Manage Azure identities and governance
Policy, Locks, and Cost Governance
CoreDistinguish Azure Policy, initiatives, effects, locks, permissions, budgets, alerts, and recommendations.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Administrators must choose the control that evaluates configuration, blocks a change, protects a resource, reports spend, or recommends an improvement without treating those jobs as interchangeable.
Must Know
- Azure Policy evaluates resource properties against definitions assigned at a management group, subscription, resource group, or resource scope.
- An initiative groups policy definitions for one assignment and compliance view; effects such as audit and deny produce different operational outcomes.
- A CanNotDelete lock allows authorized changes but blocks deletion; a ReadOnly lock blocks control-plane updates and deletion.
- Budgets track actual and forecast cost against thresholds and can trigger notifications, but they do not automatically stop Azure resources.
- Azure Advisor produces prioritized recommendations across categories such as cost, reliability, performance, security, and operational excellence.
Compare and Distinguish
- RBAC vs Policy vs lock: authorize a principal’s actions vs evaluate or enforce resource state vs protect a resource from control-plane change or deletion.
- Policy vs initiative: one rule definition vs a collection managed and assigned together.
- Deny vs audit: prevent a noncompliant create or update vs allow it and record noncompliance.
- Budget alert vs Azure Advisor: threshold-based cost signal vs a recommendation derived from resource usage and configuration.
Scenario examples
- Scenario: New resources outside approved regions must be rejected. Think: Assign a location policy with a deny effect at the intended parent scope.
- Scenario: Operators may update a database but must not delete it. Think: Apply a CanNotDelete lock rather than removing normal management permission.
- Scenario: A subscription should notify finance at several forecast thresholds. Think: Configure a budget and notification contacts, knowing this does not shut workloads down.
Exam traps
- An audit policy reports noncompliance but does not block the request.
- A resource lock is not an authorization system and does not protect data-plane operations in every service.
- A budget is a visibility and notification control, not a hard spending cap.
Key takeaways
- Choose authorization, compliance, mutation protection, or cost visibility according to the required effect.
- Always evaluate governance at the assignment scope and include inherited controls and exclusions.
How it works
- Azure Policy evaluates applicable assignments during supported resource operations and through compliance scans.
- Resource Manager checks inherited locks when a control-plane request would modify or delete a protected scope.
Objects and administrative surfaces
- Management group, subscription, resource group, or resource — policy and initiative assignments with exclusions as needed.
- Subscription, resource group, or resource — locks inherited by descendants; the most restrictive applicable lock governs.
- Billing scope — budgets and cost analysis; resource context — Azure Advisor recommendations.
When to use it
- Use Policy for repeatable configuration guardrails and compliance reporting across many resources.
- Use locks as an extra safeguard for critical resources and budgets or Advisor for financial operations.
Security and governance implications
- Test deny and modify behavior before broad assignment, and grant remediation identities only the access they require.
- Document lock ownership so emergency changes are deliberate and traceable.
How to reason about this
- For a blocked deployment, read the error, find inherited policy and lock assignments, and distinguish authorization failure from denied state or ReadOnly protection.
- For missing cost notifications, verify budget scope, threshold basis, recipients or action group, and current cost-evaluation timing.
More detail
- Policy definitions contain a condition and effect; assignments set scope and parameters, while initiatives provide a combined compliance target.
- Locks affect control-plane operations even for authorized users, and budget thresholds can notify action groups or contacts without enforcing service shutdown.
Ready for the quiz?
- When should an initiative be preferred over assigning several unrelated definitions separately?
- Which control allows updates but blocks deletion?
- Why can a budget alert fire while resources continue running?
Related objectives
- D1.3.S1 — Implement and manage Azure Policy
- D1.3.S2 — Configure resource locks
- D1.3.S6 — Manage costs by using alerts, budgets, and Azure Advisor recommendations