Azure management and governance for AZ-900: the tools the exam expects you to tell apart
Azure management and governance is 30–35% of AZ-900 (Microsoft Azure Fundamentals) in the skills outline as of 20 July 2026, split into four groups: cost management, governance and compliance, managing and deploying resources, and monitoring. Questions here hand you four tools with overlapping jobs and ask which one fits, so this page sorts them into the pairs the exam likes to swap, then runs 12 practice questions on this line.
What this skill area covers and how much it weighs
At 30–35%, management and governance is the second-heaviest of the three skill areas, behind Azure architecture and services at 35–40% and ahead of cloud concepts at 25–30%. Expect roughly a third of your exam to sit on this line. The full outline, all three areas side by side, is on the AZ-900 study guide hub.
30–35%of the outlinesecond heaviest
4sub-objectives
12practice questions herethree per sub-objective
The four sub-objectives and the choice each one tests
The July 2026 revision changed wording, not weight: Azure CLI and Azure PowerShell are now listed apart from Cloud Shell, and Application Insights is named Azure Monitor Application Insights.
Managing cost: calculator, Cost Management and tags
Most cost questions turn on one detail: has the money been spent yet? The pricing calculator estimates resources you have not deployed. Cost Management reads the spend that already happened, breaks it down, forecasts it, and lets you set budgets that alert when actual spend crosses a threshold. Find the tense in the stem and half the options fall away.
This is Azure’s bill, not the exam fee. What you pay to sit the exam, and what retakes cost, is on what AZ-900 costs.
What moves the bill
Resource type and size: a bigger VM or a premium tier costs more.
Budgets with alerts, forecasts and cost recommendations
Groups spend by tag, resource group or service
The tell Future tense (plan, estimate, before we deploy) points to the calculator. Past or present tense (spent, trend, over budget) points to Cost Management.
Tags are name/value pairs, such as department: finance, attached to resources, resource groups and subscriptions so cost reports can group by them. They label; they enforce nothing. Resources don’t inherit a resource group’s tags by default, which is why Azure Policy is the answer when a stem says every resource must carry a tag.
Elimination run
A shared subscription hosts resources for three departments. Finance wants cost reports grouped by department without moving anything. What should you apply?
AResource locksOut · round 1
BManagement groupsOut · round 2
CTagsSurvivor
DAzure RBAC rolesOut · round 1
Start from what a cost report needs: a label to group by. The lock and the role carry none, so round one strikes them. Round two strikes management groups, which organize whole subscriptions, and here all three departments share one. Tags label individual resources, so they survive.
Governance and compliance: Purview, Policy, locks
Three tools, three targets. Azure Policy decides what may exist and how it must be configured. A resource lock stops a resource from being deleted or changed. Microsoft Purview governs data across Azure, on-premises systems and other clouds. Almost every governance question adds a fourth name, Azure RBAC, which the outline places with identity on the architecture and services line.
Azure Policy
Rules evaluated against resources: allowed regions, VM sizes, required tags, with effects such as deny, audit and modify. An initiative bundles policies, which is how regulatory compliance sets are applied. Assignments inherit down from the scope they are set on.
Resource lock
CanNotDelete (Delete in the portal) blocks deletion; ReadOnly blocks deletion and changes. It binds everyone, Owners included, until removed, and child resources inherit it.
Microsoft Purview
Data governance and compliance: a map and catalog of where data lives, classification of sensitive information, lineage, and risk tools across the data estate.
Azure Policy
Judges the resource: its region, size, tags and settings
Applies to every deployment, whoever runs it
Can block a non-compliant deployment or flag existing resources
vs
Azure RBAC
Judges the identity: user, group, service principal
Grants actions through roles at a scope
Has no view on how a resource is configured
The tell Find the subject of the stem. A who (the helpdesk, a contractor, an app) is RBAC. A what (storage accounts, regions, VM sizes) is Policy.
Policy, RBAC, locks and tags: four governance answers side by side
Swipe sideways: 4 columns
Tool
Question it answers
Binds an Owner?
Stem words that point to it
Azure Policy
What may be deployed, and how
Yes: a deny blocks anyone’s non-compliant deployment
allowed, require, enforce, compliant
Azure RBAC
Who may perform which actions
No: Owner holds full rights at its scope
user, team, role, permission, least privilege
Resource lock
Whether a resource can be deleted or changed
Yes, until someone removes the lock
accidental, prevent deletion, read-only
Tags
Which label a resource carries
No: labels restrict nothing
department, cost center, environment, report
Elimination run
Every new storage account must have public network access disabled, no matter which administrator creates it. Which tool enforces this?
