MSDEVBUILD / azure

Governance in the Cloud

AZURE POLICY Rule: only EU regions, tags required West EU✓ Brazil? North EU✓ DENIED
Azure Policy is a gate: resources that follow the rules pass, and the one in the wrong region is denied.

😟 THE PROBLEM

Someone creates an expensive server in the wrong country on a Friday afternoon.

😊 THE SOLUTION

Set rules once and let Azure enforce them automatically.

  • Resources created in forbidden regions✓ Azure Policy denies them
  • Critical database deleted by mistake✓ A resource lock blocks deletion
  • Nobody knows who owns a resource✓ Required tags via policy
🛠️ Solved with: Azure Policy · Resource locks
Try it yourself in the Azure simulator No Azure account needed. Your first resource group · Protect resources with locks 📦 Try it ❯🔒 Try it ❯
Module 1: Cloud Concepts ⏱ 7 min read Updated 11 Nov 2026

Quick answer

Governance in the cloud is the set of rules, processes and tools that keep your cloud use compliant with company and regulatory standards. The cloud makes governance easier because rules can be applied in software, with templates for standards, automatic auditing that flags non-compliant resources, and enforcement that can block or fix them automatically, using tools such as Azure Policy and resource locks.

Exam objective: 1.2.3 Describe the benefits of security and governance in the cloud. (Skills measured as of July 20, 2026)

Start with a question

What stops an employee from creating a 50,000-a-month server in the wrong country on a Friday afternoon?

In many organisations, the honest answer used to be “nothing, until the bill arrives”. With hundreds of people able to create resources in minutes, you need rules, and those rules must be checked automatically. Nobody can review every click by hand.

That is governance.

Explain it like I’m 10

The technical explanation

Microsoft’s AZ-900 material describes how the cloud supports governance and compliance:

  1. Templates help you deploy resources that already meet corporate standards and regulatory requirements.
  2. Auditing can automatically flag resources that are out of compliance.
  3. Updates and enforcement: providers update the platform with new compliance capabilities, and policies can automatically block or remediate non-compliant resources.

  1. 1 Request

    Someone deploys a storage account in "Brazil South".

  2. 2 Evaluate

    Azure Resource Manager checks the assigned policies.

  3. 3 Decide

    Policy "Allowed locations: EU only" → Deny.

  4. 4 Report

    Compliance dashboard shows every resource's status.

How Azure Policy governs a new resource

The governance toolbox in Azure

ToolGovernsCovered in
Azure PolicyWhat resources may look like (regions, SKUs, tags, encryption)Module 3
Resource locksPrevent accidental deletion or modificationModule 3
Management groupsApply policies and access across many subscriptionsModule 2
TagsOwnership, environment and cost centre metadataModule 3
Microsoft PurviewData governance: discover, classify and track dataModule 3
Azure RBACWho can do what (access governance)Module 2
Cost ManagementBudgets and spending accountabilityModule 3

Real-world business scenario

Healthcare / life sciences

A multinational pharmaceutical company

The problem
Research teams created resources in many regions without tags; auditors could not prove where clinical data lived or who owned which costs.
What they used
Management group hierarchy with Azure Policy initiatives (allowed EU regions, mandatory owner and cost-centre tags, encryption required), resource locks on production data stores, and Microsoft Purview to classify sensitive data.
Why that choice
Rules are enforced automatically at creation time and continuously audited, without blocking teams' self-service.
The result
Compliance reports are generated from the dashboard in minutes, and untagged spending dropped to near zero.

When to use it and when not to

✓ Use it when…

  • From day one. Governance is far easier before hundreds of resources exist.
  • Regulated industries that must prove where data lives and how it is protected.
  • Organisations with many teams and subscriptions.

✕ Think twice when…

  • Locking everything down with "deny" policies so tightly that teams create shadow IT elsewhere.
  • Writing rules nobody monitors. Review compliance dashboards regularly.

