Identity, Governance & Monitoring — A Unit 1 Survey

This lesson provides a broad survey of the first major domain tested on the AZ-305 certification exam: Design identity, governance, and monitoring solutions. It establishes the mental model that ties three seemingly distinct concerns — who can access what (identity), what rules constrain the environment (governance), and how you know what is happening (monitoring) — into a single, coherent architecture layer. By the end of this lesson you will understand how these three pillars reinforce one another and where to dive deeper in the Topic- and Learning-Objective-level lessons that follow.

The Microsoft Azure Well-Architected Framework (WAF) defines five pillars: Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency. This unit maps primarily to the Security pillar (identity and governance) and the Operational Excellence pillar (monitoring), but cost governance touches Cost Optimization as well. The Cloud Adoption Framework (CAF) identifies seven phases of cloud adoption — Strategy, Plan, Ready, Adopt (Migrate / Innovate), Govern, Manage, and Organize — and this unit corresponds most directly to the Govern, Manage, and Ready phases where landing zones, policies, and monitoring are established.

Reference: Ch. 1, §§1.1–1.4, pp. 1–50 of the AZ-305 exam book.

Why This Matters

If you have ever been woken at 2 a.m. by an alert that "someone" changed a production database and there is no record of who authorized it, you already feel the pain this unit addresses. The AZ-305 exam expects you to design solutions where identity, governance, and monitoring work as a closed loop: identities authenticate and are authorized through well-defined roles, governance policies enforce organizational standards on those identities and the resources they create, and monitoring captures every action so you can detect anomalies, prove compliance, and continuously improve.

Mastering this unit is critical because roughly 25–30% of the AZ-305 exam questions draw from these skills. More importantly, every other unit — data storage, business continuity, and infrastructure — assumes that identity and governance are already in place. You cannot design a secure storage solution without RBAC; you cannot prove compliance without logging; you cannot enforce naming conventions without Azure Policy. This unit is the foundation on which every other architectural decision rests.

For your career, architects who can design a landing zone with proper identity, governance, and monitoring from day one save organizations months of expensive retrofitting later. Cloud-migration projects that skip this unit's concerns during the planning phase almost always circle back to add them — at far greater cost and risk. This is the unit that separates a solutions architect who deploys resources from one who designs secure, compliant, observable systems.

Prerequisites

• Azure fundamentals (AZ-900 level): Can you explain the difference between IaaS, PaaS, and SaaS and name at least three Azure services in each category?
• Basic networking concepts: Can you describe what a virtual network, subnet, and NSG do in Azure?
• Familiarity with the Azure Portal: Can you navigate to a resource group, open its IAM blade, and view role assignments?
• Understanding of on-premises Active Directory: Can you explain what a domain controller, forest, and organizational unit (OU) are?
• JSON literacy: Can you read a JSON object and identify keys, values, and nested structures? This matters because Azure Policy rules, RBAC role definitions, and ARM templates are all expressed in JSON.

Learning Objectives

1. Evaluate how identity, governance, and monitoring interact as a unified control plane for Azure solutions.
2. Design a mental model that maps Azure services to the three pillars (logging & monitoring, authentication & authorization, governance).
3. Recommend which Well-Architected Framework pillars each pillar of this unit addresses and why.
4. Analyse a set of business requirements and determine which Unit 1 skills (1.1–1.4) are relevant.
5. Differentiate the responsibilities of Azure Monitor, Microsoft Entra ID (formerly Azure AD), and Azure Policy at a high level.
6. Construct a curriculum reading plan that sequences the Topic and LO lessons under this unit for maximum learning efficiency.

