AZ-900 CERTIFICATION BOOTCAMP
Microsoft Azure Fundamentals — Know the cloud. Name it exactly.
20 sessions · 30 minutes each · 4 weeks at your own pace · Track A or Track B, chosen at enrolment
WEEK 3 OF 4 · IDENTITY, SECURITY AND COST · SESSIONS 11–15
B · Describe Azure architecture and services · 35–40%SESSION 11
Identity: Microsoft Entra ID, sign-in methods, external identities, Conditional Access
Skills measured — Microsoft’s wording
- Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
- Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
- Describe external identities in Azure
- Describe Microsoft Entra Conditional Access
Why This Matters
Every Azure sign-in, and every role you assign next session, starts with one directory: Microsoft Entra ID. Microsoft renamed Azure Active Directory in 2023, so older notes that say Azure AD describe the same product. Today you learn the directory services, how people prove who they are, how outsiders get in safely, and how Conditional Access decides who gets through. I have watched candidates confuse Microsoft Entra ID with Microsoft Entra Domain Services; you will leave able to separate them in one sentence. At work, this answers every auditor's question: who can sign in, from where, and how do we know it is them?
The 30-Minute Session
0:00 – 7:00
Directory services: Microsoft Entra ID and Domain Services
- An analogy: a directory is a hospital's staff register, an identity is a staff badge, and authentication is the guard checking the face against the badge.
- Microsoft Entra ID is Microsoft's cloud-based identity and access management service. People use it to sign in to Microsoft cloud applications and to cloud applications you develop. You control the identity accounts; Microsoft keeps the service available globally.
- It provides authentication, single sign-on, application management, and device management through tools such as Microsoft Intune.
- Microsoft Entra Connect synchronises user identities between on-premises Active Directory and Microsoft Entra ID, so you maintain one set of identities instead of two, and Microsoft can then spot suspicious sign-ins such as those from unknown devices.
- Microsoft Entra Domain Services provides managed domain join, group policy, LDAP and Kerberos/NTLM authentication without you deploying or maintaining domain controllers; Azure runs two of them, called a replica set, in your chosen region. Its purpose: lifting and shifting legacy applications that can't use modern authentication.
- THE EXAM LINE
Microsoft Entra ID is the cloud identity service. Microsoft Entra Domain Services adds managed domain join, group policy, LDAP and Kerberos/NTLM for legacy apps. Synchronisation runs one way, from Entra ID into the managed domain.
A legacy app that needs Kerberos or group policy points to Domain Services, not to Entra ID alone.
7:00 – 14:00
Proving who you are: SSO, MFA and passwordless
- Learn's diagram plots security against convenience: a password alone is low security but high convenience, while passwordless is high on both.
- single sign-on (SSO) lets a user sign in once and reach multiple trusted applications. Fewer passwords mean fewer credential incidents and simpler access changes. The catch: SSO is only as secure as the initial authenticator.
- multifactor authentication (MFA) asks for an extra factor, so a stolen password alone is not enough. The factors are something the user knows (a password), has (a code sent to a phone) or is (a fingerprint or face scan). Microsoft's service is Microsoft Entra multifactor authentication.
Passwordless option How it works Windows Hello for Business Biometric or PIN tied to the user's own PC; ideal for information workers with a designated Windows PC Microsoft Authenticator app Turns an iOS or Android phone into the sign-in factor: match the number, confirm with biometric or PIN FIDO2 security keys Unphishable hardware keys (typically USB) that sign in with no password to expose - THE EXAM LINE
Passwordless replaces the password with a trusted device plus a biometric signal or PIN. The AZ-900 unit names three options: Windows Hello for Business, Microsoft Authenticator app and FIDO2 security keys.
- Entra's current product documentation also speaks of passkeys (FIDO2); recognise it, but the table's names are the exam unit's.
SSO reduces how often people sign in; MFA strengthens each sign-in. They work together.
14:00 – 20:00
External identities and Conditional Access
- An external identity is a person, device or service outside your tenant, and Microsoft Entra External ID groups the capabilities for working with them. Their own identity provider handles authentication; you control authorisation.
- B2B collaboration lets partners and contractors sign in to your apps with their preferred identity; they appear in your directory, typically as guest users, and an access review can recertify or remove their access. B2B direct connect is a mutual, two-way trust with another Entra tenant, currently for Teams shared channels, and its users aren't represented in your directory.
- Microsoft Entra Conditional Access allows or denies access based on signals: who the user is, where they are, and what device they use. It collects signals, decides, then enforces: allow, require MFA, or block. Policies are if-then statements: if a user wants a resource, then they must complete an action.
- THE EXAM LINE
Conditional Access uses signals such as user, location and device to allow access, require MFA or block. Typical uses: MFA for privileged roles and blocking risky sign-ins from unexpected locations.
- Licensing trap. At the time of writing, Conditional Access requires Microsoft Entra ID P1 licences (Microsoft 365 Business Premium customers can also use it), and risk-based policies need P2. Without P1, use security defaults: preconfigured protection against attacks such as password spray and phishing, available to all customers.
A guest in your directory means B2B collaboration; a Teams shared channel with no guest object means B2B direct connect.
20:00 – 26:00
Hands-on: find each capability
- Illustrative case: a Lagos logistics firm has 40 office staff, 12 contract drivers on their own phones, and an old payroll app that needs Kerberos. Decide each capability before you open anything.
- TRACK A · YOUR AZURE ACCOUNT
- In the Microsoft Entra admin center, browse to Entra ID → Overview → Properties and screenshot the Tenant ID section.
- Browse to Entra ID → Authentication methods → Policies and note which methods are enabled. Then open Entra ID → Conditional Access → Policies; create no policy, start no trial, and screenshot what your tenant shows.
- Open Entra ID → External Identities → External collaboration settings and note the guest settings without changing them. If a page refuses you, screenshot the message and tell me the same day.
TRACK B · NO PAYMENT CARD- Screenshot the security-versus-convenience diagram in the Learn unit Describe Azure authentication methods, with the address visible.
- From Learn's Conditional Access overview, copy the licensing sentence exactly, with your reading date.
- Note which extra sign-in methods your own personal Microsoft account offers, in its own words. It is a consumer account, not an Entra tenant.
- Now map the case: staff sign-in, the drivers, the payroll app, and a rule for sign-ins from outside Nigeria. One line each, naming the capability.
A screenshot of a licence message is honest evidence. A description of a page you could not open is not.
26:00 – 30:00
Wrap-up and your assignment
- Write down what Entra ID, Entra Connect and Domain Services each do, the three MFA factor types, the three passwordless options, the two B2B capabilities, and the Conditional Access signals and licence.
- Your assignment is an identity plan for a small organisation that uses contractors, naming each capability and any licence it needs.
- Report a blocker the same day, including any admin center page your account cannot open.
Name the capability, then the risk it removes.
