AZ-900 · Domain 3 of 3

AZ-900 Domain 3: Describe Azure management and governance

This group covers managing, governing and monitoring Azure. It covers cost management, governance and compliance tools such as Azure Policy and resource locks, deployment and management tools from the portal to ARM templates, and monitoring tools.

Exam format
30–35%
Official functional groups
4
Assessment estimate
13–20
Suggested study time estimate
5–10 hrs

About 10 min read Reviewed October 2026

Overview

Describe Azure management and governance covers running, governing and monitoring an Azure environment. It has four objective groups. Cost management covers factors affecting cost, the pricing calculator, cost management capabilities and tags. Governance and compliance cover Microsoft Purview, Azure Policy and resource locks. Management and deployment tools cover the Azure portal, Cloud Shell with CLI and PowerShell, Azure Arc, infrastructure as code and Azure Resource Manager and ARM templates. Monitoring covers Azure Advisor, Service Health and Azure Monitor with Log Analytics, alerts and Application Insights.

At 30–35%, this is the second-largest group. It is recognition-level, testing what each governance, deployment and monitoring tool does and when to use it. The exam rewards knowing which tool enforces policy, which controls cost, which prevents accidental deletion and which monitors health, within the resource hierarchy from Domain 2.

How it's tested

AZ-900 questions in this group describe a governance, cost, deployment or monitoring need and ask which tool fits, at recognition level. Read the full scenario and all options before choosing, picking the service or term that most precisely matches what is described.

  • Right governance tool

    A control need is described, and you choose Azure Policy, resource locks or tags.

  • Cost tool

    A cost estimation or tracking need is described, and you choose the pricing calculator, cost management or tags.

  • Monitoring tool

    A health or performance visibility need is described, and you choose Advisor, Service Health or Azure Monitor.

Reasoning it through

An organization must ensure that no one can accidentally delete a critical production resource, regardless of their permissions. Azure Policy enforces configuration rules but does not block deletion by an authorized user, and RBAC controls who has permissions in general. A resource lock set to prevent deletion blocks deletion of the resource even for users who otherwise have permission, which matches the requirement, so a resource lock is the tool.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

3.1 Describe cost management in AzureCost factors, the pricing calculator, cost management and tags.
What it means
This covers factors that affect Azure costs, the pricing calculator for estimating costs before deployment, Microsoft Cost Management for tracking and analyzing spend and setting budgets, and tags for organizing and attributing costs.
What to understand
Costs depend on resource type, usage, region and other factors. The pricing calculator estimates costs before deployment, while Cost Management tracks actual spend, analyzes it and sets budgets and alerts. Tags label resources to attribute costs to teams or projects.
How it shows up
A cost estimation or tracking need is described, and you must choose the pricing calculator, Cost Management or tags.
Common confusion
Confusing the pricing calculator with Cost Management; the calculator estimates before deployment, while Cost Management tracks actual spend.
3.2 Describe features and tools in Azure for governance and complianceMicrosoft Purview, Azure Policy and resource locks.
What it means
This covers Microsoft Purview for data governance and compliance, Azure Policy for enforcing configuration rules across resources, and resource locks for preventing accidental deletion or modification of resources.
What to understand
Azure Policy enforces and audits configuration, such as allowed regions or required tags, flowing down the hierarchy. Resource locks prevent deletion or changes regardless of permissions. Microsoft Purview governs data across the estate. Each addresses a different governance need.
How it shows up
A governance or compliance need is described, and you must choose Azure Policy, a resource lock or Purview.
Common confusion
Confusing Azure Policy with role-based access control; Policy enforces configuration rules, while RBAC grants permissions.
3.3 Describe features and tools for managing and deploying Azure resourcesThe portal, Cloud Shell, Azure Arc, infrastructure as code and ARM templates.
What it means
This covers the Azure portal for a graphical interface, Azure Cloud Shell with the Azure CLI and PowerShell, Azure Arc for managing resources outside Azure, infrastructure as code, and Azure Resource Manager and ARM templates for repeatable deployment.
What to understand
The portal is graphical, while the CLI and PowerShell in Cloud Shell are command-line. Azure Arc extends Azure management to on-premises and other clouds. Infrastructure as code, through ARM templates or Bicep, deploys resources repeatably. ARM is the deployment and management layer for Azure resources.
How it shows up
A management or deployment need is described, and you must choose the portal, Cloud Shell, Azure Arc or ARM templates.
Common confusion
Confusing Azure Arc with Azure Resource Manager; Arc manages resources outside Azure, while ARM is the deployment layer for Azure resources.
3.4 Describe monitoring tools in AzureAzure Advisor, Service Health and Azure Monitor.
What it means
This covers Azure Advisor for best-practice recommendations, Azure Service Health for the status of Azure services affecting you, and Azure Monitor including Log Analytics, Monitor alerts and Application Insights for collecting and analyzing telemetry.
What to understand
Azure Advisor recommends improvements across cost, security, reliability and performance. Service Health reports on Azure service issues and planned maintenance affecting your resources. Azure Monitor collects metrics and logs, with Log Analytics for querying, alerts for notification and Application Insights for application performance.
How it shows up
A monitoring or recommendation need is described, and you must choose Advisor, Service Health or Azure Monitor.
Common confusion
Confusing Azure Advisor with Service Health; Advisor recommends best-practice improvements, while Service Health reports Azure service status.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Pricing calculator vs. Cost Management

