The "manage Azure subscriptions and governance" item in AZ-104 domain 1 (20–25%) bundles together Azure Policy, resource locks, tags, resource groups, subscriptions, management groups, and "manage costs by using alerts, budgets, and Azure Advisor recommendations." Our question bank has more than 20 questions in this area, and the answer usually turns on a behavior rule: "Is this setting inherited by lower scopes?", "Does it apply to resources that already exist?", "Does it stop an Owner too?"
This article first draws the governance hierarchy from management groups down to resources, then explains how Azure Policy, resource locks, and tags each behave on top of it. Finally it covers managing cost with budgets, cost alerts, and Azure Advisor. RBAC, which decides what people can do, is covered in Reading Azure RBAC Role Assignments for AZ-104, and the basics of Policy and locks in Identity and Governance.
---
The Governance Hierarchy: From Management Groups to Resources
A company places divisions under headquarters, teams under divisions, and employees under teams. Rules set by headquarters apply to every division and team. Azure groups resources in four levels as well, management group → subscription → resource group → resource, and pushes settings applied above down to the levels below.
| Level | Role | What to remember | |------|------|------| | Management group | Groups subscriptions so policies and roles apply once | Up to 10,000 per directory, a tree up to six levels deep, a root management group at the top | | Subscription | Billing and access boundary | Belongs to only one management group; transferring it to another Entra tenant deletes all its role assignments | | Resource group | Logical group of resources that share a lifecycle | A resource belongs to one group, groups can't be nested, deleting a group deletes everything in it | | Resource | Actual services such as VMs, storage accounts, and VNets | Can be in a different region from its resource group |
Every management group and subscription can have only one parent. When you move a subscription to another management group, it picks up the new parent's policies and role assignments and loses what it inherited from the old parent.
!In the governance hierarchy, RBAC, Policy, and locks are inherited, but tags are not
Exam tip: "Apply the same policy to several subscriptions at once" means assigning the policy to a management group. If "users can't access resources after a subscription was transferred to another tenant," it's because the transfer permanently deleted the role assignments, so they must be reassigned in the new tenant.
---
Azure Policy: Rules That Resources Must Follow
If RBAC decides "who can do what," Azure Policy decides "what resources must look like." It can stop even an Owner from creating a resource that breaks the policy.
| Component | Meaning | |------|------| | Policy definition | A single rule (condition + effect) | | Initiative | A set that groups several policy definitions | | Assignment | Applies a definition or initiative to a scope, with optional excluded child scopes | | Exemption | Removes specific resources from evaluation while keeping a record |
The effect decides what a policy does when it meets a resource that matches its condition.
| Effect | Behavior | Clues in a question | |------|------|------| | Deny | Rejects create or update requests that break the rule | "allow creation only in approved regions" | | Audit | Allows the request but records it as non-compliant | "don't block, just report" | | Append | Adds fields during create or update | "add a setting value to the request" | | Modify | Adds, changes, or removes properties such as tags; existing resources are fixed with a remediation task | "add the tag automatically if missing" | | DeployIfNotExists | Deploys a related resource if it doesn't exist | "deploy diagnostic settings automatically if missing" | | AuditIfNotExists | Records non-compliance if a related resource doesn't exist | "report VMs without the extension" | | DenyAction | Blocks a specific action (such as delete) | "block deletion of critical resources" | | Disabled | The policy is turned off | Keep the assignment but switch it off for now |
Policies are evaluated when a resource is created or updated and when an assignment is created, and then reevaluated every 24 hours. Assigning a new Deny policy doesn't delete or change existing resources; it only marks them non-compliant. To fix existing resources you run a remediation task for a DeployIfNotExists or Modify policy, and the policy assignment's managed identity must hold the required role.
Exam tip: "Tag existing non-compliant resources as well" means assigning a Modify policy and then running a remediation task. An option that only assigns a Deny policy blocks future resources and nothing else.