↔ Alternatives to consider

  • Start with **audit** effects to measure, then move critical rules to **deny**.
  • Use the **Azure landing zone** reference architecture for a ready-made governance baseline.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What does governance mean in the cloud?

Model answer

Governance means having rules for how the cloud is used and making sure they are followed. For example, only allowing certain regions, requiring tags for cost tracking, or making sure storage is encrypted. In Azure, tools like Azure Policy check and enforce these rules automatically.

Interviewer follows up

Why is that easier in the cloud?

You

Because everything is created through software and APIs, rules can be checked and enforced automatically at creation time, and audits can run continuously instead of once a year.

Intermediate Name Azure tools used for governance and what each does.

Model answer

Azure Policy enforces and audits rules on resources; resource locks prevent accidental deletion or changes; management groups apply policies and access across many subscriptions; tags organise resources for cost and ownership; Microsoft Purview governs data, including discovery, classification and lineage; and Microsoft Cost Management with budgets governs spending.

Experienced developer How do you build governance that does not slow developers down?

Model answer

Use guardrails rather than gates. Design a management group hierarchy (for example from Azure landing zones), assign policy initiatives at the top so every subscription inherits them, use deny only for the critical rules (public exposure, allowed regions), use audit and deployIfNotExists for the rest so things are fixed automatically, and give teams self-service subscriptions inside those boundaries. Make compliance visible on a dashboard and treat policy as code in a repository with reviews.

Scenario A company must keep all customer data within the EU. How can Azure help enforce that?

Model answer

Assign an Azure Policy "Allowed locations" rule at the management group level, listing only EU regions. Any attempt to create a resource elsewhere is denied, and the compliance dashboard shows existing resources that violate it.

Test yourself with exercises

4 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 4

Which cloud benefit ensures that resources are deployed and maintained according to company standards and regulatory requirements?

Question 2

Question 2 of 4

Your company requires that Azure resources can only be created in two specific regions.

Which Azure service should you use to enforce this?

Question 3

Question 3 of 4 · Select 2

Which TWO ways does the cloud help with governance and compliance?

Question 4

Question 4 of 4

What is the key difference between Azure Policy and Azure role-based access control (RBAC)?

Quick revision

Key points

  • Governance = rules and processes to keep cloud usage compliant and under control.
  • The cloud enables templates, automatic auditing and automatic enforcement.
  • Azure tools: Azure Policy, resource locks, management groups, tags, Microsoft Purview, Cost Management.
  • Policies can audit, deny, or remediate (deploy missing settings).
  • Good governance is guardrails that keep teams safe while letting them move fast.

Important terminology

Governance
Policies and processes that ensure cloud resources meet organisational and regulatory standards.
Compliance
Meeting the requirements of laws, regulations and industry standards (for example GDPR, ISO 27001, PCI DSS).
Azure Policy
A service that evaluates resources against rules and can audit, deny or remediate non-compliant ones.
Guardrails
Automated controls that keep teams within safe boundaries without slowing them down.

Common mistakes

  • Confusing governance (rules and compliance) with security (protecting against threats). They overlap but are different.
  • Thinking Azure Policy controls who can do things. That is Azure RBAC. Policy controls what resources may look like.

Exam tips

  • "Ensure resources comply with company standards" / "audit and enforce rules" = governance / Azure Policy.
  • "Prevent accidental deletion" = resource locks.

Five quick revision questions

  1. 1.What is cloud governance?Show

    The rules, processes and tools that keep cloud usage compliant with organisational and regulatory standards.

  2. 2.Which Azure service audits and enforces rules on resources?Show

    Azure Policy.

  3. 3.What prevents a critical resource from being deleted accidentally?Show

    A resource lock (CanNotDelete).

  4. 4.How does the cloud make auditing easier?Show

    Resources are continuously evaluated and non-compliant ones are flagged automatically.

  5. 5.What is the difference between Azure Policy and Azure RBAC?Show

    Policy controls what resources can look like; RBAC controls who can perform actions.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Manageability