AZ-900 Governance and Compliance: Azure Policy, Blueprints & Purview 2026
📝 Prepare for the AZ certification. Practice questions with answer explanations covering all exam domains.
Why Governance Matters on the AZ-900 Exam
Cloud governance is the set of policies, processes, and tools that ensure resources are used appropriately, costs are controlled, security standards are met, and regulatory obligations are fulfilled. For the AZ-900, Microsoft expects candidates to understand the purpose of each governance tool — not deep configuration syntax, but which tool solves which problem.
The Management and Governance domain (30–35%) is the largest single domain on the exam. Questions frequently ask you to match a scenario to the correct Azure service. For example: "Which service lets you enforce a naming convention across all Azure subscriptions?" (Azure Policy) or "Which tool provides a pre-packaged, repeatable environment definition?" (Azure Blueprints). Knowing the distinctions will earn you significant marks. Start your preparation with our AZ-900 practice test to benchmark your current knowledge, then revisit this guide to fill any gaps.
Governance in Azure operates at multiple levels of the management hierarchy: Management Groups → Subscriptions → Resource Groups → Resources. Policies and locks applied at a higher level cascade downward, which is why governance tools are so powerful in enterprise environments. This hierarchy also appears in our AZ-900 complete guide alongside other foundational concepts.
Free AZ-900 Study Tools
Interactive AZ-900 resources on PracticeTestGeeks, free to start:
- AZ-900 — 16 questions with instant scoring and answer explanations
- AZ-900 flashcards — review key terms and concepts card by card
- AZ-900 study guide — topic-by-topic overview of what the exam covers
- AZ-900 cheat sheet — one-page printable summary for last-minute review
AZ-900: upcoming dates and official changes
- Jul 20, 2026: Microsoft's current AZ-900 skills outline took effect on July 20, 2026, with minor changes listed for compute and networking, resource management and deployment, and monitoring objectives. (Microsoft)
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
- Microsoft does not publish a fixed AZ-900 question count on the reviewed pages and says most Microsoft Certification exams typically contain 40–60 questions, with variation by exam. (Microsoft)
- AZ-900 allows 45 minutes to complete the exam, with Microsoft allocating 65 minutes of seat time for Fundamentals exams. (Microsoft)
- AZ-900 requires a scaled score of at least 700 on Microsoft's 1–1,000 technical-exam scale. (Microsoft)
- AZ-900 retakes require payment when applicable; Microsoft does not specify a separate retake price on its retake-policy page. (Microsoft)
- AZ-900 candidates must wait 24 hours after their first failed attempt and 14 days between subsequent attempts, with no more than five attempts within 12 months of the first attempt. (Microsoft)
- The Microsoft Certified: Azure Fundamentals certification earned through AZ-900 does not expire. (Microsoft)
- Microsoft Certified: Azure Fundamentals does not require periodic renewal because Fundamentals certifications do not expire. (Microsoft)
- AZ-900 candidates scheduling through Pearson VUE can select a test-center or online proctored appointment, subject to availability. (Microsoft)
- Microsoft recommends that AZ-900 candidates have skills and experience in an IT area such as infrastructure management, database management, or software development. (Microsoft)
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
AZ-900 Exam at a Glance
| Item | Detail | Official source |
|---|---|---|
| Number of questions | Variable; no confirmed AZ-900-specific count | Microsoft |
| Time limit | 45-minute exam; 65-minute appointment | Microsoft |
| Passing score | 700 on a scaled score of 1–1,000 | Microsoft |
| Retake fee | Payment required when applicable | Microsoft |
| Retake policy | 24 hours after first failure; then 14 days; maximum five attempts | Microsoft |
| Validity | Does not expire | Microsoft |
| Renewal | No periodic renewal required | Microsoft |
| Delivery | Test center or online proctored appointment | Microsoft |
| Eligibility | IT skills and experience recommended | Microsoft |
| Score release | Usually within minutes; profile within 24 hours | Microsoft |
| Registration opens | Booking up to 90 days ahead | Microsoft |
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
Azure Policy: Enforcing Standards at Scale
Azure Policy is the primary tool for implementing governance rules across your Azure environment. A policy definition is a JSON document that describes the condition to evaluate and the effect to apply (Audit, Deny, Append, Modify, DeployIfNotExists, or AuditIfNotExists). Policies are assigned to a scope — management group, subscription, or resource group — and can be grouped into policy initiatives (also called policy sets) for easier management.
