AZ-900 governance and monitoring: rules, permissions, protection and the look-alikes beside them
Azure Policy sets rules for what resources may look like, Azure RBAC decides who may do what, and a resource lock protects against deletion or change. Management and governance carry 30 to 35 per cent of AZ-900, so pair them with the estimate versus track cost tools and the three monitoring tools.
When two tools both govern resources, the question is always which kind of control.
The group in brief
Management and governance carry 30 to 35 per cent of AZ-900. It has four skill areas: cost management, governance and compliance, managing and deploying resources, and monitoring tools. In a 30-hour plan it gets 10 hours.
Many wrong answers come from confusing tools with similar purposes, so learn pairs and trios, not separate definitions. Revise managing and deploying resources (portal, Cloud Shell, CLI, PowerShell, Azure Arc, ARM templates) too, because Microsoft marked minor changes there in July 2026.
Rules, permissions, protection
| Tool | The question it answers |
|---|---|
| Azure Policy | What may resources look like? (rules) |
| Azure RBAC | Who may do what? (permissions) |
| Resource lock | How do I stop deletion or change? (protection) |
A typical question asks how to prevent anyone, including owners, from accidentally deleting a production storage account. RBAC is the runner-up, because it decides who may do what, and an owner is allowed to delete. The answer is a resource lock.
Three monitoring tools
| Tool | What it shows |
|---|---|
| Azure Advisor | Recommendations to improve |
| Azure Service Health | Azure's own outages and maintenance |
| Azure Monitor | Your resources' metrics, logs and alerts |
If Microsoft announces planned maintenance in the region where your virtual machines run, you see it in Service Health. Azure Monitor is the runner-up: it shows your resources, not Microsoft's platform notices.
Estimate versus track
The pricing calculator estimates cost before you build. Cost Management tracks and analyses what you have already spent. A finance analyst who wants to estimate the monthly cost of a planned deployment needs the calculator, since Cost Management cannot predict a deployment that does not yet exist.
More pairs in this group
| Pair | The difference |
|---|---|
| Microsoft Purview, Defender for Cloud | Governs and protects data; assesses and protects resources against threats |
| Azure Arc, Azure Resource Manager | Manages servers and resources outside Azure; the layer that deploys and manages resources inside Azure |
Tags and cost
Cost management also covers the factors that affect cost, the pricing calculator, cost management capabilities and tags. A tag such as "purpose: study" is a label on a resource. Learn it as the third step of the habit: estimate before you build, track after, and label resources.
How to drill
Cover the right-hand column and say each answer aloud. Then invent one situation for each tool in a single sentence. After three days, mix them and see which pair still trips you.
Match your misses to a habit
If you miss governance, cost or monitoring questions in a practice set, the habit is blurring these tools. Separate rules, permissions and protection; estimate versus track; your metrics versus Microsoft's notices. That separation is the fix.
Questions readers ask
How do I stop anyone deleting a storage account by accident?
Where do I see Microsoft's planned maintenance?
Which tool estimates cost before I build?
This article is independent and is not endorsed by Microsoft. Facts change: confirm them on the official page before you act.