AAzure RBACOut · round 2
BA ReadOnly lockOut · round 1
CAzure PolicySurvivor
DA tag on each storage accountOut · round 1
Round one strikes the tag, which only labels, and the lock, which freezes resources that already exist instead of shaping new ones. Round two strikes RBAC: the stem says no matter which administrator, so the rule is about the resource, not the person. Policy survives.
Purview gets picked by mistake when a stem says compliance. Ask what the compliance is about: resource settings (regions, SKUs, disk encryption) point to Policy; the data itself (where personal data sits, how sensitive a dataset is) points to Purview.
Tools for managing and deploying resources
Every way of touching Azure, from a portal click to a CLI command, a PowerShell cmdlet, an SDK call or a REST request, passes through Azure Resource Manager. That is why ARM, not any single tool, is where RBAC, locks and tags are applied: they hold whichever tool you use.
Azure portal
The web interface: point and click, no install.
Azure Cloud Shell
A browser shell, already signed in, with Bash or PowerShell and a file share that keeps your files.
Azure CLI
Cross-platform az commands, installed locally or used in Cloud Shell.
Azure PowerShell
The Az module of cmdlets such as New-AzVM, on Windows, macOS or Linux, and ready in Cloud Shell.
ARM template
A JSON file declaring the resources you want; deploying it twice gives the same result.
Azure Arc
Brings servers, Kubernetes clusters and data services outside Azure (on-premises, edge, other clouds) under Azure management.
Azure Arc
Projects machines and clusters outside Azure into Azure
Policy, RBAC, tags and monitoring then reach them
Moves nothing: the servers stay where they are
vs
Azure Resource Manager
The control layer for resources inside Azure
Every portal, CLI and PowerShell action is an ARM request
ARM templates deploy Azure resources from code
The tell If the stem mentions on-premises, another cloud or the edge, think Arc. If it is about deploying or organizing Azure resources consistently, think ARM.
Infrastructure as code questions test one distinction: declarative versus imperative. An ARM template states the end result and Resource Manager works out the order; a CLI or PowerShell script lists steps. Bicep, which compiles to ARM JSON, fills plenty of study material, but the outline names only infrastructure as code and ARM templates.
Elimination run
Linux servers in your own datacenter and virtual machines at another cloud provider must show up in Azure with tags and Azure Policy applied, without being moved. What should you use?
AAzure MigrateOut · round 2
BAzure ArcSurvivor
CARM templatesOut · round 1
DAzure Cloud ShellOut · round 1
Without being moved is the tell. Round one strikes Cloud Shell, a place to type commands, and ARM templates, which deploy Azure resources rather than adopt existing outside ones. Round two strikes Azure Migrate, because migrating is moving. Arc manages them in place.
Monitoring: Advisor, Service Health, Azure Monitor
The three monitoring tools differ by where the information comes from. Azure Advisor reviews your configuration and recommends changes. Azure Service Health reports Microsoft’s incidents and planned maintenance that touch your subscriptions and regions. Azure Monitor collects metrics and logs from your own resources and applications and lets you query and alert on them.
Advisor sorts recommendations into reliability, security, performance, operational excellence and cost.
Service Health is the middle of three layers: Azure status (public, every region), Service Health (your subscriptions and regions), Resource Health (one resource).
Log Analytics queries Azure Monitor’s logs with Kusto Query Language (KQL), in a workspace that can pool many resources.
Azure Monitor alerts fire on a metric, a log query or an activity log event, and notify people or start automation.
Application Insights watches a running app: requests, failures, response times, dependencies, in Azure, on-premises or another cloud.
Azure Advisor
Looks at how your resources are set up
Recommends: resize, add redundancy, close a security gap
Says nothing about Azure outages
vs
Azure Service Health
Looks at Azure’s own platform
Incidents, planned maintenance, health advisories
Scoped to the services and regions you use
The tell Would the problem remain after you fixed everything you own? Then it is Azure’s problem, and Service Health. If you can fix it yourself, it is Advisor.
Elimination run
A virtual machine has averaged under 5% CPU for a month. Which service suggests running it on a smaller size?
AAzure Service HealthOut · round 1
BAzure AdvisorSurvivor
CAzure Monitor alertsOut · round 2
DMicrosoft PurviewOut · round 1
Round one strikes Purview, a data governance tool, and Service Health, which reports Azure’s problems rather than yours. Round two is the close pair: an alert can tell you CPU is low, but it does not recommend a change. Advisor does.
