4.1 Introduction to Azure Governance

In a small Azure lab, resources can be created and managed manually. In an enterprise, the environment may contain hundreds of subscriptions, thousands of resources, multiple teams, multiple regions, and strict security or compliance requirements. Governance provides the management framework required to keep such an environment controlled.

Definition

Azure Governance is a structured collection of Azure tools, policies, controls, and management practices used to keep an organization’s cloud environment organized, secure, standardized, cost-aware, and compliant with business requirements. It helps administrators define how Azure resources should be created, accessed, protected, classified, and monitored across departments, subscriptions, and workloads. In a large enterprise, governance provides a consistent management framework so that cloud resources do not grow in an uncontrolled or inconsistent manner.

(Azure Governance का मतलब केवल Resources बनाना या manage करना नहीं है। इसका purpose यह सुनिश्चित करना है कि Azure Environment company के rules के अनुसार organized, secure, cost-controlled और compliant रहे।)

Explanation

Governance answers questions such as: Who owns this resource? Which department is paying for it? In which region is it allowed to run? Can it be deleted? Which standards must it follow? Which team can access it? In a mature cloud environment, these questions must be answered consistently rather than manually.

Example

A global company uses Azure for HR, Finance, Sales, Development, and Production. Governance can help separate workloads, classify costs, protect production resources, and enforce approved deployment standards.

Why is it Important?

Without governance, cloud environments can become difficult to control as resource count and organizational complexity increase.

Main Goals of Azure Governance

• Cost Control – identify and manage cloud spending.
• Security – reduce uncontrolled or risky configurations.
• Compliance – help resources follow organizational requirements.
• Standardization – use consistent rules and structures.
• Organization – make resources easier to identify and manage.
• Protection – reduce accidental deletion or modification of critical resources.

4.2 Azure Subscription

An Azure Subscription is one of the most important administrative boundaries in Azure. Azure resources are created under a Subscription, and the Subscription is associated with billing, limits, access, and governance.

Definition

An Azure Subscription is a logical Azure boundary under which cloud resources are created, organized, consumed, and billed. It acts as both a billing boundary and an administrative boundary, allowing an organization to track service usage and cost while also applying access control, quotas, service limits, policies, and other governance settings at Subscription scope. Organizations can use separate Subscriptions to isolate departments, projects, countries, or environments such as Development, Testing, and Production when separate management and cost visibility are required.

(Subscription को Azure का billing और administrative boundary समझें। Resources किसी Subscription के अंदर create होते हैं और उसी boundary पर billing, access और कई governance settings manage की जा सकती हैं।)

Explanation

A Subscription helps an organization separate cloud usage into manageable boundaries. For example, Production can be kept separate from Development so that cost, access, quotas, and governance can be managed independently. Large organizations may also separate subscriptions by department, geography, business unit, or environment.

Example

ABC Technologies uses separate Development, Testing, and Production subscriptions. This makes it easier to track spending and apply different levels of control to each environment.

Why is it Important?

Subscriptions make Azure usage easier to organize, govern, and account for.

Important Responsibilities Associated with a Subscription

• Billing management.
• Resource organization.
• RBAC access control.
• Resource and service quotas.
• Service limits.
• Azure Policy assignments.
• Cost Management and reporting.

Subscription as a Billing Boundary

Azure usage generates cost. Keeping workloads in appropriate subscriptions can help an organization understand which environment, department, or business unit is consuming Azure services.

Subscription as an Administrative Boundary

Administrators can use the Subscription as a scope for access control and governance. A role or policy assigned at Subscription scope can affect resources below that boundary according to the Azure hierarchy.

4.3 Azure Subscription Types

Azure can be purchased or consumed through different commercial arrangements. The Module 4 source introduces Free Trial, Pay-As-You-Go, Enterprise Agreement, Microsoft Customer Agreement, and Cloud Solution Provider.

