Describe Azure management and governance is worth 30–35% of your AZ-900 score — the single largest scored domain on the exam. It is also the domain most often under-prepared, because it is the least glamorous: no shiny compute service, no networking diagrams, just the money, the guardrails, and the dashboards that keep a real Azure estate from turning into an ungoverned, over-spending mess. The good news is that this domain rewards recognition, not depth. The exam does not ask you to write an Azure Policy definition or a KQL query. It asks you to hear a business scenario — “we need to stop anyone deleting the production database,” “we want to be warned before we blow past our monthly budget,” “we need a personalized list of security and cost improvements” — and name the one Azure feature that solves it.
This guide walks the whole of Domain 3 the way the AZ-900 frames it, following the current skills measured blueprint (updated July 2026): cost management, governance and compliance tools, the surfaces for managing and deploying resources, and the monitoring tools. Everything is fundamentals-level — what each tool is for and when it applies — with the confusable pairs pulled out into decision tables, because that is exactly where the exam sets its traps.
What “Management and Governance” Actually Covers
Governance is the practice of staying in control of a cloud estate as it grows: controlling cost, enforcing rules, standardizing deployments, and observing what is happening. The AZ-900 splits the domain into four objective groups, and it is worth holding the map in your head before the details:
| Objective group | The question it answers | Key tools |
|---|---|---|
| Cost management | ”What will this cost, and how do I track and control it?” | Pricing Calculator, TCO Calculator, Microsoft Cost Management, tags |
| Governance & compliance | ”How do I enforce rules and prevent mistakes?” | Azure Policy, resource locks, Microsoft Purview |
| Managing & deploying | ”How do I interact with and provision resources?” | Portal, Cloud Shell, Azure CLI, Azure PowerShell, Azure Arc, IaC, ARM |
| Monitoring | ”What is happening, and what should I improve?” | Azure Monitor, Log Analytics, Application Insights, Advisor, Service Health |
Notice the shape: two groups are about control (cost and governance), one is about doing (management surfaces), and one is about seeing (monitoring). If you can slot any exam scenario into one of those four buckets, you are 80% of the way to the right answer.
Cost Management in Azure
Cost is the emotional core of the “why cloud” conversation, and the exam leans on it heavily. Domain 3 expects you to know what drives an Azure bill, the two tools that estimate cost before you deploy, the service that tracks and controls actual spend, and the humble feature — tags — that ties spend back to a team or project.
What Drives Your Azure Bill
Several factors move your invoice, and the exam likes to ask which lever applies:
- Resource type and size — a larger VM SKU, premium managed disks, or a higher database tier all cost more.
- Region — the same resource can cost different amounts in different Azure regions; pricing is region-specific.
- Bandwidth (egress) — inbound data transfer is generally free, but outbound data leaving an Azure region is metered. This “egress is what you pay for” point is a frequent exam cue.
- Billing model — pay-as-you-go is the most flexible but most expensive per unit; reservations (1- or 3-year commitments) and the Azure Hybrid Benefit (reusing on-prem Windows Server / SQL Server licenses) reduce cost in exchange for commitment.
- Spot capacity for interruptible workloads is deeply discounted.
The underlying principle is the consumption-based model you met in cloud concepts: you pay for what you use, which turns capital expense into operating expense.
Estimating Cost Before You Deploy: Two Calculators
The exam consistently tests the difference between the two free web calculators. Read the scenario carefully — one estimates a new solution, the other compares against on-premises.
| Tool | Purpose | Exam cue |
|---|---|---|
| Pricing Calculator | Estimate the monthly cost of a proposed set of Azure services before you build | ”How much will these VMs and this database cost?” |
| Total Cost of Ownership (TCO) Calculator | Compare the cost of running workloads on-premises vs on Azure, including hidden costs (power, cooling, IT labor) | “Should we migrate? What do we save vs our datacenter?” |
Mnemonic: Pricing = build, TCO = compare/migrate.
Microsoft Cost Management
Both calculators are pre-deployment. Once resources are live, Microsoft Cost Management is the service for tracking and controlling actual spend. On the AZ-900 you need to recognize its three headline capabilities:
- Cost analysis — visualize and break down accumulated spend by subscription, resource group, service, region, or tag.
- Budgets — set a spending threshold on a scope and trigger alerts (or automated actions) as you approach or exceed it. A budget does not stop resources from running — it notifies. That distinction is a classic trap.
- Exports and recommendations — schedule cost exports and surface cost-saving recommendations (which overlap with Azure Advisor’s cost pillar).