The exact names
As Microsoft prints them — the exam and the marker both expect these, letter for letter.Microsoft Entra ID | service | Microsoft's cloud-based identity and access management service. | Learn → |
Microsoft Entra Domain Services | service | Managed domain services for legacy apps, with no domain controllers to run. | Learn → |
Microsoft Entra Connect | tool | Syncs on-premises Active Directory identities with Entra ID. | Learn → |
single sign-on (SSO) | concept | Sign in once to reach multiple trusted applications. | Learn → |
multifactor authentication (MFA) | concept | Requires an extra factor beyond the password. | Learn → |
Windows Hello for Business | feature | Passwordless sign-in tied to the user's own PC. | Learn → |
Microsoft Authenticator app | feature | Phone app that can serve as a passwordless credential. | Learn → |
FIDO2 security keys | feature | Unphishable hardware keys for passwordless sign-in. | Learn → |
Microsoft Entra External ID | service | Capabilities for users outside your tenant. | Learn → |
B2B collaboration | feature | Outsiders sign in with their own identity, as guests. | Learn → |
B2B direct connect | feature | Two-way trust with another Entra tenant, for Teams shared channels. | Learn → |
Microsoft Entra Conditional Access | feature | Uses signals to allow access, require MFA or block. | Learn → |
Microsoft Entra ID P1 | tier | The licence Conditional Access requires. | Learn → |
security defaults | setting | Preconfigured identity protection for all customers. | Learn → |
Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).
Key Terms
Authentication
Establishing identity by requiring credentials.
Guest user
How a B2B collaboration user is typically represented in your directory.
Replica set
The two domain controllers Azure deploys for a Domain Services managed domain.
Signal
Information Conditional Access weighs, such as user, location and device.
Self-Check — Before You Submit
1. A manufacturer must move a legacy app that relies on group policy and Kerberos into Azure, without running domain controllers. Which service fits?
- A. Microsoft Entra Connect
- B. Microsoft Entra Domain Services
- C. Microsoft Entra External ID
- D. Microsoft Entra Conditional Access
B. Microsoft Entra Domain Services — Domain Services provides managed group policy and Kerberos with no domain controllers to manage. Entra Connect is tempting, but it only synchronises identities.
2. A small agency on the free tier wants preconfigured protection against password spray and phishing, without buying licences. What should it use?
- A. Conditional Access policies
- B. B2B direct connect
- C. Microsoft Entra Domain Services
- D. Security defaults
D. Security defaults — Security defaults are available to all customers at no extra licence. Conditional Access is tempting, but it requires Microsoft Entra ID P1 licences.
3. A hospital wants partner contractors to use their own work accounts for an internal app, and to appear in its directory for access reviews. Which capability fits?
- A. B2B collaboration
- B. B2B direct connect
- C. Microsoft Entra Domain Services
- D. Single sign-on alone
A. B2B collaboration — B2B collaboration users sign in with their own identity and appear in your directory as guests. B2B direct connect users don't appear there.
Today’s Assignment
Write an identity plan for a small organisation that uses contractors, naming each Microsoft Entra capability you would use and why.
- Describe a small organisation you know (or a labelled illustrative one) with staff, contractors and at least one older application.
- Directory: say how Microsoft Entra ID holds staff identities, and whether Entra Connect or Microsoft Entra Domain Services is needed, with reasons.
- Sign-in: decide where single sign-on (SSO), multifactor authentication (MFA) and one passwordless option apply, and for whom.
- Outsiders: choose B2B collaboration or B2B direct connect for the contractors, and say how you would review their access.
- Control: write two Microsoft Entra Conditional Access policies as if-then statements, state the licence (Microsoft Entra ID P1), and give your fallback without it.
- Write 300–700 words using the exact names, with no real staff names or passwords.
Evidence to include
- Track A: screenshots of the Tenant ID section, the Authentication methods policies page, and the Conditional Access page as your tenant shows it.
- Track B: screenshots of the Learn authentication diagram and the Conditional Access licensing section, with addresses visible.
- Both tracks: a table of each need, capability and licence note.
Names your answer must use exactly
Microsoft Entra ID Microsoft Entra Domain Services single sign-on (SSO) multifactor authentication (MFA) B2B collaboration Microsoft Entra Conditional Access Microsoft Entra ID P1Track B
Track B students write the same plan from the Learn pages and submit the Learn screenshots instead of the admin center ones.
Track B students write the same plan from the Learn pages and submit the Learn screenshots instead of the admin center ones.
How this is marked — the rubric
| Each need is matched to the right Entra capability, with a reason that follows Microsoft's description | 35 |
| The Conditional Access policies are valid signal-and-decision statements, and the licence note and fallback are correct | 20 |
| Uses the exact names from the names box, spelled and capitalised as Microsoft prints them | 20 |
| Evidence: the screenshots and summary table are present, legible and match the track | 25 |
| Total · pass mark 70 | 100 |
Submitting session 11
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Session: 11 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.Skills Covered
Entra ID vs Domain ServicesSSO, MFA, passwordlessExternal identities (B2B)Conditional Access licensingPlan identity for contractors
B · Describe Azure architecture and services · 35–40%SESSION 12
Access and security: RBAC, Zero Trust, defense in depth, Defender for Cloud
Skills measured — Microsoft’s wording
- Describe Azure role-based access control (RBAC)
- Describe the concept of Zero Trust
- Describe the purpose of the defense-in-depth model
- Describe the purpose of Microsoft Defender for Cloud
Why This Matters
Session 11 settled who someone is. Today settles what they may do, and how you stay protected when something still goes wrong. Azure role-based access control (Azure RBAC) decides who can act on which resources. Zero Trust and defense-in-depth are the security models the exam expects you to explain, and Microsoft Defender for Cloud watches your security posture. I have watched candidates give Owner to anyone who needs to "manage" something. The exam rewards least privilege, and so does every auditor. At work, these ideas become the access requests you approve.
IN YOUR SUBSCRIPTION
- Creates
- Track A only: an empty resource group named
rg-az900-s12. - Cost
- A resource group is a container, and this lab deploys nothing into it. Enable no paid Defender for Cloud plan. Your Session 1 budget will warn you if anything unexpected is billed.
- Clean-up
- Open
rg-az900-s12, select Delete resource group, type its name, and select Delete.
The 30-Minute Session
0:00 – 8:00
Azure RBAC: roles, scopes and assignments
- An analogy: in a hospital's key cabinet, a role is a key ring, the scope is the doors it opens, and a role assignment is signing the ring out to a named person.
- Azure RBAC controls access following the principle of least privilege: you assign roles, and the person or group receives every permission in the role. A role assignment attaches a role definition to a user, group, service principal or managed identity at a particular scope.
- Scopes are a management group, a subscription, a resource group or a single resource. Access is inherited: Reader at a subscription lets the holder view every resource group and resource in it.
Built-in role Microsoft's description Where I would use it Owner Full access to manage all resources, including assigning roles in Azure RBAC The few people accountable for a scope Contributor Full access to manage all resources, but can't assign roles in Azure RBAC Engineers who build and change resources Reader View all resources, but no changes Auditors and managers who only need to look User Access Administrator Manage user access to Azure resources Someone who manages access, not resources - THE EXAM LINE
Azure RBAC is an allow model: role assignments add up. It is enforced through Azure Resource Manager, not at the application or data level. Owner can assign roles; Contributor cannot.
