existing infrastructure from accidental changes.	Prevent deletion of a production resource group.
Azure Policy	Enforces organizational requirements.	Reject deployments in unapproved regions or require specified tags.

These controls work together. A permitted deployment can still fail because of an inherited ReadOnly lock, a policy restriction, or an exhausted quota. Inspect the error before changing permissions. Policy errors such as RequestDisallowedByPolicy identify the policy involved.

Configuration and exam details

• In the portal, open the target scope → Locks → Add, then choose the lock level.

• Owner and User Access Administrator can manage locks. Custom roles can also include lock permissions.

• Locks protect management-plane operations. A storage account lock does not prevent blob deletion through the data plane. Use soft delete, versioning, or immutability for data protection.

• For select resource groups, subscriptions, and virtual machines; management groups are outside the supported lock scopes.

• Azure resource locks (CanNotDelete and ReadOnly) can be applied at three scopes: subscription, resource group, and an individual resource. A virtual machine is a resource, so it qualifies. Locks are inherited, so a lock at a higher scope applies to everything beneath it.

Resource locks are configured through the Azure control plane, using the portal, CLI, PowerShell, or ARM/Bicep. You can apply a lock at subscription, resource group, or individual resource scope. Parent locks flow down to child resources.

In this example, the subscription’s CanNotDelete lock protects the resource group, VM, and storage account from deletion. The storage account also has a direct ReadOnly lock, so its control-plane updates are blocked. The most restrictive applicable lock takes precedence.

Request	Result in this example
Change the VM’s size	Allowed by the Delete lock, provided the caller has permission.
Delete the VM	Blocked by the inherited Delete lock.
Change storage account configuration	Blocked by the direct ReadOnly lock.
Delete a blob through its data endpoint	Governed by data permissions and data protection settings. The resource lock does not block this operation.

AZ-104 reminder. Locks protect control-plane resource operations. Use features such as blob soft delete, versioning, or immutability to protect stored data. Locks can start at the subscription, resource group, or resource level.

Apply and manage tags on resources

A resource tag is a key–value pair that describes an Azure resource, such as Environment = Production. Tags help you organize resources by business purpose, ownership, and cost—even when those resources belong to different resource groups or subscriptions.

Tags connect resources to business information

Consistent tags let teams examine costs across several dimensions. Finance can review spending by department, a project manager can track Atlas, and operations can identify Production workloads. Tags can also record an owning team, service commitment, or sensitivity classification to support automation and governance.

Example tag	Purpose
Department = Finance	Attribute spending to a business unit.
Project = Atlas	Track resources and costs for a workload.
Environment = Production	Separate production, test, and development resources.
OwnerTeam = PlatformOps	Identify the team responsible for support.
DataClassification = Confidential	Identify resources requiring particular controls.

For shared services, Cost Management allocation rules can distribute costs among departments or projects. Rules can use fixed percentages or proportions based on targets’ compute, storage, or network costs. Tags identify the allocation targets. More detailed allocation based on application usage metrics requires additional reporting or allocation logic.

Apply and maintain tags with Azure Policy

Resource tags do not automatically inherit from a subscription or resource group. In this example, a Modify policy copies the resource group’s CostCenter tag onto resources that lack it. Existing noncompliant resources require a remediation task, using the policy assignment’s managed identity with the necessary permissions.

Choose policy behavior to match the requirement. Audit reports missing tags, Deny can reject requests that fail required tagging rules, and Modify can add or replace tag values. Combine separate policies for requirements such as allowed locations. Use an Automation runbook, Function, or other workflow for complex cleanup actions, with tags providing the selection criteria.

AZ-104 details to remember

• Tags can be applied to supported resources, resource groups, and subscriptions. Management groups do not support tags.

• Tag names are case-insensitive for operations. Tag values are case-sensitive, so standardize values such as Production.

• The general limit is 50 tag pairs per resource, resource group, or subscription, with lower limits for some resource types.

• Tags are plain-text metadata. Store classification labels rather than secrets or sensitive personal information.

• If an org requires all azure resources to have specific tags for cost center and project tracking, and that resources without proper tags should be automatically tagged with default values the azure policy effect that should be used is "Modify".

