Memory hook: RBAC decides who may act; Policy evaluates what configuration is acceptable.
Must remember
- A management-group hierarchy applies governance across subscriptions. Resources belong to resource groups and subscriptions, but not every resource type supports every move. Check dependencies, provider registration, quotas and move validation before changing scope.
- Azure Policy definitions evaluate resource properties; initiatives group policies; assignments apply them at scopes with exclusions/exemptions. Effects include audit, deny, modify and deployIfNotExists. Existing noncompliant resources may need a remediation task and suitable managed-identity permissions.
- A CanNotDelete lock blocks management-plane deletion; ReadOnly can block management operations that look like reads but use POST. Locks are inherited and are not a universal data-plane protection mechanism. A privileged user able to remove a lock can change its protection.
- Tags support ownership and cost allocation, but tags do not automatically inherit from resource group to resource. Policy can enforce or add supported tags. Keep a naming/tagging convention and handle untaggable/shared resources explicitly.
- Cost Management analyses spending; budgets notify configured thresholds; Advisor recommends improvements. A budget is not a universal immediate resource shutdown. Billing latency, reservations/savings commitments and shared costs affect interpretation.
- Resource groups are useful for lifecycle management, but deleting a group is a broad action. Review dependencies and locks first. Region affects resource availability, residency and price; the resource group's metadata location does not force every contained resource into that Region.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Prevent unsupported regions at deployment | Azure Policy deny at the appropriate scope. |
| Let a team manage resources but not grant roles | Contributor, constrained to the required scope. |
| Find an oversized idle workload | Usage evidence plus Advisor/Cost Management recommendations. |
Traps
- Audit reports a problem; it does not block it.
- A tag on a group is not automatic tag inheritance.
- A budget alert is not a guaranteed spending cap.
Active recall
1. Why can deployIfNotExists fail remediation?
Its assignment identity may lack permission, or the remediation conditions/deployment can fail.
2. Can resources in one group use different Regions?
Yes, subject to each resource's capabilities.
3. What does a lock primarily protect?
Supported management-plane operations at its scope and descendants.
4. Why use a policy exemption instead of silently removing the policy?
It preserves explicit scope, justification and review of the exception.
5. Does a subscription move eliminate previous costs?
No. Billing history and resource ownership need separate handling.