Building Blocks

Microsoft Entra ID (formerly Azure Active Directory / AAD) — Analogy: Think of Entra ID as the building's reception desk — it checks your badge (authentication) and tells you which floors you may enter (authorization). Formal definition: Entra ID is Microsoft's cloud-based identity and access management (IDAM) service. It manages users, groups, service principals, and managed identities and provides authentication protocols (OAuth 2.0, OpenID Connect, SAML) for Azure resources, Microsoft 365, and thousands of third-party SaaS apps. Why it matters: Every Azure resource operation passes through Entra ID — without it there is no "who" in your architecture. The exam book (Ch. 1, §1.2, p. 19) calls Entra ID "a comprehensive native IDAM solution in Azure" and emphasizes its role in both B2B and B2C scenarios.

Azure Role-Based Access Control (RBAC) — Analogy: RBAC is the key-card system programmed at the reception desk — each card grants access to specific rooms (scopes) based on the holder's role. Formal definition: Azure RBAC is an authorization system built on Azure Resource Manager that provides fine-grained access control. A role assignment binds a security principal (user, group, service principal, or managed identity) to a role definition (set of permissions) at a scope (management group, subscription, resource group, or resource). Why it matters: RBAC is the primary mechanism the exam tests for controlling who can do what across Azure resources. The book (Ch. 1, §1.2, p. 17) describes the four components: security principal, role definition, scope, and deny assignments.

Management Group / Subscription / Resource Group hierarchy — Analogy: Picture a company org chart — the CEO (root management group) oversees divisions (management groups), each division has cost centres (subscriptions), each cost centre has project teams (resource groups), and each team owns equipment (resources). Formal definition: Azure organizes resources in a four-level hierarchy: management groups → subscriptions → resource groups → resources. Governance policies and RBAC assignments applied at a higher level are inherited by all children. Key constraints: a single Entra ID tenant supports up to $10{,}000$ management groups; the hierarchy can be up to 6 levels deep (excluding root and subscription level); each management group can have many children but only one parent. Why it matters: This hierarchy is the backbone of governance — you cannot design Azure Policy, RBAC, or cost management without understanding it. The book (Ch. 1, §1.3, pp. 29–30) provides the hierarchy diagram that the exam references repeatedly.

Azure Monitor — Analogy: Azure Monitor is the building's security-camera network plus its alarm system — it collects footage (logs and metrics) from every floor and triggers alarms (alerts) when something looks wrong. Formal definition: Azure Monitor is a comprehensive monitoring service that collects, analyses, and acts on telemetry from Azure and on-premises resources. It stores logs in Log Analytics workspaces (queried via Kusto Query Language / KQL) and metrics in a time-series database, and provides alerting, visualizations (dashboards, workbooks), and insights (Application Insights, VM Insights, Container Insights, Network Insights). Why it matters: Without Azure Monitor you are flying blind — you cannot detect breaches, diagnose performance issues, or prove SLA compliance. The book (Ch. 1, §1.1, pp. 8–15) details the tools within Azure Monitor and their use cases.

Azure Policy — Analogy: Azure Policy is the building code inspector — it walks through your construction site and flags (or prevents) anything that violates the approved blueprints. Formal definition: Azure Policy is a service that creates, assigns, and manages policies that enforce rules and effects over Azure resources. Policies can audit, deny, append, modify, or deploy resources that do not comply. Policies are grouped into initiatives for easier management. Built-in initiatives cover regulatory frameworks like CIS, NIST, HIPAA, and ISO 27001. Why it matters: Policy is the primary governance tool on the exam and the main way organizations enforce compliance at scale. The book (Ch. 1, §1.3, p. 31) shows how initiatives bundle dozens of policies for regulatory compliance.

Diagnostic Settings — Analogy: Diagnostic settings are the wiring that connects each room's sensors to the central security monitor. Formal definition: A per-resource configuration in Azure that routes platform logs and metrics to one or more destinations: a Log Analytics workspace, an Azure Storage account, an Azure Event Hub, or a partner solution. Why it matters: Resource logs are not collected by default — without diagnostic settings, your monitoring is incomplete. This is one of the most frequently tested concepts in the logging portion of the exam.

