Governance and compliance make up 30–35% of the AZ-900 exam under the Management and Governance domain. This guide covers Azure Policy, resource locks, Microsoft Purview, Azure Blueprints, Compliance Manager, and the Trust Center — everything you need to know to pass the exam and understand how Microsoft helps organizations stay in control of their cloud environments.
Cloud governance is the set of policies, processes, and tools that ensure resources are used appropriately, costs are controlled, security standards are met, and regulatory obligations are fulfilled. For the AZ-900, Microsoft expects candidates to understand the purpose of each governance tool — not deep configuration syntax, but which tool solves which problem.
The Management and Governance domain (30–35%) is the largest single domain on the exam. Questions frequently ask you to match a scenario to the correct Azure service. For example: "Which service lets you enforce a naming convention across all Azure subscriptions?" (Azure Policy) or "Which tool provides a pre-packaged, repeatable environment definition?" (Azure Blueprints). Knowing the distinctions will earn you significant marks. Start your preparation with our AZ-900 practice test to benchmark your current knowledge, then revisit this guide to fill any gaps.
Governance in Azure operates at multiple levels of the management hierarchy: Management Groups → Subscriptions → Resource Groups → Resources. Policies and locks applied at a higher level cascade downward, which is why governance tools are so powerful in enterprise environments. This hierarchy also appears in our AZ-900 complete guide alongside other foundational concepts.
Interactive AZ-900 resources on PracticeTestGeeks, free to start:
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
| Item | Detail | Official source |
|---|---|---|
| Number of questions | Variable; no confirmed AZ-900-specific count | Microsoft |
| Time limit | 45-minute exam; 65-minute appointment | Microsoft |
| Passing score | 700 on a scaled score of 1–1,000 | Microsoft |
| Retake fee | Payment required when applicable | Microsoft |
| Retake policy | 24 hours after first failure; then 14 days; maximum five attempts | Microsoft |
| Validity | Does not expire | Microsoft |
| Renewal | No periodic renewal required | Microsoft |
| Delivery | Test center or online proctored appointment | Microsoft |
| Eligibility | IT skills and experience recommended | Microsoft |
| Score release | Usually within minutes; profile within 24 hours | Microsoft |
| Registration opens | Booking up to 90 days ahead | Microsoft |
Facts verified Oct 17, 2026 against Microsoft. Dates that have passed are removed automatically.
Azure Policy is the primary tool for implementing governance rules across your Azure environment. A policy definition is a JSON document that describes the condition to evaluate and the effect to apply (Audit, Deny, Append, Modify, DeployIfNotExists, or AuditIfNotExists). Policies are assigned to a scope — management group, subscription, or resource group — and can be grouped into policy initiatives (also called policy sets) for easier management.
On the AZ-900 exam, key facts to remember: policies enforce standards continuously, not just at deployment time; a compliance dashboard shows the percentage of compliant resources; and the DeployIfNotExists effect can automatically remediate non-compliant resources by deploying supporting configurations. Unlike resource locks, which prevent user actions, policies evaluate resource properties. For hands-on practice, try our AZ-900 practice exam which includes scenario-based policy questions.
Resource locks protect critical resources from accidental deletion or modification, regardless of RBAC permissions. Even subscription owners cannot delete a locked resource without first removing the lock. Two lock types exist: CanNotDelete allows reads and updates but blocks deletion; ReadOnly blocks all writes including updates. Locks are inherited — a lock on a resource group applies to all resources within it. The AZ-900 exam may present scenarios where a team accidentally deleted a production database, and the question is which control would have prevented it: the answer is a resource lock. Compare this with identity and security controls like RBAC, which manage who can act rather than preventing actions entirely.
Microsoft Purview (formerly Azure Purview combined with Microsoft 365 compliance tools) provides a unified platform for data governance, risk, and compliance. It scans data sources, automatically classifies sensitive data (PII, financial records, health data), and builds a searchable data catalog. For compliance, Purview includes Information Protection, Data Loss Prevention, eDiscovery, and audit capabilities. On the AZ-900, Purview questions focus on its role in understanding what data you have and ensuring data privacy regulations (GDPR, HIPAA) are met. See how networking controls complement data governance in the Azure networking guide.