Definition

Azure Subscription types and purchasing arrangements describe the different ways an individual or organization can obtain, consume, and pay for Microsoft Azure services. The appropriate model depends on factors such as organization size, billing requirements, contractual relationship with Microsoft, expected Azure usage, and whether Azure is purchased directly or through a Microsoft partner. The supplied module introduces Free Trial, Pay-As-You-Go, Enterprise Agreement, Microsoft Customer Agreement, and Cloud Solution Provider as the main models students should understand.

Explanation

The correct purchasing model depends on organization size, billing requirements, contractual arrangement, and whether a Microsoft partner is involved.

4.4 Management Groups

When a company owns only one Subscription, governance can be applied directly at Subscription level. When the company owns many Subscriptions, repeating the same governance configuration across each one becomes difficult. Management Groups provide a higher organizational level.

Definition

An Azure Management Group is a higher-level governance container used to organize and manage multiple Azure Subscriptions within a common hierarchy. It allows administrators to apply governance controls such as Azure Policy and RBAC at a level above individual Subscriptions, which is especially useful when the same organizational rules must apply across many business units, countries, or environments. Instead of configuring every Subscription separately, Management Groups provide a centralized structure for enterprise-wide administration and governance.

(Management Group multiple Subscriptions के ऊपर एक higher-level container है। इसका use तब useful होता है जब same governance rule या access structure कई Subscriptions पर centrally apply करना हो।)

Explanation

Management Groups are useful in large enterprises with multiple countries, departments, or environments. Instead of assigning the same policy separately to every Subscription, administrators can organize subscriptions under a Management Group and apply governance at that level.

Example

A corporate management group contains India, USA, UK, and Australia subscriptions. A security policy applied to the Management Group can govern the subscriptions below it.

Why is it Important?

Management Groups reduce repetitive administration and support centralized enterprise governance.

Infographic: Centralized governance using a Management Group.

Benefits of Management Groups

• Organize multiple Subscriptions.
• Centralize governance.
• Apply Azure Policy at a higher scope.
• Assign RBAC at a higher scope.
• Create a logical enterprise hierarchy.
• Simplify management across many Subscriptions.

4.5 Resource Groups

After a Subscription is created, Azure resources still need a logical organization model. Resource Groups provide that application/project-level grouping.

Definition

An Azure Resource Group is a logical management container used to organize Azure resources that belong to the same application, project, environment, department, or business function. Resources such as Virtual Machines, Storage Accounts, Virtual Networks, databases, Public IP addresses, and App Services can be grouped together so administrators can manage access, policy, deployment, and lifecycle at a common scope. Because the supplied module states that deleting a Resource Group deletes the resources inside it, Resource Groups should also be designed and managed with resource lifecycle and dependency awareness.

(Resource Group को केवल folder मत समझें। यह related Azure Resources को एक logical management unit में organize करता है। Production में Resource Group delete करने से पहले बहुत सावधानी जरूरी है क्योंकि उसके अंदर के resources भी प्रभावित होते हैं।)

Explanation

Resources that belong to the same application, project, environment, or business function can be placed in the same Resource Group. This makes access control, policy application, deployment, and resource lifecycle management easier.

Example

A company website uses VM-Web01, SQL Database, Storage Account, Virtual Network, and Public IP. These related resources can be grouped in RG-WebApp.

Why is it Important?

Resource Groups help administrators manage related resources as a logical unit.

Infographic: Related application resources inside RG-WebApp.

Why Resource Groups Are Used

• Organize related resources.
• Apply RBAC at Resource Group scope.
• Apply governance policies at a logical workload boundary.
• Manage application resources together.
• Simplify deployment and lifecycle management.

Important Deletion Behavior

The supplied Module 4 content states that deleting a Resource Group deletes the resources inside it. Therefore, administrators should verify dependencies and business impact before deleting a Resource Group.

