1.2AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Azure Governance: Management Groups, Azure Policy & Resource Locks

Establish enterprise cloud governance across multi-subscription environments using Management Group hierarchies, Azure Policy compliance definitions with auto-remediation, and Resource Locks.

Tags:#Azure#Governance#Azure Policy#Management Groups#Resource Locks#AZ-104
01

Overview

Enterprise cloud governance in Microsoft Azure provides structural control, compliance guardrails, and financial accountability across multiple subscriptions. The core pillars include:

  1. Management Groups: Hierarchical containers that sit above subscriptions. A single tenant supports up to 6 levels of depth under the Root Management Group (Tenant Root Group), enabling policy and RBAC inheritance across up to 10,000 management groups.
  2. Azure Policy: Enforces organizational standards and assesses compliance at scale. Evaluates resource properties through JSON rule logic using effects such as Audit, Deny, DeployIfNotExists (DINE), Modify, and Disabled.
  3. Resource Locks: Prevents accidental deletion (CanNotDelete) or unauthorized modification (ReadOnly) of critical resources regardless of RBAC assignments.
  4. Cost Budgets & Alerts: Tracks consumption thresholds against defined financial allocations to prevent cloud spend overruns.

---

02

When to Use: Policy Effects Comparison

EffectAction When Non-CompliantBest Used For
DenyBlocks the resource deployment immediately with an error.Hard guardrails (e.g., blocking unapproved VM SKUs, restricting regions).
AuditAllows deployment but flags the resource as non-compliant in compliance dashboards.Soft auditing without breaking developer CI/CD workflows.
DeployIfNotExists (DINE)Deploys a child/extension resource via a Managed Identity when a parent resource is created.Auto-installing Azure Monitor Log Analytics agent, Diagnostic Settings, or Antimalware.
ModifyAdds, updates, or removes properties or tags during resource creation or update.Enforcing standard resource tags (e.g., CostCenter, Environment).
DisabledTurns off rule evaluation without deleting the assignment.Testing or temporarily halting evaluation during migrations.

---

03

Prerequisites

Administrator Permissions:

  • Resource Policy Contributor or Owner at the target Management Group or Subscription scope.
  • User Access Administrator (required if assigning policies with DeployIfNotExists or Modify effects that require Managed Identity role assignments).

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Management groups
│   └── Tenant Root Group
│       ├── Landing-Zones (Production / Non-Production)
│       └── Governance & RBAC Inheritance
├── Policy
│   ├── Definitions (Search built-in or create Custom JSON policy)
│   ├── Assignments (Assign policy definition or Initiative to scope)
│   └── Remediation (Trigger remediation tasks for existing resources)
└── [Target Resource Group / Resource]
    └── Locks (Add CanNotDelete or ReadOnly lock)

---

05

Step-by-Step Implementation

Step 1: Create a Management Group Structure

  1. Navigate to Azure Portal > Management groups.
  2. Click + Create and configure:
  • Management group ID: mg-enterprise-core
  • Display name: Enterprise Core Landing Zone
  1. Move targeted subscriptions into the new management group to inherit baseline policies and RBAC.

Step 2: Assign Azure Policy (Allowed Locations)

  1. Navigate to Policy > Assignments > Assign policy.
  2. Set Scope: Select Enterprise Core Landing Zone.
  3. Select Policy definition: Built-in Allowed locations.
  4. In the Parameters tab: Select approved geographic regions (e.g., uaenorth, westeurope, eastus).
  5. In the Enforcement mode tab: Set to Enabled.
  6. Review and click Create. Any deployment outside selected regions is rejected instantly.

Step 3: Configure a Resource Lock on Production Databases

  1. Navigate to your production Resource Group or specific Azure SQL Database.
  2. Under Settings, select Locks > click + Add.
  3. Set:
  • Lock name: lock-prod-db-nodelete
  • Lock type: Delete (CanNotDelete)
  • Notes: Protected against accidental administrative deletion.
  1. Click OK.

