AZ-305 · Domain 1 of 4

AZ-305 Domain 1: Design identity, governance, and monitoring solutions

This domain covers designing the control plane of an Azure solution: logging and monitoring, authentication and authorization with Microsoft Entra ID, secrets management, and governance with management groups, Azure Policy and compliance.

Exam format
25–30%
Official functional groups
3
Assessment estimate
11–16
Suggested study time estimate
25–35 hrs

About 10 min read Reviewed October 2026

Overview

Design identity, governance, and monitoring solutions is a foundational AZ-305 domain, covering how a solution is secured, controlled and observed at design time. It has three objective groups. Designing logging and monitoring covers recommending logging, log routing and monitoring solutions with Azure Monitor, Log Analytics and Application Insights. Designing authentication and authorization covers recommending authentication, identity management, access to Azure and on-premises resources with Microsoft Entra ID and role-based access control, and managing secrets, certificates and keys. Designing governance covers recommending a management group, subscription and resource group structure, tagging, compliance management with Azure Policy, and identity governance.

At 25–30%, this is a top-weighted domain. Unlike the administrator exam, AZ-305 tests design judgment: recommending the right identity, governance and monitoring design for stated business and compliance requirements, not configuring it. Together with infrastructure, identity and governance make up more than half the exam.

How it's tested

AZ-305 questions are design scenarios that state business, security and compliance requirements and ask you to recommend the best solution, where several options may work. In this domain they describe an identity, governance or monitoring need and reward the design that meets all the requirements. Read every requirement before recommending.

  • Recommend the identity design

    An authentication or access requirement is described, and you recommend the Entra ID feature, RBAC design or secrets solution.

  • Recommend the governance structure

    A control or compliance requirement is described, and you recommend the management group hierarchy, Azure Policy or tagging strategy.

  • Recommend the monitoring solution

    A visibility or logging requirement is described, and you recommend the Azure Monitor, Log Analytics or log-routing design.

Reasoning it through

A company must grant an application access to Azure resources without storing any credentials, and must rotate secrets automatically for other services. Storing a service principal secret creates a credential to protect. A managed identity gives the application an identity with no stored credential for Azure access, and Azure Key Vault stores and rotates the other secrets, so the recommended design combines a managed identity with Key Vault, the credential-free approach the exam expects.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Design solutions for logging and monitoringRecommend logging, log routing and monitoring solutions.
What it means
This covers recommending a logging solution, a solution for routing logs to the right destinations, and a monitoring solution, using Azure Monitor, Log Analytics workspaces, diagnostic settings, Application Insights and alerting.
What to understand
Azure Monitor collects metrics and logs; Log Analytics workspaces store and query logs with KQL; diagnostic settings route logs to workspaces, storage or event hubs. Application Insights monitors application performance. The design recommends where logs go, how long they are kept, and how the solution is monitored and alerted.
How it shows up
A visibility or logging requirement is described, and you must recommend the monitoring design and log routing.
Common confusion
Confusing metrics with logs, or Azure Monitor with Log Analytics; Log Analytics is the workspace and query engine within Azure Monitor.
1.2 Design authentication and authorization solutionsRecommend authentication, identity management, access, and secrets management.
What it means
This covers recommending an authentication solution, an identity management solution, solutions for authorizing access to Azure and on-premises resources with Microsoft Entra ID and role-based access control, and a solution to manage secrets, certificates and keys with Azure Key Vault.
What to understand
Authentication verifies identity, with single sign-on, multifactor authentication and Conditional Access, while authorization grants access with RBAC roles at scopes. Managed identities give resources credential-free access. Key Vault stores and rotates secrets, keys and certificates. On-premises access may use Entra ID with hybrid identity. The design matches the mechanism to the requirement.
How it shows up
An authentication, access or secrets requirement is described, and you must recommend the Entra ID feature, RBAC design or Key Vault solution.
Common confusion
Confusing authentication with authorization; authentication (MFA, SSO) verifies who the user is, while RBAC authorizes what they can do.
1.3 Design governanceRecommend management group structure, tagging, compliance and identity governance.
What it means
This covers recommending a structure for management groups, subscriptions and resource groups and a resource tagging strategy, a solution for managing compliance with Azure Policy, and a solution for identity governance such as access reviews and entitlement management.
What to understand
The management hierarchy applies policy and access downward, so a sound structure enforces standards at scale. Azure Policy audits and enforces configuration, distinct from RBAC which grants permissions. Tags attribute cost and organize resources. Identity governance manages the lifecycle of access with reviews and entitlement management.
How it shows up
A control, compliance or organizational requirement is described, and you must recommend the hierarchy, Azure Policy, tagging or identity governance design.
Common confusion
Confusing Azure Policy with RBAC; Policy enforces configuration and compliance, while RBAC grants permissions to identities.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Authentication vs. authorization

    Verifying identity versus granting access.