# Illustrative: create a monthly cost budget on a resource group (CLI)
az consumption budget create \
--budget-name "prod-monthly" \
--amount 5000 \
--category cost \
--time-grain monthly \
--resource-group prod-rgTags: The Glue of Cost Allocation and Governance
Tags are name–value metadata you attach to resources (for example costCenter=marketing, env=prod, owner=alice). They are how organizations answer “which team spent this money?” in Cost Management and “which resources belong to this project?” in governance reports. Two exam-relevant facts: tags are not inherited by child resources automatically (a resource does not adopt its resource group’s tags — you can enforce inheritance with Azure Policy), and a resource can carry many tags. Tags are free, but they are the backbone of any real chargeback or showback model.
Governance and Compliance Tools
If cost management is about money, governance is about rules and guardrails — making sure resources are deployed the way your organization requires and cannot be accidentally destroyed.
Azure Policy
Azure Policy enforces organizational standards by evaluating resources against policy definitions and reporting or blocking non-compliant ones. Typical rules: “only allow resources in West Europe and East US,” “only allow approved VM sizes,” “require a costCenter tag,” “audit any storage account without encryption.”
Key concepts the exam expects you to recognize:
- Policy definition — a single rule.
- Initiative — a group of policy definitions bundled toward a goal (for example a regulatory-compliance baseline).
- Effects — what happens on evaluation: Deny (block the deployment), Audit (allow but flag as non-compliant), Append/Modify (add or change a property), DeployIfNotExists (auto-remediate by deploying a missing resource).
- Compliance dashboard — the at-a-glance view of which resources pass or fail.
# Assign the built-in "Allowed locations" policy to a resource group
az policy assignment create \
--name "allowed-locations" \
--policy "e56962a6-4747-49cd-b67b-bf8b01975c4c" \
--params '{ "listOfAllowedLocations": { "value": ["eastus","westeurope"] } }' \
--resource-group prod-rgThe most important distinction in the whole domain: Azure Policy vs Azure RBAC. They sound similar but answer different questions. RBAC controls who can do what (identities and their permissions). Azure Policy controls what properties resources are allowed to have (regardless of who deploys them). A question about granting a user read access to a resource group is RBAC; a question about preventing anyone from creating a resource outside an approved region is Azure Policy. RBAC itself is covered in the identity, access and security guide.
Resource Locks
A resource lock protects a resource, resource group, or subscription from accidental change or deletion. There are two types:
| Lock type | Effect |
|---|---|
| CanNotDelete | Authorized users can read and modify the resource but cannot delete it |
| ReadOnly | Users can read the resource but cannot modify or delete it |
The crucial exam point: a lock overrides RBAC permissions. Even a subscription Owner is blocked by a CanNotDelete lock until they remove the lock first. Locks are the answer to “how do we stop someone accidentally deleting the production database, even an admin?”
az lock create --name "no-delete-prod-db" \
--lock-type CanNotDelete \
--resource-group prod-rg \
--resource prod-sql --resource-type "Microsoft.Sql/servers"Microsoft Purview
Microsoft Purview is the current AZ-900 answer for the data governance and compliance side of the domain. It helps organizations discover, classify, catalog, and govern data across Azure, on-premises, and multicloud estates — for example scanning storage to find and label sensitive data (PII, financial records) so it can be protected and audited. On the exam, Purview is the recognition-level answer to “how do we understand and govern our data landscape and support regulatory compliance?”
Exam-honesty note: older AZ-900 material and study courses reference Azure Blueprints as a governance tool. Azure Blueprints entered deprecation in July 2026 and is being retired (with its capabilities moving to Deployment Stacks and template specs), and it is no longer on the current AZ-900 blueprint. If a practice question tests Blueprints, treat it as out of date — the exam now emphasizes Azure Policy, resource locks, and Microsoft Purview for governance.
Managing and Deploying Azure Resources
Governance defines the rules; this objective group is about the surfaces you use to actually interact with Azure and the philosophy of deploying resources repeatably.
The Four Ways You Talk to Azure
| Surface | What it is | When you’d reach for it |
|---|---|---|
| Azure portal | The web-based graphical console | Exploring, learning, one-off tasks, dashboards |
| Azure Cloud Shell | Browser-based shell (Bash or PowerShell) with tools pre-installed and pre-authenticated | Quick CLI work with no local setup |
| Azure CLI | Cross-platform command-line tool (az commands) | Scripting and automation, especially on Linux/macOS |
| Azure PowerShell | PowerShell cmdlets (Az module) | Scripting for teams already invested in PowerShell |
The exam point is simply that the CLI and PowerShell are functionally equivalent scripting choices, Cloud Shell removes local install/auth friction, and the portal is the GUI. It rarely goes deeper than that.