Zero Trust — Analogy: Instead of a castle with a moat (trust everything inside the perimeter), zero trust treats every request as if it comes from an untrusted network. Formal definition: A security model with three principles: verify explicitly (authenticate and authorize every request using all available signals), use least privilege access (limit permissions with just-in-time and just-enough-access), and assume breach (minimize blast radius and use encryption end-to-end). Why it matters: The exam book (Ch. 1, §1.2, p. 16) frames the entire identity pillar around zero trust, and many exam scenarios test whether candidates design solutions that assume breach rather than trusting network perimeters.

Deep Dive

Topic 1 — Logging & Monitoring (Skill 1.1)

The monitoring pillar answers the question "What is happening in my environment right now, and what happened in the past?" Azure generates telemetry at five layers, each feeding into Azure Monitor:

The key services you will study in the Topic 1 lesson are Azure Monitor (the umbrella), Log Analytics workspaces (the query engine using KQL), Application Insights (APM for code), Azure Network Watcher (network diagnostics), Microsoft Defender for Cloud (security posture), Microsoft Sentinel (SIEM/SOAR), and Cost Management (consumption tracking). The exam tests your ability to route logs to the right destination and choose the right monitoring tool for a given scenario.

Log destinations serve different purposes and cost profiles:

[!TIP] When the exam asks you to "recommend a logging solution," start by identifying the layer (tenant, subscription, resource, guest OS, application) and then pick the appropriate routing and tool. See the LO lessons under Topic 1 for the full decision tree.

For the deep-dive on each LO, see the Topic 1 lesson: "Design Solutions for Logging and Monitoring" and its child LO lessons on log routing, logging levels, and monitoring tools.

Topic 2 — Authentication & Authorization (Skills 1.2 & 1.4)

The identity pillar answers "Who or what is requesting access, and should they be allowed?" The AZ-305 exam splits this into two skills: Skill 1.2 (human identities — users, groups, roles, securing identities) and Skill 1.4 (application identities — service principals, managed identities, app registrations, user consent).

The mental model is a three-step pipeline:

Key concepts the Topic 2 lesson explores in depth:

The hybrid identity story is particularly important for enterprise scenarios. The book (Ch. 1, §1.2, pp. 22–23) covers three authentication methods for Microsoft Entra Connect Sync: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), and Federation (ADFS). Each has trade-offs around security, latency, and operational complexity that the exam tests explicitly.

[!WARNING] The exam frequently tests the boundary between Entra ID roles (tenant-level administration like Global Administrator, User Administrator) and Azure RBAC roles (resource-level authorization like Owner, Contributor, Reader). Confusing the two is one of the most common mistakes. See the Common Mistakes section below.

For the deep-dive, see the Topic 2 lesson: "Design Authentication and Authorization Solutions" and the Topic 4 lesson: "Design Identities and Access for Applications."

Topic 3 — Governance (Skill 1.3)

The governance pillar answers "What rules constrain how resources are created, configured, and consumed?" Governance ties identity and monitoring together: RBAC (from Topic 2) controls who can act, Azure Policy controls what they can do, and monitoring (from Topic 1) records everything for auditing.

The resource hierarchy is the backbone of governance:

Azure Policy effects determine how non-compliant resources are handled:

Key governance tools the Topic 3 lesson covers:

[!IMPORTANT] Policies applied at a management group are inherited by every subscription, resource group, and resource below it. This inheritance model is tested heavily on the exam. Understand the order of evaluation: deny assignments → policy deny effects → RBAC → policy audit effects.

For the deep-dive, see the Topic 3 lesson: "Design Governance" and its child LO lessons on organizational hierarchy and compliance enforcement.

Worked Examples

Easy — Identify the pillar

Problem: Contoso's CTO asks: "I need to make sure no one creates a VM larger than Standard_D4s_v5 in our development subscription." Which Unit 1 pillar and Azure service addresses this?