    Remember
    MFA and SSO authenticate; RBAC authorizes.
    Tested as
    Identity design questions.
    Trap
    Confusing the two.

  • Managed identity

    A credential-free identity for an Azure resource.

    Remember
    Preferred over stored service principal secrets.
    Tested as
    Access design questions.
    Trap
    Recommending stored credentials instead.

  • Conditional Access

    Policy that grants or blocks access based on signals.

    Remember
    It enforces conditions such as MFA for risky sign-ins.
    Tested as
    Authentication design questions.
    Trap
    Confusing it with RBAC.

  • Azure RBAC design

    Roles assigned at scopes, inheriting downward.

    Remember
    Recommend least privilege at the narrowest scope.
    Tested as
    Authorization design questions.
    Trap
    Recommending broad scopes.

  • Azure Key Vault

    Managed storage and rotation of secrets, keys and certificates.

    Remember
    Keep secrets out of code, retrieve via managed identity.
    Tested as
    Secrets design questions.
    Trap
    Designing hard-coded secrets.

  • Management group hierarchy

    Management groups, subscriptions, resource groups and resources.

    Remember
    Policy and RBAC applied higher flow down.
    Tested as
    Governance design questions.
    Trap
    Designing a flat structure that cannot enforce standards.

  • Azure Policy

    Enforces and audits configuration and compliance.

    Remember
    It governs configuration, not permissions.
    Tested as
    Compliance design questions.
    Trap
    Confusing it with RBAC.

  • Identity governance

    Access reviews and entitlement management for the access lifecycle.

    Remember
    It controls who keeps access over time.
    Tested as
    Governance design questions.
    Trap
    Overlooking access lifecycle.

  • Azure Monitor and Log Analytics

    Metrics and logs platform with a workspace and KQL query engine.

    Remember
    Log Analytics is the workspace within Azure Monitor.
    Tested as
    Monitoring design questions.
    Trap
    Confusing metrics with logs.

  • Diagnostic settings and log routing

    Send logs to workspaces, storage or event hubs.

    Remember
    They determine where logs are stored and analyzed.
    Tested as
    Logging design questions.
    Trap
    Not routing logs to the right destination.

  • Hybrid identity

    Extending identity to on-premises with Entra ID.

    Remember
    It enables single identity across cloud and on-premises.
    Tested as
    Identity design questions.
    Trap
    Designing separate identities per environment.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Authentication vs. authorization vs. governance

ConceptMeaningKey differenceCommon trap
Authentication Verifies identity Who the user is Confusing with authorization
Authorization (RBAC) Grants permissions What the user can do Confusing with authentication
Governance (Policy) Enforces configuration and compliance What configuration is allowed Confusing with RBAC

Managed identity vs. service principal secret

ConceptMeaningKey differenceCommon trap
Managed identity Credential-free Azure identity No secret to store or rotate Not using it where available
Service principal secret App identity with a stored secret Requires protecting and rotating Using it where a managed identity fits

Azure Monitor vs. Log Analytics vs. Application Insights

ConceptMeaningKey differenceCommon trap
Azure Monitor The overall metrics and logs platform Umbrella service Confusing it with its components
Log Analytics Workspace and KQL query engine Stores and queries logs Confusing with metrics
Application Insights Application performance monitoring App-level telemetry Overlooking app telemetry

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Stored secret for app access

    What candidates pick
    Recommend a service principal with a stored secret for app access to Azure.
    Why it looks right
    It is a familiar pattern.
    Why it's wrong
    A managed identity gives credential-free access with no secret to store or rotate.

    Clue to watch for An Azure resource needs to access another Azure resource securely.

  2. Policy for permissions

    What candidates pick
    Recommend Azure Policy to grant users permissions.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration and compliance; RBAC grants permissions.

    Clue to watch for The requirement is to grant or limit what users can do.

  3. RBAC for compliance rules

    What candidates pick
    Recommend RBAC to enforce that resources use approved regions.
    Why it looks right
    RBAC controls access.
    Why it's wrong
    Enforcing configuration such as allowed regions is Azure Policy, not RBAC.