Azure Arc
Azure Arc extends Azure management and governance to resources that live outside Azure — on-premises servers, Kubernetes clusters, and resources in other clouds. Once a resource is Arc-enabled, you can apply Azure Policy to it, see it in the portal, and manage it as though it were a native Azure resource. Arc is the answer to “we want to govern our on-prem and multicloud servers with the same Azure tools.”
Infrastructure as Code and ARM
Infrastructure as code (IaC) means defining your infrastructure in declarative files that can be versioned, reviewed, and deployed repeatably — so environments are consistent and reproducible instead of hand-clicked. In Azure, every action ultimately goes through Azure Resource Manager (ARM), the deployment and management layer that receives requests, authenticates and authorizes them (via RBAC), and provisions resources. You describe what you want in an ARM template (JSON) or in Bicep (a cleaner, more readable language that compiles to ARM JSON), and ARM makes it so — idempotently.
# Deploy an ARM/Bicep template to a resource group
az deployment group create \
--resource-group prod-rg \
--template-file main.bicep \
--parameters environment=prodFor the AZ-900 you only need the concepts: IaC = repeatable, declarative deployments; ARM = the underlying engine; ARM templates / Bicep = how you express the desired state.
Monitoring Tools in Azure
The final objective group is about observing your estate and acting on what you see. Three tools dominate, and the exam’s favorite trick is making you choose between them.
Azure Monitor
Azure Monitor is the umbrella platform for collecting and analyzing telemetry — metrics (numeric time-series like CPU %), logs, and alerts. Two components you must recognize by name:
- Log Analytics — the workspace and query tool (using KQL, the Kusto Query Language) where log data is stored and interrogated.
- Application Insights — the application performance monitoring (APM) piece: it instruments your app code to track request rates, response times, failures, dependencies, and live usage.
- Azure Monitor alerts — fire when a metric or log condition is met (for example CPU > 90% for 5 minutes), notifying an action group by email, SMS, webhook, or automation.
Mental model: Azure Monitor is the platform; Log Analytics is where logs live; Application Insights watches your application.
Azure Advisor
Azure Advisor is a free, personalized recommendation engine. It scans your resources and produces actionable best-practice recommendations across five categories: cost, security, reliability, operational excellence, and performance. Advisor is the answer to “give me a prioritized list of ways to improve my environment” — for example resize an underused VM (cost), enable MFA (security), or add redundancy (reliability).
Azure Service Health
Azure Service Health tells you about the health of Azure itself as it affects your resources — active service issues, planned maintenance, and health advisories. Do not confuse it with Resource Health (the health of one specific resource) or with Azure Monitor (your telemetry). Service Health answers “is Azure having an outage in my region that affects my services?”
How the AZ-900 Frames These Questions
The exam almost never asks “what is Azure Policy?” directly. It gives a scenario and asks you to pick the tool. These are the highest-yield discriminations:
| Scenario cue | Right answer | Not this |
|---|---|---|
| ”Prevent resources being created outside approved regions” | Azure Policy | RBAC (that’s who, not what) |
| “Grant a user permission to manage a resource group” | RBAC | Azure Policy |
| ”Stop anyone — even admins — deleting a resource” | Resource lock (CanNotDelete) | RBAC |
| ”Estimate the cost of a solution before building it” | Pricing Calculator | Cost Management |
| ”Compare on-prem vs Azure to justify migration” | TCO Calculator | Pricing Calculator |
| ”Track and alert on actual monthly spend” | Microsoft Cost Management (budgets) | Pricing Calculator |
| ”Personalized best-practice recommendations” | Azure Advisor | Azure Monitor |
| ”Is Azure having an outage affecting me?” | Azure Service Health | Azure Monitor |
| ”Monitor my application’s performance and failures” | Application Insights | Log Analytics |
| ”Govern on-prem and multicloud servers with Azure tools” | Azure Arc | ARM templates |
| ”Discover and classify sensitive data across the estate” | Microsoft Purview | Azure Policy |
A Worked Exam Scenario
A company runs a production SQL database in Azure. Leadership wants three things: no one should be able to delete the database accidentally, all new resources must be deployed only in East US, and the finance team needs to be alerted before monthly spend exceeds $10,000. Which combination of features do you use?
Walk it tool-by-tool:
- “No one can delete the database” → a resource lock of type CanNotDelete on the database (overrides even Owner permissions).
- “New resources only in East US” → an Azure Policy assignment using the Allowed locations definition with a Deny effect.