- Trap: RBAC does not secure the application itself. Also note that the portal lists Owner, Contributor and User Access Administrator as privileged administrator roles, separate from job function roles, and Microsoft recommends limiting the privileged ones.
Choose the smallest role at the narrowest scope that still lets the person do the job.
8:00 – 13:00
Zero Trust
- Traditional networks treated anything inside the perimeter as safe. Zero Trust flips that: it assumes breach at the outset and verifies each request as though it came from an uncontrolled network. Microsoft's short form is "never trust, always verify".
- The three guiding principles: Verify explicitly (authenticate and authorise based on all available data points); Use least privilege access (just-in-time and just-enough access, risk-based adaptive policies, data protection); and Assume breach (limit the impact, segment access, verify end-to-end encryption, use analytics to detect threats).
- THE EXAM LINE
Zero Trust's guiding principles are Verify explicitly, Use least privilege access and Assume breach. Being on the corporate network earns no trust by itself.
- How the pieces fit: Microsoft calls Conditional Access its Zero Trust policy engine; Azure RBAC applies least privilege; the layers in the next step assume breach.
If an option trusts a request because it comes from the office network, it is not Zero Trust.
13:00 – 19:00
Defense-in-depth
- defense-in-depth protects information from people who aren't authorised to access it, using a series of mechanisms to slow an attack: if one layer is breached, the next is already in place. Picture a Lagos bank branch: fence, guarded door, locked back office, then the vault.
Layer (outside in) Its job Physical security Protect buildings and the computing hardware in the datacenter Identity and access Control access to infrastructure and change control; use SSO and MFA; audit events Perimeter DDoS protection and perimeter firewalls against large-scale network attacks Network Limit communication between resources; deny by default; secure on-premises links Compute Secure access to virtual machines; endpoint protection and patching Application Keep applications free of vulnerabilities; store secrets securely, such as in Azure Key Vault Data Control access to operational and customer data; encryption at rest and in transit - THE EXAM LINE
The layers, outside in: physical security, identity and access, perimeter, network, compute, application, data. Data sits at the centre, and no single layer is relied on.
- Practise: DDoS filtering is perimeter, blocking traffic between internal systems is network, MFA is identity and access, VM patching is compute, and database encryption is data.
To find the layer, ask what the control protects, then pick the layer named for it.
19:00 – 26:00
Microsoft Defender for Cloud, then hands-on
- Microsoft Defender for Cloud is a security posture management and threat protection service. It monitors cloud, on-premises, hybrid and multicloud resources, including AWS and GCP, and gives recommendations and alerts.
- Three jobs. Continuously assess: find vulnerabilities. Secure: harden resources against the Microsoft cloud security benchmark (MCSB), with a secure score that rises as you fix recommendations. Defend: security alerts and threat protection, such as just-in-time VM access. Free Foundational CSPM is included; Cloud Security Posture Management (CSPM) checks and improves the posture of cloud resources.
- THE EXAM LINE
Defender for Cloud assesses, secures and defends resources across Azure, on-premises and other clouds. Its secure score summarises your security posture.
- Illustrative practice: a hospital's finance analyst views one subscription (Reader there); a developer rebuilds a test web app (Contributor on its resource group only).
- TRACK A · YOUR AZURE ACCOUNT
- Create an empty resource group named
rg-az900-s12. Open it and select Access control (IAM). On the Check access tab, select View my access and screenshot your role assignments at this scope, including inherited ones. - On the Roles tab, find Reader and select View in the Details column, then the Permissions tab. Screenshot it, then do the same for Contributor and compare.
- Search the portal for Microsoft Defender for Cloud and screenshot its overview, including a secure score if one shows. Enable no paid plan. Then follow the lab clean-up.
TRACK B · NO PAYMENT CARD- Screenshot the privileged roles table on Learn's Azure built-in roles page, with the address visible, and find Reader.
- Read the portal steps Track A follows on Learn's List Azure role definitions page.
- Screenshot the defense-in-depth layer list in the Learn unit, with the address visible.
- Create an empty resource group named
Read the Permissions tab once, and Owner versus Contributor will stop tripping you.
26:00 – 30:00
Wrap-up and your assignment
- Track A: check Resource groups to confirm
rg-az900-s12has gone. - Write down the four scopes, the four roles and what separates them, the three Zero Trust principles, the seven layers in order, and Defender for Cloud's assess, secure and defend.
- Your assignment gives four people least-privilege access and places six controls in their layers. I mark the scope you choose as carefully as the role.
Every extra permission is a question an auditor will ask.
The exact names
As Microsoft prints them — the exam and the marker both expect these, letter for letter.Azure role-based access control (Azure RBAC) | feature | Controls who can act on which Azure resources, at which scope. | Learn → |
Owner | role | Full access, including assigning roles. | Learn → |
Contributor | role | Full access to manage resources, but can't assign roles. | Learn → |
Reader | role | View all resources without making changes. | Learn → |
User Access Administrator | role | Manages user access to Azure resources. | Learn → |
Access control (IAM) | portal | Page on any scope for viewing roles and role assignments. | Learn → |
Zero Trust | concept | Security model that assumes breach and verifies every request. | Learn → |
Verify explicitly | concept | Zero Trust principle: authenticate and authorise on all available data. | Learn → |
Use least privilege access | concept | Zero Trust principle: give only the access needed. | Learn → |
Assume breach | concept | Zero Trust principle: limit impact and segment access. | Learn → |
defense-in-depth | concept | Layered security with data at the centre. | Learn → |
Microsoft Defender for Cloud | service | Security posture management and threat protection across clouds. | Learn → |
secure score | feature | Defender for Cloud's summary of your security posture. | Learn → |
Cloud Security Posture Management (CSPM) | feature | Checks and improves the security posture of cloud resources. | Learn → |
Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).
Key Terms
Scope
The set of resources an access assignment applies to: management group, subscription, resource group or resource.
Least privilege
Giving people only the access they need to do their job.
Allow model
Permissions from several role assignments add up rather than cancel out.
Security posture
How well protected your resources are.
Self-Check — Before You Submit
1. A Lagos bank's internal auditor must view every resource in one subscription but change nothing. Which assignment follows least privilege?
- A. Owner at the subscription
- B. Contributor at the subscription
- C. Reader at the subscription
- D. Reader at a management group above all subscriptions
C. Reader at the subscription — Reader views without changing, and the subscription is the narrowest scope that fits. A management group would grant access to every subscription beneath it.
2. Which defense-in-depth layer uses DDoS protection to filter large-scale attacks before they affect users?
- A. Network
- B. Perimeter
- C. Compute
- D. Physical security
B. Perimeter — Learn places DDoS protection and perimeter firewalls in the perimeter layer. Network is tempting, but that layer limits communication between your own resources.
3. Which statement matches the Zero Trust model?
- A. Devices on the corporate network are trusted by default
- B. VPN access alone proves identity
- C. Perimeter firewalls make internal traffic safe
- D. Assume breach and verify each request as though it came from an uncontrolled network
D. Assume breach and verify each request as though it came from an uncontrolled network — Zero Trust assumes breach at the outset and verifies each request. The other options all grant trust because of location, which Zero Trust rejects.
