Manage Identities & Governance — MOC
MS Learn path: Manage identities and governance in Azure Covers the Identity & Governance skill area of the AZ-104 exam.
Map / Canvas
The core idea
Administrators must control who can access what, and enforce how the environment is governed (cost, compliance, standards). Two halves:
- Identity = the people/apps (Microsoft Entra ID) + how they prove identity (authN) and what they’re allowed to do (authZ via RBAC).
- Governance = subscriptions, management groups, policies, tagging, and cost control.
Concepts (linked from here)
Identity
- Microsoft Entra ID (Azure AD) — the identity service for users/apps
- User accounts vs service principals & managed identities
- Entra license management
- Multifactor authentication
- Self-service password reset (SSPR)
- Role-Based Access Control (RBAC)
- Microsoft Entra roles
- Conditional Access
Governance
- Azure subscription
- Management groups
- Resource groups
- Azure Policy
- Azure Landing Zone IaC Accelerator
- Azure Blueprints (retiring)
- Tags
- Cost Management & budgets
Modules in this path
- Understand Microsoft Entra ID
- Create, configure & manage Identities
- Secure Azure resources with RBAC
- Manage authentication, MFA & SSPR
- Manage subscriptions & governance
Skills measured (current exam blueprint)
- Manage Entra users and groups: properties, licenses, external users, and SSPR.
- Manage Azure access: built-in roles, assignments at scope, and interpretation of effective access.
- Manage governance: Policy, locks, tags, resource groups, subscriptions, budgets/Advisor, and management groups.
Route check: Before moving on, explain why Entra ID authenticates, RBAC authorizes, and Policy governs configuration. Then complete the foundation/governance lab.
Cross-module lab
- Identity and governance controls
- Entra user and group lifecycle
- Governance change safety
- Safe SSPR rollout
Practice questions
- Q: RBAC scope precedence
- Q: Policy vs RBAC
- Q: Requiring MFA from untrusted locations
- Q: Policy & RBAC on many subscriptions
- Q: Self-service password reset
- Q: Entra license versus RBAC
- Q: partner guest access
- Q: deletion protection with locks
Conceptual checkpoint
Explain the sequence in this path using one workload scenario: identify the boundary being changed, the identity or tool acting on it, the expected evidence, and the failure that would change your decision.
Sources and re-audit
- AZ-104 course overview, checked 2026-08-31.
- AZ-104 study guide, checked 2026-08-31.
Re-audit when the AZ-104 course path, study-guide effective date, or the services and permissions taught here change.