---
Resource Locks: Preventing Accidental Deletion
A resource lock is like a second lock on a safe. Even someone with permission must remove the lock before deleting or changing the resource.
| Lock | Portal name | What it blocks | |------|------|------| | CanNotDelete | Delete | Blocks deletion only; reading and modifying are allowed | | ReadOnly | Read-only | Blocks both deletion and modification (similar to limiting every user to Reader) |
A lock at a parent scope is inherited by every resource below it, including resources added later The most restrictive lock in the inheritance chain takes precedence Locks apply to all users, including Owners; creating or deleting a lock requires Microsoft.Authorization/locks permissions, as held by Owner or User Access Administrator Locks apply only to control plane (Azure Resource Manager) operations and don't block data plane operations If one resource has a delete lock, deleting its whole resource group fails (no partial deletion)
ReadOnly locks block some operations you might not expect, because they block POST requests to ARM.
| Where the ReadOnly lock is | What gets blocked | |------|------| | Storage account | Listing account keys (users must access data with Entra credentials) | | Resource group that contains a VM | Starting and restarting the VM | | Storage account | Creating a blob container through the control plane (creation through the data plane still works) |
Exam tip: If "an Owner can't delete a resource," suspect a lock. "VMs in a resource group can't be started" is caused by a ReadOnly lock on the resource group.
---
Tags: Labels That Track Cost and Ownership
A tag is a name-value pair attached to a resource (for example, CostCenter = 1001, Environment = Prod). Use tags to group costs in cost analysis and to find owners or environments.
Up to 50 tag pairs per resource, resource group, and subscription Tags on a resource group or subscription aren't inherited by the resources inside When inheritance is needed, assign a built-in Modify policy such as "Inherit a tag from the resource group" The Tag Contributor role manages tags without access to the resources themselves
Exam tip: "A Department tag was added to the resource group, but it doesn't show on the VMs inside" is expected behavior. The fix is a tag inheritance policy plus a remediation task.
---
Cost Management: Budgets, Alerts, and Azure Advisor
A budget is like the monthly spending limit in a household ledger. It tells you when you're getting close, but it doesn't freeze your card.
| Tool | What it does | What to remember | |------|------|------| | Budget | Sets an amount per month, quarter, or year and alerts at actual and forecasted cost thresholds | Doesn't stop resources, evaluated every 24 hours, resets automatically each period | | Action group link | Sends email or push, runs a Logic App, Automation runbook, and more when a budget threshold is hit | Supported only for budgets at subscription and resource group scope | | Cost alerts | Budget alerts, credit alerts, department spending quota alerts, anomaly alerts | Shown together in Cost Management | | Cost analysis | Breaks down cost by service, resource group, or tag | Department-level analysis is easy only with tags | | Azure Advisor | Personalized recommendations in five categories: reliability, security, performance, cost, operational excellence | Right-size or shut down underutilized VMs, buy reservations, and more |
Exam tip: "Notify the administrator when monthly cost reaches 80% of the budget and stop the dev VMs automatically at 100%" means budget alerts plus an action group (such as an Automation runbook). A budget alone never stops resources. "Find ways to cut cost on underused VMs" points to Azure Advisor's cost recommendations.
---
Exam Quick Reference
Key points to check one last time before the exam.
| Topic | What to remember | |------|------| | Hierarchy | Management group → subscription → resource group → resource | | Management groups | Up to 10,000, six levels deep, one parent | | Subscription tenant transfer | Role assignments are permanently deleted; reassign them in the new tenant | | Inheritance | RBAC, Policy, and locks are inherited; tags are not | | Policy vs RBAC | Rules resources must follow vs actions people can take | | Deny vs Audit | Reject vs allow and record | | Modify · DeployIfNotExists | Fix existing resources with a remediation task; the assignment's managed identity is needed | | Evaluation timing | On create, update, and assignment, then every 24 hours | | Locks | CanNotDelete (delete only) vs ReadOnly (modify and delete); applies to Owners; control plane only | | ReadOnly side effects | Can't list storage keys; can't start or restart VMs in the resource group | | Tags | Up to 50 pairs; inherit through a Modify policy | | Budgets | Notify only; automatic action through action groups (subscription and RG scope); Advisor has five categories |
---
Next Steps
With the rules for resources sorted out, continue with managing the people and groups who wor