Govern and Monitor Azure Resources

Apply tags, locks, and policies to govern Azure resources end-to-end.

Introduction

30 Second Summary

Imagine a shared office where anyone can rearrange furniture, throw things away, or order supplies with no spending limit. Without rules, chaos is inevitable.

In this project, you will build a fully governed Azure environment from scratch. You will tag resources for tracking, lock them against accidental deletion, assign an Azure Policy that blocks non-compliant resources, and explore the monitoring tools that give you visibility into recommendations and spending.

What You'll Build

You will watch Azure reject a resource deployment in real time because your policy catches that it is missing a required tag, proving your governance controls are actively enforcing compliance.

By the end of this project, you'll have:

Resource tags and a resource lock protecting your storage account from accidental deletion, with proof that Azure blocks the delete operation.
An Azure Policy assignment that actively denies untagged resources from being created, demonstrated by watching Azure reject a non-compliant deployment.
First-hand experience navigating Azure Advisor recommendations, Service Health status, and Cost Management cost breakdowns.
Secret Mission: Create a proactive budget alert in Cost Management that notifies you when spending approaches a threshold.

Are there any prerequisites?

This project assumes you already have an Azure account (free tier or pay-as-you-go) and basic familiarity with the Azure Portal. No CLI or coding experience is required.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters. You're going to set up a fully governed Azure environment with real protections that prevent accidental deletion, enforce organizational rules, and give you visibility into spending and health.

Set Up Your Resource Group and Storage Account

Every governance tool in Azure (tags, locks, policies) needs real resources to protect. Without resources in your environment, there is nothing to tag, lock, or enforce rules against.

In this step, you will create a resource group and a storage account. These two resources become the foundation that you will govern throughout the rest of the project.

In this step, get ready to:

Create a resource group named az900-governance-lab in the Azure Portal.
Create a storage account with Standard LRS redundancy inside that resource group.
Verify both resources appear in your resource group's resource list.

Sign in and create your resource group

A resource group is a container that holds related Azure resources. You will group everything for this governance lab into a single resource group so you can manage it as one unit.

Open your browser and navigate to portal.azure.com.
Sign in with your Azure account credentials.

Once signed in, you will see the Azure Portal home page with a search bar at the top.

In the search bar at the top of the portal, type Resource groups and select Resource groups from the results.
Click Create.
Select your Azure subscription from the Subscription dropdown.
In the Resource group field, enter az900-governance-lab.
For Region, select a location close to you (for example, East US).
Click Review + Create.
Click Create.

The resource group is created in a few seconds. Click Go to resource group from the notification bell, or select the resource group name from the list.

You should see an empty resource group with no resources listed yet.

What is a resource group?

A resource group is a logical container in Azure that holds related resources (virtual machines, storage accounts, databases) so you can manage them as a single unit.

When you delete a resource group, every resource inside it is deleted too. This makes cleanup simple and predictable.

Create a storage account inside the resource group

A storage account provides a unique namespace in Azure for storing data objects like blobs, files, and tables. You need one here so you have a tangible resource to protect with locks and policies in later steps.

While inside the az900-governance-lab resource group, click Create at the top of the resource list.
In the Marketplace search box, type Storage account and select Storage account from the results.
Click Create.
Confirm that the Resource group field is already set to az900-governance-lab.
In the Storage account name field, enter az900govstore followed by a few random digits (for example, az900govstore4821). The name must be globally unique, 3-24 characters, and contain only lowercase letters and numbers.
For Performance, leave it set to Standard (the default).
For Redundancy, select Locally-redundant storage (LRS).
Click Review + create.

What does Standard LRS mean?

Standard performance is the general-purpose tier recommended for most workloads. LRS (locally-redundant storage) keeps three copies of your data within a single data center.

This is the cheapest redundancy option, which is perfect for a governance lab where we care about the resource existing, not about production-grade durability.

Review the summary. If validation passes, click Create.

Storage account name already taken?

Storage account names must be globally unique across all of Azure. If you see a validation error, try adding different random digits to the end of your name.

Remember: only lowercase letters and numbers are allowed. No hyphens, underscores, or uppercase characters.

Why is my storage account name being rejected?

The deployment takes about 30 seconds. Once it completes, click Go to resource to open your new storage account.

Verify your resources

Before you move on, do you think both resources are visible in the same place? Where would you check?

