Domain 3: Management and Governance

Domain 3 of 3, at 30 to 35 percent. Many candidates under study this one because the tools are Azure specific with no general IT equivalent. Give it as much time as Domain 2.

Managing cost

What affects your cost

• Resource type, size, and settings (a bigger VM costs more).
• Region (prices differ between regions, and moving data between regions can add cost).
• Ingress and egress: data coming in is usually free, data going out is often charged.
• Billing model: pay as you go, reservations, or the Azure Hybrid Benefit (reuse existing licenses).

Tools to estimate and control cost

• Pricing Calculator: estimate the cost of services before you deploy them.
• Total Cost of Ownership (TCO) Calculator: compare the cost of running on-premises versus in Azure.
• Microsoft Cost Management: analyze actual spending, set budgets, and get alerts when you approach a limit.
• Tags: attach name and value labels to resources (for example, department or project) to organize and report cost.

Reservations and spot pricing lower cost: a reservation commits to one or three years for a discount, and spot uses spare capacity cheaply for workloads that can be interrupted.

Governance and compliance

• Azure Policy: enforce rules on resources, such as "only allow these regions" or "require a tag," and report on compliance across your estate.
• Resource locks: prevent accidental change or deletion. A CanNotDelete lock allows edits but blocks deletion, a ReadOnly lock blocks both. Locks apply even to owners.
• Microsoft Purview: govern and understand your data across the organization, including classification and lineage.
• Service Trust Portal: Microsoft's hub for compliance reports, audit documents, and trust information.
• Azure Blueprints helps set up governed environments (note it is being replaced by template specs and deployment stacks, but you may still see it).

Policy and locks work together: policy enforces what resources may look like, locks protect what already exists.

Managing and deploying resources

• Azure portal: the web based graphical console for managing everything.
• Azure Cloud Shell: a browser based shell with tools preinstalled, running either Azure CLI (cross platform commands) or Azure PowerShell (cmdlets).
• Azure CLI and PowerShell: command line ways to automate management from your own machine.
• Azure Arc: extend Azure management and governance to servers, Kubernetes, and services running on-premises, at the edge, or in other clouds.
• ARM templates and Bicep: infrastructure as code, declaring what you want in a file so deployments are repeatable and consistent.

Portal for learning and one off tasks, command line and code for repeatable automation at scale.

Monitoring

• Azure Advisor: personalized recommendations across cost, security, reliability, performance, and operational excellence.
• Azure Service Health: the status of Azure services that affect you, including outages and planned maintenance for your specific resources.
• Azure Monitor: the platform that collects metrics and logs from your resources. It includes:
• Log Analytics: query and analyze collected log data.
• Azure Monitor Alerts: notify or act when a condition is met.
• Application Insights: monitor the performance and behavior of your applications.

Quick contrast: Advisor recommends improvements, Service Health tells you if Azure itself has a problem, Azure Monitor collects and analyzes your telemetry.

Why infrastructure as code helps

Declaring your resources in an ARM template or a Bicep file makes deployments repeatable, so you get the same result every time, consistent across environments like test and production, and reviewable and version controlled like any other code. You describe the desired state, and Azure Resource Manager makes it real.

Domain 3 quick recap

• Cost depends on type, size, region, and egress. Estimate with the Pricing and TCO calculators, control with Cost Management, budgets, and tags.
• Azure Policy enforces rules and reports compliance, resource locks prevent change or deletion.
• Manage through the portal, Cloud Shell, CLI, PowerShell, Arc, and infrastructure as code.
• Advisor recommends, Service Health reports Azure status, Azure Monitor (Log Analytics, Alerts, Application Insights) collects and analyzes.