Microsoft Certified: Azure Administrator Associate Manage Azure Identities and Governance Syllabus

Name the three fundamental built-in Azure roles and what each grants.

Owner: full access including the ability to delegate access to others; Contributor: full access to manage resources but cannot grant access to others; Reader: view-only access to resources.

What does the built-in 'User Access Administrator' role allow?

It allows managing user access to Azure resources—specifically creating and managing role assignments—without granting the ability to manage the resources themselves.

How does inheritance work for Azure RBAC role assignments?

Role assignments are inherited downward: access granted at a parent scope (e.g., subscription) automatically applies to all child scopes (resource groups and resources) within it.

In Azure RBAC, how are the permissions from multiple role assignments combined?

Azure RBAC is additive—a principal's effective permissions are the union of all role assignments across all applicable scopes (unless a deny assignment applies).

What is a deny assignment in Azure RBAC and how does it interact with role assignments?

A deny assignment blocks specified actions for principals; deny assignments take precedence over (override) role assignments. They are created by Azure (e.g., Blueprints/managed apps), not directly by users.

What are the four key sections of an Azure RBAC custom role definition?

Actions (allowed control-plane operations), NotActions (operations excluded from Actions), DataActions (allowed data-plane operations), and NotDataActions (data operations excluded).

How are a custom role's effective control-plane permissions calculated from Actions and NotActions?

Effective permissions = Actions minus NotActions. NotActions are not deny rules; they subtract operations from the granted Actions set.

What are the prerequisites and limits for creating Azure custom roles?

You need Microsoft.Authorization/roleDefinitions/write permission (e.g., Owner or User Access Administrator). A tenant can have up to 5,000 custom roles (500 for Azure China/US Gov).

What property in a custom role definition controls where the role can be assigned?

AssignableScopes—it lists the management groups, subscriptions, or resource groups at which the custom role can be assigned.

What is the core difference between Azure RBAC and Microsoft Entra roles?

Azure RBAC controls access to Azure resources (control/data plane via Azure Resource Manager); Microsoft Entra roles control access to Microsoft Entra ID resources such as users, groups, and directory settings.

At what scopes do Microsoft Entra roles versus Azure RBAC roles apply?

Entra roles apply at the tenant/directory level (some support administrative-unit scope); Azure RBAC roles apply at management group, subscription, resource group, or individual resource scope.

Which role gives full control over Microsoft Entra ID, and which gives full control over Azure resources?

Global Administrator (Entra role) gives full control over Microsoft Entra ID; Owner (Azure RBAC role) gives full control over Azure resources at its scope.

How can a Global Administrator gain access to manage all Azure subscriptions?

By toggling the 'Access management for Azure resources' setting in Entra ID, which grants them the User Access Administrator role at the root (/) scope of all subscriptions in the tenant.

What does it mean to 'interpret effective permissions' in Azure, and what tool helps?

It means determining the actual access a principal has by combining all role assignments and deny assignments across inherited scopes. The 'Check access' feature on a resource's Access control (IAM) blade shows a principal's effective access.

If a user has Reader at the subscription and Contributor on a resource group within it, what are their effective permissions on that resource group?

Contributor—because RBAC is additive and inherited, the union of Reader (subscription) and Contributor (resource group) results in Contributor-level access on that resource group.

What is an Azure management group?

A container above subscriptions used to organize multiple subscriptions and apply governance conditions (RBAC and Azure Policy) that are inherited by all subscriptions and resources beneath it.

What is the root management group and key facts about the management group hierarchy?

The root (Tenant Root Group) is the top-level management group automatically created per Entra tenant. The hierarchy supports up to 6 levels of depth (excluding root and subscription), and each MG/subscription has exactly one parent.

What is the maximum number of management groups per Microsoft Entra tenant?

Up to 10,000 management groups per tenant, with a hierarchy depth of up to 6 levels (not counting the root level or the subscription level).

What is Azure Policy and what is its primary purpose?

Azure Policy is a governance service that creates, assigns, and manages policies to enforce rules and effects on resources, ensuring they stay compliant with corporate standards and SLAs (e.g., allowed regions, required tags).

Name five common effects available in Azure Policy.

Deny, Audit, Append, Modify, DeployIfNotExists (others include AuditIfNotExists, Disabled, and Deny). Deny blocks non-compliant resources; Audit logs them as non-compliant.

What is the difference between Azure Policy and Azure RBAC?

Azure RBAC controls WHO can perform actions (authorization over principals); Azure Policy controls WHAT properties/configurations resources may have (enforcement over resource state), regardless of who creates them.

What is an Azure Policy initiative (policy set)?

A collection of multiple policy definitions grouped together and assigned as a single unit to achieve a broader compliance goal (e.g., a regulatory compliance baseline).

What does Azure Policy 'remediation' do, and which effects support it?

Remediation brings existing non-compliant resources into compliance by deploying or modifying configurations. It applies to deployIfNotExists and modify effects and uses a managed identity to perform the changes.

What are the two types of Azure resource locks and what does each prevent?

CanNotDelete (Delete lock): authorized users can read and modify but cannot delete the resource; ReadOnly: authorized users can read but cannot modify or delete the resource.

At what scopes can Azure resource locks be applied and how do they inherit?

Locks can be applied at subscription, resource group, or individual resource scope, and they are inherited by all child resources within that scope.

Which RBAC permissions are required to create or delete Azure resource locks?

Microsoft.Authorization/locks/* actions—provided by the Owner and User Access Administrator built-in roles.

When multiple resource locks apply to a resource, which one takes precedence?

The most restrictive lock wins—if both ReadOnly and CanNotDelete are inherited/applied, ReadOnly takes precedence and prevents modification.

What is an Azure resource tag and what is its structure?

A tag is metadata applied to Azure resources as a name/value pair (e.g., Environment=Production) used to organize resources logically for management, billing, and automation.

Do Azure resource tags inherit from a resource group to its resources by default?

No—tags are not inherited by default; a resource does not automatically receive its resource group's tags. Inheritance can be enforced using Azure Policy (modify/append effects).

What are the limits on the number of tags per Azure resource and tag name/value length?

Up to 50 tags per resource/resource group; tag name max 512 characters, tag value max 256 characters. (Storage accounts are limited to 128 characters for names.)

How do resource tags support cost tracking in Azure?

Tags appear in Cost Management and billing reports, letting you group, filter, and analyze costs by tag (e.g., by CostCenter, Department, or Environment) for chargeback and showback.

What is Microsoft Cost Management and what does it provide?

A suite of tools to monitor, allocate, analyze, and optimize Azure spending—offering cost analysis, budgets, alerts, recommendations, and exports across subscriptions and resource groups.

What is an Azure budget in Cost Management and what happens when thresholds are reached?

A budget sets a spending threshold over a time period (monthly, quarterly, annually). When actual or forecasted spend crosses a configured percentage threshold, it triggers alerts (email/action groups); budgets notify but do NOT automatically stop resources.

What is the difference between 'actual' and 'forecasted' cost alerts in an Azure budget?

Actual cost alerts fire when accrued spending reaches the threshold; forecasted alerts fire when Azure predicts spending will exceed the threshold by period end, allowing proactive action.