Subscriptions and Governance

• Governance flows down the management hierarchy: assign at the highest scope that should be affected
• Use a management group to govern many subscriptions at once
• A subscription is the billing and quota boundary; a resource group is a logical lifecycle container
• Azure Policy governs what resources look like; RBAC governs who can act
• Definition is one rule, initiative bundles many, assignment binds them to a scope
• Deny blocks new non-compliant resources; Audit only logs them
• DeployIfNotExists auto-fixes via remediation, and the assignment needs a managed identity
• Policy compliance re-evaluates about every 24 hours, not instantly
• A resource lock overrides RBAC: even an Owner is blocked
• CanNotDelete allows modify; ReadOnly is the stricter one that blocks modify too
• A ReadOnly lock can block operations that look like reads but are POSTs
• When locks overlap, the most restrictive one in the chain wins
• Tags do not inherit: a resource doesn't get its resource group's tags automatically
• A resource can hold up to 50 tags; names are case-insensitive, values case-sensitive
• Moving a resource locks source and target and isn't supported for every type
• A budget alerts when crossed: it never stops spending on its own
• Cost analysis breaks spend down by subscription, resource group, service, or tag
• Azure Advisor has five categories: Cost is the one that finds savings
• Buy reservations for steady, always-on workloads
• Budgets offer Actual and Forecasted alert types, up to five thresholds
• Budget action groups work only at subscription and resource-group scope

Unlock with Premium — includes all practice exams and the complete study guide.