AZ-305 identity, governance and monitoring
Design identity, governance, and monitoring solutions is worth 25–30% of AZ-305. It covers three areas: recommending how logs are collected and routed, recommending how people and workloads authenticate and are authorized, and recommending how an estate of subscriptions is structured and kept compliant. The questions are about choosing the right model for an organisation, not about clicking through a setting.
Design solutions for logging and monitoring
Logs and where they go
Azure Monitor collects metrics and logs; Log Analytics workspaces store the logs and answer KQL queries. A diagnostic setting on a resource sends its logs to one or more destinations:
| Destination | Choose it when |
|---|---|
| Log Analytics workspace | You need to query, alert and correlate across resources |
| Storage account | You need cheap, long-term retention and do not query often |
| Event Hubs | You need to stream logs to a third-party SIEM or another system |
The usual design question is workspace layout. One central workspace simplifies cross-resource queries and retention; several workspaces are justified by data residency, separate ownership or very different retention needs. Remember that access can be scoped by resource permissions even in a shared workspace.
Monitoring tools
Application Insights monitors application performance and dependencies, VM insights and container insights cover infrastructure, and Azure Monitor alerts with action groups handle notification. If a scenario asks about end-to-end application tracing, think Application Insights; if it asks about trends across many resources, think workspace plus workbooks or dashboards.
Design authentication and authorization
Authentication
Microsoft Entra ID is the identity platform. Key design choices:
- Workforce identities live in Entra ID, synchronised from on-premises Active Directory with Entra Connect or cloud sync when a hybrid estate exists.
- Partners and guests use B2B collaboration, so they sign in with their own organisation’s identity.
- Customers of a consumer-facing app use the external identity service for customers, which handles social sign-in and self-service sign-up.
- Conditional Access and multifactor authentication enforce risk-based sign-in rules.
Authorization
Azure RBAC grants access to Azure resources at management group, subscription, resource group or resource scope. Recommend the narrowest scope and the least-privileged role. A recurring distinction is between Entra roles (manage the directory) and Azure roles (manage resources).
For on-premises resources, Microsoft Entra application proxy publishes an internal web app without opening inbound firewall ports or building a VPN. Hybrid joins and Kerberos-based options come up for file shares and legacy apps.
Workload identity and secrets
For code that calls Azure services, prefer a managed identity over a service principal with a secret. Managed identities have no credential for you to store or rotate. System-assigned identities live and die with one resource; user-assigned identities can be shared across resources. Use a service principal only when the workload runs somewhere managed identities are unavailable.
Azure Key Vault stores secrets, keys and certificates. Recommend RBAC for data-plane access, private endpoints when the vault must not be reachable from the internet, soft delete and purge protection for recovery, and managed HSM only when strict key-custody rules require it.
Design governance
Structure
Azure resources nest as management groups, subscriptions, resource groups and resources. Policy and role assignments flow down the tree, so design the tree around where you want controls to apply:
- Management groups for business units, environments or compliance boundaries.
- Subscriptions as scale and billing boundaries; split when you reach limits or need separate cost owners.
- Resource groups for resources that share a lifecycle.
- A tagging strategy for cost allocation and ownership. Tags do not inherit by default, so enforce them with Azure Policy.
Compliance
Azure Policy evaluates resources against rules: Deny blocks, Audit reports, Modify and DeployIfNotExists correct. Initiatives group policies for a standard. Defender for Cloud adds a compliance view against regulatory frameworks. When a scenario says “prevent”, pick Deny; when it says “find out”, pick Audit.
Identity governance
- Access reviews make owners periodically confirm who still needs access.
- Entitlement management packages access for people, including external users, with approval and expiry.
- Privileged Identity Management gives just-in-time, time-limited elevation instead of permanent admin roles.
Worked example
A retailer has development, test and production subscriptions in three countries and must keep customer data in the EU. A sound design: a management group per environment, an allowed-locations policy at the top, production under a stricter group with Deny policies, a central workspace for security logs with Event Hubs export to the SIEM, managed identities for every app, and PIM for administrators.
Practice questions
Question 1. An organisation has 40 subscriptions across development, test and production. All production subscriptions must enforce the same set of Azure Policy rules, and new production subscriptions must inherit them automatically. What should you recommend?
- A. Assign the policy initiative separately to each production subscription
- B. Assign the policy initiative to each production resource group
- C. Put production subscriptions under one management group and assign the initiative there
- D. Tag production subscriptions with environment=prod
Show answer
Answer: C
Policy assignments flow down the hierarchy, so placing all production subscriptions under one management group and assigning the initiative there covers existing and future subscriptions. Assigning the policy to each subscription needs manual work for every new one. Resource group assignments cover only part of a subscription. Tags do not enforce anything by themselves.
Want more questions like this? Full AZ-305 practice tests →
Question 2. An Azure Function must read secrets from Key Vault. The security team does not want any credential stored in configuration or rotated by developers. What should you recommend?
- A. Enable a managed identity on the function and grant it access to the vault
- B. Create a service principal and store its client secret in app settings
- C. Store a storage account key in the function configuration
- D. Give the function a shared access signature
Show answer
Answer: A
A managed identity gives the function an identity without a credential to store or rotate; you grant it access to the vault. A service principal with a client secret needs the secret stored and rotated. A storage account key is not a Key Vault credential. A shared access signature does not authenticate to Key Vault.
Want more questions like this? Full AZ-305 practice tests →
Question 3. A company shares a project portal with staff from a partner organisation. Access should expire automatically and be reviewed by sponsors, and partner staff should keep signing in with their own organisation's accounts. What should you recommend?
- A. Create a cloud-only account in your tenant for each partner user
- B. Share a single account among the partner staff
- C. Give the partner staff a VPN connection to the network
- D. Invite them as B2B guests and manage their access with entitlement management and access reviews
Show answer
Answer: D
B2B collaboration lets guests use their own identity, and entitlement management with access packages adds approval, expiry and periodic reviews. Creating cloud accounts for partner staff duplicates identities and passwords. Sharing one account removes accountability. A VPN does not govern application access or expiry.
Want more questions like this? Full AZ-305 practice tests →
What to do next
Cover the data side with the data storage guide, then check the cheat sheet for the decision shortcuts. The identity and governance objectives overlap with AZ-104, but here you choose the model rather than configure it.