Unit 1 roadmap — Manage Azure identities and governance

What this unit is really testing

Unit 1 is about who may act, where they may act, and what the platform will let them leave behind. Almost every question resolves to a scope question: an assignment made at the wrong level is the single most common way an administrator grants too much or too little. Read every stem for the scope first — management group, subscription, resource group, resource — and only then for the permission.

The order to work through it

1. Start with identity objects, because everything else is granted to one: users, groups, and how membership is decided.
2. Move to Azure role-based access control, and hold the distinction between directory roles and resource roles firmly. They are two systems that share a portal.
3. Finish with governance, which is the widest surface: policy, locks, tags, resource groups, subscriptions, cost control and management groups.

Topic map

Every objective title below is quoted from Microsoft's skills-measured outline, as of 2026-04-17.

Manage Microsoft Entra users and groups

AZ104-U1.T1 · 5 objectives

• Create users and groups
• Manage user and group properties
• Manage licenses in Microsoft Entra ID
• Manage external users
• Configure self-service password reset (SSPR)

Manage access to Azure resources

AZ104-U1.T2 · 3 objectives

• Manage built-in Azure roles
• Assign roles at different scopes
• Interpret access assignments

Manage Azure subscriptions and governance

AZ104-U1.T3 · 7 objectives

• Implement and manage Azure Policy
• Configure resource locks
• Apply and manage tags on resources
• Manage resource groups
• Manage subscriptions
• Manage costs by using alerts, budgets, and Azure Advisor recommendations
• Configure management groups

Traps

Check yourself

Are you ready to move on?

• You can state this unit's published range without looking it up.
• You can name every sub-area and say what separates it from its neighbours.
• You can explain each trap above to somebody else, in your own words.
• You have worked the unit's 99 bank questions and can say why the wrong options are wrong.

When all four are true, take a blueprint-weighted mock rather than more of this unit. A mock is the only asset here that tells you how this unit performs against the other four under time.