AZ-104 Part 1 — Identity & Governance

The mental picture

Tenant (your company)
└── Management Group    (folder of subscriptions)
    └── Subscription    (billing container)
        └── Resource Group  (folder of resources)
            └── Resource     (VM, storage, DB…)

Rule of thumb: apply RBAC and Policies at the highest level that makes sense — they flow down.

Azure AD in plain English

• User — a login (real person or a bot).
• Group — a bag of users to keep permissions clean.
• Service Principal — an identity for an app (like a CI/CD pipeline).
• Managed Identity — a service-principal that Azure creates & rotates for you.

# Create a user
az ad user create --display-name "Priya Sharma" \
  --user-principal-name "priya@contoso.com" --password "Secret@123"

# Create a group and add the user
az ad group create --display-name "AZ-Admins"
az ad group member add --group "AZ-Admins" --member-id <object-id>

RBAC — Role-Based Access Control

Every access decision is who × what × where:

• Who — a user, group, service principal or managed identity.
• What — a built-in role (Reader / Contributor / Owner) or a custom role.
• Where — the scope (Management Group → Subscription → RG → Resource).

az role assignment create \
  --role "Reader" \
  --assignee priya@contoso.com \
  --scope "/subscriptions/<sub-id>"

Deny assignments beat allow — even Owner can be blocked by a deny.

Azure Policy — the auto-inspector

• Policy definition — a single rule (e.g. "resources must live in East US").
• Initiative — a bundle of definitions (e.g. "HIPAA baseline").
• Effect — Audit / Deny / DeployIfNotExists / Append.

az policy assignment create --name "OnlyEastUS" \
  --policy "Allowed Locations" \
  --params '{"allowedLocations": "eastus"}' \
  --scope "/subscriptions/<sub-id>"

Real-world example

The finance team files an audit finding: any VM created outside India violates data-residency. You create one policy at the Management Group level with effect Deny and scope India-only regions. Now every future subscription in the org inherits it automatically — zero clicks per team.

Exam gotchas

• RBAC ≠ Azure AD roles. Azure AD roles manage AD itself; RBAC manages Azure resources.
• Deny assignments override allow.
• Azure Advisor gives you optimization tips; Service Health tells you when Azure itself is broken.
• Custom roles are JSON with actions, notActions, and assignableScopes.