    Estimates before deployment versus tracks actual spend.

    Remember
    Calculator for planning, Cost Management for tracking.
    Tested as
    Cost questions.
    Trap
    Confusing the two.

  • Tags

    Labels for organizing and attributing costs.

    Remember
    They group costs by team or project.
    Tested as
    Cost questions.
    Trap
    Expecting cost breakdowns without tags.

  • Azure Policy

    Enforces and audits configuration rules.

    Remember
    It governs configuration, not permissions.
    Tested as
    Governance questions.
    Trap
    Confusing it with RBAC.

  • Resource locks

    Prevent deletion or modification of resources.

    Remember
    They block deletion regardless of permissions.
    Tested as
    Governance questions.
    Trap
    Confusing them with Policy or RBAC.

  • Microsoft Purview

    Data governance and compliance across the estate.

    Remember
    It governs data, not infrastructure config.
    Tested as
    Compliance questions.
    Trap
    Confusing it with Azure Policy.

  • Azure portal vs. Cloud Shell

    Graphical interface versus command line.

    Remember
    CLI and PowerShell run in Cloud Shell.
    Tested as
    Management questions.
    Trap
    Confusing the interfaces.

  • Azure Arc

    Manages resources outside Azure.

    Remember
    It extends Azure management to hybrid and multicloud.
    Tested as
    Management questions.
    Trap
    Confusing it with ARM.

  • ARM and ARM templates

    The deployment layer and infrastructure as code.

    Remember
    Templates deploy resources repeatably.
    Tested as
    Deployment questions.
    Trap
    Confusing ARM with Arc.

  • Azure Advisor

    Best-practice recommendations across pillars.

    Remember
    It recommends improvements.
    Tested as
    Monitoring questions.
    Trap
    Confusing it with Service Health.

  • Azure Service Health

    Status of Azure services affecting you.

    Remember
    It reports outages and maintenance.
    Tested as
    Monitoring questions.
    Trap
    Confusing it with Advisor.

  • Azure Monitor

    Collects metrics and logs with Log Analytics, alerts and Application Insights.

    Remember
    It provides observability.
    Tested as
    Monitoring questions.
    Trap
    Confusing its components.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Azure Policy vs. RBAC vs. resource locks

ConceptMeaningKey differenceCommon trap
Azure Policy Enforces configuration rules Controls what configuration is allowed Confusing it with RBAC
RBAC Grants permissions to identities Controls who can act Confusing it with Policy
Resource locks Prevent deletion or changes Block changes regardless of permissions Confusing with Policy

Pricing calculator vs. Cost Management

ConceptMeaningKey differenceCommon trap
Pricing calculator Estimates costs before deployment Planning estimates Treating it as actual spend
Cost Management Tracks and analyzes actual spend Budgets and alerts Confusing it with the calculator

Advisor vs. Service Health vs. Azure Monitor

ConceptMeaningKey differenceCommon trap
Azure Advisor Best-practice recommendations Improve cost, security, reliability Confusing with Service Health
Service Health Azure service status for you Outages and maintenance Confusing with Advisor
Azure Monitor Metrics, logs and alerts Observability of your resources Confusing its components

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Policy prevents deletion

    What candidates pick
    Use Azure Policy to stop a resource from being deleted.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration rules; a resource lock prevents deletion regardless of permissions.

    Clue to watch for The need is to block accidental deletion.

  2. Policy grants access

    What candidates pick
    Use Azure Policy to give a user permissions.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration; role-based access control grants permissions.

    Clue to watch for The need is to grant permissions.