Today’s Assignment
Design least-privilege role assignments for four people, with scopes, and place six security controls in their defense-in-depth layers.
- Describe an organisation you know (or a labelled illustrative one) with at least two resource groups and four people in different jobs, such as an auditor, a developer and an access manager.
- For each person, choose one built-in role (Owner, Contributor, Reader or another from Learn's built-in roles page) and the narrowest workable scope, and say why a smaller role or scope would not do.
- Explain how inheritance affects one of your assignments, and why Azure role-based access control (Azure RBAC) alone would not protect the application's own data.
- Place six security controls the organisation uses or needs in defense-in-depth layers, and link two of them to Zero Trust principles by name.
- Say briefly what Microsoft Defender for Cloud would add. Write 300–700 words using the exact names, with no real names or account details.
Evidence to include
- Track A: screenshots of View my access, the two Permissions tabs, and Resource groups after the deletion.
- Track B: screenshots of the built-in roles table and the Learn defense-in-depth list, with addresses visible.
- Both tracks: a table of person, role, scope and reason, and a table of control and layer.
Names your answer must use exactly
Azure role-based access control (Azure RBAC) Owner Contributor Reader Zero Trust defense-in-depth Microsoft Defender for CloudTrack B
Track B students do the same work from Learn's pages and submit those screenshots instead of the portal ones.
Track B students do the same work from Learn's pages and submit those screenshots instead of the portal ones.
How this is marked — the rubric
| Each person gets the smallest suitable built-in role at the narrowest workable scope, with a correct reason | 35 |
| Each control sits in the correct layer, and the Zero Trust links and Defender for Cloud summary are accurate | 25 |
| Uses the exact names from the names box, spelled and capitalised as Microsoft prints them | 20 |
| Evidence: the screenshots and both tables are present, legible and match the track | 20 |
| Total · pass mark 70 | 100 |
Submitting session 12
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Session: 12 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.Skills Covered
Azure RBAC roles and scopesLeast privilegeZero Trust principlesDefense-in-depth layersDefender for Cloud
C · Describe Azure management and governance · 30–35%SESSION 13
What drives cost, and the pricing calculator (hands-on)
Skills measured — Microsoft’s wording
- Describe factors that can affect costs in Azure
- Explore the pricing calculator
Why This Matters
Every Azure estimate comes down to a handful of cost factors, and the exam expects you to name them. Why does the same VM cost more in one region? Why does a bill continue after a VM is deleted? Today you learn Microsoft's list of cost factors and then build a real estimate in the public Azure pricing calculator. Both tracks do the full hands-on, because the calculator needs no subscription. At work, an estimate with dated line items wins budget approval, and a guess does not. This session also opens your third short paper.
The 30-Minute Session
0:00 – 7:00
What makes a resource cost more or less
- An analogy: a taxi fare depends on the kind of car, the distance, the city, and how long it waits for you. Azure works the same way. You pay for what you use, and several factors set the rate.
- Resource type: the type of resource, its settings and its region all affect the price. For a storage account, that means the kind of data, how fast you need it, how many backup copies you keep, and the region. For a VM, it means software licensing, the processor and number of cores, attached storage and the network interface.
- Consumption: pay-as-you-go charges for what you use in each billing cycle. For predictable work, Reservations, Azure savings plan for compute and Azure Spot Virtual Machines can lower the cost, as Session 3 showed.
- Maintenance: when you provision a VM, storage and networking are provisioned with it, and they may not be removed when you deprovision the VM. Leftovers keep costing money. That is why I insist that you delete what you create.
- THE EXAM LINE
Learn's cost factors are resource type, consumption, maintenance, geography, network traffic, subscription type and Azure Marketplace. Resources left behind after a VM is deprovisioned are a maintenance problem.
When a VM has gone but the bill has not, look for the storage and networking it left behind.
7:00 – 13:00
Region, traffic, subscription and marketplace
- Geography: the cost of power, labour, taxes and fees varies by location, so the same resource can cost different amounts in different regions. Moving data within Europe costs less than moving it from Europe to Asia or South America.
- Network traffic: some inbound data transfers into Azure datacenters are free, while outbound transfers are priced by zone. A billing zone is a geographical grouping of Azure regions used specifically for data-transfer pricing. Azure's bandwidth pricing page has the detail.
- THE EXAM LINE
Billing zones are different from availability zones. A billing zone groups Azure regions for data-transfer pricing. Some inbound transfers are free; outbound transfers are priced by zone.
- Subscription type: some subscriptions include usage allowances. At the time of writing, Learn's example is the Azure free trial: some products free for 12 months, credit to spend in the first 30 days, and more than 25 always-free products, depending on resource and region availability.
- Azure Marketplace: solutions from third-party vendors, such as a preconfigured web server or a managed backup solution. You may pay for the Azure services and for the vendor's services or expertise, and the vendor sets the billing structure.
Some traffic into Azure is free; traffic out is where zone pricing starts.
13:00 – 17:00
The pricing calculator and its limits
- The Azure pricing calculator turns anticipated usage into an estimated cost. You can price individual resources, build out a whole solution, or start from an example scenario. It covers compute, storage and network costs, including storage type, access tier and redundancy.
- It is for information only. Nothing is provisioned when you add a product, and you are not charged for anything you select. Signing in is optional: signed out, you see retail prices; signed in, you can see prices negotiated for your account.
- THE EXAM LINE
The pricing calculator estimates costs before you deploy; nothing is provisioned and nothing is charged. Learn's AZ-900 unit says the Total Cost of Ownership (TCO) calculator has been retired.
- Trap: older practice material still asks about the TCO calculator for comparing on-premises and Azure costs. The current Learn unit says it has been retired, so read any option that names it with care.
- The controls you will use today: Expand all shows every configuration in detail, Clone copies a product with its settings, Export downloads the estimate as an Excel file, Share creates a unique link, and Save keeps your progress. Currency changes the displayed currency, and the estimate lists a Licensing Program.
An estimate is a plan, not a promise. Date it and say which prices you saw.
17:00 – 26:00
Hands-on: estimate a small system
- Illustrative brief: a public agency wants a small booking site. Following Learn's own example, model one App Service plan, a managed database and the storage it needs, in a region near its users.
- Open the calculator; no sign-in is needed. From the Products tab, add App Service, a managed database such as Azure SQL Database, and a storage account. Give each the same region, set tiers and quantities for a small, steady workload, and name each configuration.
- Record the total. Then change one thing at a time (region, tier, redundancy, or a reservation where offered), using Clone to keep the original, and record each new total with the factor it touches.
- Select Expand all and screenshot every line item. Use Export for the Excel file and Share for a link.
- TRACK A · YOUR AZURE ACCOUNT
- Stay signed out of the calculator unless your account has negotiated prices, so your figures are retail and comparable with Track B's. Then open Budgets on your subscription, screenshot your Session 1 budget, and note how its amount compares with your estimate.
TRACK B · NO PAYMENT CARD- Run exactly the same exercise, signed out. The calculator needs no subscription, so you complete the full hands-on today.
