Microsoft AZ-104: Identity and Governance Priorities

Identity and governance account for 20–25% of the current AZ-104 blueprint, making this one of the largest skill areas on the exam. The domain covers Microsoft Entra users and groups, licenses, external users, self-service password reset, Azure role assignments, Azure Policy, locks, tags, resource groups, subscriptions, cost controls, and management groups. The AZ-104 exam therefore expects administrators to understand both who can act and how Azure resources are organized and controlled.

The most useful preparation method is to treat identity, authorization, and governance as different layers. Other Microsoft certifications examine design or security from different angles, but AZ-104 scenarios reward precise administrative decisions: choose the right scope, grant the least necessary access, apply a policy at the correct level, or protect a resource from accidental change.

Know the weight and the administrative outcome

Because the domain carries a significant percentage of the exam, it should not be studied as a list of portal steps. The questions can combine identity and governance with storage, compute, or networking. A virtual machine scenario may actually be testing a role assignment. A storage scenario may actually be testing policy or resource locks. Read for the administrative outcome before focusing on the resource type.

Identity answers “who is this principal?” Authorization answers “what can this principal do here?” Governance answers “what rules and organizational controls apply to these resources?” Mixing those layers leads to common mistakes, such as using a policy when an RBAC role is required or granting a role when the requirement is to enforce a configuration standard.

The blueprint also includes cost management inside governance. Budgets, alerts, and Azure Advisor recommendations are operational controls, not billing trivia. Administrators are expected to manage the subscription as an ongoing environment.

Use the Azure scope hierarchy deliberately

Azure administration depends on scope. Management groups can organize multiple subscriptions. Subscriptions contain resource groups and resources. Role assignments, policy assignments, and some governance settings can inherit downward from higher scopes. A decision at the wrong level can either leave resources unprotected or affect far more of the environment than intended.

For exam scenarios, identify the smallest scope that satisfies the requirement. If one team needs access to a single resource group, a subscription-wide assignment may be unnecessarily broad. If an organization needs a standard across many subscriptions, configuring each resource group separately is operationally weak. Scope is part of the answer, not a detail after the role or policy is selected.

Inheritance is powerful because it reduces repetitive configuration, but it also makes troubleshooting more complex. An effective permission or policy result may come from a parent scope that is not obvious when you inspect only the resource.

Separate identity administration from Azure resource access

Microsoft Entra users and groups are identity objects. Azure RBAC governs access to Azure resources. Managing a user account, license, external identity, or password-reset capability is different from granting that identity Contributor or Reader at a subscription, resource group, or resource. The exam can place both operations in the same scenario, so keep the control planes separate in your reasoning.

Groups simplify administration because role assignments can target a group rather than many individual users. The benefit is operational consistency: membership changes in the identity layer can change effective access without editing each resource assignment. That does not remove the need to choose the correct Azure role and scope.

Least privilege should guide role selection. Broad roles are easy to assign but create unnecessary access. Built-in roles usually provide a better starting point when their permissions match the job.

Distinguish RBAC, Policy, locks, and tags

These controls solve different problems. RBAC determines permitted actions for identities. Azure Policy evaluates or enforces resource configuration and organizational standards. Resource locks protect resources from deletion or modification depending on the lock type. Tags provide metadata that supports organization, reporting, automation, and cost management.

A scenario that says “only this team may restart virtual machines” is about authorization. A scenario that says “all resources must use an approved region” points toward policy. “Prevent accidental deletion” points toward a lock. “Track costs by department” often points toward tags combined with cost-management tooling.

The exam becomes easier when you translate the business statement into the control category before choosing an Azure feature.

Manage subscriptions and costs as governance

Subscription administration includes more than access. Budgets and alerts help administrators detect spending patterns before they become surprises. Azure Advisor can provide recommendations that affect cost, reliability, security, performance, and operational excellence. Resource groups and tags make ownership and cost attribution more manageable when they are used consistently.