Which tool answers which question
Read the four options before the stem. When they come from two different sub-objectives, the stem’s verb decides; when they come from one, the matrix below names the decoy that usually sits next to the answer.
Management and governance: the question, the answer, the usual decoy
Swipe sideways: 3 columns
What the stem asks
Answer
Usual decoy, and why it is out
What will this cost before we build it?
Pricing calculator
Cost Management: reads spend that already happened
Which department owns this resource on the bill?
Tags
Management groups: organize subscriptions, not single resources
Only these regions; every resource carries tag X
Azure Policy
Azure RBAC: governs people, not resource settings
Let a contractor view resources but change nothing
Azure RBAC (Reader)
ReadOnly lock: would freeze the resource for everyone
Nobody may delete the production database
Resource lock
Azure RBAC: Owners keep delete rights
Find and classify sensitive data across the estate
Microsoft Purview
Azure Policy: rules about resources, not the data in them
Manage on-premises and other-cloud servers from Azure
Azure Arc
Azure Migrate: moves workloads instead of managing them in place
Deploy the same environment repeatably from a file
ARM templates
A CLI script: imperative steps, not a declared end state
Suggestions to cut cost or raise reliability
Azure Advisor
Azure Monitor: collects data, makes no recommendation
An Azure outage or planned maintenance in your region
Azure Service Health
Azure Advisor: reviews your setup, not Azure’s
Work these twelve in the three passes the practice test sets out. On this line the second pass usually turns on one word: who or what, before or after, inside Azure or outside.
Read the options, then find the stem’s subject. A who is RBAC, a what is Policy, a do-not-delete is a lock.
Practice this area: 12 questions
Twelve questions, three per sub-objective. Each is a triangle station on the line above the card: ink when right, gray when missed, a colored ring where you are. Tap a station to jump, or use the Sub-objective menu to ride one group. Pick with a click or 1–4 / A–D, and the panel explains the answer and every option you did not pick.
12 practice questions on this line
Keys: 1–4 or A–D to answer, left and right arrows to move
Question 1 of 12
Management and governanceDescribe cost management in Azure
What Azure tool should you use to compare the cost of running a workload in different regions?
The Pricing Calculator allows you to estimate and compare costs for the same workload across different Azure regions.
Why each answer is in or out
ACost analysis reports actual spending.
BAdvisor recommends optimizations.
CCorrect: the Pricing Calculator lets you price the same configuration in different regions side by side.
DAzure Monitor measures telemetry, not prices.
Management and governanceDescribe cost management in Azure
Which factor does NOT affect the cost of virtual machines in Azure?
The number of resource groups doesn't affect VM costs. Costs are determined by factors like compute type, usage time, and location.
Why each answer is in or out
ACorrect: resource groups are free containers, so their number does not change VM cost.
BSize (vCPU and RAM) drives the price.
CPrices differ by region.
DWindows licensing costs more than Linux.
Management and governanceDescribe cost management in Azure
What should you use to analyze long-term cost trends across multiple subscriptions?
Cost analysis in Azure Cost Management provides detailed views of long-term cost trends across multiple subscriptions.
Why each answer is in or out
ACorrect: cost analysis in Cost Management charts spending over time across scopes.
BPrice sheets list rates, not trends.
CInvoices are per billing period.
DUsage reports are raw detail, not trend analysis.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which setting lets authorized users read and modify a resource but blocks anyone from deleting it?
A Delete (CanNotDelete) lock allows reads and changes but prevents deletion. A ReadOnly lock blocks both changes and deletion. Locks apply to every user, including Owners.
Why each answer is in or out
AThe Azure Policy audit effect only flags non-compliance.
BAn Owner role grants permissions; it blocks nothing.
CCorrect: a Delete (CanNotDelete) lock allows reading and changes but blocks deletion for every user.
DA ReadOnly lock blocks changes as well as deletion.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which feature in Azure Policy helps implement regulatory compliance requirements?
Initiative definitions in Azure Policy group related policies together to achieve compliance with specific regulatory standards.
Why each answer is in or out
AAn assignment applies a definition to a scope, but the compliance bundle is the initiative.
BCorrect: initiatives (policy sets), including built-in regulatory ones such as ISO 27001 or NIST, group policies for a compliance goal.
CParameters customize definitions.
DEffects decide what a single policy does.
Management and governanceDescribe features and tools in Azure for governance and compliance
What is the recommended way to enforce consistent resource naming conventions across your organization?
Azure Policy can enforce naming conventions by requiring resources to follow specific patterns during creation.
Why each answer is in or out
AResource groups organize resources but enforce nothing.