- Read Learn's Estimate costs with the Azure pricing calculator page and note what signing in would change. Screenshot it with the address visible.
Change one setting at a time, or you will not know which factor moved the total.
26:00 – 30:00
Wrap-up, Pop Quiz 3 and your assignment
- Write down the seven cost factors with one example each, what a billing zone is, and three facts about the calculator: nothing is provisioned, sign-in is optional, and estimates can be exported or shared.
- Pop Quiz 3 opens now: five questions in eight minutes on Sessions 11 to 13. Sit it closed book before you start the assignment.
- Your assignment is the estimate you have just built, plus two changes that would reduce it. Every figure must come from your own dated screenshots or export.
A quiz score is information. Reread whatever it tells you to reread.
The exact names
As Microsoft prints them — the exam and the marker both expect these, letter for letter.Azure pricing calculator | tool | Turns anticipated usage into an estimated cost; provisions nothing. | Learn → |
Resource type | concept | Cost factor: the resource, its settings and its region. | Learn → |
Consumption | concept | Cost factor: pay-as-you-go use, and commitment discounts. | Learn → |
Maintenance | concept | Cost factor: leftover resources that keep costing money. | Learn → |
Geography | concept | Cost factor: prices differ by region. | Learn → |
Network traffic | concept | Cost factor: data-transfer pricing, based on billing zones. | Learn → |
Subscription type | concept | Cost factor: some subscriptions include usage allowances. | Learn → |
Azure Marketplace | service | Third-party solutions, where the vendor sets billing. | Learn → |
billing zone | concept | A grouping of Azure regions for data-transfer pricing. | Learn → |
Total Cost of Ownership (TCO) calculator | tool | Retired, according to the current AZ-900 Learn unit. | Learn → |
Export | portal | Calculator control that downloads the estimate as an Excel file. | Learn → |
Share | portal | Calculator control that creates a unique link to the estimate. | Learn → |
Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).
Key Terms
Estimate
A set of configured products in the pricing calculator with their calculated costs.
Bandwidth
Data moving in and out of Azure datacenters.
Retail price
The public price the calculator shows when you are not signed in.
Deprovision
Removing a resource you no longer need, which may leave related resources behind.
Self-Check — Before You Submit
1. A logistics firm deletes a test VM, but charges continue for the storage and networking created with it. Which cost factor does this show?
- A. Geography
- B. Subscription type
- C. Maintenance
- D. Azure Marketplace
C. Maintenance — Learn's maintenance factor warns that resources provisioned with a VM may not be removed with it. Geography is tempting, but region does not explain leftover charges.
2. What happens when you add a virtual machine to an estimate in the Azure pricing calculator?
- A. Nothing is provisioned and nothing is charged
- B. A stopped VM is created in your subscription
- C. A reservation is placed on your account
- D. The VM is billed until you delete the estimate
A. Nothing is provisioned and nothing is charged — Learn says the calculator is for information only: nothing is provisioned and you aren't charged for services you select. It needs no subscription at all.
3. Which statement about billing zones is correct?
- A. They are the same as availability zones
- B. They set the price of inbound transfers only
- C. They decide which regions offer reservations
- D. They are geographical groupings of Azure regions used for data-transfer pricing
D. They are geographical groupings of Azure regions used for data-transfer pricing — Learn defines a billing zone as a grouping of regions for data-transfer pricing and says billing zones are different from availability zones, which is the trap.
Today’s Assignment
Build a pricing calculator estimate for a described small system, list its line items, and propose two changes that reduce the cost, naming the factor each change affects.
- Use this illustrative system: a small public agency's booking site with an App Service plan, a managed database and a storage account, serving users in one country during office hours. You may adjust sizes, but state every assumption.
- Build it in the Azure pricing calculator, using the same region for each product. List every line item exactly as the calculator shows it (product, region, tier or size, quantity and estimate) and the date.
- Propose two changes that would reduce the estimate, clone or rebuild the configuration for each, and record the new totals. For each change, name the cost factor it affects, such as Resource type, Consumption or Geography, and one risk it brings.
- Explain what your estimate cannot tell you, including outbound traffic and any Maintenance leftovers after changes.
- Write 300–700 words using the exact names, and invent no figures.
Evidence to include
- Screenshots of the expanded estimate showing every line item and the total, before and after each change, with the date visible.
- The file from Export, or the share link.
- Track A: the Budgets screenshot. Track B: the Learn pricing calculator page screenshot with the address visible.
Names your answer must use exactly
Azure pricing calculator Resource type Consumption Geography Maintenance ExportTrack B
Track B students build exactly the same estimate signed out, since the calculator needs no subscription, and submit the Learn page screenshot instead of the Budgets screenshot.
Track B students build exactly the same estimate signed out, since the calculator needs no subscription, and submit the Learn page screenshot instead of the Budgets screenshot.
How this is marked — the rubric
| The estimate matches the described system, and every line item and total is recorded accurately | 30 |
| Each change genuinely lowers the estimate, is tied to the correct cost factor, and states a risk | 30 |
| Uses the exact names from the names box, spelled and capitalised as Microsoft prints them | 20 |
| Evidence: the screenshots show line items, totals and dates, and the export or link is attached | 20 |
| Total · pass mark 70 | 100 |
Submitting session 13
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Session: 13 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.ASSESSMENT NOW OPEN
Pop Quiz 3 — Identity and Cost opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.
Sit Pop Quiz 3 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Skills Covered
Cost factorsBilling zonesBuild an estimateExport and shareReduce an estimate
C · Describe Azure management and governance · 30–35%SESSION 14
Cost management and tags
Skills measured — Microsoft’s wording
- Describe cost management capabilities in Azure
- Describe the purpose of tags
Why This Matters
Session 13 estimated costs before deployment. Today you watch costs after deployment and make them traceable. Microsoft Cost Management shows where money goes, alerts you as it goes, and holds your budgets. Tags are how you label resources so that the question "which department spent this?" has an answer. Two traps catch candidates every sitting: a budget does not stop spending, and resources do not inherit tags from their resource group. At work, cost questions arrive from finance with no warning, and the person who designed the tags is the person who can answer them.
IN YOUR SUBSCRIPTION
- Creates
- Track A only: a resource group named
rg-az900-s14with tags, and a budget scoped to that resource group. - Cost
- Neither a resource group nor a budget is a running service, and this lab deploys nothing that runs. Your Session 1 budget still watches the subscription.
- Clean-up
- Delete the budget first: in
rg-az900-s14, select Budgets, open the budget and delete it. Then select Delete resource group, type its name and select Delete.
The 30-Minute Session
0:00 – 7:00
Microsoft Cost Management and cost analysis
- An analogy: Cost Management is the organisation's household accounts. Cost analysis is the bank statement, budgets are the monthly allowance, and alerts are the text from your bank when you get close to it.
- Microsoft Cost Management is Microsoft's suite of FinOps tools for analysing, monitoring and optimising Microsoft Cloud costs. You can reach it from the Billing area, from every subscription, resource group and management group in the portal, or as a standalone tool.
- Cost analysis is the feature for exploring costs visually. You can view total cost by billing cycle, region or resource; group costs by subscription, resource group or service; and follow accumulated costs over time against a budget.