• If you need to create a governance solution that ensures all azure subscriptions follow consistent naming conventions, have required tags, and are placed in appropriate management groups based on their purpose you should implement 'azure policy initiative' with naming, tagging, and management group policies.

• Example: You need to create a policy that prevents the creation of virtual machine larger than standard D4s in a dev subscription while allowing and size in prod. Solution is to create a single policy with conditional logic based on subscription tags which uses subscription metadata to apply different VM size restrictions based on environment type.

Microsoft’s current documentation states that Tag Contributor supports tag operations through PowerShell and REST, but cannot apply tags to resources or resource groups through the Azure portal. For the specific requirement to tag VMs through the portal, resource write permission is needed—for example, Virtual Machine Contributor at the appropriate scope. A carefully defined custom role can be narrower. IAM is where the role assignment is made. Using the CLI to create that assignment is also valid when the role and scope are correct.

Manage resource groups

An Azure resource group is a logical container for related resources. Group resources that share a lifecycle so you can deploy, update, govern, and eventually delete them together. For example, an application and its database might belong together, while a shared network has a separate lifecycle.

Organize resources and apply governance

Each resource group belongs to one subscription, and a resource belongs to one resource group at a time. Resources can communicate across resource groups when networking and permissions allow it. Resource groups can contain resources in different regions. The resource group’s own location specifies where Azure stores its metadata.

Management feature	How it applies to a resource group
Azure RBAC	Assign a team permissions over the group and its resources. Parent assignments also apply.
Azure Policy	Apply requirements to resources, such as allowed regions or required tags.
Locks	Protect the group and its resources from deletion or modification.
Tags	Describe ownership, project, or environment. Resource tags require explicit application or policy-based copying.
Budgets	Track group spending and trigger alerts at configured thresholds.

Use consistent names, such as rg-atlas-prod-eastus, to identify workload, environment, and location. Deleting a resource group deletes its contained resources, subject to locks and other restrictions, so review shared dependencies first.

Move resources between resource groups

Create the destination group, select the resources in the source group, and choose Move → Move to another resource group. Azure validates whether the selected resources and their dependencies support the move. During the operation, both groups are temporarily locked against management changes. The resources retain their regions, but their resource IDs change. Review references and inherited permissions afterward. Cross-subscription moves require both subscriptions to use the same Microsoft Entra tenant.

Move the existing resources after handling certificate restrictions. Uploaded/imported TLS certificates require deletion and re-upload, followed by restoring bindings. Free App Service managed certificates require deletion and recreation. The requirement to move all App Service resources together is specifically documented for cross-subscription moves, so avoid treating it as a universal rule for every resource-group move.

In PowerShell example tests role lookup and resource-group scope. The listed answer is $RoleName = "CustomRole1", because -Name expects the role’s name. The corrected assignment is:

$rg = "RG1"
$RoleName = "CustomRole1"
$Role = Get-AzRoleDefinition -Name $RoleName

New-AzRoleAssignment `
    -SignInName "user1@contoso.com" `
    -RoleDefinitionName $Role.Name `
    -ResourceGroupName $rg

Use Get-AzRoleDefinition -Id <role-id> when looking up by ID. For nightly automation, also check whether the assignment already exists before creating it again. Microsoft Learn

In the Azure Backup example, Vault1 is simply a resource contained in RG1. After installing MARS, download the vault credentials file and register Server1 with the vault. Registration also configures the encryption passphrase needed for recovery.

Configure management groups

Azure management groups organize subscriptions so you can govern them together. Assign Azure Policy or Azure RBAC roles to a management group, and those assignments flow down to its descendant subscriptions, resource groups, and resources.

In this example, both production subscriptions inherit the approved-regions policy and the auditors’ Reader assignment. The Development branch receives its own assignments. A policy assigned at the tenant root reaches every branch, so reserve that scope for requirements that apply throughout the organization.

