Build a Safe AZ-104 Workspace

Create a protected Azure workspace with tags, a budget, and a Delete lock.

Introduction

30 Second Summary

A blank cloud account feels harmless until experiments start piling up. Without a clear home or safety net, later practice work becomes harder to track and easier to remove by mistake.

In this project, you will build a governed Azure practice workspace with visible tags, a monthly budget, and deletion protection. You will prove the guardrail works by watching Azure reject a deliberate deletion attempt.

What You'll Build

You open the Azure portal to a tagged practice workspace with a monthly budget and a Delete lock that keeps it standing through a deliberate deletion attempt.

By the end of this project, you'll have:

A tagged resource group that lets you recognize each lab's environment, workload, and cost purpose at a glance.
A monthly budget that can email you when actual cost reaches your chosen threshold.
A Delete lock you can demonstrate by triggering a blocked deletion while the practice workspace stays visible.
Secret Mission: Test a Read-only lock by proving it blocks a tag change. Then restore the Delete lock for future labs.

Are there any prerequisites?

You need a Mac with Safari, a Microsoft Learn account, a personal Azure subscription, and Owner access on that subscription. An ephemeral Bash session in Azure Cloud Shell removes the need for a local Azure CLI installation.

Before We Start

This first checkpoint defines the purpose of your protected practice workspace before you change your subscription. You are building rg-az104-practice to organize future labs, monitor their cost, and protect them from accidental deletion.

Verify Your Azure Admin Workspace

Every action in the Azure portal targets an active Azure subscription. Every command in Azure Cloud Shell also uses an active subscription.

A mismatch could place future AZ-104 resources in the wrong subscription. You'll first use Safari to select your intended personal subscription.

You'll then confirm your Owner access. Finally, you'll use an ephemeral Bash session to check the active Azure CLI subscription.

In this step, get ready to:

Verify portal access to your intended personal subscription.
Confirm Owner access at the subscription scope.
Verify the active subscription from an ephemeral Azure Cloud Shell session.

Select your personal subscription

Your selected subscription becomes the scope for the governance controls you create later. Confirming its name gives every following portal action a clear target.

Press Cmd+Space on your Mac to open macOS search.
Type Safari into the search bar to find the browser.
Press Enter to open Safari.
Go to the Azure portal in Safari.
Sign in with your Microsoft Learn account.
Use the search bar at the top of the Azure portal to find Subscriptions.
Select Subscriptions from the search results.
Select the personal subscription you intend to use for AZ-104 practice.
Record the selected subscription name here: your personal Azure subscription name.

The subscription name at the top of the page should match your personal Azure subscription name. Your portal actions now have a confirmed target.

Can't See Your Subscription?

Check that you signed in with the account connected to your personal Azure subscription.
Refresh the Subscriptions page.
Confirm that the subscription is active in your Azure account.

Help me find my personal Azure subscription.

Confirm Owner access

Owner access includes the permission needed to manage budgets. It also includes the permission needed to manage resource locks.

Select Access control (IAM) from the subscription menu.
Select the Check access tab.
Select View my access.
Confirm that Owner is listed at the subscription scope.

You'll see Owner associated with your access at the selected subscription scope. This confirms that your account can manage the governance controls used later.

Owner Access Missing?

The permission check protects you from reaching a blocked budget or lock action later. Resolve the missing role before continuing.

Return to the Subscriptions page.
Verify that you selected your intended personal subscription.
Ask the subscription administrator to grant Owner access at the subscription scope if the role remains absent.

Help me understand my Azure subscription access.

Verify the subscription in Cloud Shell

Azure Cloud Shell gives you an authenticated command environment inside the portal. Choosing No storage account required creates an ephemeral session whose saved files are deleted after the session ends.

Select Azure Cloud Shell from the portal's top navigation.
Choose Bash for the shell environment.
Select No storage account required.
Select your personal Azure subscription name as the subscription.
Select Apply to start the session.

✔️ The Bash Prompt Opens

Your Bash prompt is ready in the Cloud Shell panel. The session is connected to the subscription you selected.

ⓧ The Provider Is Unregistered

Cloud Shell requires the Microsoft.CloudShell resource provider. Register it within the intended subscription before retrying the session.

Return to your personal Azure subscription name in the Azure portal.
Select Resource providers from the subscription menu.
Search for Microsoft.CloudShell.
Use the registration action for Microsoft.CloudShell.

The provider registration enables Cloud Shell for this subscription. Retry the first-use flow after the registration finishes.

Select Azure Cloud Shell from the portal's top navigation.
Choose Bash.
Select No storage account required.
Select your personal Azure subscription name.
Select Apply.

Cloud Shell Still Won't Open?

Confirm that the provider registration completed within the same subscription you selected for Cloud Shell.

