Cost Management & Governance

Azure Cost Management is a built-in service that gives organizations visibility into actual spending across subscriptions, resource groups, and individual resources. Teams can set budgets with threshold-based alerts so stakeholders are notified before costs exceed a defined limit, and cost-analysis views break spending down by tag, location, or service. A key AZ-900 distinction is that Cost Management works on real, incurred charges, whereas the Pricing Calculator produces hypothetical estimates before any resources are deployed. It also integrates with Azure Advisor, surfacing actions such as rightsizing underutilized virtual machines, supporting the Cost Optimization pillar of the Azure Well-Architected Framework.

Total Cost of Ownership (TCO) accounts for every expense tied to a workload over its lifetime, not just hardware prices, but also power, physical space, cooling, network hardware, and the IT labor needed to maintain on-premises infrastructure. Microsoft’s free Azure TCO Calculator quantifies these hidden on-premises costs and compares them against equivalent Azure workloads. A common exam confusion is mixing up the TCO Calculator with the Pricing Calculator: the Pricing Calculator estimates what Azure services will cost, while the TCO Calculator is used before migration to justify the business case by showing how much on-premises spending Azure can eliminate.

The Azure Pricing Calculator is a free, web-based tool that lets you select any combination of Azure services, configure their settings (region, tier, usage hours, storage size), and see an estimated monthly cost before deploying any resources. You can save and share estimates, making it useful for budgeting and stakeholder sign-off. The key exam distinction is scope: the Pricing Calculator forecasts hypothetical future spend, while Azure Cost Management reports actual, historical spending on resources already deployed. Separately, the TCO Calculator compares on-premises costs against Azure to build a migration business case.

Azure Advisor is a free, personalized cloud consultant in the Azure portal that analyzes deployed resources and configurations against Azure best practices. It organizes recommendations into five categories: Cost, Security, Reliability, Performance, and Operational Excellence. Each recommendation carries an impact level and a direct link to the affected resource, so you can act without leaving the portal. A common exam trap mixes Advisor up with Azure Monitor: Monitor collects telemetry and fires alerts on live metrics, while Advisor interprets configuration and usage to suggest proactive improvements. Advisor’s Security recommendations come from Microsoft Defender for Cloud, making the two complementary.

Resource tags are name-value pairs — such as Environment: Production or CostCenter: Finance — attached to Azure resources, resource groups, or subscriptions for logical organization and granular cost tracking. Unlike resource groups, which impose a structural hierarchy, tags are flexible metadata overlaid on top, and a single resource can carry up to 50 tags. The key exam distinction is that tags are not inherited by default: a tag on a resource group does not automatically propagate to resources inside it. Azure Policy can require specific tags before deployment, while Cost Management + Billing uses tags to break down spending by project, team, or environment.

Azure Policy is a governance service that evaluates Azure resources against business rules defined as JSON policy definitions. Policies can audit existing resources, deny non-compliant deployments before they happen, or automatically remediate drift — for example, tagging resources or enforcing that storage accounts use only HTTPS. Multiple related policies are grouped into an initiative (formerly called a policy set) and assigned at the management-group, subscription, or resource-group scope. A key exam distinction: Azure Policy controls what can be deployed and enforces configuration standards, while Azure Role-Based Access Control (RBAC) controls who can take action. They work together but are not interchangeable — an action permitted by RBAC can still be blocked by Policy if it violates a compliance rule.

Resource locks are an Azure governance feature applied at the subscription, resource group, or individual resource scope to prevent unintended changes or deletions. The two lock types are CanNotDelete, which allows reads and modifications but blocks deletion, and ReadOnly, which restricts a resource to read operations only — preventing both modifications and deletions regardless of a user’s Azure role-based access control (RBAC) permissions. The key exam nuance is that locks supersede RBAC: even an Owner cannot delete a CanNotDelete-locked resource without first removing the lock. Unlike Azure Policy, which governs how resources are created or modified, locks act as a hard stop on actions against existing resources.

Azure Blueprints lets organizations define a repeatable package of Azure resources — ARM templates, Azure Policy assignments, role assignments (RBAC), and resource groups — and deploy them together as a single versioned artifact. This makes standing up a new subscription that already meets corporate governance standards straightforward. The key exam distinction: Azure Policy enforces rules on new or existing resources, while Blueprints orchestrates the initial deployment of a governed environment that can include those policies. Blueprints also retain the connection between the definition and the subscriptions deployed from it, helping track configuration drift — something ARM templates alone do not provide.

A Service-Level Agreement (SLA) is a formal commitment in which Microsoft guarantees a minimum uptime and connectivity percentage for an Azure service, plus the service credits customers receive if that threshold is missed. Different services carry different SLA percentages, and free-tier resources typically carry no SLA at all. The key exam nuance is composite SLA calculation: when an application depends on two or more services, you multiply their individual percentages together, which always yields a number lower than either alone. Adding redundancy through availability zones or paired regions can raise the effective uptime guarantee above a single instance.

Azure Arc extends the Azure control plane to resources outside Azure—including on-premises servers, Kubernetes clusters, and virtual machines in other clouds such as AWS or Google Cloud. By projecting them into Azure Resource Manager, Arc makes them manageable through the Azure portal, Azure Policy, and Microsoft Defender for Cloud, without migrating the workloads. The key exam distinction is management reach, not hosting: Arc governs non-Azure resources but does not run workloads in Azure. Contrast it with Azure Migrate, which actually moves workloads into Azure. Hybrid or multicloud governance scenarios—especially enforcing consistent policy across environments—point to Azure Arc.