- “Alert before spend exceeds $10,000” → a Microsoft Cost Management budget with an alert threshold.
Three requirements, three distinct tools — and notice none of them is RBAC. That is exactly the kind of clean mapping the AZ-900 rewards.
Common Mistakes to Avoid
| Mistake | The correction |
|---|---|
| Thinking Azure Policy controls who can act | Policy controls what resources are allowed to be; RBAC controls who |
| Assuming a budget stops spending | A budget alerts; it does not cap or shut down resources |
| Confusing the Pricing Calculator with the TCO Calculator | Pricing = estimate a new build; TCO = compare vs on-premises |
| Thinking an Owner can bypass a lock | A CanNotDelete/ReadOnly lock blocks everyone until removed |
| Mixing up Azure Monitor, Advisor, and Service Health | Monitor = your telemetry; Advisor = recommendations; Service Health = Azure’s status |
| Expecting tags to inherit automatically | Child resources do not inherit tags unless enforced via Policy |
| Citing Azure Blueprints as a current tool | Blueprints is retiring; the exam now uses Policy, locks, and Purview |
How to Lock This In Before Exam Day
Domain 3 is a scoring opportunity: it is the largest slice of the exam, and it is pure recognition. The fastest way to bank those marks is repetition against realistic, scenario-worded questions until the tool-mapping is automatic — the moment you read “even an admin can’t delete it,” your brain should fire resource lock before you finish the sentence.
That reflex is exactly what timed practice builds. Sailor.sh’s AZ-900 Fundamentals mock exam bundle is built to mirror the current skills measured blueprint, with a heavy weighting on management and governance scenarios so you practice the discriminations above under exam conditions. If you want to try the format first, work through the free AZ-900 practice questions and the full AZ-900 practice set.
To round out the Azure architecture and services side of the exam, pair this with the sibling guides on Azure Compute, Azure Storage, and Azure Identity, Access & Security. Start with the AZ-900 exam guide for 2026 for logistics and the full blueprint, and schedule your prep with the 30-day AZ-900 study plan. Still deciding? Read is the AZ-900 worth it in 2026 or compare paths in AZ-900 vs AWS Cloud Practitioner.
Frequently Asked Questions
How much of the AZ-900 is management and governance?
The Describe Azure management and governance domain is weighted at 30–35%, making it the largest scored domain on the current AZ-900 (as of the July 2026 skills-measured update). It is worth prioritizing precisely because it is both the biggest slice and one of the easier ones to master.
What is the difference between Azure Policy and Azure RBAC?
RBAC controls who can perform actions on resources (identity and permissions). Azure Policy controls what properties resources are allowed to have — for example allowed regions, allowed SKUs, or required tags — regardless of who is deploying. They work together: RBAC decides if you can act, Policy decides if the result is compliant.
Will a resource lock stop a subscription Owner from deleting a resource?
Yes. A CanNotDelete lock blocks deletion for everyone, including Owners, until the lock itself is removed. Locks intentionally override RBAC permissions to prevent accidental changes to critical resources.
What is the difference between the Pricing Calculator and the TCO Calculator?
The Pricing Calculator estimates the monthly cost of a proposed Azure solution before you deploy it. The TCO (Total Cost of Ownership) Calculator compares the cost of running workloads on-premises versus on Azure, including hidden datacenter costs — it is a migration-justification tool.
Does a budget in Microsoft Cost Management stop me spending money?
No. A budget monitors spend against a threshold and triggers alerts (or optional automated actions), but it does not cap usage or shut down resources on its own. To actually prevent spend you would use governance controls like Azure Policy to restrict what can be deployed.
When would I use Azure Arc?
Use Azure Arc when you need to manage and govern resources that live outside Azure — on-premises servers, Kubernetes clusters, or resources in other clouds — using the same Azure tools like Azure Policy and the portal.
Is Azure Blueprints on the AZ-900 exam?
No longer. Azure Blueprints began deprecation in July 2026 and is being retired, with its capabilities moving to Deployment Stacks and template specs. The current AZ-900 governance objectives cover Azure Policy, resource locks, and Microsoft Purview instead.
Conclusion
Management and governance is where cloud fundamentals meet real operational discipline: controlling cost with calculators, Cost Management and tags; enforcing rules with Azure Policy and resource locks; deploying repeatably with ARM and IaC; and observing everything with Azure Monitor, Advisor, and Service Health. Because it is the biggest scored domain and rewards clean tool-mapping over deep configuration, it is the smartest place to invest your final study hours. Learn the decision tables above cold, drill them against scenario questions until the answers are reflexive, and you will convert the AZ-900’s largest domain into its most reliable source of points.