Naming Convention Examples

• RG-Production
• RG-Development
• RG-Network
• RG-HR
• RG-Finance
• RG-HR-Prod-EastUS
• RG-App-Dev-CentralIndia

4.6 Azure Resource Locks

Production resources may be technically accessible to administrators who have permission to modify or delete them. Human mistakes can still happen. Resource Locks add an additional protection mechanism against accidental administrative actions.

Definition

Azure Resource Locks are protection controls that administrators can apply to important Azure resources to reduce the risk of accidental deletion or modification. They add a safeguard at the resource-management level even when a user already has Azure permissions to manage the resource. The module introduces two lock types—Delete (CanNotDelete) and Read-Only—so administrators can either prevent deletion while still allowing changes, or prevent both modification and deletion for resources that require stronger protection.

Explanation

A Resource Lock does not replace RBAC. RBAC determines whether a user has permission to perform an action. A lock adds resource protection even when an authorized administrator attempts an operation that the lock blocks.

Example

A Production SQL Database is critical for an application. Applying a Delete Lock can prevent accidental deletion until the lock is intentionally removed.

Why is it Important?

Locks are useful for production databases, critical networking resources, shared infrastructure, and other resources where accidental changes could cause business impact.

Infographic: Delete Lock vs Read-Only Lock.

Delete Lock (CanNotDelete)

Users can read and modify the resource, but deletion is blocked until the lock is removed.

Read-Only Lock

Users can read the resource, but modification and deletion are blocked.

(सबसे आसान difference: Delete Lock केवल deletion रोकता है, जबकि Read-Only Lock modification और deletion दोनों रोकता है।)

Lock Scope and Inheritance

The supplied Module 4 notes state that locks can be applied at Subscription, Resource Group, or individual Resource level, and child resources can inherit protection from the higher scope.

4.7 Azure Tags

As Azure environments grow, technical resource names alone may not provide enough business information. Administrators need to know who owns a resource, which department uses it, whether it is Production or Development, and which cost center should be charged.

Definition

Azure Tags are customizable key-value metadata pairs that administrators attach to Azure resources to add business and operational information that may not be clear from the resource name alone. Tags can identify details such as Department, Environment, Owner, Project, CostCenter, or BusinessUnit and can therefore improve resource organization, ownership tracking, reporting, automation, and cost analysis. In large Azure environments, a consistent tagging strategy makes it easier to understand why a resource exists, who is responsible for it, and how its cost should be classified.

Explanation

A tag adds business metadata to a resource. The Key describes the category and the Value describes the resource's classification within that category. Tags can support reporting, ownership identification, cost analysis, and automation scenarios.

Example

A Virtual Machine can have Department=Finance, Environment=Production, Owner=CloudTeam, Project=ERP, and CostCenter=FIN-001.

Why is it Important?

Tags make large Azure environments easier to understand from a business and operational perspective.

500 Virtual Machines Example

If a company has 500 Virtual Machines, identifying department ownership manually becomes difficult. Department tags can help classify resources so Azure Cost Management reports can be grouped using those tags.

(Tags Resource को protect नहीं करते और Permission भी नहीं देते। Tags का main purpose Resource को business information के साथ classify करना है—जैसे Department, Owner, Environment और CostCenter।)

4.8 Azure Policy

Organizations often have mandatory cloud standards. Examples include approved Azure regions, mandatory tags, approved VM sizes, encryption requirements, or required security settings. Depending only on administrators to remember every standard is difficult.

Definition

Azure Policy is an Azure governance service used to define, evaluate, and enforce organizational standards across cloud resources. It allows administrators to check whether Azure resources follow required rules—such as approved deployment regions, mandatory tags, allowed VM sizes, encryption requirements, or security configurations—and to take an appropriate governance action when a resource is non-compliant. Depending on the Policy effect, Azure can deny a deployment, audit the resource, add or modify required properties, or deploy a missing configuration.

