AZ-900 management and governance explained
Describe Azure management and governance is the AZ-900 domain worth 30–35% of the exam. It answers four practical questions about running Azure: what it costs, how you keep it compliant, how you deploy and manage it, and how you know it is healthy. The difficulty is that many tools sound alike. Almost every question in this domain comes down to picking the right one of two or three similar tools.
Cost management
What affects cost
- Resource type and size. A larger VM or a premium storage tier costs more.
- Consumption. Pay-as-you-go bills actual use; reservations lower the price for a commitment.
- Region. The same service can cost different amounts in different regions.
- Bandwidth. Data coming into Azure is generally free; data going out, or between regions, is charged.
- Maintenance. Resources left running or orphaned after a project keep costing money.
- Licensing. Existing licences can sometimes be reused through Azure Hybrid Benefit.
Tools
| Tool | Use it to |
|---|---|
| Pricing calculator | Estimate the cost of services you have not deployed yet |
| Cost Management | Analyse, budget and alert on spending for what is already running |
| Tags | Label resources (department, project, environment) so costs can be grouped and reported |
The calculator is for planning; Cost Management is for what is already running. Tags do not control anything by themselves — they are metadata that cost reports and policies can use.
Governance and compliance
| Tool | Purpose |
|---|---|
| Microsoft Purview | Discover, classify and govern data across Azure, on-premises and other sources; risk and compliance |
| Azure Policy | Define rules for resource settings and evaluate or enforce compliance, for example allowed regions or required tags |
| Resource locks | Prevent accidental deletion (CanNotDelete) or any change (ReadOnly) to a resource, group or subscription |
The three-way confusion to master is RBAC versus Azure Policy versus locks:
- RBAC controls who can perform actions.
- Azure Policy controls what configurations are allowed, whoever deploys them.
- Locks stop deletion or modification even by someone with permission, until the lock is removed.
Policies and locks both inherit downwards, like role assignments. A lock on a resource group protects every resource in it.
Managing and deploying resources
- Azure portal: the web interface. Good for learning and one-off tasks.
- Azure Cloud Shell: a browser-based shell with Azure CLI and Azure PowerShell already installed and signed in.
- Azure CLI and Azure PowerShell: command-line tools for scripting. Functionally similar; pick by preference.
- Azure Arc: extends Azure management — policy, monitoring, RBAC — to servers and Kubernetes clusters outside Azure, on-premises or in other clouds.
- Infrastructure as code (IaC): describing infrastructure in files so it can be deployed repeatably and version-controlled.
- Azure Resource Manager (ARM): the deployment and management layer every request to Azure goes through, whether from the portal, CLI, PowerShell or an SDK. ARM templates are JSON files that declare the resources to deploy.
ARM templates are declarative: you describe the end state, not the steps. Deploying the same template twice gives the same result.
Monitoring
| Tool | Tells you |
|---|---|
| Azure Advisor | Personalised recommendations on reliability, security, performance, cost and operational excellence |
| Azure Service Health | Whether Azure itself has an incident, planned maintenance or advisory affecting your services and regions |
| Azure Monitor | Metrics and logs from your resources and applications, with alerts |
| Log Analytics | The tool in Azure Monitor for writing and running queries on log data |
| Azure Monitor alerts | Notifications or actions when a metric or log condition is met |
| Application Insights | Performance and usage monitoring for web applications |
The distinction that decides marks: Service Health is about Microsoft’s platform, Azure Monitor is about your resources, and Advisor gives recommendations rather than live data. This monitoring sub-section was revised in the July 20, 2026 update, so check older study material against it.
Three practice questions
Question 1. Administrators with the Owner role keep deleting a production database by mistake. They must keep their permissions, but deletion of the database must be blocked until someone deliberately removes the protection. What should you use?
- A. Remove the Owner role and assign Reader
- B. Add a tag marking the database as production
- C. Apply a CanNotDelete resource lock to the database
- D. Enable Azure Advisor recommendations
Show answer
Answer: C
A CanNotDelete resource lock prevents deletion even by users with Owner permissions, until the lock itself is removed. Removing the Owner role would take away permissions the administrators need. A tag only labels the resource. Azure Advisor gives recommendations and cannot block actions.
Want more questions like this? Full AZ-900 practice tests →
Question 2. A company runs servers in its own datacenter and in another cloud provider. It wants to manage them with Azure Policy and monitor them alongside its Azure resources. What should it use?
- A. ARM templates
- B. Azure Arc
- C. Azure Migrate
- D. Azure Cloud Shell
Show answer
Answer: B
Azure Arc projects servers and Kubernetes clusters running outside Azure into Azure Resource Manager, so they can be governed with Azure Policy and monitored like Azure resources. ARM templates deploy Azure resources. Azure Migrate moves servers into Azure rather than managing them where they are. Cloud Shell is a command-line environment.
Want more questions like this? Full AZ-900 practice tests →
Question 3. Users report that an application hosted in Azure is unreachable. You want to know first whether an outage in the Azure platform in your region is the cause. Which tool should you check?
- A. Azure Service Health
- B. Azure Advisor
- C. The Azure pricing calculator
- D. Azure Monitor Application Insights
Show answer
Answer: A
Azure Service Health reports incidents, planned maintenance and advisories in the Azure platform that affect your subscriptions and regions. Azure Monitor shows metrics and logs for your own resources. Azure Advisor gives best-practice recommendations. The pricing calculator estimates cost.
Want more questions like this? Full AZ-900 practice tests →
How to study this domain
Build a one-line definition for every tool in the outline and test yourself on the confusing trios: calculator versus Cost Management versus tags; RBAC versus Policy versus locks; Service Health versus Monitor versus Advisor. The study plan covers this domain in week 4, and the cheat sheet has the pairs on one page.