On the AZ-900 exam, key facts to remember: policies enforce standards continuously, not just at deployment time; a compliance dashboard shows the percentage of compliant resources; and the DeployIfNotExists effect can automatically remediate non-compliant resources by deploying supporting configurations. Unlike resource locks, which prevent user actions, policies evaluate resource properties. For hands-on practice, try our AZ-900 practice exam which includes scenario-based policy questions.
Resource Locks: Preventing Accidents
Resource locks protect critical resources from accidental deletion or modification, regardless of RBAC permissions. Even subscription owners cannot delete a locked resource without first removing the lock. Two lock types exist: CanNotDelete allows reads and updates but blocks deletion; ReadOnly blocks all writes including updates. Locks are inherited — a lock on a resource group applies to all resources within it. The AZ-900 exam may present scenarios where a team accidentally deleted a production database, and the question is which control would have prevented it: the answer is a resource lock. Compare this with identity and security controls like RBAC, which manage who can act rather than preventing actions entirely.
Microsoft Purview: Data Governance and Compliance
Microsoft Purview (formerly Azure Purview combined with Microsoft 365 compliance tools) provides a unified platform for data governance, risk, and compliance. It scans data sources, automatically classifies sensitive data (PII, financial records, health data), and builds a searchable data catalog. For compliance, Purview includes Information Protection, Data Loss Prevention, eDiscovery, and audit capabilities. On the AZ-900, Purview questions focus on its role in understanding what data you have and ensuring data privacy regulations (GDPR, HIPAA) are met. See how networking controls complement data governance in the Azure networking guide.
Azure Blueprints: Repeatable Environments
Azure Blueprints allow you to define a repeatable set of Azure resources that implements and adheres to standards, patterns, and requirements. A blueprint can contain policy assignments, role assignments, resource groups, and ARM templates — all versioned and tracked together. Unlike an ARM template alone, a Blueprint maintains a live connection between the blueprint definition and deployed resources, allowing updates to be pushed centrally. This is the key differentiator for exam questions: Blueprints track the relationship between the definition and the deployment. Use Blueprints when you need to rapidly stand up compliant environments at scale, for example, onboarding a new subsidiary to your enterprise standards. Storage compliance is another governance concern addressed in our storage services guide.
Compliance Manager and the Trust Center
The Microsoft Compliance Manager (accessed via the Microsoft Purview compliance portal) helps organizations manage compliance activities. It provides a compliance score, pre-built regulatory templates (ISO 27001, SOC 2, GDPR, NIST), and action items broken into Microsoft-managed controls and customer-managed controls. The score reflects how well you've implemented recommended configurations.
The Microsoft Trust Center is a public website (microsoft.com/trust-center) that provides documentation about security, privacy, compliance, and transparency across Microsoft cloud services. It is the go-to resource for understanding Microsoft's commitments — not a tool you configure, but a reference you consult. On the exam, if a question asks "Where can you find information about Microsoft's compliance certifications and data handling practices?", the answer is the Trust Center. For scenario questions requiring actual compliance tracking and scoring, the answer is Compliance Manager.
For a fuller set of questions on this topic, see our az 900 exam resource.
For a fuller set of questions on this topic, see our az 900 practice test resource.
For a fuller set of questions on this topic, see our microsoft certified: azure fundamentals resource.