(Azure Policy का focus User Permission नहीं, बल्कि Resource Standards और Compliance है। Company के rules के अनुसार Resource create/configure हो रहा है या नहीं, Policy उसे evaluate और जरूरत के अनुसार enforce कर सकती है।)

Explanation

Azure Policy evaluates Azure resources against defined governance rules. Depending on the policy effect, Azure can deny a non-compliant deployment, audit the condition, add or modify properties, or deploy required configuration.

Example

A company requires all resources to be deployed only in Central India. If a user attempts to deploy a VM in East US, an assigned policy can block the non-compliant deployment.

Why is it Important?

Policy turns organizational standards into repeatable governance controls instead of relying only on manual checking.

Infographic: Azure Policy evaluates resources against organizational standards.

Common Governance Requirements

• Allow only approved Azure regions.
• Require mandatory Tags.
• Restrict allowed VM sizes.
• Require encryption settings.
• Enforce secure configurations.
• Audit resources that do not meet standards.

4.9 Common Azure Policy Effects

Azure Policy effects determine what happens when a resource matches or violates a policy condition.

Definition

An Azure Policy Effect defines what Azure Policy should do when a resource is evaluated against the conditions in a Policy definition. The effect determines whether Azure should block a non-compliant action, record it for compliance reporting, add or modify required information, or deploy a missing configuration. In the supplied Module 4, the key effects students need to understand are Deny, Audit, Append, Modify, and DeployIfNotExists.

How to Remember the Effects

Deny = Stop it.

Audit = Record it.

Append = Add information.

Modify = Change required properties.

DeployIfNotExists = Deploy the missing requirement.

4.10 Azure Governance Hierarchy

Azure governance becomes easier to understand when the resources are viewed as a hierarchy rather than isolated objects.

Definition

The Azure Governance hierarchy is the structured relationship through which Azure environments can be organized from broad enterprise-level management down to individual cloud resources. In the supplied module, the hierarchy is Management Group → Subscription → Resource Group → Resources. Each level represents a different management scope: Management Groups organize multiple Subscriptions, Subscriptions provide billing and administrative boundaries, Resource Groups organize related workloads, and Resources are the actual Azure services being operated.

(Hierarchy को top-to-bottom structure की तरह समझें: Management Group सबसे ऊपर multiple Subscriptions को organize करता है; Subscription के अंदर Resource Groups होते हैं; Resource Groups के अंदर actual Azure Resources होते हैं।)

Explanation

Each level provides a different management boundary. Governance can be applied at the level that best matches the business requirement. Broad organizational controls belong higher in the hierarchy; workload-specific controls can be applied lower.

Example

A global company may use a Corporate Management Group, country or environment Subscriptions, application Resource Groups, and then individual VMs, Storage Accounts, databases, and networks.

Why is it Important?

Understanding hierarchy is essential because RBAC, Policy, and Locks can be scoped at different levels.

4.11 Azure Policy vs Azure RBAC

Azure Policy and Azure RBAC are both important governance-related technologies, but they solve different problems.

Definition

Azure RBAC and Azure Policy are complementary Azure governance technologies, but they solve different problems. Azure RBAC is an authorization mechanism that determines which identity can access an Azure resource and which management actions that identity is allowed to perform at a particular scope. Azure Policy focuses on resource governance and compliance by evaluating whether resource configurations follow organizational standards and, depending on the assigned effect, auditing or enforcing those standards. A user can therefore have RBAC permission to create a resource while Azure Policy can still block the deployment if the requested configuration violates company rules.

(Easy difference: RBAC पूछता है 'User क्या कर सकता है?' Azure Policy पूछती है 'Resource company के rules follow कर रहा है या नहीं?')

Explanation

RBAC is an authorization mechanism. Policy is a governance and compliance mechanism. A user may have permission through RBAC to create a VM, but an Azure Policy may still block that VM if the deployment violates an organizational standard.

