Module 5 — Identity, security, governance, and cost
Place in the route
This module completes the AZ-900 foundation. It gives the learner a risk model for who can act, what they can change, how the platform constrains configuration, and how usage becomes cost.
Identity and access
Authentication proves a principal’s identity. Single sign-on (SSO) reuses that sign-in across trusted applications. Multifactor authentication (MFA) adds another proof; passwordless authentication replaces a memorized secret with a stronger device or biometric method. Conditional Access evaluates signals such as user, device, location, or risk and then applies a requirement such as MFA or block. External identities represent people outside the organization who are invited or federated into a controlled collaboration boundary.
Microsoft Entra ID is the identity directory. Azure role-based access control (RBAC) authorizes Azure resource actions at a scope. A successful login does not imply permission to change a resource: the token identifies the principal, then RBAC and governance controls are evaluated. Zero Trust makes this explicit: verify explicitly, use least privilege, and assume breach. Defense in depth adds independent layers such as identity, network, host, application, and data controls so one failed layer does not expose the workload.
Governance and protection
Azure Policy evaluates resource configuration against a rule and can audit or deny noncompliant deployment. A resource lock protects management operations such as deletion. Tags attach classification such as owner, environment, or cost center; they support reporting but do not enforce configuration. Microsoft Defender for Cloud combines security posture recommendations and workload protection signals; it does not replace RBAC or Policy. Microsoft Purview catalogs and governs data, which is a different concern from resource deployment policy.
Cost reasoning
Cost depends on the service, region, performance tier, amount of storage or execution, network transfer, retention, and commitment or licensing choice. The pricing calculator estimates a design before deployment. Cost Management analyzes actual and forecast spend and budgets alert on thresholds. A budget is an observation and notification control; it is not a universal automatic shutdown.
Worked scenario and checkpoint
For a contractor accessing a production API, explain the authentication proof, conditional-access decision, RBAC scope, Policy rule, and tag used for ownership. For an unexpectedly expensive workload, separate a pricing estimate, actual meter, budget alert, and Advisor recommendation. Identify which control prevents a deployment, which prevents deletion, and which merely reports classification.
Hands-on / what to try
Read a fictional access request and resource definition. Mark authentication, authorization, Policy, lock, tag, Defender, pricing, and budget responsibilities on the request path. Then alter one condition at a time and predict whether the request is blocked, audited, or allowed. No Azure resource is required.
Sources and re-audit
- AZ-900 course, checked 2026-08-31.
- AZ-900 study guide, skills measured 2026-07-20, checked 2026-08-31.
- Azure RBAC overview, checked 2026-08-31.
- Azure Policy overview, checked 2026-08-31.
- Cost Management overview, checked 2026-08-31.
Re-audit when identity, governance effects, security posture, pricing tools, or cost-management behavior changes.