AZ-305 Learning Portal
Objective 1.3 40 minhigh prioritymanagement-groupsazure-policyrbactaggingpimgovernancesubscriptions

1.3 — Design Governance

Design enterprise-scale governance structures using management groups, Azure Policy, subscription strategies, resource tagging, and Privileged Identity Management to enforce compliance and operational standards.

Concept — What & Why

Governance Architecture

Management GroupsGovernance containers above subscriptions in the Azure hierarchy. Policies and Azure RBAC assigned at a management group cascade to all nested subscriptions. Support up to 6 levels of nesting (excluding root). Used for policy enforcement, not billing.Azure PolicyA declarative governance service that enforces, audits, or remediates resource configurations across Azure. Policy effects: Deny (block non-compliant), Audit (log without blocking), Modify (auto-append tags), DeployIfNotExists (create missing resources). Assign at management group for enterprise-wide enforcement.Privileged Identity Management (PIM)An Entra ID feature for just-in-time (JIT) access to elevated roles. Users are "Eligible" for a role and must request and receive approval to activate it. Activations expire automatically. Provides audit trails for all privilege escalations. Required for regulatory compliance.Resource TagsKey-value metadata attached to Azure resources for organization, cost allocation, and automation. Tags are metadata only — they do NOT enforce security or compliance. Security requires RBAC, encryption, and network controls. Enforce mandatory tags via Azure Policy with Modify effect.
Root Management Group
├── Platform (shared infrastructure)
│   ├── Management (monitoring, automation)
│   ├── Identity (Entra ID, domain controllers)
│   └── Connectivity (ExpressRoute, hub VNets)
├── Landing Zones (application workloads)
│   ├── Production
│   ├── Non-Production
│   └── Sandbox
└── Decommissioned

Best Practice: Keep hierarchy to 3 levels maximum (excluding root). Deep nesting (>4 levels) increases policy debugging complexity without adding meaningful control.

Subscription as Management Boundary

Subscriptions provide:

  • Billing boundary: Costs roll up to subscription
  • Quota limits: Per-subscription limits (e.g., 250 storage accounts)
  • Policy boundary: Can have different policies than peers
  • Scale boundary: Separate subscriptions for production vs. non-production
Deep Dive — How It Works

Policy Effects Deep Dive

EffectBehaviorWhen to Use
DenyBlocks resource creation/modificationStrict enforcement (after testing)
AuditLogs non-compliance, doesn't blockVisibility without disruption
ModifyAppends/changes tags or propertiesAuto-tag resources at creation
DeployIfNotExistsCreates missing resourcesEnsure monitoring agents installed
AuditIfNotExistsAudits if dependent resource missingDetect missing security configs

Phased Enforcement Strategy:

  1. Audit — measure scope of non-compliance without disrupting workflows
  2. Deploy/Modify — automatically fix new resources as they're created
  3. Deny — block after existing resources are brought into compliance

Resource Tagging Strategy

Mandatory Tags (5–7 maximum)

Tag KeyExample ValuesPurpose
Applicationecommerce, payrollApplication owner
Environmentprod, dev, testLifecycle filtering
Ownerteam-platform, user@corp.comResponsibility
CostCenterFC-1001, ENG-042Chargeback
DataClassificationConfidential, InternalCompliance

Enforcement: Assign Azure Policy with Modify effect to auto-append a default tag value. Use Deny to block resources missing mandatory tags after baseline is established.

Access Reviews and PIM

Access Reviews: Periodic certifications of who has what access. Remove unused roles automatically. Generate audit reports for compliance. Typically run quarterly.

