Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Manage Azure Identities and Governance (AZ-104) Syllabus

What does the 'User Access Administrator' built-in role allow?

It lets a principal manage user access to Azure resources (i.e., create and remove role assignments) but does not grant the ability to manage the resources themselves.

What is the structure of an Azure RBAC role definition's permission set?

A role definition contains Actions (allowed control-plane operations), NotActions (subtracted from Actions), DataActions (allowed data-plane operations), and NotDataActions (subtracted from DataActions). Effective permissions = (Actions − NotActions) plus (DataActions − NotDataActions).

In an Azure custom role, how are effective permissions calculated from Actions and NotActions?

Effective control-plane permissions equal the Actions minus the NotActions: $\text{Permissions} = \text{Actions} - \text{NotActions}$. NotActions are not deny rules; they simply exclude operations from the granted Actions.

How does Azure RBAC evaluate access when a principal has multiple role assignments?

Azure RBAC is additive: the principal's effective permissions are the union of all their role assignments at the relevant scope. There is no deny by default from RBAC roles unless an explicit Azure deny assignment applies.

What is an Azure deny assignment, and how does it interact with role assignments?

A deny assignment blocks specified principals from performing specified actions even if a role assignment grants them. Deny assignments take precedence over role assignments. They are created by Azure (e.g., by Blueprints or managed apps), not directly by users.

How do you create a custom Azure RBAC role, and what limits apply?

Define a JSON role definition specifying Actions, NotActions, DataActions, NotDataActions, and AssignableScopes, then create it via the portal, Azure CLI, or PowerShell. A tenant supports up to 5,000 custom roles.

What is the maximum number of role assignments allowed per Azure subscription?

4,000 role assignments per subscription (a hard limit). Management group scope supports up to 500 role assignments. Plan group-based assignments to stay within these limits.

Why is it a best practice to assign Azure RBAC roles to groups rather than individual users?

Assigning roles to groups reduces the total number of role assignments (helping stay under the 4,000-per-subscription limit), simplifies administration, and lets membership changes automatically grant or revoke access.

What is the key conceptual difference between Azure RBAC roles and Microsoft Entra roles?

Azure RBAC roles control access to Azure resources (management groups, subscriptions, resource groups, resources). Entra roles control access to Entra ID/Microsoft 365 directory objects and administrative features (users, groups, applications, directory settings).

Give an example task that requires an Entra (directory) role versus one that requires an Azure RBAC role.

Creating or managing users and groups in the directory requires an Entra role (e.g., User Administrator). Creating a virtual machine or managing a resource group requires an Azure RBAC role (e.g., Contributor).

At what scope levels do Entra roles versus Azure RBAC roles apply?

Entra roles apply at the tenant (directory) level, with optional administrative-unit scoping. Azure RBAC roles apply at management group, subscription, resource group, or individual resource scope.

Which Entra role provides full access to manage the directory, and what is the special root role above subscriptions?

Global Administrator provides full access to manage Entra ID and all Microsoft 365 services. There is no single Azure 'root' RBAC role, but a Global Admin can elevate access to gain User Access Administrator at the root (/) scope to manage all subscriptions.

Does being an Entra Global Administrator automatically grant access to manage Azure resources?

No. By default a Global Administrator does not have access to Azure resources. They must elevate access (a one-time toggle that grants User Access Administrator at root scope) or be assigned an Azure RBAC role to manage subscriptions/resources.

What is an Azure subscription, and what is its role in the resource hierarchy?

A subscription is a logical container and billing/management boundary for Azure resources, linked to an Entra tenant. It sits between management groups and resource groups in the hierarchy and is the unit to which policies, RBAC, and spending limits commonly apply.

What is an Azure management group and what is it used for?

A container that organizes one or more subscriptions (and other management groups) into a hierarchy, allowing you to apply governance conditions like Azure Policy and RBAC assignments across many subscriptions at once. They are inherited downward.

