Azure Management & Governance is the heaviest slice of the AZ-900, weighted at 30–35% of scored content — and, more usefully, it is the most learnable slice. This is not a domain of architecture puzzles; it is a domain of vocabulary. Learn a compact set of terms precisely, and roughly a third of the exam turns into recognition rather than reasoning. The governance map above is the whole domain on one page — read it top to bottom, then keep it in your head.
The hierarchy is the backbone — learn it top-down
Everything in this domain hangs off one four-level tree: Management Groups → Subscriptions → Resource Groups → Resources. Management groups contain subscriptions, subscriptions contain resource groups, resource groups contain the actual resources — a VM, a storage account, a database. The single fact the exam rewards most is that settings flow downward: assign a permission or a policy high up, and everything beneath inherits it. Want one standard across two subscriptions at once? You apply it at the management-group level above both. A resource group, by contrast, lives inside exactly one subscription and can never span two — a favorite distractor.
RBAC vs Azure Policy: two questions, never confuse them
These two are the beating heart of the domain, and almost every governance question is secretly testing whether you can tell them apart. Reduce each to a single question:
- RBAC — who can do what, and where? Role-based access control assigns a role (like Reader, Contributor, Owner, or a narrower built-in role such as Virtual Machine Contributor) to a principal, at a scope. It governs the permissions of people and identities. Least privilege is the reflex it rewards: the narrowest role at the smallest scope that still does the job.
- Azure Policy — what is allowed to exist? It audits or enforces rules on the resources themselves, no matter who creates them. A policy can deny resources in the wrong region, require a tag, or flag non-compliant configurations. It does not care who the user is.
As the diagram shows, both run as vertical bands down the side of the same hierarchy and both inherit downward — but one guards identities and the other guards resources. If a question is about a person’s abilities, it’s RBAC. If it’s about which resources or settings are permitted, it’s Policy.
The exam reliably tests whether you can match a cost tool to a moment in time:
| Tool | Job | The tell |
|---|
| Pricing Calculator | Estimate the price of a deployment before you build it | ”How much will this cost?” |
| TCO Calculator | Compare on-premises vs. Azure for a migration business case | ”On-prem versus cloud” |
| Azure Cost Management (+ Budgets) | Track and alert on what you’re already spending | ”What am I spending now?” |
Two are planning calculators; one monitors live spend and raises budget alerts. Keep the timeline straight and this cluster of questions becomes free points.
Monitor, Advisor, Defender — collect, advise, secure
Three more names, three clean lanes:
- Azure Monitor collects — metrics, logs, and alerts. It gives you the raw signal of what is happening.
- Azure Advisor advises — a free, prioritized to-do list across reliability, security, cost, and performance for the resources you already run.
- Microsoft Defender for Cloud secures — it scores your security posture as a Secure Score and hands you hardening steps. “Secure Score” is its signature phrase.
Round it off with the Service Trust Portal, where Microsoft publishes its own audit reports and compliance certifications (SOC, ISO) — the platform’s paperwork, as opposed to your resources’ compliance, which is Azure Policy’s job. The exam mixes multiple-choice, true/false, and matching formats; our seven sample questions below are standard multiple-choice, and every explanation carries a “why not the others” so the three wrong options — the ones that won’t introduce themselves on exam day — become just as instructive as the right one.
Updated for AZ-900 (July 2026). The sample questions above are our own work
in the style of the exam — not real exam items. The exam itself is set and marked
by the certification body.