In the search bar at the top of the portal, type az900-governance-lab and select your resource group from the results.
Look at the resource list in the center of the page.

You should see one resource listed: your storage account. The resource group itself acts as the container, so it does not appear as a resource inside itself.

Don't see the storage account?

If the resource list appears empty, click Refresh at the top of the resource list. Deployments can take a moment to propagate.

If the storage account still does not appear, confirm you selected az900-governance-lab as the resource group during storage account creation.

Help me find my storage account in the resource group

Your resources are live and ready to govern. Next up, you will tag them for organization and discover a gap in their protection.

Tag Your Resources and Discover the Gap

Your resource group and storage account are live in Azure. But right now, if someone asked which team owns that storage account or whether it belongs to a development or production environment, there would be no way to tell.

Resource tags solve this by attaching key-value metadata to any Azure resource. In this step, you will tag your resources for tracking, then discover a critical gap: nothing stops someone from accidentally deleting your storage account.

In this step, get ready to:

Apply tags to organize your resource group and storage account.
Discover that your resources have no protection against accidental deletion.

Tag your resource group

Tags let you categorize resources by environment, department, project, or any label that makes sense for your organization. You will add two tags that identify this resource group as a training environment.

In the Azure Portal, navigate to your az900-governance-lab resource group.
In the left menu, click Tags.
In the first row, enter Environment as the Name and Development as the Value.
In the second row, enter Department as the Name and Training as the Value.
Click Apply.

You should see a success notification confirming the tags have been saved. Both tags now appear on the resource group's Tags page.

What are resource tags?

A tag is a key-value pair you attach to an Azure resource. Think of tags like labels on physical equipment: they tell you who owns it, what it is for, and where it belongs.

Organizations use tags to filter billing reports by department, identify which environment a resource belongs to, and enforce governance rules with Azure Policy.

Tag your storage account

Tags on a resource group do not automatically flow down to the resources inside it. You need to tag the storage account individually.

Return to the az900-governance-lab resource group overview.
Click on your storage account name to open it.
In the left menu, click Tags.
Add the same two tags: Environment with value Development, and Department with value Training.
Click Apply.

You should see the same success notification. Both tags now appear on the storage account's Tags page, matching the resource group.

Tags not saving?

Make sure you click Apply after entering both tag rows. If you navigate away before clicking Apply, your tags will be lost.

Also check that both the Name and Value fields are filled in for each tag. Azure will not save a tag with an empty value.

Help me troubleshoot my Azure resource tags.

Attempt to delete your storage account

Your resources are now organized with tags. But organization is not the same as protection. What happens if someone accidentally deletes your storage account?

Before you try this, what do you think will happen when you click Delete on the storage account? Will Azure warn you or block you in any way?

Navigate to your storage account's Overview page.
Click Delete in the top toolbar.
Azure shows a confirmation dialog. Notice that there is no special warning or block preventing you from proceeding.
Click Cancel. Do NOT complete the deletion.

Azure offered nothing more than a standard confirmation prompt. Any user with the right permissions could delete this resource in two clicks. Your tags tell you who owns it, but they do nothing to prevent someone from removing it.

Why is this a problem?

In a real organization, accidentally deleting a production storage account could mean losing customer data, breaking applications, or triggering a service outage. Tags help you track resources, but they cannot protect them.

This is exactly the gap that resource locks fill. A lock overrides user permissions and physically prevents deletion or modification until the lock itself is removed.

Your resources are tagged and organized, but completely unprotected. In the next step, you will apply resource locks that make accidental deletion impossible.

Apply Resource Locks to Prevent Accidental Deletion

In the last step, you tagged your resources and discovered a gap. Azure let you start deleting the storage account with zero resistance.

A resource lock is Azure's answer to accidental deletion. Locks apply regardless of a user's RBAC permissions, so even an Owner cannot delete a locked resource without removing the lock first.

In this step, get ready to:

Add a Delete lock to your storage account.
Prove the lock works by attempting to delete the storage account.
Add a Delete lock to the resource group to protect all resources inside it.

Add a Delete lock to your storage account

Azure offers two lock types in the portal: Delete (prevents deletion but allows reads and modifications) and Read-only (prevents any changes at all). You need a Delete lock to protect against accidental removal while still allowing normal usage.

In the Azure Portal, navigate to your storage account inside the az900-governance-lab resource group.
In the left menu under Settings, select Locks.
Click Add.
Set Lock name to CannotDelete-StorageAccount.
Set Lock type to Delete.
In the Notes field, enter Protects governance lab storage..
Click OK.