  3. Calculator tracks spend

    What candidates pick
    Use the pricing calculator to track actual monthly spend.
    Why it looks right
    Both relate to cost.
    Why it's wrong
    The pricing calculator estimates before deployment; Cost Management tracks actual spend.

    Clue to watch for The need is to monitor real spending.

  4. Arc is ARM

    What candidates pick
    Use Azure Arc to deploy resources within Azure.
    Why it looks right
    Both are management tools.
    Why it's wrong
    Azure Arc manages resources outside Azure; ARM is the deployment layer for Azure resources.

    Clue to watch for The resources are on-premises or in another cloud versus in Azure.

  5. Advisor is Service Health

    What candidates pick
    Use Azure Advisor to check whether an Azure service is currently down.
    Why it looks right
    Both are monitoring tools.
    Why it's wrong
    Service Health reports Azure service status; Advisor gives best-practice recommendations.

    Clue to watch for The need is current Azure service status versus improvement advice.

  6. No tags, cost breakdown

    What candidates pick
    Expect per-team cost breakdowns without tagging resources.
    Why it looks right
    Cost Management shows spend.
    Why it's wrong
    Tags attribute costs to teams or projects; without them, breakdowns by team are not possible.

    Clue to watch for The need is to attribute cost by team or project.

Answer framework

For any Domain 3 scenario, use these steps to find the answer AZ-900 expects.

  1. Identify whether the need is cost, governance and compliance, deployment and management, or monitoring.
  2. For cost, use the pricing calculator to estimate before deployment, Cost Management to track spend, and tags to attribute it.
  3. For governance, use Azure Policy for configuration rules, resource locks to prevent deletion, and Purview for data governance, keeping these distinct from RBAC.
  4. For deployment and management, choose the portal, Cloud Shell, ARM templates for repeatable deployment, or Azure Arc for resources outside Azure.
  5. For monitoring, choose Advisor for recommendations, Service Health for Azure status, and Azure Monitor for metrics, logs and alerts. Where two options seem to fit, pick the one that most precisely matches the scenario.

Practice question

An administrator must ensure that a critical production storage account cannot be accidentally deleted, even by users who have permission to manage it. Which Azure feature should the administrator use?

Want more like this? The AZ-900 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this group as learning each management tool's distinct purpose, because the exam tests which tool does what. Start with governance, drilling the three controls candidates confuse: Azure Policy enforces configuration rules, RBAC grants permissions, and resource locks prevent deletion. Keep them firmly separate.

Next, learn cost management, distinguishing the pricing calculator (estimates before deployment) from Cost Management (tracks actual spend), with tags for attribution. Then cover deployment and management tools, keeping Azure Arc (resources outside Azure) distinct from ARM (Azure deployment). Finally, learn the monitoring tools, separating Advisor (recommendations), Service Health (Azure status) and Azure Monitor (telemetry).

Because this is a recognition exam, a focused review of each tool's purpose and practice questions suffice. Because AZ-900 is a recognition exam, flashcards and timed practice questions are more valuable than hands-on labs, and reviewing missed questions by group shows where to focus; the free Microsoft Learn Azure Fundamentals path maps directly to these objectives. This is the final group, so finish with full practice tests spanning all three.

FAQ

How much of AZ-900 is Domain 3?

Describe Azure management and governance is 30–35% of the exam, the second-largest group.

What is the difference between Azure Policy and RBAC?

Azure Policy enforces and audits configuration rules, such as allowed regions or required tags. Role-based access control grants permissions, controlling who can perform actions.

What do resource locks do?

They prevent a resource from being deleted or modified, even by users who have the permission to do so, protecting against accidental changes.

What is the difference between the pricing calculator and Cost Management?

The pricing calculator estimates costs before deployment for planning. Microsoft Cost Management tracks and analyzes actual spend and sets budgets and alerts.

What is Azure Arc for?

Managing resources that live outside Azure, such as on-premises servers or other clouds, through Azure's management tools.

What is the difference between Azure Advisor and Service Health?

Azure Advisor gives best-practice recommendations across cost, security, reliability and performance. Service Health reports the status of Azure services and maintenance affecting your resources.

How does Domain 3 connect to the rest of the exam?

It governs, deploys and monitors the services and hierarchy from Domain 2, applying the cost and responsibility concepts from Domain 1.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered cost management, governance, deployment and monitoring tools. Test whether you can match the right tool to a need under exam conditions.

Take the AZ-900 practice test Check your AZ-900 readiness

Keep going