Azure Blueprints allow you to define a repeatable set of Azure resources that implements and adheres to standards, patterns, and requirements. A blueprint can contain policy assignments, role assignments, resource groups, and ARM templates — all versioned and tracked together. Unlike an ARM template alone, a Blueprint maintains a live connection between the blueprint definition and deployed resources, allowing updates to be pushed centrally. This is the key differentiator for exam questions: Blueprints track the relationship between the definition and the deployment. Use Blueprints when you need to rapidly stand up compliant environments at scale, for example, onboarding a new subsidiary to your enterprise standards. Storage compliance is another governance concern addressed in our storage services guide.
The Microsoft Compliance Manager (accessed via the Microsoft Purview compliance portal) helps organizations manage compliance activities. It provides a compliance score, pre-built regulatory templates (ISO 27001, SOC 2, GDPR, NIST), and action items broken into Microsoft-managed controls and customer-managed controls. The score reflects how well you've implemented recommended configurations.
The Microsoft Trust Center is a public website (microsoft.com/trust-center) that provides documentation about security, privacy, compliance, and transparency across Microsoft cloud services. It is the go-to resource for understanding Microsoft's commitments — not a tool you configure, but a reference you consult. On the exam, if a question asks "Where can you find information about Microsoft's compliance certifications and data handling practices?", the answer is the Trust Center. For scenario questions requiring actual compliance tracking and scoring, the answer is Compliance Manager.
For a fuller set of questions on this topic, see our az 900 exam resource.
For a fuller set of questions on this topic, see our az 900 practice test resource.
For a fuller set of questions on this topic, see our microsoft certified: azure fundamentals resource.
| Pros | Cons |
|---|---|
| Multiple preparation pathways (self-study, courses, coaching) accommodate different learning styles and schedules | The scope of tested content requires substantial preparation time that competes with existing professional or academic commitments |
| A growing ecosystem of study resources means candidates at any budget level can access quality preparation materials | No single resource covers the full content scope — candidates typically need multiple study tools for comprehensive preparation |
| Clear score reporting allows candidates to identify specific strengths and weaknesses for targeted remediation | Test anxiety and exam-day performance variability mean preparation effort does not always translate linearly to scores |
| Professional recognition associated with strong performance provides tangible career and academic benefits | Registration, preparation, and potential retake costs accumulate into a significant financial investment |
Try these questions from our free AZ-900 practice tests. The correct answer and an explanation follow each question.
A company is planning to deploy a critical application on Azure Virtual Machines. They need to ensure the application remains available even if a single datacenter in an Azure region fails. Which Azure concept should they use to achieve this level of resilience?
Answer: B. Availability Zones
Availability Zones are physically separate locations within an Azure region, each with its own power, cooling, and networking. Deploying virtual machines across multiple Availability Zones ensures that if one zone experiences an outage (equivalent to a datacenter failure), the VMs in the other zones remain operational, providing high availability for the application.
Which Azure feature enables you to enforce organizational standards and assess compliance at scale across all your Azure resources?
Answer: B. Azure Policy
Azure Policy allows organizations to define and enforce rules for Azure resources, ensuring compliance with corporate standards and regulatory requirements. It can audit existing resources and prevent non-compliant resources from being created.
A company is planning to migrate its on-premises data center to Azure. They need a tool to estimate the potential cost savings by comparing their current on-premises infrastructure costs with the projected costs of running the same workloads in Azure. Which Azure tool is specifically designed for this purpose?
Answer: D. Total Cost of Ownership (TCO) Calculator
The Total Cost of Ownership (TCO) Calculator is designed to help you compare the costs of running your workloads on-premises versus in Azure to estimate potential savings. The Pricing Calculator is used for estimating the cost of specific Azure services you plan to use, while Azure Cost Management helps monitor and control spending, and Azure Advisor provides optimization recommendations.
What is the difference between Azure Policy and Azure RBAC?
Answer: B. Azure Policy focuses on resource properties; RBAC controls user access and actions
Azure Policy enforces rules about resource configurations (e.g., allowed locations), while RBAC controls who can perform what actions on which resources.