Step-by-step solution:

1. The requirement is a constraint on resource configuration → this is a governance problem.
2. The tool is Azure Policy — create a policy with an allowedValues parameter on the VM SKU field, and set the effect to Deny.
3. Assign the policy at the development subscription scope so it does not affect production.

[!NOTE] Key insight: Governance (Azure Policy) enforces the rule; monitoring (Activity Log) records when someone tries to violate it; identity (RBAC) controls who can exempt the policy.

Medium — Route logs correctly

Problem: Fabrikam runs a web application on Azure App Service. The security team needs to query application exceptions alongside Azure platform metrics in a single pane of glass, with 90-day retention. The compliance team also requires a 7-year archive of all logs. Design the logging architecture.

Step-by-step solution:

1. Enable Application Insights on the App Service for application-level telemetry (exceptions, traces, requests).
2. Configure diagnostic settings on the App Service to route platform logs and metrics to a Log Analytics workspace with 90-day interactive retention.
3. Application Insights data also flows to the same Log Analytics workspace — this gives the single pane of glass.
4. For 7-year archival, configure an export rule (or diagnostic settings secondary destination) to send logs to an Azure Storage account with an immutable retention policy set to 7 years in the Archive access tier.
5. Use KQL in Azure Monitor to query both platform and application data interactively within the 90-day window.

[!NOTE] Key insight: Log Analytics provides the interactive query layer; Azure Storage provides the cost-effective long-term archive. The two destinations serve different personas (SecOps vs compliance) and different cost profiles.

Hard — End-to-end landing zone design

Problem: Woodgrove Bank is migrating to Azure. They have three departments (Retail Banking, Corporate Banking, IT Operations) each needing isolated environments (prod and dev). All departments must comply with the CIS Microsoft Azure Foundations Benchmark. The IT Operations team should be the only group that can modify governance policies. Design the identity, governance, and monitoring architecture.

Step-by-step solution:

1. Hierarchy: Create a root management group → three child management groups (one per department) → two subscriptions per department (prod, dev) = 6 subscriptions.
2. Governance: Assign the CIS benchmark Policy initiative at the root management group so it inherits everywhere. Use resource locks (CanNotDelete) on production resource groups.
3. Identity: Create an Entra ID security group SG-Governance-Admins containing only IT Operations staff. Assign the Resource Policy Contributor role to this group at the root management group scope. Other departments get Contributor at their own management group scope — this lets them create resources but not modify policies.
4. Monitoring: Deploy a central Log Analytics workspace in a shared-services subscription. Configure diagnostic settings on every subscription to route Activity Logs to this workspace. Use Microsoft Sentinel on top for SIEM/SOAR. Set up Azure Monitor alert rules for policy non-compliance events.
5. Cost governance: Create budgets per subscription with alerts at 80% and 100% thresholds via Cost Management.

[!NOTE] Key insight: The three pillars form a closed loop — RBAC restricts policy changes to IT Ops, Policy enforces CIS, and Monitor/Sentinel provides the audit trail proving continuous compliance.

Visual Explanations

The Three-Pillar Closed Loop

Caption: The three pillars of Unit 1 form a reinforcing loop. Identity produces audit data consumed by monitoring; monitoring detects violations that governance rules should prevent; governance constrains the actions that identities can perform.

Azure Resource Hierarchy with Governance Touchpoints (TikZ)

Caption: The Azure resource hierarchy showing how governance artefacts (policies, RBAC assignments) are applied at different scopes and inherit downward. Dashed red arrows indicate where each artefact is assigned.

RBAC Assignment Components

Entra ID vs Azure RBAC Role Comparison

Common Mistakes

❌ Myth: "Azure RBAC roles and Entra ID roles are the same thing." ✅ Reality: They are two separate role systems. Azure RBAC roles (Owner, Contributor, Reader) control access to Azure resources via Azure Resource Manager. Entra ID roles (Global Administrator, User Administrator) control access to Entra ID tenant operations such as creating users, managing groups, and configuring conditional access policies. Why it's tricky: Some Azure Portal blades show both role types side by side, and the Global Administrator can elevate to gain Azure RBAC access, blurring the boundary.