The lock appears in the Locks list for your storage account. This confirms the lock is now active.

What is a Delete lock?

A Delete lock prevents anyone from deleting the resource, regardless of their role or permissions. To delete the resource, you must explicitly remove the lock first.

This two-step requirement (remove lock, then delete) acts as a safety net that prevents accidental "oops" moments in production environments.

Prove the lock blocks deletion

In the last step, you attempted to delete this same storage account and Azure offered no resistance. Now the lock should block that action entirely.

Before you try, what do you think will happen when you click Delete on a locked resource? Will Azure show a confirmation prompt like before, or something different?

Navigate to the Overview page of your storage account.
Click Delete in the top toolbar.

Azure blocks the operation with an error message indicating that the resource is locked and cannot be deleted. This is completely different from the unprotected confirmation prompt you saw earlier. The lock is working.

Not seeing an error about the lock?

Make sure you added the lock to the storage account itself, not just the resource group. Go back to your storage account, select Locks under Settings, and confirm CannotDelete-StorageAccount appears in the list with type Delete.

Still stuck? Help me figure out why my Delete lock isn't blocking deletion of my storage account.

Lock the resource group

You locked the storage account individually. But what about future resources you add to this resource group? A lock on the resource group applies to all resources inside it, protecting everything at once.

Navigate back to the az900-governance-lab resource group.
In the left menu, select Locks.
Click Add.
Set Lock name to CannotDelete-ResourceGroup.
Set Lock type to Delete.
Click OK.

The lock appears in the resource group's Locks list. This prevents the entire resource group and all its contents from being deleted.

Why lock both the resource group and the storage account?

A lock on the resource group protects all resources inside it through inheritance. You could rely on just the resource group lock, but adding a lock directly to critical resources provides defense in depth.

If someone removes the resource group lock, the storage account lock still stands as a second layer of protection.

Don't see the Locks option in the left menu?

Make sure you are at the resource group level, not inside a specific resource. The breadcrumb at the top of the page should show your subscription followed by az900-governance-lab. Locks appears under the Settings section in the left menu.

Need more help? I cannot find the Locks menu option for my resource group in the Azure Portal.

Your resources are now locked against accidental deletion. Next up, you will enforce organizational rules with Azure Policy to prevent untagged resources from being created in the first place.

Enforce Tagging with Azure Policy

Your resource locks prevent accidental deletion. But they do not prevent someone from creating a brand-new resource without any tags.

An untagged resource is invisible to cost tracking and ownership reports. Azure Policy solves this by enforcing organizational rules at deployment time, blocking any resource that does not meet your requirements before it is created.

In this step, get ready to:

Assign the built-in "Require a tag on resources" policy to your resource group.
Configure the policy to require an Environment tag on every new resource.
Test the policy by attempting to create a non-compliant resource and watching Azure deny it.

Open Azure Policy and start a new assignment

Azure Policy lives in its own service blade in the portal. You will create a policy assignment that scopes a built-in rule to your resource group.

In the Azure Portal search bar at the top, type Policy and select the Policy service from the results.
In the left menu, click Assignments.
Click Assign policy at the top of the Assignments page.
On the Basics tab, click the ellipsis (...) next to Scope.
In the scope selector, select your subscription.
Expand the subscription and select the az900-governance-lab resource group.
Click Select.

Why scope to the resource group?

Scoping a policy to a single resource group means it only affects resources inside that group. In production, organizations scope policies at the subscription or management group level to enforce rules across all teams at once.

Select the built-in policy and configure parameters

Still on the Basics tab, click the ellipsis (...) next to Policy definition.
In the filter dropdown labeled Type, select Built-in.
In the search box, type Require a tag on resources.
Select the policy named Require a tag on resources from the results.
Click Add.
Leave the Assignment name as the default.
Set Policy enforcement to Enabled.
Click the Parameters tab at the top of the form.
In the Tag Name field, enter Environment.
Click Review + create.
Click Create.

You should see a notification confirming the policy assignment was created successfully. The assignment now appears in your Assignments list.

What does this policy do?

The "Require a tag on resources" policy uses a deny effect. Any time someone tries to create or update a resource without the specified tag, Azure blocks the deployment before the resource is created.

This policy does not apply to resource groups themselves. It only applies to individual resources inside the group.