Management groups become important when governance must span subscriptions. Policies or role assignments at a management-group scope can create consistent controls across a larger estate. The trade-off is blast radius: a mistake at a high scope can affect many workloads.

Good governance therefore combines centralized standards with carefully chosen scope and exceptions. The goal is not maximum restriction; it is predictable administration aligned with organizational requirements.

Connect fundamentals to role-based administration

Candidates coming from AZ-900 may already understand subscriptions, resource groups, identity, and shared responsibility at a conceptual level. AZ-104 goes further by asking you to implement and interpret these controls. The administrator must know where an assignment lives, what inherits, how a policy affects deployments, and how to troubleshoot an access result.

Architecture-oriented candidates may also recognize concepts that appear in AZ-305, but the emphasis differs. AZ-104 is operational: configure the users, roles, policies, locks, tags, and subscription controls that make the environment work day to day.

Do not overcomplicate the question with architecture features that are not required. If the scenario can be solved with a scoped role or a policy assignment, adding a new network design or application component is usually a distraction.

Use an exam decision sequence

For an identity or governance question, first identify the actor or organizational unit. Second, identify the resource scope. Third, determine whether the need is identity management, authorization, policy enforcement, protection from change, metadata, or cost control. Fourth, choose the narrowest control that satisfies the requirement and check how inheritance affects the result.

This method prevents feature-name guessing. It also helps with “least administrative effort” questions because the scope hierarchy and group-based administration often reduce repeated work. A single assignment at the correct parent scope may be better than many child assignments, provided the broader effect is intended.

For broader exam preparation, the existing AZ-104 preparation material can provide study context, but blueprint-aligned practice should focus on current 2026 objectives rather than relying on an older checklist.

Practice by explaining why the wrong control is wrong

Take a set of scenarios and answer twice: first with the correct control, then with the most tempting incorrect control. Explain the difference. Why does RBAC not enforce a region? Why does Policy not authenticate a user? Why is a lock not a substitute for backup? Why are tags not an access-control mechanism? This comparison builds the conceptual boundaries the exam frequently tests.

Then repeat the exercise at different scopes. Ask what changes if the same requirement applies to one resource, one resource group, one subscription, or several subscriptions. Identity and governance questions become much more predictable when control type and scope are solved before the product details.

Troubleshoot effective access and inherited governance

Real administration frequently involves a resource whose effective state is the result of several inherited settings. A user may receive access through a group assignment at a parent scope while a policy assigned higher in the hierarchy restricts the resource configuration. A lock can then prevent an otherwise authorized administrator from completing a change. Troubleshooting requires reading the layers independently rather than assuming one control overrides every other one.

Start with identity and group membership, then inspect role assignments and their scopes. Next inspect policy assignments and compliance state, followed by locks and the resource hierarchy. If the issue involves a deployment rather than a user action, ask whether policy is denying the configuration. If the user can read but not modify, inspect the role rather than adding a broader role immediately.

This order of operations is useful on the exam because it ties each symptom to the control that can produce it. It also reinforces least privilege: a failed action is not automatically evidence that the user needs Owner or Contributor. The correct fix may be a narrower role, a different scope, a policy exception, or removal of an inappropriate lock.

Stay inside the current AZ-104 blueprint

Identity platforms contain many advanced capabilities, but the April 2026 AZ-104 blueprint is specific about what this domain measures. Prioritize Entra users and groups, licenses, external users, SSPR, built-in Azure roles and scope, Policy, locks, tags, resource groups, subscriptions, costs, and management groups. Broader identity-security technologies can provide context, but they should not displace the operational objectives Microsoft currently lists.

This boundary helps allocate study time. You should be able to distinguish authentication policy from Azure authorization, yet you do not need to turn every identity scenario into an advanced security-design exercise. AZ-104 rewards administrators who can implement the controls that keep an Azure estate organized, accessible to the right people, and governed consistently.