❌ Myth: "Enabling Azure Monitor automatically collects all resource logs." ✅ Reality: Azure Monitor collects platform metrics automatically, but resource logs are not collected by default. You must configure diagnostic settings on each resource to route logs to a destination (Log Analytics, Storage, Event Hub). Why it's tricky: The Azure Portal shows a "Logs" blade on every resource, which makes it look like logging is already enabled — but the blade is empty until you configure diagnostic settings.

❌ Myth: "Azure Policy can only audit — it cannot prevent non-compliant resources from being created." ✅ Reality: Azure Policy supports multiple effects: Audit (log but allow), Deny (block creation), Modify (auto-remediate), DeployIfNotExists (auto-provision a companion resource), and more. The Deny effect actively prevents non-compliant deployments. Why it's tricky: Many tutorials only show the Audit effect, so learners assume that is the only capability. The exam expects you to pick the right effect for each scenario.

❌ Myth: "Assigning a policy at a subscription scope only affects new resources — existing resources are not evaluated." ✅ Reality: Policies evaluate both new and existing resources. Existing resources that do not comply are flagged as non-compliant (for Audit) or auto-remediated (for Modify / DeployIfNotExists). Only the Deny effect applies exclusively to new deployments and modifications. Why it's tricky: The word "enforce" suggests blocking, but Azure Policy's evaluation engine runs continuously and reports on everything already deployed.

Practice Exercises

🟢 Easy — Identify the service You need to ensure that all VMs in a subscription have the Azure Monitor Agent installed. Which Azure service and policy effect should you use?

▶💡 Hint

Think about which policy effect can automatically deploy a resource or extension that does not yet exist.

▶✅ Solution

Use Azure Policy with the DeployIfNotExists effect. Assign a policy that checks whether the AMA extension is installed and deploys it automatically if missing. Assign the policy at the subscription scope.

🟢 Easy — Scope inheritance Contoso assigns the Reader role to the group SG-Auditors at the management group MG-Production. The management group contains two subscriptions. Will members of SG-Auditors be able to read resources in both subscriptions?

▶💡 Hint

Recall how RBAC inheritance works in the Azure resource hierarchy.

▶✅ Solution

Yes. RBAC role assignments at a management group scope are inherited by all subscriptions, resource groups, and resources within that management group. Members of SG-Auditors will have Reader access across both subscriptions and every resource within them.

🟡 Medium — Log routing design Fabrikam needs to send Azure SQL Database audit logs to both a Log Analytics workspace (for interactive querying) and a Storage account (for 5-year compliance retention). How many diagnostic settings are required on each Azure SQL Database?

▶💡 Hint

Can a single diagnostic setting send to multiple destinations, or do you need separate settings?

▶✅ Solution

You can configure one diagnostic setting that sends to multiple destinations simultaneously. A single diagnostic setting on the Azure SQL Database can route SQLSecurityAuditEvents to both the Log Analytics workspace and the Storage account. Alternatively, you could create two separate diagnostic settings — one per destination — which some organizations prefer for clarity. Both approaches are valid.

🟡 Medium — Conditional Access vs Azure Policy A security architect says: "I want to block any user from accessing the Azure Portal unless they are on a corporate-managed device." Is this an Azure Policy scenario or a Conditional Access scenario?

▶💡 Hint

Azure Policy governs resource configurations. What service governs user sign-in conditions?

▶✅ Solution

This is a Conditional Access scenario. Conditional Access policies in Entra ID evaluate signals like device compliance, location, and user risk at sign-in time. Create a policy targeting all users, scoping to the "Microsoft Azure Management" cloud app, with a condition requiring a compliant device — and a grant control of "Block access" if the condition is not met. Azure Policy cannot control user sign-in behaviour.