Help me finish Cloud Shell setup.

What Does Ephemeral Mean?

An ephemeral Cloud Shell session does not keep saved files after the session ends. This project only needs the authenticated command environment to verify your active subscription.

Before you run the check, consider whether Cloud Shell will report your personal Azure subscription name as its active subscription.

Check the active Azure CLI subscription by running this command:

az account show

What Does This Command Show?

The az account show command returns details for the default subscription used by Azure CLI. This makes the active command target visible before you create anything.

You'll see the current subscription details in the Cloud Shell terminal.

Compare the returned subscription name with your personal Azure subscription name.

The returned subscription should match the personal subscription you selected in the Azure portal. That match proves your portal scope matches your Azure CLI scope.

Seeing a Different Subscription?

Close the current Cloud Shell panel.
Reopen Azure Cloud Shell from the portal's top navigation.
Choose Bash.
Select No storage account required.
Select your personal Azure subscription name.
Select Apply.
Repeat the active subscription check above.

Help me correct my active Azure CLI subscription.

That's your admin workspace verified. The intended personal Azure subscription is selected in the Azure portal.

Your account has Owner access at subscription scope.

An ephemeral Bash session is open in Azure Cloud Shell with No storage account required. The session is connected to the same personal subscription.

The az account show output confirms the active subscription.

Your Azure scope is verified. Next, you'll create rg-az104-practice as the tagged home for future labs.

Create and Tag Your Practice Workspace

Your Azure admin access is verified. Now you can create the workspace that will hold your future AZ-104 labs.

Future labs need one visible lifecycle boundary. A resource group keeps related resources together.

This shared scope keeps future costs easier to trace. It also gives cleanup a clear target.

In this step, get ready to:

Create a dedicated resource group for future AZ-104 labs.
Apply purpose labels with tags.
Inspect the workspace Overview for its scope details.

Create the practice resource group

A resource group's location determines where Azure stores its metadata. Resources added later can use other Azure regions.

Why use a nearby region?

A nearby region gives the resource group a sensible metadata location for your practice environment. The location does not restrict where you deploy future lab resources.

In the Azure portal from earlier, select Resource groups from the portal menu.
Select Create.
Choose the intended personal subscription for the new resource group.
Enter rg-az104-practice as the resource group name.
Select a nearby Azure region for the group's metadata.
Select Review + Create.

The review page summarizes the scope and location that Azure uses for the new resource group.

Confirm the review shows your intended personal subscription.
Confirm the review shows rg-az104-practice.
Select Create.
Return to Resource groups from the portal menu.

Good start. You should see rg-az104-practice in the resource group list.

Can't find the new resource group?

Confirm the Azure portal still has your intended personal subscription selected.
Refresh the Resource groups page.

Help me find my resource group.

Apply the workspace tags

Each tag uses a name and a value to label the workspace. These labels make its environment and purpose visible from the Overview.

Select rg-az104-practice from the resource group list.
Select Add tags.

Keep tags non-sensitive

Azure stores tags as plain text. Keep passwords and other sensitive values out of them.

Enter Environment as the first tag name.
Enter Lab as its value.
Enter Workload as the second tag name.
Enter AZ104 as its value.
Enter CostCenter as the third tag name.
Enter Learning as its value.
Select Save.

You should see all three saved tag names with their matching values.

Tags missing after saving?

Confirm every tag row has both a name and a value.
Select Save again after correcting any incomplete row.

Help me fix my resource group tags.

Verify the workspace Overview

The Overview connects your visible labels to the resource group's Azure scope. Checking these details now helps you recognize the boundary used by later labs.

Select Overview from the resource group menu.
Confirm the subscription matches your intended personal subscription.
Confirm the location matches the nearby Azure region you selected.
Inspect the resource ID to recognize the resource group's full Azure scope.
Confirm Environment shows Lab.
Confirm Workload shows AZ104.
Confirm CostCenter shows Learning.

Before you refresh, do you expect every saved detail to remain visible?

Return to Resource groups from the portal menu.
Refresh the Resource groups page.
Select rg-az104-practice.

You should see rg-az104-practice under your intended personal subscription. Its Overview shows the chosen location and resource ID.

The Overview also displays Environment=Lab, Workload=AZ104, and CostCenter=Learning.

That is the foundation in place. Your empty practice workspace now has a visible purpose and a clear lifecycle boundary.

Overview missing a tag?

Return to Add tags from the resource group Overview.
Enter the missing name or value exactly as shown above.
Select Save.

Help me restore a missing tag.

Your tagged practice workspace is ready for future AZ-104 resources. Next up, you'll add a budget that can notify you about spending inside this scope.

Add a Budget and Discover Its Limitation

Your tagged Azure resource group now gives future labs one visible home. Its tags make the workspace easy to identify.