BManagement groups are only a scope where you assign policies.
CTags are metadata, not naming rules.
DCorrect: Azure Policy can deny resources whose names do not match a pattern.
Management and governanceDescribe features and tools for managing and deploying Azure resources
What is the main purpose of Azure Resource Manager?
Azure Resource Manager is the deployment and management service that provides a consistent management layer for Azure resources.
Why each answer is in or out
AMonitoring is Azure Monitor's role.
BStoring data is a storage service's role.
CRunning apps is a compute service's role.
DCorrect: Resource Manager is the single management layer through which every request (portal, CLI, templates) creates, updates and deletes resources.
Management and governanceDescribe features and tools for managing and deploying Azure resources
What should you use to automate resource deployment using JSON templates?
ARM templates use JSON format to define infrastructure and configuration for Azure resources in a declarative way.
Why each answer is in or out
AAzure PowerShell is imperative scripting, not JSON templates.
BThe Azure CLI is imperative commands.
CCloud Shell is where you run tools; it is not a template format.
DCorrect: ARM templates are declarative JSON files describing resources to deploy.
Management and governanceDescribe features and tools for managing and deploying Azure resources
What is required to use Azure PowerShell from a local computer?
The Az PowerShell module must be installed to use Azure PowerShell cmdlets from a local computer.
Why each answer is in or out
ACloud Shell is the browser option and needs no local install.
BCorrect: install the Az PowerShell module locally, then sign in with Connect-AzAccount.
CThe Azure CLI is a separate tool.
DSDKs are for code, not PowerShell.
Management and governanceDescribe monitoring tools in Azure
Which monitoring service includes the Log Analytics feature for complex log queries?
Azure Monitor includes Log Analytics, which allows you to write complex queries to analyze log data from your resources.
Why each answer is in or out
AService Health reports Azure incidents.
BCorrect: Log Analytics is the Azure Monitor tool for writing KQL queries over log data.
CDefender for Cloud consumes logs but is a security service.
DAdvisor makes recommendations.
Management and governanceDescribe monitoring tools in Azure
What is the primary purpose of Azure Log Analytics workspace?
A Log Analytics workspace is a central location where Azure Monitor stores and aggregates log data for analysis.
Why each answer is in or out
AAccess control is RBAC's job.
BBackup policies live in Recovery Services vaults.
CCorrect: a Log Analytics workspace stores logs collected by Azure Monitor for KQL querying and analysis.
DDeployment is ARM's job.
Management and governanceDescribe monitoring tools in Azure
Which feature should you use to automatically notify stakeholders when Azure service issues occur?
Service Health alerts can automatically notify stakeholders when Azure service issues impact your resources.
Why each answer is in or out
ACorrect: Service Health alerts notify action groups when an Azure incident or maintenance affects your services and regions.
B'Resource alerts' is not a named Azure alert type; resource-level metric alerts do not report platform incidents.
CCost alerts track budgets.
DAzure Policy does not send service-issue notifications.
Q1How much of AZ-900 is management and governance?
30–35% of the outline as of 20 July 2026, the second-largest of the three skill areas after architecture and services at 35–40% (Microsoft study guide).
Q2What is an Azure governance model?
For AZ-900, the scopes plus the rules on them. Scopes: management groups, subscriptions, resource groups, resources. Rules: Azure Policy for what may exist, Azure RBAC for who may act, locks for what must not be deleted, tags for tracking cost. Policy and RBAC set high apply to everything below.
Q3What is the difference between Azure Policy and RBAC?
Azure Policy controls resources: which regions, sizes and settings are allowed, whoever deploys them. Azure RBAC controls identities: which actions a user, group or app may perform at a scope. A person in the stem means RBAC; a resource setting means Policy.
Q4What does a resource lock do in Azure?
It stops a resource, resource group or subscription from being deleted (CanNotDelete), or deleted and changed (ReadOnly). It binds everyone, Owners included, until removed.
Q5What is the difference between Azure Advisor and Azure Service Health?
Advisor reviews your configuration and recommends changes. Service Health reports Azure’s side: incidents, planned maintenance and advisories for the services and regions you use.
Q6What is Azure Arc used for?
Managing servers, Kubernetes clusters and data services outside Azure, on-premises, at the edge or in another cloud, with Azure Policy, RBAC, tags and monitoring. It does not move them; that is Azure Migrate.
Q7Are the TCO Calculator and Azure Blueprints still on AZ-900?
No. The January 2026 revision replaced the TCO Calculator objective with the pricing calculator, and Blueprints is absent from the July 2026 outline (study guide).