Describe Azure management and governance
Azure Governance and Compliance
CoreDistinguish data governance, resource compliance, authorization, and change protection.
Aligned to the AZ-900 skills measured as of July 20, 2026; product behavior verified August 23, 2026.
Why this matters
Governance questions turn on the object being governed: data, resource configuration, permitted actions, or accidental modification.
Must Know
- Microsoft Purview provides capabilities for discovering, cataloging, classifying, and governing data across an organization’s data estate.
- Azure Policy evaluates Azure resources against organizational standards and can enforce effects at an assigned scope.
- Azure RBAC authorizes what principals may do; it does not determine whether a resource configuration complies with a standard.
- Resource locks protect management-plane resources from accidental deletion or modification. CanNotDelete permits updates but blocks deletion; ReadOnly blocks modification operations.
- Locks apply independently of RBAC authorization: an authorized user can still be blocked by a lock.
Compare and Distinguish
- Purview vs Azure Policy: data governance and visibility versus Azure resource configuration compliance.
- Policy vs RBAC: permitted/configuration state versus principal/action authorization.
- Policy vs lock: standards and compliance effects versus direct protection from deletion or modification.
- CanNotDelete vs ReadOnly: deletion protection with updates allowed versus blocking modifications.
Scenario examples
- A data office catalogs sensitive information and traces lineage with Purview.
- A platform team requires resources to follow an approved configuration with Azure Policy.
- A critical resource receives a CanNotDelete lock so authorized administrators can update but not accidentally delete it.
Exam traps
- Permission to create a resource does not make a noncompliant configuration acceptable.
- A lock does not grant or remove ordinary role permissions.
- Purview is not the Azure management-plane permission system.
Key takeaways
- Name the governed object before choosing the tool.
- RBAC answers who can act; Policy answers whether resource state follows standards.
- Locks add deletion or modification protection even for authorized users.
Ready for the quiz?
- Which service governs the data estate?
- How do Policy and RBAC answer different questions?
- Which lock permits updates but blocks deletion?
Related objectives
- D3.2.S1 — Describe the purpose of Microsoft Purview in Azure
- D3.2.S2 — Describe the purpose of Azure Policy
- D3.2.S3 — Describe the purpose of resource locks