Tags identify where future costs belong. They cannot notify you when spending crosses a threshold.

In this step, a budget in Microsoft Cost Management adds that notification. You will then test its boundary through a controlled action in the Azure portal.

In this step, get ready to:

Create a monthly budget for rg-az104-practice.
Add an Actual cost alert at 50% for your email address.
Test whether the budget changes the resource group's deletion flow.

Create the monthly budget

Resource-group scope keeps this budget focused on future costs associated with rg-az104-practice. A monthly period resets the tracked amount each month.

Return to the Overview for rg-az104-practice in the Azure portal.
Select Budgets from the resource group menu.
Select Add.

You will see the budget setup form scoped to rg-az104-practice.

Can't Access the Budget Form?

A new subscription can take up to 48 hours before all Cost Management features become available.

Continue to Step 4 while Cost Management becomes available.
Return to this substep when Budgets becomes available.

Help me check why the budget form is unavailable.

Enter budget-az104-practice as the budget name.
Choose Monthly as the reset period.
Enter 10 as the amount in your subscription billing currency.

The form now shows a monthly amount of 10 for the resource-group scope.

Set the expiration date to one year from today.
Select Next.

You will see the alert configuration for the new budget.

How Does the Monthly Period Work?

The future expiration date keeps the budget active across monthly resets. Each new period uses the same amount of 10.

Add the actual cost alert

An Actual cost alert compares accrued cost with your chosen threshold. The budget uses your email address to send the notification.

Select Actual cost as the alert type.
Enter 50% as the alert threshold.
Enter your email address as the alert recipient.
Finish creating the budget from the alert page.

When Will the Alert Arrive?

Cost data typically becomes available within 8 to 24 hours. Azure evaluates budgets every 24 hours. Email notifications normally arrive within an hour after evaluation.

The alert sends a notification. Resources continue consuming services until you stop or delete them.

Return to the Budgets list for rg-az104-practice.
Refresh the budget list.

You should see budget-az104-practice with a monthly amount of 10 in your subscription billing currency.

You have the cost signal in place. The budget is ready to email you after available cost data crosses the threshold.

Budget Missing From the List?

Return to rg-az104-practice from Resource groups.
Select Budgets from that resource group's menu.
Refresh the budget list.

Help me locate my resource-group budget.

Test the budget's boundary

A governance control becomes useful when you understand its boundary. This controlled test checks whether cost monitoring changes a separate management action.

Deletion controls deserve care. This test stops at the confirmation screen.

Before you test this, do you expect the budget to stop the deletion flow or only monitor costs?

Return to the Overview for rg-az104-practice.
Select Delete resource group.

You will see that the deletion confirmation is still available. This visible delete path is the intended shortfall.

Leave the resource group name field empty.
Select Cancel.
Return to Resource groups.
Refresh the resource group list.

You should still see rg-az104-practice in the intended personal subscription. The canceled test left the workspace intact.

What Did the Test Prove?

The budget tracks costs through alerts. Azure still allows the deletion process to begin because the budget does not restrict control-plane operations.

Can't Find the Workspace?

Confirm that the intended personal subscription remains selected.
Search Resource groups for rg-az104-practice.

Help me locate my practice resource group.

Your budget now watches future costs. Next, you will close the exposed deletion path with a resource lock.

Block Accidental Deletion

Your budget now tracks the practice workspace. However, the deletion path you exposed in the last step is still available.

In this step, you'll add a Delete lock in the Azure portal. The lock protects rg-az104-practice through Azure's control plane.

You'll repeat the deletion attempt from the last step. The outcome gives you direct evidence that the new guardrail is active.

In this step, get ready to:

Apply a Delete lock to rg-az104-practice.
Confirm the lock is active at the resource-group scope.
Test the lock with a deliberate deletion attempt.

Add a Delete lock

A Delete lock allows updates while blocking deletion at its scope. Applying it to the resource group gives the practice workspace one deletion guardrail.

Switch back to the rg-az104-practice page in the Azure portal from earlier.
Select Locks in the resource group's menu.
Select Add.
Enter lock-prevent-delete as the lock name.
Choose Delete as the lock type.
Enter a short note explaining why you want to prevent deletion of this practice workspace.
Save the lock.

You should see lock-prevent-delete in the Locks list. Its lock type should show Delete.

What does the Delete lock protect?

The lock applies to control-plane operations at the rg-az104-practice scope.

You can still read the resource group. You can still modify its settings.

Azure blocks deletion of the protected scope. This guardrail keeps the workspace available for future labs.

Confirm the lock is active

A lock must be present at the intended scope before you test it. The Locks list provides that checkpoint.

Find lock-prevent-delete in the Locks list.
Confirm the lock type shows Delete.
Confirm you are viewing Locks inside rg-az104-practice.