AZ-900 Governance Exam Checklist
- ✓Know the difference between CanNotDelete and ReadOnly resource locks
- ✓Understand that Azure Policy evaluates compliance continuously, not just at deployment
- ✓Recognize that policy initiatives group multiple policy definitions together
- ✓Know that Azure Blueprints maintain a live link between definition and deployment
- ✓Understand Microsoft Purview's role in data discovery, classification, and cataloging
- ✓Know that Compliance Manager provides a compliance score and action items
- ✓Know that the Trust Center is a public reference site, not a configurable tool
- ✓Understand that governance policies cascade down the management hierarchy
AZ Pros and Cons
- +AZ-900 has a defined, publicly available content blueprint — candidates know exactly what to prepare for
- +Multiple preparation pathways (self-study, courses, coaching) accommodate different learning styles and schedules
- +A growing ecosystem of study resources means candidates at any budget level can access quality preparation materials
- +Clear score reporting allows candidates to identify specific strengths and weaknesses for targeted remediation
- +Professional recognition associated with strong performance provides tangible career and academic benefits
- −The scope of tested content requires substantial preparation time that competes with existing professional or academic commitments
- −No single resource covers the full content scope — candidates typically need multiple study tools for comprehensive preparation
- −Test anxiety and exam-day performance variability mean preparation effort does not always translate linearly to scores
- −Registration, preparation, and potential retake costs accumulate into a significant financial investment
- −Content and format can change between exam versions, making older preparation materials less reliable
Pros and Cons at a Glance
| Pros | Cons |
|---|---|
| Multiple preparation pathways (self-study, courses, coaching) accommodate different learning styles and schedules | The scope of tested content requires substantial preparation time that competes with existing professional or academic commitments |
| A growing ecosystem of study resources means candidates at any budget level can access quality preparation materials | No single resource covers the full content scope — candidates typically need multiple study tools for comprehensive preparation |
| Clear score reporting allows candidates to identify specific strengths and weaknesses for targeted remediation | Test anxiety and exam-day performance variability mean preparation effort does not always translate linearly to scores |
| Professional recognition associated with strong performance provides tangible career and academic benefits | Registration, preparation, and potential retake costs accumulate into a significant financial investment |
Sample AZ-900 Practice Questions
Try these questions from our free AZ-900 practice tests. The correct answer and an explanation follow each question.
A company is planning to deploy a critical application on Azure Virtual Machines. They need to ensure the application remains available even if a single datacenter in an Azure region fails. Which Azure concept should they use to achieve this level of resilience?
- A. Resource Groups
- B. Availability Zones
- C. Azure Geographies
- D. Region Pairs
Answer: B. Availability Zones
Availability Zones are physically separate locations within an Azure region, each with its own power, cooling, and networking. Deploying virtual machines across multiple Availability Zones ensures that if one zone experiences an outage (equivalent to a datacenter failure), the VMs in the other zones remain operational, providing high availability for the application.
Which Azure feature enables you to enforce organizational standards and assess compliance at scale across all your Azure resources?
- A. Azure Monitor
- B. Azure Policy
- C. Microsoft Defender for Cloud
- D. Azure Blueprints
Answer: B. Azure Policy
Azure Policy allows organizations to define and enforce rules for Azure resources, ensuring compliance with corporate standards and regulatory requirements. It can audit existing resources and prevent non-compliant resources from being created.
A company is planning to migrate its on-premises data center to Azure. They need a tool to estimate the potential cost savings by comparing their current on-premises infrastructure costs with the projected costs of running the same workloads in Azure. Which Azure tool is specifically designed for this purpose?
- A. Azure Pricing Calculator
- B. Azure Cost Management
- C. Azure Advisor
- D. Total Cost of Ownership (TCO) Calculator
Answer: D. Total Cost of Ownership (TCO) Calculator
The Total Cost of Ownership (TCO) Calculator is designed to help you compare the costs of running your workloads on-premises versus in Azure to estimate potential savings. The Pricing Calculator is used for estimating the cost of specific Azure services you plan to use, while Azure Cost Management helps monitor and control spending, and Azure Advisor provides optimization recommendations.
What is the difference between Azure Policy and Azure RBAC?
- A. Azure Policy controls user actions; RBAC controls resource properties
- B. Azure Policy focuses on resource properties; RBAC controls user access and actions
- C. They are the same service with different names
- D. Azure Policy is for cost control; RBAC is for security
Answer: B. Azure Policy focuses on resource properties; RBAC controls user access and actions
Azure Policy enforces rules about resource configurations (e.g., allowed locations), while RBAC controls who can perform what actions on which resources.
AZ-900 Governance Questions and Answers
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Registration, retake fee, retake policy, exam format, score validity, eligibility, renewal, test delivery, passing score, score release · verified Oct 2026