AZ-900 Azure Management and Governance: Domain 3 Study Notes

Domain 3 Overview: Management and Governance

Azure Management and Governance is the largest domain on the AZ-900 exam, accounting for 30–35% of all questions. This domain tests your understanding of how Azure helps organizations control costs, enforce compliance, and maintain visibility across cloud resources.

Domain 3 is organized around three pillars:

• Cost Management — Tools that help you estimate, track, and optimize Azure spending.
• Governance — Services that enforce organizational rules, protect resources, and maintain compliance at scale.
• Monitoring — Solutions that provide operational visibility, proactive recommendations, and service-health awareness.

Because this domain makes up roughly one-third of the exam, even a basic conceptual understanding of each tool can meaningfully improve your score. You are not expected to configure these services — only to understand what they do and when you would use them.

Before diving in, make sure you have already reviewed core Azure services and the broader AZ-900 study guide, since governance concepts build on foundational cloud knowledge.

Cost Management Tools in Detail

Pricing Calculator vs. TCO Calculator

The Azure Pricing Calculator is used before you deploy. You select Azure products, configure their expected usage (region, tier, hours per month), and receive a cost estimate. It is ideal for planning new workloads or comparing service tiers.

The Total Cost of Ownership (TCO) Calculator serves a different purpose: it helps you justify migration by comparing your current on-premises infrastructure costs against equivalent Azure costs over time. You input your existing servers, storage, networking, and labor costs, and the tool projects multi-year savings. On the exam, remember: Pricing Calculator = estimate Azure costs; TCO Calculator = compare cloud vs. on-prem.

Azure Cost Management

Once resources are running, Azure Cost Management (sometimes called Microsoft Cost Management) provides dashboards, budgets, and alerts to track actual spending. You can set budget thresholds that trigger email alerts when costs approach or exceed defined limits, and use cost-analysis views to break down spending by service, resource group, or time period.

Tags

Tags are name-value pairs you attach to Azure resources (e.g., Department: Finance or Environment: Production). Tags do not affect resource behavior, but they make it easy to filter cost reports and allocate charges to specific teams or projects. Tags are applied at the resource or resource-group level.

Governance Features in Detail

Azure Policy vs. Resource Locks

Azure Policy lets you define rules — called policy definitions — that Azure enforces across your subscriptions and resource groups. A policy might require all resources to have a specific tag, restrict deployment to certain regions, or mandate a minimum VM SKU. Policies can audit (report non-compliant resources) or deny (block non-compliant deployments). You can bundle multiple policies into an initiative (also called a policy set).

Resource Locks operate differently: they prevent changes or deletions regardless of the user's permissions. A CanNotDelete lock allows reads and modifications but blocks deletion. A ReadOnly lock prevents all writes — even authorized administrators cannot modify the resource without first removing the lock. Locks are applied at the resource, resource-group, or subscription level and cascade downward.

Key distinction for the exam: Azure Policy enforces what can be deployed or configured; Resource Locks protect existing resources from modification or deletion.

Microsoft Purview

Microsoft Purview is a unified data-governance platform. It discovers data across Azure, on-premises, and multi-cloud environments, classifies it (e.g., identifying personal data or financial records), and tracks data lineage. Purview supports compliance requirements such as GDPR by giving organizations a map of where sensitive data lives and how it flows.

Azure Blueprints

Azure Blueprints package together role assignments, policy assignments, ARM templates, and resource groups into a single reusable definition. When you deploy a blueprint to a subscription, Azure creates all the components consistently and maintains a tracked relationship between the blueprint and what was deployed — making it easy to audit or update governed environments. Blueprints are designed for repeatable, compliant environment setup at scale.

Monitoring Tools in Detail

Azure Advisor

Azure Advisor analyzes your Azure usage and configurations and provides personalized, actionable recommendations across five categories: Cost, Security, Reliability (formerly High Availability), Operational Excellence, and Performance. Advisor is proactive — it surfaces potential improvements before problems occur. For example, it might recommend resizing an underutilized VM or enabling soft delete on a storage account.

Azure Monitor

Azure Monitor is the central platform for collecting, analyzing, and acting on telemetry from Azure and on-premises environments. It ingests metrics (numerical time-series data like CPU usage) and logs (structured or unstructured event records). Key sub-features include Log Analytics (query logs with KQL), Application Insights (application performance monitoring), and Alerts (notifications triggered by metric thresholds or log conditions). Azure Monitor is reactive — it tells you what is happening or has happened.

Azure Service Health

Azure Service Health communicates the health of the Azure platform itself — not your individual resources. It has three components: Azure Status (global outage map), Service Health (personalized alerts for the regions and services you use), and Resource Health (health of your specific resources). If an Azure data center has an outage affecting your region, Service Health is where you learn about it and receive updates.

For a complete picture of exam topics, see the complete AZ-900 guide and review all domains in the Microsoft Certified Azure Fundamentals overview.