Don't see the policy in search results?

Make sure you set the Type filter to Built-in before searching. The search only applies within the selected filter. If results are still empty, try clearing any extra filters and searching again.

Help me find the policy

Test your policy by attempting a non-compliant deployment

Azure Policy can take a few minutes to become active after assignment. Give it 5-10 minutes before testing.

Wait 5-10 minutes after creating the assignment.
In the Azure Portal search bar, type Storage accounts and select the service.
Click + Create.
Select the az900-governance-lab resource group.
Enter any globally unique name for the storage account.
Leave all other settings at their defaults. Do NOT add any tags.

Before you click Review + create, think about what you expect to happen. Will Azure allow this deployment to succeed, or will something block it?

Click Review + create.
Click Create.

Azure blocks the deployment with a validation error. The error references your "Require a tag on resources" policy and indicates the resource was disallowed because it is missing the required Environment tag.

What just happened?

Your policy evaluated the new storage account at deployment time. Because you did not add an Environment tag, the policy's deny effect kicked in and blocked the entire operation. The resource was never created.

This is the power of Azure Policy. It enforces compliance automatically, before non-compliant resources can enter your environment.

Deployment succeeded instead of failing?

The policy may not have taken effect yet. Azure Policy needs a few minutes to propagate after assignment. Wait another 5 minutes and try again with a different storage account name.

Also confirm your policy assignment has Policy enforcement set to Enabled. If enforcement is disabled, the policy audits but does not block.

Help me troubleshoot my policy

Your governance controls are now fully active. Tags organize resources, locks prevent deletion, and policy blocks non-compliant deployments. Next up, you will explore the monitoring tools that give you visibility into recommendations, health, and spending.

Explore Monitoring Tools (Advisor, Service Health, Cost Management)

Your governance layer is now fully active. Tags organize your resources, locks prevent accidental deletion, and a policy blocks non-compliant deployments at creation time.

Governance protects resources, but it does not give you visibility into what Azure recommends you improve, whether any services are experiencing outages, or how much you are spending. Three monitoring tools complete the picture: Azure Advisor, Azure Service Health, and Cost Management.

In this step, get ready to:

Review Azure Advisor recommendations across five categories.
Check your region's service health status for incidents, maintenance, and advisories.
View your resource group's cost breakdown in Cost Management.

Review recommendations in Azure Advisor

Azure Advisor scans your subscription and surfaces actionable recommendations across five categories. It is the first place to look when you want to improve reliability, security, performance, cost efficiency, or operational health.

In the Azure Portal search bar at the top, type Advisor.
Under Services in the search results, select Advisor.
The Advisor Overview page opens. You see tiles for each recommendation category: Reliability, Security, Performance, Cost, and Operational Excellence.
Click the Cost tile to open cost optimization suggestions.
Return to the Advisor Overview and click into one other category (for example, Reliability or Security) to see what Azure recommends there.

You should now see at least the five category tiles on the Overview, even if some show zero recommendations.

What is Azure Advisor?

Azure Advisor is a free, personalized cloud consultant built into the Azure Portal. It analyzes your deployed resources and usage patterns, then surfaces recommendations across five categories: Reliability, Security, Performance, Cost, and Operational Excellence.

A brand-new subscription may show limited recommendations. That is normal. Advisor updates recommendations daily based on your usage, so more suggestions appear as your environment matures.

Not seeing any recommendations?

Advisor can take up to 24 hours to generate recommendations for newly created resources. If your tiles all show zero, that is expected for a fresh lab environment.

Confirm you are on the Advisor Overview page (not a filtered sub-page) and that the Subscription filter at the top includes your subscription.

Why are my Advisor tiles empty?

Check your region's status in Service Health

Service Health gives you a personalized view of incidents, maintenance, and advisories that affect the specific Azure regions and services you use. Unlike the global Azure Status page, Service Health filters events to your subscriptions.

In the Azure Portal search bar, type Service Health.
Select Service Health from the results.
In the left menu, select Service issues. This page shows any active incidents affecting your subscriptions. Note whether your region currently has any active issues.
Select Planned maintenance in the left menu. This shows upcoming maintenance that could affect availability for your services.
Select Health advisories in the left menu. Advisories notify you about changes like feature deprecations or upgrade requirements that need your attention.

You have now reviewed all three categories. Note your region's current status: are there any active incidents, upcoming maintenance, or advisories listed?