---

06

Azure PowerShell & Azure CLI

PowerShell: Deploy Tag Policy with Auto-Remediation

PowerShell
# Connect and set subscription context
Connect-AzAccount
Set-AzContext -SubscriptionId "<YOUR-SUBSCRIPTION-ID>"

$subId = (Get-AzContext).Subscription.Id

# 1. Retrieve built-in policy for requiring a tag
$policyDef = Get-AzPolicyDefinition | Where-Object { 
    $_.Properties.DisplayName -eq "Require a tag and its value on resources" 
}

# 2. Assign policy at Subscription scope with Deny/Audit parameter
$params = @{
    "tagName"  = @{ "value" = "Environment" }
    "tagValue" = @{ "value" = "Production" }
}

$assignment = New-AzPolicyAssignment `
    -Name "enforce-env-tag" `
    -DisplayName "Enforce Environment=Production Tag" `
    -Scope "/subscriptions/$subId" `
    -PolicyDefinition $policyDef `
    -PolicyParameterObject $params `
    -AssignIdentity `
    -Location "westeurope"

Write-Host "Policy Assigned successfully: $($assignment.ResourceId)" -ForegroundColor Green

# 3. Apply a CanNotDelete Resource Lock to Resource Group
New-AzResourceLock `
    -LockName "rg-critical-lock" `
    -LockLevel "CanNotDelete" `
    -ResourceGroupName "rg-production-core" `
    -Notes "Critical production services - deletion locked." -Force

Azure CLI: Create Management Group and Audit Non-Compliant Resources

Bash / Shell
# Create Management Group
az account management-group create \
  --name "mg-production" \
  --display-name "Production Workloads"

# Move subscription into Management Group
az account management-group subscription add \
  --name "mg-production" \
  --subscription "<YOUR-SUBSCRIPTION-ID>"

# Check compliance state across subscription
az policy state list \
  --subscription "<YOUR-SUBSCRIPTION-ID>" \
  --filter "complianceState eq 'NonCompliant'" \
  --query "[].{Resource:resourceId, Policy:policyDefinitionName}" \
  --output table

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Management group hierarchy reflects organizational boundaries (Platform, Landing Zones, Sandbox).
Policy inheritance verified: child subscriptions automatically inherit policies assigned at parent management groups.
Attempting to deploy a resource in an unapproved region returns HTTP 403 Forbidden (RequestDisallowedByPolicy).
Critical production resource groups show CanNotDelete lock active in portal.
Attempting to delete a locked resource fails with ScopeLocked error code even for Subscription Owners.
08

Common Pitfalls & Troubleshooting Matrix

IssueRoot CauseResolution
Owner unable to delete resourceCanNotDelete lock is active on the parent Resource Group.Remove the lock first before deletion; locks override RBAC Owner privileges.
Policy assignment takes time to enforceAzure Policy compliance evaluation operates on an asynchronous cycle.State triggers within 15 minutes of resource creation; force evaluation via Start-AzPolicyComplianceScan.
DINE policy fails during remediationManaged Identity lacks target RBAC permissions on the target scope.Grant the Managed Identity the required Contributor/Role on the target subscription.
Cannot delete Management GroupManagement Group still contains child subscriptions or sub-groups.Move or remove all child entities before deleting the management group.

---

09

Real-World Architecture / Flow

Interactive Topology & Workflow
Tenant Root Groupgovernance
Stage 1

---

10

Audit & Monitoring

  • Monitor policy evaluations using Azure Activity Log:
  • Event: Microsoft.Authorization/policies/audit/action
  • Event: Microsoft.Authorization/policies/deny/action
  • Set up Azure Monitor Alerts for Policy Non-Compliance Rate > 5%.
  • Configure Microsoft Cost Management budgets with Webhook notifications to Teams/Slack when forecasted spend hits 80%, 100%, and 120%.

---

11

Rollback & Emergency Recovery

  • Remove Resource Lock:

```powershell

Remove-AzResourceLock -LockName "rg-critical-lock" -ResourceGroupName "rg-production-core" -Force

```

  • Exempt a Resource from Azure Policy:
  • In Policy > Exemptions, create an exemption assignment for specific emergency VMs or test subnets without tearing down the parent policy rule.

---

12

Official Documentation Reference

---

13

Exam Blueprint & Pro Tips (AZ-104)

Exam Blueprint & High-Yield Traps

AZ-104 High-Yield Rules:

  1. Locks Override RBAC: Even a Subscription Owner cannot delete a resource locked with CanNotDelete without explicitly removing the lock first.
  2. Lock Inheritance: A lock applied at a Subscription or Resource Group inherits down to all child resources and cannot be bypassed at the child level.
  3. Policy Evaluation Priority: Azure Policy does not restrict permissions; it evaluates resource properties. Deny policies take precedence during ARM evaluation.
  4. Tenant Root Group: By default, Global Admins do not have access to manage the Root Management Group until they toggle Access management for Azure resources to Yes in Entra ID properties.
PREVIOUS TOPIC1.1 Azure RBAC: Built-in Roles & Custom Role JSONNEXT TOPIC2.1 Storage Accounts: Blob Access Tiers & Lifecycle