Example

A Developer has Contributor access and can create VMs. The company has a policy allowing deployment only in Central India. The Developer is authorized to create a VM, but a VM deployment in East US can still be denied by Policy.

Why is it Important?

Using RBAC and Policy together provides both access control and configuration governance.

4.12 Azure Governance Best Practices

• Separate Production, Development, and Testing where the organizational design requires independent control.
• Use Management Groups to organize multiple Subscriptions.
• Use Resource Groups based on applications, projects, departments, or business functions.
• Follow consistent naming conventions.
• Use mandatory Tags for ownership and cost classification.
• Protect critical Production resources with appropriate Resource Locks.
• Use Azure Policy to enforce organizational standards.
• Apply RBAC according to the Principle of Least Privilege.
• Review governance rules and compliance regularly.
• Understand dependencies before deleting Resource Groups or critical resources.

4.13 Real-Life Enterprise Scenarios

Production Protection

Requirement: Critical Production VMs must not be accidentally deleted.

Recommended Governance Approach: Apply a Delete Lock at the appropriate scope.

Department Cost Tracking

Requirement: Finance needs department-wise Azure cost reports.

Recommended Governance Approach: Use Department and CostCenter Tags.

Approved Region

Requirement: Resources must be deployed only in Central India.

Recommended Governance Approach: Use Azure Policy to enforce the approved region.

Many Subscriptions

Requirement: A company has country-wise subscriptions and wants common security governance.

Recommended Governance Approach: Organize subscriptions under a Management Group and apply governance at the higher scope.

Application Organization

Requirement: VM, database, network, storage, and public IP belong to one web application.

Recommended Governance Approach: Place related resources in an application Resource Group.

Shared Subscription

Requirement: Multiple departments share one Subscription but need logical separation.

Recommended Governance Approach: Use separate Resource Groups and appropriate RBAC scope.

Common Student Confusions

Quick Revision

Practical 1: Create a Resource Group

• Sign in to the Azure Portal.
• Search for Resource Groups.
• Click Create.
• Select the required Subscription.
• Enter a meaningful Resource Group name.
• Select the required Region.
• Review the configuration.
• Create the Resource Group.
• Verify it appears in the Resource Groups list.

Practical 2: Explore / Apply a Resource Lock

• Open a test Resource Group or Resource.
• Locate the Locks option.
• Review the available lock types.
• Choose Delete or Read-only according to the lab requirement.
• Give the lock a meaningful name.
• Save the lock.
• Verify the lock is visible before testing any protected action.
• Practical 3: Add Tags to a Resource
• Open a test Azure Resource.
• Locate Tags.
• Enter a Key such as Department.
• Enter a Value such as Finance.
• Add additional tags such as Environment, Owner, Project, or CostCenter.
• Save the tags.
• Verify the Key-Value pairs are displayed on the resource.

Practical 4: Explore Azure Policy

• Search for Policy in Azure Portal.
• Open the Azure Policy service.
• Explore Definitions.
• Explore Assignments.
• Explore Compliance.
• Identify a built-in policy related to region, tags, or security.
• Observe the available policy effect and assignment scope without changing production governance unless authorized.

AZ-104 Interview Questions

1. What is Azure Governance?
2. What is an Azure Subscription?
3. Why do organizations use multiple Azure Subscriptions?
4. What is a Management Group?
5. What is a Resource Group?
6. What happens when a Resource Group is deleted?
7. What are Azure Resource Locks?
8. What is the difference between Delete Lock and Read-Only Lock?
9. What are Azure Tags and why are they used?
10. What is Azure Policy?
11. What are common Azure Policy effects?
12. What is the difference between Azure Policy and Azure RBAC?
13. Explain the Azure Governance hierarchy.
14. How would you prevent resources from being deployed outside an approved Azure region?
15. How would you track Azure costs department-wise?
16. How would you protect a Production database from accidental deletion?
17. What governance design would you recommend for an enterprise with many Subscriptions?