🔴 Hard — Multi-department governance design Tailwind Traders has four departments, each with prod and dev environments. The CISO requires that all resources in all environments comply with the NIST SP 800-53 framework. The CTO requires that dev environments have a maximum monthly spend of $$5{,}000$. Design the management group structure, policy assignments, and budget configuration.

▶💡 Hint

Think about where to assign the NIST initiative for maximum coverage with minimum repetition, and where to assign budget constraints so they only affect dev subscriptions.

▶✅ Solution

1. Hierarchy: Root MG → 4 department MGs → 2 subscriptions each (prod, dev) = 8 subscriptions.
2. NIST compliance: Assign the NIST SP 800-53 Policy initiative at the Root MG. This ensures all 8 subscriptions inherit the compliance framework without duplicating assignments.
3. Dev budget cap: In Cost Management + Billing, create a budget of $$5{,}000$/month on each of the 4 dev subscriptions. Configure action groups to email the department lead at 80% and auto-disable non-essential resources at 100%.
4. RBAC: Give each department Contributor on their own MG. Give the central cloud team Owner at the Root MG and Resource Policy Contributor so only they can modify policy assignments.

🔴 Hard — Monitoring architecture trade-offs Woodgrove Bank runs 200 VMs across 3 regions. The security team wants sub-minute alerting on failed SSH logins. The compliance team wants 10-year log retention at minimum cost. The operations team wants a single dashboard showing VM health across all regions. Design the monitoring architecture, justifying each component.

▶💡 Hint

Consider which log types carry SSH data, what destination supports fast alerting, and what destination is cheapest for long-term retention.

▶✅ Solution

1. Agent: Deploy Azure Monitor Agent (AMA) on all 200 VMs with a data-collection rule that forwards Linux auth.log / Windows Security Event Log to a central Log Analytics workspace.
2. Near-real-time alerting: Create a log-search alert rule in Azure Monitor that queries for failed SSH events every 1 minute. Attach an action group that pages the security on-call team via SMS and email.
3. 10-year retention: Configure a second diagnostic-settings destination to send raw logs to an Azure Storage account in the Archive access tier with an immutable retention policy set to 10 years. Storage costs are a fraction of Log Analytics per-GB pricing.
4. Single dashboard: Use Azure Monitor Workbooks or Azure Managed Grafana to build a cross-region VM health dashboard. VM Insights provides the dependency map and performance data. Pin the workbook to a shared Azure Dashboard.

Summary & Concept Map

• Unit 1 covers three pillars: monitoring, identity, and governance — each pillar depends on and feeds the other two in a closed loop.
• Azure Monitor (with Log Analytics, Application Insights, Network Watcher, Defender for Cloud, and Sentinel) provides the telemetry and alerting layer.
• Microsoft Entra ID (with RBAC, Conditional Access, PIM, managed identities, and Identity Protection) provides the identity and access control layer.
• Azure Policy (with management groups, initiatives, resource locks, and Blueprints) provides the governance and compliance layer.
• Resource logs are not collected by default — diagnostic settings must be configured per resource.
• RBAC and policy assignments inherit down the resource hierarchy (management group → subscription → resource group → resource).
• The exam tests your ability to route the right logs to the right destination, choose the right identity service for human vs application identities, and select the correct policy effect for each governance scenario.