What does Service Health track?

Service Health tracks five event types: service issues (outages affecting you now), planned maintenance (upcoming changes), health advisories (deprecations or required actions), security advisories, and billing updates.

If all three pages are empty, that means your region has no active incidents or upcoming changes. This is good news for your resources.

View your resource group's cost breakdown in Cost Management

Cost Management lets organizations track spending at any scope: subscription, resource group, or management group. By scoping to a single resource group, you can see exactly what that group's resources cost. This is where the tags you applied earlier become powerful for filtering and reporting.

In the Azure Portal search bar, type Cost Management.
Select Cost Management from the results.
In the left menu, select Cost analysis.

Before you change the scope, what do you think the cost will show for a resource group containing a single empty storage account that has existed for less than an hour?

At the top-left of the Cost analysis view, click the Scope pill to open the scope picker.
Click your subscription name to expand it, then select az900-governance-lab from the list of resource groups.
Click Select at the bottom of the scope picker.

The cost breakdown now shows spending for your governance lab resource group only. You should see $0.00 or a few cents for the storage account.

How do organizations use Cost Management scopes?

Organizations scope their cost analysis to resource groups to track spending by team, project, or environment. Combined with the tags you applied earlier (Environment, Department), this gives finance teams granular visibility into which department and environment is driving costs.

On the AZ-900 exam, expect questions about how tags and scopes work together for cost tracking. You have now seen both in action.

Cost analysis shows no data?

Make sure you selected the az900-governance-lab resource group in the scope picker (not a subscription or billing account). If costs still show nothing, the storage account may not have incurred any charges yet. A $0.00 result is normal for a freshly created resource.

Why is my Cost Management showing zero costs?

Secret mission

Create a Budget Alert in Cost Management

You have governance controls that protect and organize your resources. But what about your spending? Right now, you would only notice a cost spike after the bill arrives. In this secret mission, you will create a proactive budget alert that notifies you before spending crosses a threshold.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. The storage account costs fractions of a cent per month if left empty, and no other resources incur charges.

Resources you used:

Resource group: az900-governance-lab.
Storage account: your custom-named storage account (e.g. az900govstore followed by random digits).
Resource locks: CannotDelete-StorageAccount and CannotDelete-ResourceGroup.
Policy assignment: "Require a tag on resources" scoped to the resource group.
Budget: governance-lab-budget ($5 monthly).

Keep everything running

No action needed. Choose this if you want to keep the environment as an AZ-900 study reference.

Your storage account costs fractions of a cent per month if left empty.
The resource locks, policy assignment, and budget incur no charges.
You can revisit this environment any time to review governance concepts for the AZ-900 exam.

Pause - I'll come back to this later

Azure resources like resource groups, storage accounts, and policy assignments either exist or they do not. There is no pause state.

If you want to keep studying, leave everything as-is (see the Keep tab).
If you are done, delete everything (see the Delete tab).
The cost of keeping these resources is negligible, so leaving them running while you decide costs almost nothing.

Delete - I don't want to use this again

Remove all project resources and start fresh. You must remove the resource locks before Azure allows deletion.

In the Azure Portal, navigate to your storage account. Select Locks under Settings in the left menu. Delete the CannotDelete-StorageAccount lock by clicking the delete icon next to it.
Navigate to the az900-governance-lab resource group. Select Locks in the left menu. Delete the CannotDelete-ResourceGroup lock.
Return to the resource group overview. Click Delete resource group at the top. Type the resource group name az900-governance-lab to confirm, then click Delete.
This removes the storage account, the policy assignment, and the budget along with the resource group.

Nice Work!

You just built a fully governed Azure environment from scratch. Starting with a bare resource group and a storage account, you layered on every governance tool the AZ-900 exam tests and proved each one works.

Here's what you accomplished:

Applied resource tags and resource locks to organize and protect your Azure resources, then proved the lock blocks deletion by attempting to delete a locked storage account.
Assigned an Azure Policy that actively denies non-compliant deployments, and watched Azure reject a resource that was missing the required tag.
Explored Azure Advisor (five recommendation categories), Service Health (incidents, maintenance, advisories), and Cost Management (cost analysis by scope) to understand how Azure monitors and optimizes your environment.
Secret Mission: Created a proactive budget alert in Cost Management that notifies you before spending exceeds your threshold.

Ready to quiz yourself?