    Clue to watch for The requirement is a configuration rule across resources.

  4. MFA grants access

    What candidates pick
    Recommend multifactor authentication to authorize access to a resource.
    Why it looks right
    Both relate to access.
    Why it's wrong
    MFA strengthens authentication; RBAC authorizes access to resources.

    Clue to watch for The requirement is to grant permissions, not verify identity.

  5. Flat hierarchy

    What candidates pick
    Recommend placing all subscriptions directly under the root with no management groups.
    Why it looks right
    It is simpler.
    Why it's wrong
    A management group hierarchy lets policy and access be applied and inherited at scale.

    Clue to watch for Standards must be enforced consistently across many subscriptions.

  6. Logs not routed

    What candidates pick
    Recommend monitoring without configuring where logs are sent.
    Why it looks right
    Monitoring seems enabled.
    Why it's wrong
    Diagnostic settings must route logs to a Log Analytics workspace, storage or event hub for analysis and retention.

    Clue to watch for Logs must be retained or analyzed in a specific place.

Answer framework

For any Domain 1 identity, governance or monitoring design, use these steps to find the answer AZ-305 expects.

  1. Read all the business, security and compliance requirements, since several designs may work and the best one meets them all.
  2. For identity, separate authentication from authorization, recommend managed identities for credential-free access, and Key Vault for secrets, keys and certificates.
  3. For governance, recommend a management group hierarchy that enforces standards, Azure Policy for configuration and compliance, and tagging for cost and organization, distinct from RBAC.
  4. For monitoring, recommend Azure Monitor with Log Analytics and route logs via diagnostic settings to the destinations the requirements demand.
  5. Favor least privilege, credential-free and policy-enforced designs that support compliance without slowing delivery. Confirm the recommended design meets every stated requirement, including compliance and cost, before committing to it.

Practice question

An application running on an Azure virtual machine must access an Azure Storage account and an Azure SQL Database without any credentials being stored in the application or its configuration. What should the architect recommend?

Want more like this? The AZ-305 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as design recommendation, not configuration, and anchor it on the Well-Architected and Cloud Adoption Frameworks. Start with identity, since it is heavily tested: separate authentication from authorization firmly, make managed identities your default for credential-free access, and know when to recommend Key Vault, Conditional Access and hybrid identity.

Next, master governance design: a management group hierarchy that enforces standards at scale, Azure Policy for configuration and compliance distinct from RBAC, tagging, and identity governance. These recur across the exam. Then learn monitoring design: Azure Monitor with Log Analytics, and routing logs via diagnostic settings to the required destinations.

Because questions are requirement-driven scenarios with several workable options, practice choosing the design that meets every stated requirement, especially compliance and least privilege. Afterwards, move to Domain 2, designing data storage solutions. Because AZ-305 is a design exam, drill requirement-driven scenarios and justify why the recommended design beats the alternatives, anchoring on the Well-Architected and Cloud Adoption Frameworks, and review missed questions by group.

FAQ

How much of AZ-305 is Domain 1?

Design identity, governance, and monitoring solutions is 25–30% of the exam, and with the infrastructure domain it makes up more than half the content.

What is the difference between authentication and authorization?

Authentication verifies who a user is, using mechanisms such as single sign-on and multifactor authentication. Authorization grants access, typically through Azure role-based access control.

When should I recommend a managed identity?

Whenever an Azure resource must access another Azure resource without storing credentials. A managed identity provides a credential-free identity, preferred over a service principal secret.

What is the difference between Azure Policy and RBAC?

Azure Policy enforces and audits configuration and compliance, such as allowed regions or required tags. Azure RBAC grants permissions, controlling who can perform actions.

What is the role of the management group hierarchy?

It lets governance, policy and access be applied at a high level and inherited down to subscriptions and resources, enforcing standards consistently at scale.

What is identity governance?

Managing the lifecycle of access with capabilities such as access reviews and entitlement management, ensuring users retain only the access they should have over time.

How does Domain 1 connect to the rest of the exam?

Identity, governance and monitoring are the control plane for the data, continuity and infrastructure designs in the other domains, so these decisions apply throughout.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered identity, governance and monitoring design, from managed identities to Azure Policy and Azure Monitor. Test whether you can recommend the control-plane design that meets every requirement.

Take the AZ-305 practice test Check your AZ-305 readiness

Keep going