What is the maximum depth and breadth of the Azure management group hierarchy?

The hierarchy supports up to 6 levels of depth (not counting the root tenant level or subscriptions), each management group can have one parent, and a directory can have up to 10,000 management groups.

What is the Azure root (tenant root) management group?

A single, top-level management group automatically created per directory under which all other management groups and subscriptions sit. Policies and RBAC assigned here apply to the entire tenant by inheritance.

How do you transfer ownership/billing of an Azure subscription to another account or tenant?

Use a billing transfer (transfer billing ownership in the Azure portal / Cost Management + Billing) to move billing to another account, or change the subscription's associated Entra directory to move it to a different tenant (which removes existing RBAC assignments).

What happens to RBAC role assignments when you move a subscription to a different Entra tenant?

All existing Azure RBAC role assignments are permanently deleted because they reference principals in the original tenant. You must recreate role assignments using principals from the new directory after the move.

What is Azure Policy, and how does it differ from Azure RBAC?

Azure Policy enforces organizational standards and assesses resource compliance by evaluating resource properties against rules (e.g., allowed regions, required tags). RBAC controls who can perform actions, whereas Policy controls what properties/configurations resources are allowed to have.

List the common effects available in an Azure Policy definition.

Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, Disabled, and Deny-related effects like denyAction. These determine what happens when a resource matches (or fails to match) the policy rule.

What is the difference between the Deny and Audit effects in Azure Policy?

Deny blocks the resource creation or update request that violates the policy (prevention). Audit allows the action but logs a non-compliance entry for reporting, without stopping the operation (detection).

What is an Azure Policy initiative (policy set)?

A collection of multiple policy definitions grouped together and assigned as a single unit to achieve a broader compliance goal (e.g., a regulatory baseline), simplifying management of many related policies.

What is the difference between Azure Policy and a resource lock?

Azure Policy enforces configuration rules and compliance across resources. A resource lock specifically prevents accidental deletion or modification of a resource regardless of RBAC permissions, and applies the CanNotDelete or ReadOnly restriction.

What are the two types of Azure resource locks and what does each prevent?

CanNotDelete (Delete lock): authorized users can read and modify the resource but cannot delete it. ReadOnly: authorized users can read but cannot modify or delete it. Locks are inherited by child resources.

How do resource locks interact with RBAC permissions?

Locks override permissions: even an Owner cannot delete a resource with a CanNotDelete lock or modify one with a ReadOnly lock until the lock is removed. Managing locks requires Microsoft.Authorization/locks/* permission (Owner or User Access Administrator).

What are Azure resource tags and what are they used for?

Name-value metadata pairs applied to resources, resource groups, and subscriptions used to organize resources and to categorize costs for billing (cost allocation), automation, and governance. Tags are not inherited by default but can be enforced/inherited via Azure Policy.

What is Microsoft Cost Management (Cost Management + Billing) used for?

A tool to monitor, analyze, allocate, and optimize Azure spending. It provides cost analysis, budgets with alerts, and recommendations, helping govern and forecast cloud expenditure across subscriptions and management groups.

What is an Azure budget in Cost Management, and what does it do when exceeded?

A budget sets a spending threshold over a time period (monthly, quarterly, annually) for a scope. When actual or forecasted spend reaches configured percentage thresholds, it triggers alerts (email/action groups); budgets notify but do not automatically stop resource usage.

What is the Azure Activity Log and what kind of events does it record?

A subscription-level (control-plane) log that records management operations on resources, such as who created, updated, or deleted a resource and when, plus service health events. It is used for auditing, troubleshooting, and tracking changes.

What tool provides resource topology, recommendations, and the diagnostic capability to view effective access, and how do you check a user's effective permissions on a resource?

Use the resource's Access control (IAM) blade with the 'Check access' feature to view a specific user's effective role assignments and permissions at that scope. Azure Advisor and Resource Health provide complementary recommendations and diagnostics.