You have attached the guardrail at the exact scope that needs protection.

Can't find the lock?

Refresh the Locks list.
Confirm the page belongs to rg-az104-practice.
Repeat the lock creation steps above if no matching row appears.

Help me check why my resource lock is missing.

Prove the deletion is blocked

A listed lock proves the configuration exists. A deliberate deletion attempt proves Azure enforces it.

A real deletion attempt can feel drastic. You have already confirmed the lock is active.

Before you submit the confirmation, which control do you expect Azure to enforce on this management request?

Return to Overview for rg-az104-practice.
Select Delete resource group.
Enter rg-az104-practice in the confirmation field.
Submit the deletion confirmation.

You'll see Azure reject the operation because the scope is locked. That blocked request proves the deletion guardrail is working.

Dismiss the locked-scope error.
Return to Resource groups.
Refresh the list.

You should still see rg-az104-practice in the list. Your failed deletion is a successful governance test.

Deletion was not blocked?

Return to Locks inside rg-az104-practice before making another attempt.
Confirm the lock name is lock-prevent-delete.
Confirm the lock type is Delete.

Help me troubleshoot why the deletion was not blocked.

Secret mission

Test a Read-only Lock

Your Delete lock stops removal while normal management changes remain available. Temporarily apply a Read-only lock to test a tag update. Restore the original Delete lock when the comparison is complete.

Clean Up Your Resources

Your protected practice workspace currently has no expected usage cost. The options below let you keep it ready, pause your active Azure Cloud Shell session, or delete the workspace entirely.

Cost warning

Microsoft Cost Management is available to Azure customers at no additional cost.

Your budget sends notifications about recorded costs. It does not stop consumption.

Delete unused workloads from future AZ-104 labs.
Check Cost analysis as you add billable services.

Resources you used:

An Azure resource group named rg-az104-practice in your personal subscription.
Three tags attached to the resource group: Environment=Lab, Workload=AZ104, and CostCenter=Learning.
A monthly budget named budget-az104-practice with an amount of 10 in your billing currency.
An Actual cost email alert set to 50%.
A Delete resource lock named lock-prevent-delete.

Keep everything running

Keeping the workspace preserves your completed governance setup for future AZ-104 labs. The budget stays active while the Delete lock continues protecting the resource group.

Keep lock-prevent-delete applied to preserve deletion protection.
Use rg-az104-practice as the landing zone for your next AZ-104 lab.
Review Cost analysis before leaving future billable services running.

Pause - I'll come back to this later

Pausing this project means ending only the temporary shell session. Your resource group configuration remains available for later.

Close the Azure Cloud Shell pane from earlier.

The ephemeral session ends when you close it. Your budget, tags, and Delete lock remain configured in the Azure portal.

Delete - I don't want to use this again

Permanent cleanup can feel drastic. Here, it removes an empty practice workspace with no deployed workload services.

The budget has its own lifecycle within Cost Management.

Return to rg-az104-practice in the Azure portal.
Select Budgets from the resource group menu.
Select budget-az104-practice.
Select Delete.
Confirm the budget deletion.

You should no longer see budget-az104-practice in the budget list.

The Delete lock now performs its intended job by blocking the resource-group deletion. It must leave the scope before Azure can remove the group.

Select Locks from the rg-az104-practice menu.
Select Delete for lock-prevent-delete.
Confirm the lock removal.

You should no longer see lock-prevent-delete in the Locks list.

Azure can now accept the permanent resource-group deletion. The attached tags leave with their resource-group scope.

Select Overview from the resource group menu.
Select Delete resource group.
Enter rg-az104-practice in the confirmation field.
Complete the final deletion confirmation.
Return to Resource groups.
Refresh the Resource groups list.

You should no longer see rg-az104-practice in the list.

That completes the cleanup. Your budget, lock, tags, and empty practice workspace are now removed.

Nice Work!

You did it! You built a governed Azure practice workspace that is ready for future AZ-104 labs.

You've learned how to:

Confirm the intended personal Azure subscription in the Azure portal. Verify Owner access at subscription scope. Check the active subscription with Azure CLI from an ephemeral Bash session in Azure Cloud Shell.
Create rg-az104-practice as a home for future labs. Label the resource group with a practical Azure tagging scheme. Track the workspace with the budget-az104-practice cost budget set to a monthly amount of 10 in your billing currency. Configure an Actual cost email alert at 50%.
Apply the lock-prevent-delete Delete lock to the resource group. Prove the guardrail works by completing a deletion attempt. Observe Azure reject the operation. Confirm rg-az104-practice remains available.
Secret Mission: Create lock-test-readonly as a Read-only lock. Prove it blocks a tag update. Restore lock-prevent-delete as a Delete lock.

Ready to quiz yourself?