- Typical uses: spotting a spend jump after a deployment, finding idle non-production resources, and checking that tags and budgets work.
- THE EXAM LINE
Cost Management lets you check resource costs, create alerts based on spend, and create budgets. Cost analysis is its feature for viewing costs visually by subscription, resource group, service, region and more.
Open cost analysis weekly. Surprises are cheaper when they are small.
7:00 – 13:00
Alerts and budgets
- Cost alerts gives you one place to check every alert type. The AZ-900 unit names three.
Alert type Fires when Applies to Budget alerts Spending reaches or exceeds a threshold you define Anyone who creates a budget Credit alerts Your Azure Prepayment is consumed; generated automatically at 90% and 100% of the credit balance Organisations with Enterprise Agreements (EAs) Department spending quota alerts Department spending reaches a fixed threshold of its quota Enterprise Agreement customers - The Cost Management overview also lists Anomaly alerts, which notify recipients when an unexpected change in daily usage has been detected.
- A budget sets the amount you plan to spend at a scope such as a subscription or resource group, with alert conditions of type Actual or Forecasted, each a percentage of the budget. At the time of writing, budgets are evaluated every 24 hours and emails normally follow within an hour. Budgets can also trigger automation, for example shutting down non-production resources.
- THE EXAM LINE
A budget alert does not stop spending: resources aren't affected and consumption isn't stopped. If you want action at a threshold, you must configure automation.
If an answer says a budget shuts Azure off by itself, it is wrong.
13:00 – 19:00
Tags
- Resource tags are metadata: name-value pairs on resources, resource groups and subscriptions. Think of the labels a hospital pharmacy puts on stock. They don't change the medicine, but they tell you whose it is and how to handle it.
Purpose What tags let you do Resource management Find and act on resources by workload, environment, team or owner Cost management and optimization Report costs, allocate internal cost centres, track budgets, forecast Operations management Group resources by how critical their availability is, to help form SLAs Security Classify data by security level, such as public or confidential Governance and regulatory compliance Identify resources for requirements such as ISO 27001; require tags such as owner Workload optimization and automation See every resource in a complex deployment and automate tasks on them - THE EXAM LINE
Resources don't inherit tags from their subscription or resource group. Azure Policy can require tags on new resources and reapply tags that were removed.
- Two warnings from the tag documentation. At the time of writing, each resource, resource group and subscription can hold at most 50 tag name-value pairs. Tags are stored as plain text, so never put sensitive values in them. Tag names are case-insensitive for operations, but tag values are case-sensitive.
- Cost Management offers tag inheritance, which copies subscription and resource group tags onto the usage records of child resources. It changes the cost data, not the tags on the resources themselves.
Agree tag names before anyone deploys. Renaming them later becomes a clean-up project.
19:00 – 26:00
Hands-on: tag a group and give it a budget
- Illustrative standard for a manufacturer, following Learn's starter set:
Environment(Prod, Dev or Test),Owner,CostCenterandWorkload. Decide your values before you start. - TRACK A · YOUR AZURE ACCOUNT
- Create a resource group named
rg-az900-s14. On its overview, select Add tags, add your four name-value pairs, and select Save. Screenshot the tags on the overview. - In the group, select Budgets, then Add. Confirm the Scope shows the group, name the budget, and set a Reset period, an Expiration date and a small Budget amount. Select Next, add one Actual and one Forecasted alert with your email, and finish. Screenshot the budget.
- Open Cost analysis for your subscription and screenshot it. On a new subscription, Learn says it might take up to 48 hours before all Cost Management features are available; if the page is empty, say so. Then open Cost alerts, and finally follow the lab clean-up.
TRACK B · NO PAYMENT CARD- Read Learn's Create and manage budgets tutorial and screenshot the step that sets alert conditions, with the address visible.
- Read Learn's Apply tags with Azure portal page and screenshot the step that adds tags.
- Design your tag standard on paper: four to six tag names, allowed values, and who sets each. You cannot apply tags without a subscription, so do not claim that you did.
- Create a resource group named
- Check each tag against the purposes table, and drop any that serves none.
A tag nobody reads is clutter. Each one should answer a question someone asks.
26:00 – 30:00
Wrap-up and your assignment
- Track A: confirm the budget and
rg-az900-s14have both gone. - Write down the three alert types from the AZ-900 unit, what a budget does and does not do, the six purposes of tags, and the inheritance rule.
- Your assignment is a tagging standard and a budget design for one organisation. Invent no amounts: say how you would set each budget from an estimate or from past costs.
Good tags make cost analysis useful; budgets make it urgent.
The exact names
As Microsoft prints them — the exam and the marker both expect these, letter for letter.Microsoft Cost Management | service | Microsoft's suite of FinOps tools for analysing and optimising cloud costs. | Learn → |
Cost analysis | feature | Visual view of your Azure costs, grouped in different ways. | Learn → |
Cost alerts | portal | One place to check every Cost Management alert. | Learn → |
Budget alerts | feature | Notify you when spending reaches a threshold you define. | Learn → |
Credit alerts | feature | Notify you when Azure Prepayment is consumed. | Learn → |
Department spending quota alerts | feature | EA alerts when a department reaches a quota threshold. | Learn → |
Azure Prepayment | concept | Prepaid credit for Enterprise Agreement organisations. | Learn → |
Anomaly alerts | feature | Notify recipients of unexpected changes in daily usage. | Learn → |
Budgets | portal | Menu item on a scope for creating budgets. | Learn → |
Resource tags | concept | Name-value metadata for organising resources. | Learn → |
Add tags | portal | Portal button for adding tags on an overview page. | Learn → |
tag inheritance | setting | Cost Management setting that applies parent tags to usage records. | Learn → |
Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).
Key Terms
Name-value pair
One tag: a name such as Owner and its value.
Threshold
The percentage of a budget at which an alert fires.
Forecasted alert
A budget alert based on projected rather than actual cost.
Enterprise Agreement (EA)
A Microsoft agreement type; credit and department quota alerts apply to it.
Self-Check — Before You Submit
1. A manufacturer's finance team wants to report cloud spend by internal cost centre across many resource groups. What should it apply first?
- A. A department spending quota alert
- B. A CostCenter tag on each resource
- C. A Reader role assignment
- D. An availability zone for each cost centre
B. A CostCenter tag on each resource — Tags let you group resources to report costs and allocate internal cost centres. Quota alerts only warn about department spending; they don't label resources.
2. A budget's Actual alert fires at 100%. What happens to the resources in its scope?
- A. They are stopped
- B. They are deleted
- C. They are moved to a cheaper tier
- D. Nothing, unless you have configured automation
D. Nothing, unless you have configured automation — Learn says resources aren't affected and consumption isn't stopped when a budget threshold is exceeded. Budgets can trigger automation only if you set it up.
3. A tag is added to a resource group. What happens to the resources already inside it?
- A. They don't inherit the tag
- B. They inherit it immediately
- C. They inherit it after 24 hours
- D. Only resources of the same type inherit it
A. They don't inherit the tag — Resources don't inherit tags from subscriptions or resource groups. Azure Policy can apply them, and Cost Management's tag inheritance changes only usage records.