Connections & Next Steps

This unit lays the foundation for every subsequent unit in the AZ-305 curriculum:

1. Recommended reading order for Unit 1: Start with the Topic 1 lesson (Logging & Monitoring) → then Topic 2 (Authentication & Authorization) → then Topic 3 (Governance). Within each topic, read the LO lessons in the order listed in the concept map above. Topic 1 comes first because monitoring concepts (diagnostic settings, Log Analytics) are referenced in the other two topics.
2. Connection to Unit 2 (Data Storage): You will need RBAC to control who can access storage accounts, Azure Policy to enforce encryption standards (TDE, TLS, customer-managed keys), and diagnostic settings to audit data-plane operations like blob reads and SQL queries.
3. Connection to Unit 3 (Business Continuity): Monitoring is essential for detecting failover events and proving RPO/RTO compliance. Governance policies can enforce backup configurations and replication settings across regions.
4. Connection to Unit 4 (Infrastructure): Compute, networking, and migration designs all rely on identity for access control, governance for compliance (e.g., allowed VM SKUs, allowed regions), and monitoring for operational visibility into VM health, container performance, and network flows.

After completing all Topic and LO lessons under Unit 1, proceed to the Unit 2 lesson: Design Data Storage Solutions.

Real-World Applications

Case Study 1 — Financial Services Landing Zone (Contoso Bank)

Contoso Bank migrated 500 workloads to Azure over 18 months. Before migration, they designed a landing zone following the Cloud Adoption Framework's enterprise-scale architecture with: a four-level management group hierarchy aligned to business units (Retail, Corporate, Treasury, IT); the CIS Azure Foundations Benchmark assigned as a Policy initiative at the root management group; Privileged Identity Management (PIM) for all Global Administrator and Owner role assignments with 8-hour activation windows requiring approval; a central Log Analytics workspace with 90-day interactive retention and a geo-redundant Storage archive for 7-year regulatory retention; and Microsoft Sentinel with playbooks for automated incident response. The result: 100% policy compliance on day one of production workload deployment, a 60% reduction in identity-related incidents thanks to PIM's just-in-time access eliminating standing admin privileges, and audit readiness achieved in weeks rather than the months typical of manual compliance efforts. This scenario exercises Skills 1.1, 1.2, and 1.3 together — exactly the integration pattern the exam tests.

Case Study 2 — SaaS Provider Multi-Tenant Monitoring (Fabrikam SaaS)

Fabrikam builds a multi-tenant SaaS application serving $2{,}000$ customers on Azure. Each customer's data is isolated in a separate resource group within shared subscriptions. Fabrikam uses: Application Insights with per-tenant instrumentation keys for isolated telemetry; a shared Log Analytics workspace with resource-centric access control so each internal engineering team sees only the resources in their scope; Azure Policy to enforce tagging (costCenter, environment, owner, tenantId) on every resource — using the Deny effect to block resource creation without mandatory tags; and Conditional Access policies requiring phishing-resistant MFA (FIDO2 keys) for all engineers accessing production subscriptions. Cost Management budgets alert product managers when a tenant's consumption exceeds plan limits, enabling proactive upselling. This scenario shows how monitoring, identity, and governance work together in a product engineering context — a common AZ-305 exam pattern that tests cross-pillar integration.

Case Study 3 — Healthcare Compliance Migration (Woodgrove Health)

Woodgrove Health migrated electronic health records (EHR) to Azure under HIPAA compliance requirements. The architecture required: encryption at rest and in transit enforced via Azure Policy — Deny effect on storage accounts without HTTPS, DeployIfNotExists for Azure Disk Encryption on all VMs; all human access restricted through RBAC with Conditional Access requiring Intune-compliant devices and MFA for every sign-in; application access to Azure SQL databases via managed identities rather than connection strings with embedded credentials; and comprehensive audit logging with diagnostic settings on every resource routing to a tamper-proof Azure Storage archive using immutable blob policies with legal hold. Microsoft Defender for Cloud provided continuous security posture assessment with the HIPAA/HITRUST built-in initiative, and the compliance dashboard gave auditors real-time adherence visibility. A quarterly access review via Entra ID Access Reviews ensured that only current staff retained access to PHI-containing resources. This scenario demonstrates how governance enforces technical controls, identity restricts human and application access, and monitoring validates everything — the exam's favourite integration pattern for regulated industries.