Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Manage Azure Identities and Governance (AZ-104) Flashcards

24 sample cards from the Manage Azure Identities and Governance (AZ-104) deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Why is it a best practice to assign Azure RBAC roles to groups rather than individual users?

   Assigning roles to groups reduces the total number of role assignments (helping stay under the 4,000-per-subscription limit), simplifies administration, and lets membership changes automatically grant or revoke access.

2. What is the key conceptual difference between Azure RBAC roles and Microsoft Entra roles?

   Azure RBAC roles control access to Azure resources (management groups, subscriptions, resource groups, resources). Entra roles control access to Entra ID/Microsoft 365 directory objects and administrative features (users, groups, applications, directory settings).

3. Give an example task that requires an Entra (directory) role versus one that requires an Azure RBAC role.

   Creating or managing users and groups in the directory requires an Entra role (e.g., User Administrator). Creating a virtual machine or managing a resource group requires an Azure RBAC role (e.g., Contributor).

4. At what scope levels do Entra roles versus Azure RBAC roles apply?

   Entra roles apply at the tenant (directory) level, with optional administrative-unit scoping. Azure RBAC roles apply at management group, subscription, resource group, or individual resource scope.

5. Which Entra role provides full access to manage the directory, and what is the special root role above subscriptions?

   Global Administrator provides full access to manage Entra ID and all Microsoft 365 services. There is no single Azure 'root' RBAC role, but a Global Admin can elevate access to gain User Access Administrator at the root (/) scope to manage all subscriptions.

6. Does being an Entra Global Administrator automatically grant access to manage Azure resources?

   No. By default a Global Administrator does not have access to Azure resources. They must elevate access (a one-time toggle that grants User Access Administrator at root scope) or be assigned an Azure RBAC role to manage subscriptions/resources.

7. What is an Azure subscription, and what is its role in the resource hierarchy?

   A subscription is a logical container and billing/management boundary for Azure resources, linked to an Entra tenant. It sits between management groups and resource groups in the hierarchy and is the unit to which policies, RBAC, and spending limits commonly apply.

8. What is an Azure management group and what is it used for?

   A container that organizes one or more subscriptions (and other management groups) into a hierarchy, allowing you to apply governance conditions like Azure Policy and RBAC assignments across many subscriptions at once. They are inherited downward.

9. What is the maximum depth and breadth of the Azure management group hierarchy?

   The hierarchy supports up to 6 levels of depth (not counting the root tenant level or subscriptions), each management group can have one parent, and a directory can have up to 10,000 management groups.

10. What is the Azure root (tenant root) management group?

    A single, top-level management group automatically created per directory under which all other management groups and subscriptions sit. Policies and RBAC assigned here apply to the entire tenant by inheritance.

11. How do you transfer ownership/billing of an Azure subscription to another account or tenant?

    Use a billing transfer (transfer billing ownership in the Azure portal / Cost Management + Billing) to move billing to another account, or change the subscription's associated Entra directory to move it to a different tenant (which removes existing RBAC assignments).

12. What happens to RBAC role assignments when you move a subscription to a different Entra tenant?

    All existing Azure RBAC role assignments are permanently deleted because they reference principals in the original tenant. You must recreate role assignments using principals from the new directory after the move.

13. What is Azure Policy, and how does it differ from Azure RBAC?

    Azure Policy enforces organizational standards and assesses resource compliance by evaluating resource properties against rules (e.g., allowed regions, required tags). RBAC controls who can perform actions, whereas Policy controls what properties/configurations resources are allowed to have.

14. List the common effects available in an Azure Policy definition.

    Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, Disabled, and Deny-related effects like denyAction. These determine what happens when a resource matches (or fails to match) the policy rule.

15. What is the difference between the Deny and Audit effects in Azure Policy?

    Deny blocks the resource creation or update request that violates the policy (prevention). Audit allows the action but logs a non-compliance entry for reporting, without stopping the operation (detection).

16. What is an Azure Policy initiative (policy set)?

    A collection of multiple policy definitions grouped together and assigned as a single unit to achieve a broader compliance goal (e.g., a regulatory baseline), simplifying management of many related policies.

17. What is the difference between Azure Policy and a resource lock?

    Azure Policy enforces configuration rules and compliance across resources. A resource lock specifically prevents accidental deletion or modification of a resource regardless of RBAC permissions, and applies the CanNotDelete or ReadOnly restriction.

18. What are the two types of Azure resource locks and what does each prevent?

    CanNotDelete (Delete lock): authorized users can read and modify the resource but cannot delete it. ReadOnly: authorized users can read but cannot modify or delete it. Locks are inherited by child resources.

19. How do resource locks interact with RBAC permissions?

    Locks override permissions: even an Owner cannot delete a resource with a CanNotDelete lock or modify one with a ReadOnly lock until the lock is removed. Managing locks requires Microsoft.Authorization/locks/* permission (Owner or User Access Administrator).

20. What are Azure resource tags and what are they used for?

    Name-value metadata pairs applied to resources, resource groups, and subscriptions used to organize resources and to categorize costs for billing (cost allocation), automation, and governance. Tags are not inherited by default but can be enforced/inherited via Azure Policy.

21. What is Microsoft Cost Management (Cost Management + Billing) used for?

    A tool to monitor, analyze, allocate, and optimize Azure spending. It provides cost analysis, budgets with alerts, and recommendations, helping govern and forecast cloud expenditure across subscriptions and management groups.

22. What is an Azure budget in Cost Management, and what does it do when exceeded?

    A budget sets a spending threshold over a time period (monthly, quarterly, annually) for a scope. When actual or forecasted spend reaches configured percentage thresholds, it triggers alerts (email/action groups); budgets notify but do not automatically stop resource usage.

23. What is the Azure Activity Log and what kind of events does it record?

    A subscription-level (control-plane) log that records management operations on resources, such as who created, updated, or deleted a resource and when, plus service health events. It is used for auditing, troubleshooting, and tracking changes.

24. What tool provides resource topology, recommendations, and the diagnostic capability to view effective access, and how do you check a user's effective permissions on a resource?

    Use the resource's Access control (IAM) blade with the 'Check access' feature to view a specific user's effective role assignments and permissions at that scope. Azure Advisor and Resource Health provide complementary recommendations and diagnostics.

What this deck covers

Manage Azure Identities and Governance (AZ-104) flashcards FAQ