Today’s Assignment
Write a tagging standard and a budget design for one organisation.
- Choose an organisation you know with at least three departments or workloads, and describe how it uses, or would use, Azure. Mark your assumptions.
- Write a tagging standard of four to eight Resource tags: name, allowed values, who sets it, and which Learn purpose it serves. Say which tags are required and how you would enforce them, given that resources don't inherit tags.
- Design two or three budgets using Budgets: scope, reset period, how you would set the amount (from an estimate or past Cost analysis; no invented figures), thresholds with Actual or Forecasted type, and recipients.
- Explain which Cost alerts types apply to this organisation and why, including Budget alerts, and what happens when a budget is exceeded.
- Show one cost question your tags would let Microsoft Cost Management answer. Write 300–700 words using the exact names, and put no sensitive values in any tag.
Evidence to include
- Track A: screenshots of the tags on the resource group overview, the budget with its alerts, Cost analysis (or its empty state), and the deletion.
- Track B: screenshots of the Learn budget and tagging steps, with addresses visible.
- Both tracks: the tagging standard as a table.
Names your answer must use exactly
Microsoft Cost Management Cost analysis Cost alerts Budget alerts Budgets Resource tagsTrack B
Track B students design the same standard and budgets on paper from Learn's tutorials, and submit the Learn screenshots instead of the portal ones.
Track B students design the same standard and budgets on paper from Learn's tutorials, and submit the Learn screenshots instead of the portal ones.
How this is marked — the rubric
| The tagging standard is consistent, each tag serves a named purpose, and non-inheritance is handled correctly | 30 |
| Budgets have sensible scopes, thresholds and recipients, and the alert types and budget limits are described correctly | 30 |
| Uses the exact names from the names box, spelled and capitalised as Microsoft prints them | 20 |
| Evidence: the screenshots and the tag table are present, legible and match the track | 20 |
| Total · pass mark 70 | 100 |
Submitting session 14
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Session: 14 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.Skills Covered
Cost Management and cost analysisAlert typesBudgets don't stop spendPurpose of tagsDesign a tagging standard
C · Describe Azure management and governance · 30–35%SESSION 15
Governance: Microsoft Purview, Azure Policy, resource locks
Skills measured — Microsoft’s wording
- Describe the purpose of Microsoft Purview in Azure
- Describe the purpose of Azure Policy
- Describe the purpose of resource locks
Why This Matters
Governance is how an organisation keeps its promises at scale. Today covers three tools candidates regularly mix up. Microsoft Purview tells you what data you hold and where it flows. Azure Policy keeps resource settings within your rules, whoever makes the change. A resource lock stops an accidental delete, even by an Owner. Knowing which tool answers which question is most of the marks. At work, these are the controls a regulator asks to see at a bank or a hospital. This session closes Week 3 and opens your third practice exam.
IN YOUR SUBSCRIPTION
- Creates
- Track A only: a resource group named
rg-az900-s15, an Azure Policy assignment of the built-in Allowed locations definition on it, and a Delete lock on it. - Cost
- Azure's pricing pages say Azure Policy on Azure resources has no charge and a virtual network is free of charge. A resource group and a lock run nothing.
- Clean-up
- Delete the lock under Locks. Delete the assignment from Policy → Compliance (the assignment's ellipsis, Delete assignment). Then select Delete resource group, type its name and select Delete.
The 30-Minute Session
0:00 – 6:00
Microsoft Purview: know your data
- An analogy: a national archive catalogues what it holds, where each item sits, how sensitive it is and where it came from. Purview does that for data.
- Microsoft Purview is a family of data governance, risk and compliance solutions giving a single, unified view of your on-premises, multicloud and software-as-a-service data, kept current by automated data discovery, sensitive data classification and end-to-end data lineage.
- The AZ-900 unit names two solution areas. risk and compliance uses Microsoft 365 services such as Teams, OneDrive and Exchange to protect sensitive data and manage regulatory requirements. unified data governance covers data in Azure, SQL and Hive databases, on-premises, and other clouds like Amazon S3: it maps the data estate, finds sensitive data and manages access at scale.
- Purview's product pages now group its solutions as data security, data governance and data compliance. The governance foundation is the Microsoft Purview Data Map, which captures metadata through built-in scanning and classification.
- THE EXAM LINE
Microsoft Purview gives one unified view of data across on-premises, multicloud and SaaS, with automated discovery, sensitive data classification and end-to-end lineage. It governs data; it does not enforce resource settings.
If the question is about knowing what data you have and where it flows, the answer is Purview.
6:00 – 13:00
Azure Policy: rules for resources
- Azure Policy lets you create, assign and manage policies that control or audit your resources. It highlights non-compliant resources, including ones created before the policy, and can prevent non-compliant resources from being created.
- Vocabulary: business rules in JSON are policy definitions, each with conditions and an effect. An initiative definition groups policy definitions towards one goal; the AZ-900 unit's example, Enable Monitoring in Azure Security Center, holds over 100. An assignment applies a definition or initiative to a scope, from a management group down to one resource, and everything below inherits it.
Effect What it does denyFails a create or update request that doesn't match the rule; the request returns 403 (Forbidden) auditWrites a warning event in the activity log for a non-compliant resource, but doesn't stop the request modifyAdds, updates or removes properties or tags during creation or update deployIfNotExistsRuns a template deployment when the condition is met - THE EXAM LINE
Azure Policy governs what resources look like, whoever makes the change; Azure RBAC governs what users can do. Microsoft says the combination provides full scope control.
- Azure Policy can remediate some resources, such as adding a missing
AppNametag, and resources can be marked as exceptions. Its compliance dashboard shows an aggregated view you can drill into.
Who may act is RBAC. What the result must look like is Policy.
13:00 – 18:00
Resource locks
- A resource lock prevents resources from being accidentally deleted or changed. RBAC still lets the right person delete a critical resource; the lock is the safety catch.
Lock In the portal On the command line Effect Prevents deletion Delete CanNotDelete Authorised users can read and modify, but not delete Prevents change and deletion Read-only ReadOnly Authorised users can read, but not update or delete; similar to limiting everyone to the Reader role - Naming trap: the AZ-900 unit writes Delete and ReadOnly, but the locks documentation uses Read-only in the portal and ReadOnly and CanNotDelete on the command line. Recognise all four.
- Locks apply to a resource, resource group or subscription and are inherited, even by resources added later; the most restrictive lock wins. They apply regardless of RBAC, so even an Owner must remove the lock first. Owner and User Access Administrator can create and delete locks.
- THE EXAM LINE
Two lock types: Delete (CanNotDelete) blocks deletion; Read-only (ReadOnly) blocks changes and deletion. Locks are inherited and apply regardless of role until someone removes them.
- A surprise: locks apply only to control plane operations, and Read-only can block more than you expect. On a resource group containing a VM, it prevents all users from starting or restarting that VM.
Delete locks suit production groups; think hard before choosing Read-only.