To configure the hierarchy in the Azure portal

1. Open Management groups.

2. Create groups with meaningful IDs and display names, such as Production and Development.

3. Place subscriptions under the appropriate group.

4. Configure Policy and Access control (IAM) assignments at the intended scope.

5. Check inherited governance before moving subscriptions between groups.

AZ-104 fact	Meaning
One tenant	All subscriptions in the hierarchy trust the same Microsoft Entra tenant.
One parent	Each subscription and each non-root management group has one parent.
Six levels	Up to six management group levels below the root, excluding subscriptions.
Inheritance	Moving a subscription changes which parent policies and role assignments it inherits.

Exam cue. If a requirement covers several subscriptions, consider a management group as the assignment scope.

Role Assignment and management group scope

An Azure role assignment connects a security principal, a role, and a scope. Assigning a role to a group at management group scope gives its members the role’s permissions throughout that management group’s descendant hierarchy.

The user receives access through Cloud Operations group membership. The assignment reaches resources under Production, while the role definition determines which operations are allowed. Virtual Machine Contributor grants VM management permissions, so inheritance does not give the group permission to manage every resource type. The Development branch is outside this assignment’s scope.

*Management group hierarchy with three business units that have both prod and dev environments could be: Root-->Bussines unit-->Environment-->Subscriptions

Manage subscriptions

An Azure subscription is a billing and management boundary for resource groups and resources. Organizations often use separate subscriptions for production, development, departments, or customers so each can have its own access permissions, budgets, and governance requirements

Each subscription trusts one Microsoft Entra tenant, while a tenant can support many subscriptions. Management groups apply shared governance above subscriptions. The billing relationship determines how charges are invoiced and can cover multiple subscriptions.

Management task	What you configure
Organize subscriptions	Use meaningful names and place subscriptions in the appropriate management group.
Control access	Assign Azure RBAC roles through Access control (IAM). Subscription-level assignments inherit to its resource groups and resources.
Enforce governance	Assign Azure Policy requirements, apply subscription tags, and configure resource locks where needed.
Manage costs	Review Cost Analysis, create budgets and alerts, and assess Advisor recommendations.
Manage deployment readiness	Check quotas and register required resource providers, such as Microsoft.Compute.
Maintain subscription context	Verify the selected subscription before deploying resources or running scripts.

For example, an administrator managing Production can assign an operations group Contributor, configure a monthly budget, and enforce approved deployment regions. Development can have different permissions and budgets while inheriting organization-wide requirements from the same management group.

AZ-104 distinction. Moving a subscription between management groups changes its inherited governance. Changing its Entra directory affects identity-based access. Transferring billing ownership changes the invoicing arrangement. Treat these as separate administrative operations.

Manage costs by using alerts, budgets, and Azure Advisor recommendations

Azure cost management combines understanding what creates charges, monitoring spending, optimizing usage, and allocating costs to the teams or customers responsible.

Architecture determines the total cost

The wider architecture sketch shows why a VM’s advertised compute price is only one part of the workload’s bill. Network services, disks, databases, logs, backups, and security services can contribute additional charges. Use Cost Analysis to identify which services and resources drive actual spending.

Component	Examples of cost drivers
Compute	Service tier, size, region, instance count, and running time
Storage and databases	Capacity, redundancy, performance tier, transactions, and throughput
Networking	Outbound data transfer, peering traffic, and deployed network appliances or gateways
Monitoring	Log ingestion, retention, queries, and chargeable alerting features
Protection	Backup storage, protected instances, and enabled security plans

The combination depends on the design. For example, an application using private connectivity, extensive logging, and replicated storage has a different cost profile from a simple standalone VM.

A VM has several associated costs

Stopped and Stopped (deallocated) have different billing implications. Shutting down inside the guest operating system can leave the VM allocated and compute billing active. Deallocation releases the host allocation and stops VM compute usage charges. Disks and some networking resources continue to incur charges. Existing reservation or savings-plan commitments also continue according to their terms.

Review the complete VM footprint when optimizing. A deallocated test VM can still have provisioned disks, retained backups, and other billable resources. VM Scale Sets, AKS nodes, and Azure Virtual Desktop hosts also depend on underlying compute and associated services.

AZ-104 Note. To stop an unused VM’s compute usage charges, ensure it is deallocated.

