Describe Azure Management and Governance · Topic 2 of 4
Governance and Compliance Tools
AZ-900 governance: the purpose of Microsoft Purview, Azure Policy and initiatives, resource locks, and how policy differs from RBAC and locks.
- 5 min
- Purview governs data across on premises, multicloud and software as a service sources.
- Azure Policy enforces and audits rules about resource configuration, such as allowed regions.
- A policy must be assigned to a scope to take effect. Initiatives group policies.
What it is
Governance is the set of rules and controls that keep an environment compliant, consistent and safe. Azure gives you three tools for this in the exam: Microsoft Purview for data governance, Azure Policy for resource rules, and resource locks for protection from accidents.
They are often confused, so the key is knowing what each one controls.
How it works
Microsoft Purview
Microsoft Purview is a family of data governance, risk and compliance solutions. It helps you discover, classify and protect data wherever it is, whether on premises, in several clouds or in software as a service applications.
It builds a map of your data estate, helps people find and understand data through a catalog, and supports compliance work such as assessing your position against regulations.
Azure Policy
Azure Policy lets you create, assign and manage rules about how resources must be configured. It evaluates your resources against the rules and reports which ones are compliant.
A policy has an effect that decides what happens when a resource does not comply, such as audit it, deny it, or change it to fit. An initiative is a group of related policies managed together.
Examples include allowing resources only in approved regions, allowing only certain virtual machine sizes, and requiring a tag.
A policy definition has no effect until it is assigned to a scope such as a management group, subscription or resource group. Policy applies to everything below that scope.
Resource locks
A resource lock protects a resource from being deleted or changed by accident. There are two types.
| Lock | What it blocks |
|---|---|
| Delete (CanNotDelete) | Deleting. Authorised users can still read and change the resource |
| Read only | Deleting and changing. The resource can only be viewed |
A lock applies at the subscription, resource group or resource level and is inherited by the resources below. It applies to everyone, including owners, who must remove the lock before they can delete the resource.
Policy, RBAC and locks compared
| Tool | Question it answers |
|---|---|
| Azure RBAC | What can this user do? |
| Azure Policy | What may resources look like? |
| Resource lock | Can this resource be changed or deleted at all? |
Azure Policy examples
Azure Policy ships with many built in definitions. These are typical.
- Allowed locations: only permit resources in chosen regions.
- Allowed virtual machine sizes: stop expensive sizes from being used.
- Require a tag on resources: deny new resources that have no tag.
- Audit virtual machines without managed disks: report, without blocking.
A group of related definitions is an initiative, such as one that groups the checks for a security standard.
One scenario, three tools
Choose the tool by what the question asks to control.
| The requirement | Tool |
|---|---|
| Resources may only be created in West Europe | Azure Policy |
| Nobody may delete the production database by mistake | Resource lock |
| Find and classify sensitive data across the company | Microsoft Purview |
| A user may read but not change a resource group | Azure RBAC |
More on Microsoft Purview
Purview helps you understand your data. It scans sources, builds a map of where data lives, classifies sensitive items such as personal data, and lets people find data through a catalog. Its compliance features help you assess your position against regulations and protect sensitive information.
Purview governs data. It does not control who may create Azure resources, which is the job of RBAC and Azure Policy.
How the exam asks about this
- "Which service enforces that all resources are created in approved regions?" Azure Policy.
- "Which feature prevents accidental deletion, even by an owner?" A resource lock.
- "Which service discovers and classifies sensitive data?" Microsoft Purview.
- If the question is about what a person may do, the answer is RBAC. If it is about what a resource may look like, it is Policy.
What to remember for the exam
- Purview governs data across on premises, multicloud and software as a service sources.
- Azure Policy enforces and audits rules about resource configuration, such as allowed regions.
- A policy must be assigned to a scope to take effect. Initiatives group policies.
- Locks come in Delete and Read only types and apply to every user, owners included.
- RBAC controls user actions, Policy controls resource rules, locks prevent accidents.
"Only allow resources in certain regions" is Azure Policy. "Stop anyone deleting this resource" is a lock. "Discover and classify our data" is Purview.
Common mistakes
Using a lock to enforce a standard. Locks stop changes and deletion. They do not check configuration, which is the job of Policy.
Thinking Policy controls what users can do. That is RBAC. Policy controls what the resources can be.
Assuming Owners are exempt from locks. A lock applies to everyone until it is removed.
Writing a policy and expecting it to work. It takes effect only once it is assigned to a scope.
A Read only lock can stop operations that look like reads but write behind the scenes, so test locks before applying them widely.
Check yourself
Which tool restricts resources to approved regions and sizes?
Azure Policy.
Which lock type still allows a resource to be modified but not deleted?
The Delete (CanNotDelete) lock.
What does a policy definition need before it takes effect?
To be assigned to a scope.
Topic 2 of 4 in Describe Azure Management and Governance
Test yourself on Describe Azure Management and Governance
The full Microsoft AZ-900 question bank has 500 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.