18:00 – 26:00
Hands-on: a policy and a lock, then remove both
- Illustrative rule for a Lagos bank: resources must stay in approved regions, and the core resource group must never be deleted by accident. Policy handles the first rule; a lock handles the second.
- TRACK A · YOUR AZURE ACCOUNT
- Create
rg-az900-s15. In Policy, select Assignments, then Assign Policy. Set Scope to your subscription and the new group, pick the built-in Allowed locations under Policy definition, leave Policy enforcement Enabled, choose one region under Parameters, then Review + create and Create. - Learn says a new assignment takes about five minutes to apply. Then try to create a virtual network in the group in another region and screenshot the refusal, which names the policy definition and assignment IDs. If a network is created anyway, delete it and tell me.
- In the group, select Locks under Settings, then Add, and save a lock with the Delete lock level. Try Delete resource group, screenshot the refusal, then follow the lab clean-up in order.
TRACK B · NO PAYMENT CARD- In Learn's Azure Policy tutorial on creating and managing policies, screenshot where it adds Allowed locations to an initiative, with the address visible.
- Read Learn's quickstart for assigning a policy in the portal and list each tab Track A passes through.
- Read the lock types section on Learn's Lock your Azure resources to protect your infrastructure page and screenshot it.
- Create
- Compare the controls: the policy refuses the wrong region and the lock refuses the delete, even for an Owner. Neither decides who may sign in.
Remove the lock first; a group with a Delete lock cannot be deleted.
26:00 – 30:00
Wrap-up, Practice Exam 3 and your assignment
- Track A: confirm the lock, the policy assignment and
rg-az900-s15have all gone. - Write down Purview's purpose and two solution areas, the Azure Policy vocabulary (definition, initiative, assignment, effect), and both lock types in both spellings.
- Week 3 is complete. Practice Exam 3 opens now: twenty questions in twenty-four minutes on Sessions 1 to 15. Sit it closed book and note every question you hesitate on. The pass mark is 70.
- Your assignment is a governance baseline for one subscription.
Treat the practice exam as a map of what to revise next week.
The exact names
As Microsoft prints them — the exam and the marker both expect these, letter for letter.Microsoft Purview | service | Data governance, risk and compliance solutions with one unified view of data. | Learn → |
risk and compliance | concept | Purview solution area built on Microsoft 365 services. | Learn → |
unified data governance | concept | Purview solution area for on-premises, multicloud and SaaS data. | Learn → |
Microsoft Purview Data Map | feature | Captures metadata through scanning and classification. | Learn → |
Azure Policy | service | Creates, assigns and manages policies that control or audit resources. | Learn → |
policy definitions | concept | Business rules in JSON, each with conditions and an effect. | Learn → |
initiative definition | concept | A collection of policy definitions for one overarching goal. | Learn → |
Allowed locations | setting | Built-in policy that restricts where resources can be deployed. | Learn → |
deny | setting | Policy effect that fails a non-compliant request. | Learn → |
resource lock | feature | Prevents resources from being accidentally deleted or changed. | Learn → |
Delete | setting | Portal lock type: modify allowed, delete blocked. | Learn → |
Read-only | setting | Portal lock type: read only; no update or delete. | Learn → |
CanNotDelete | setting | Command-line name of the Delete lock. | Learn → |
ReadOnly | setting | Command-line name of the Read-only lock. | Learn → |
Every name in the course is on one printable page: download the AZ-900 cheat sheet (PDF).
Key Terms
Data lineage
The record of where data came from and how it moved.
Remediation
Bringing a non-compliant resource into compliance, sometimes automatically.
Control plane
Management operations on resources, the only operations locks apply to.
Guardrail
A rule that keeps changes within agreed limits, such as allowed locations or required tags.
Self-Check — Before You Submit
1. A public agency must ensure that nobody can create resources outside two approved regions, whatever their role. Which service fits?
- A. Azure RBAC
- B. Microsoft Purview
- C. A Delete resource lock
- D. Azure Policy
D. Azure Policy — Azure Policy enforces rules on resource properties whoever makes the change, as the Allowed locations built-in does. RBAC controls what users can do, not where resources go.
2. Which lock lets authorised users modify a resource but not delete it?
- A. Delete (CanNotDelete)
- B. Read-only (ReadOnly)
- C. The Reader role
- D. The deny effect
A. Delete (CanNotDelete) — Delete, called CanNotDelete on the command line, allows reading and modifying but blocks deletion. Read-only also blocks updates, and the other two options are not locks.
3. A hospital needs a map of where sensitive patient data sits across Azure, on-premises databases and another cloud, with lineage. Which service fits?
- A. Azure Policy
- B. Microsoft Purview
- C. Microsoft Defender for Cloud
- D. Microsoft Cost Management
B. Microsoft Purview — Purview gives a unified view of data with sensitive data classification and end-to-end lineage across environments. Defender for Cloud protects resources instead.
Today’s Assignment
Write a governance baseline for one subscription, naming the policies, locks and where Microsoft Purview fits.
- Choose a subscription you know (or a labelled illustrative one) at an organisation with regulatory duties, such as a bank or hospital, and describe its workloads and data briefly.
- List three to five Azure Policy assignments. For each, give the built-in definition or the rule in plain words, the scope, the effect (for example deny or audit) and the reason. Say whether you would group any of them into an initiative definition.
- List where you would place each resource lock, its type (Delete or Read-only), and one thing it could break, citing an example from the locks documentation.
- Explain where Microsoft Purview fits: which data it would discover and classify, and which of its two solution areas applies.
- Explain how the baseline works alongside Azure RBAC. Write 300–700 words using the exact names.
Evidence to include
- Track A: screenshots of the policy assignment, the refusal or compliance result, the lock and the refused deletion, and the clean-up.
- Track B: screenshots of the Learn tutorial step showing Allowed locations and the lock types section, with addresses visible.
- Both tracks: a baseline table of control, type, scope and reason.
Names your answer must use exactly
Azure Policy initiative definition deny resource lock Delete Read-only Microsoft PurviewTrack B
Track B students write the same baseline from the Learn pages and submit those screenshots instead of the portal ones.
Track B students write the same baseline from the Learn pages and submit those screenshots instead of the portal ones.
How this is marked — the rubric
| Each policy and lock is appropriate, correctly scoped and typed, and justified | 35 |
| Purview's role and the difference between Azure Policy and Azure RBAC are explained correctly | 20 |
| Uses the exact names from the names box, spelled and capitalised as Microsoft prints them | 20 |
| Evidence: the screenshots and baseline table are present, legible and match the track | 25 |
| Total · pass mark 70 | 100 |
Submitting session 15
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Write your answer in Word or Google Docs, with your screenshots pasted in. The top of the document must carry the line
Session: 15 (the template has it ready, under the Course line), or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter by email; the mark appears on your progress page. Do the self-check above before you submit.ASSESSMENT NOW OPEN
Practice Exam 3 — Security, Cost and Governance opens now. Sit it before the next session. It is how you find out what has stuck, and practice papers may be resat as often as you like.
Sit Practice Exam 3 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Skills Covered
Purpose of Microsoft PurviewAzure Policy vocabularyPolicy effectsLock types, both spellingsGovernance baseline