1.3 - Governance: resource locks, Azure Policy and cost
AZ-104 objective 1.3 covers governance and cost management. Resource groups hold your resources, and moving a resource between groups in the same subscription keeps it running and never changes the region it lives in - it is a metadata move. Management locks protect against mistakes independently of RBAC: a CanNotDelete lock blocks deletion while still allowing edits, and a ReadOnly lock is stricter and blocks changes too, with the most restrictive lock anywhere in the inheritance chain winning, so a ReadOnly lock on the resource group overrides a CanNotDelete lock on the subscription. Besides Owner, the User Access Administrator role can create and delete locks by default. Azure Policy enforces rules such as allowing only an approved short list of resource types or regions, and you group several related policy definitions into an initiative to assign them together as one unit; a DeployIfNotExists policy plus a remediation task fixes noncompliant resources. For cost, a budget with an alert emails you when actual or forecast spend crosses a threshold without stopping any resource, and the Total Cost of Ownership calculator compares current on-premises workloads against equivalent Azure costs. Expect scenarios that ask which governance or cost tool fits.
Moving a resource never changes its region. CanNotDelete blocks deletion, ReadOnly blocks changes too; strictest lock in the chain wins. Bundle policies to assign together = initiative. A budget alert notifies, never stops resources.
Practice questions
1. An Azure Policy must stop non-compliant virtual machines from being created at all. Which policy effect achieves this?
- Deny (correct answer)
- Audit, which only records the non-compliance in the report while still allowing creation
- Append
- Modify
The Deny effect blocks the create or update request outright when it violates the policy. Audit merely flags non-compliance without blocking, Append adds fields, and Modify changes properties.
2. A production resource group must stay fully editable, but nobody, including owners, may delete its resources. What should you apply?
- A CanNotDelete lock (correct answer)
- A ReadOnly lock, which would also block every update and configuration change on the resources
- A deny assignment
- A resource tag
A CanNotDelete lock allows reads and updates but blocks deletion for everyone until removed. A ReadOnly lock would wrongly block edits too, a tag is only metadata, and a deny assignment is not the standard deletion safeguard.
3. You must apply one Azure Policy to several subscriptions at once from a single point of control. Which container should you target?
- A management group (correct answer)
- A single resource group that is somehow shared across all of the different subscriptions
- A tag
- An Entra ID group
Management groups sit above subscriptions, so a policy assigned there is inherited by every subscription beneath it. Resource groups cannot span subscriptions, tags only label, and Entra groups organize identities.
4. An Azure Policy must record which resources are non-compliant without blocking any deployment. Which effect should the definition use?
- Audit (correct answer)
- Deny, which rejects the create or update request outright whenever a resource violates the policy condition
- Append
- Modify
The Audit effect flags non-compliant resources in the compliance report but still allows the deployment. Deny would block it, Append adds fields, and Modify changes properties.
5. A policy must automatically add a missing tag value to new resources during creation, without blocking them. Which effect fits?
- Append (correct answer)
- Deny, which instead refuses the whole request so that no resource missing the tag can ever be created
- Audit
- Disabled
The Append effect adds specified fields such as a tag to a resource during creation without rejecting it. Deny blocks, Audit only flags, and Disabled turns the policy off.
6. A policy must deploy a diagnostic setting on any resource that lacks one. Which effect performs this remediation deployment?
- DeployIfNotExists (correct answer)
- Audit, which merely reports the absence of the diagnostic setting without ever provisioning it for you
- Deny
- Append
DeployIfNotExists runs a linked ARM deployment to create the related resource when it is missing, using a managed identity. Audit only reports, Deny blocks, and Append adds simple fields, not full deployments.