Subscription Design Patterns

ScenarioRecommended Design
Small organization (fewer than 50 workloads)2–4 subscriptions (production, non-production, identity, connectivity)
Enterprise with compliance domainsSeparate subscriptions per compliance scope (HIPAA, PCI, General)
Multi-region data residencyRegion-specific subscriptions under separate MGs
SaaS multi-tenantDedicated subscription per major tenant or tenant group
Hands-On Lab

Hands-On: Create Management Group Hierarchy and Assign Policy

Step 1: Create Management Group Hierarchy

  1. Open Azure portal > Management groups
  2. Click Create management group
  3. Enter ID (e.g., platform) and display name
  4. Make Root Management Group the parent
  5. Create child groups: management, identity, connectivity
  6. Create landing-zones group with children: production, non-production, sandbox

Step 2: Move Subscriptions to Management Groups

  1. Open Management groups > target management group
  2. Click Subscriptions tab
  3. Click Add existing subscription and search for subscription name
  4. Click Save — subscription inherits parent's policies

Step 3: Create and Assign Azure Policy

  1. Open Azure portal > Policy > Definitions
  2. Search for Require a tag on resources
  3. Click Assign and select scope (management group recommended)
  4. Set parameters: Required tag names (e.g., Environment, Owner)
  5. Choose effect: Audit first, then Deny after validating impact
  6. Submit; existing non-compliant resources appear in Compliance view

Step 4: Configure Privileged Identity Management

  1. Open Entra ID > Privileged Identity Management > Azure resources
  2. Click Discover resources to onboard subscriptions
  3. Click subscription > select a role (e.g., Owner)
  4. Change from Permanent to Eligible
  5. Set Maximum activation duration (e.g., 8 hours)
  6. Require Approval and set approvers
  7. Users must now request activation before using the elevated role

Step 5: Apply Tags at Scale

  1. Open Azure portal > Policy > Definitions
  2. Search for Inherit a tag from the resource group if missing
  3. Assign with Modify effect at subscription or management group scope
  4. Resources created without the tag automatically inherit it from their resource group
Exam Angle — What AZ-305 Tests

AZ-305 Exam Focus

AZ-305 governance questions test your ability to design enterprise-scale hierarchy and select the right policy effect for a given compliance scenario. The exam frequently tests understanding of what management groups do vs. subscriptions, and the difference between policy effects.

Exam Trap

Management Groups Are Not Subscriptions: Management groups are policy and RBAC containers — they cannot contain resources directly and are not billing boundaries. Subscriptions are the billing and resource containers. Management groups organize subscriptions and cascade governance.

Exam Trap

Tags Are Not Security Controls: Tagging a resource "Confidential" does not restrict access to it. Tags are metadata for organization, cost allocation, and automation. Security requires RBAC for access control, network rules for isolation, and encryption for data protection.

Exam Trap

Don't Start with Deny Effect: Immediately using Deny policy effect blocks workflows for existing non-compliant resources. The correct phased approach is Audit → Modify → Deny, giving teams time to remediate before enforcement.

Exam Trap

Deep Management Group Hierarchy: More than 4 levels of nesting creates policy inheritance debugging challenges. Azure best practices recommend 3 levels maximum. Use policies to differentiate governance rather than hierarchy depth.

Exam Tip

PIM for Time-Limited Access: When a scenario mentions temporary access, contractor access, or access that must expire automatically — the answer is PIM with an eligible role assignment and activation duration. Regular RBAC assignments are permanent; PIM adds time-limited and approval-gated access.

Must Memorize

Policy Effect Selection: Deny = strict enforcement; Audit = visibility without disruption; Modify = auto-append tags; DeployIfNotExists = ensure companion resources (monitoring agents, locks) exist. The exam will give scenarios where you must select the correct effect.

Question — click to flip

Q: What is the difference between a management group and a subscription in Azure governance?

Question — click to flip

Q: What Azure Policy effect should you use to automatically append a required tag to resources at creation time?

Question — click to flip

Q: What does Privileged Identity Management (PIM) provide that standard RBAC does not?

Question — click to flip

Q: A policy assigned at a management group uses the Deny effect. A developer in a child subscription tries to create a VM without required tags. What happens?

Question — click to flip

Q: An organization has HIPAA workloads in East US and GDPR workloads in West Europe. How should management groups be structured?

Question — click to flip

Q: What is the maximum recommended depth for a management group hierarchy?

Sources & Further Reading

← 1.2 — Design Authentication and Authorization SolutionsPractice This Domain →