Optimize usage, then choose discounts

Azure Advisor identifies opportunities such as resizing or shutting down underutilized resources. Validate recommendations against workload requirements before buying commitments because resizing changes the demand those commitments should cover. Advisor savings estimates can overlap, so adding every estimate together can overstate savings.

Optimization	Purpose
Rightsizing	Select a size that meets measured demand.
Autoscaling or scheduled deallocation	Reduce provisioned capacity or running hours when demand falls.
Reservations	Discount eligible usage through a commitment to specified resource characteristics.
Savings plan for compute	Discount eligible compute usage through an hourly spending commitment.
Azure Hybrid Benefit	Apply qualifying existing licenses to eligible Azure services.
On-demand capacity reservation	Reserve capacity availability. Capacity reservation has its own billing implications.

These options address different needs and must be evaluated against the workload.

automation scenario

Implement a workflow that analyzes utilization over time, checks an explicit allowlist, excludes critical production VMs, obtains any required approval, and deallocates eligible machines. Advisor supplies recommendations. A separately configured Logic App, Function, or Automation runbook performs the approved changes. Advisor alerts can invoke action groups to start that workflow.

Monitor spending and respond to thresholds

For a monthly threshold of $X, configure an actual-cost budget notification at that amount. A higher threshold of $X + Y can invoke an action group linked to your automation. That automation needs its own identity, permissions, and logic to assign a policy or change resources. A budget does not itself impose a spending cap. Cost-data and notification delays mean the response cannot guarantee an exact dollar cutoff.

Use the tools for their respective questions:

• Cost Analysis shows where spending is occurring.

• Budgets compare actual or forecast spending with a target.

• Anomaly alerts identify unusual spending.

• Advisor alerts notify you about new optimization recommendations.

• Azure Monitor supplies performance evidence for operational decisions.

Govern customer costs and allocate shared services

A subscription per customer provides separate resource, access, and cost-reporting scopes. A management group supplies centralized governance when the subscriptions trust the same Microsoft Entra tenant. Separate subscriptions do not automatically produce separate customer invoices. Customer charging and billing ownership still depend on the commercial arrangement. learn.microsoft.com

For supported billing agreements, cost allocation rules distribute shared-service costs to subscriptions, resource groups, or tag-defined targets. For example, allocate shared networking evenly, by custom percentages, or proportionally using the targets’ compute, storage, or network costs. Tags such as Customer, Project, and Environment improve attribution.

Cost visibility is available at resource group scope, as well as broader scopes. Cost Management Reader at the required scope is the usual read-only choice for cost reporting. Contributor already includes cost-management capabilities within its assigned scope, so investigate the selected scope, billing-agreement visibility settings, and data availability before adding subscription-wide access. A security administration role alone does not establish cost access, and Billing Reader is not the automatic least-privilege answer for resource-group reporting.

Azure management groups

Azure management groups organize subscriptions into a hierarchy for centralized governance. Assign Azure Policy or Azure RBAC roles at a management group, and those assignments inherit down to its descendant subscriptions and resources.

In this example, both production subscriptions inherit the approved-regions policy and the auditors’ Reader assignment. Development receives its own requirements. Assignments at the tenant root management group apply throughout the hierarchy.

To configure management groups in the Azure portal:

1. Open Management groups and create groups with meaningful IDs and display names.

2. Arrange child management groups and subscriptions beneath the appropriate parents.

3. Assign governance requirements through Azure Policy.

4. Assign administrative access through Access control (IAM).

5. Review inherited permissions and policies before moving subscriptions between groups.

AZ-104 concept	What to remember
Tenant relationship	Subscriptions in the hierarchy must trust the same Microsoft Entra tenant.
Parent relationship	Each subscription and non-root management group has one parent.
Hierarchy depth	Supports six management group levels below the root, excluding subscriptions.
Moving subscriptions	Changes which parent policies and role assignments apply.
Managing the hierarchy	Management Group Contributor can manage management groups. Assigning roles or policies requires additional permissions.

Example. When a new subscription is placed under Production, it inherits that branch’s assignments automatically. Policy evaluation and any required remediation still take time, so placement alone does not establish immediate compliance.