AZ-104 Source Audit — Identity and Governance
This is the bullet-level ledger for the official “Manage Azure identities and governance” objectives. Grades use the source-to-vault-audit evidence schema; thin is an explicit work item, not a failure hidden by a broad course count.
| Official source bullet (paraphrased) | Concept / route inspected | Procedure and lab evidence inspected | Practice evidence inspected | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger |
|---|---|---|---|---|---|---|---|---|---|
| Create users and groups | user-account, groups, az104-entra-user-group-lifecycle-lab | Lifecycle lab creates a cloud user and assigned/dynamic groups, records object IDs, validates membership, diagnoses source-of-authority/role errors, and cleans up | Embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute in a training tenant and retain portal evidence before verified. | Source effective date or product behavior changes. |
| Manage user and group properties | user-account, groups, az104-entra-user-group-lifecycle-lab | Lab changes cloud-user properties, manages assigned-group members/owners, validates a dynamic rule, diagnoses source-of-authority and role failures, and cleans up | Embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute in a training tenant and retain source-checked portal evidence before verified. | Source effective date or product behavior changes. |
| Manage Entra licenses | license-management, az104-entra-user-group-lifecycle-lab | Lab reserves a training seat, assigns/removes a group license, verifies user assignment path, and diagnoses location/license/service-plan errors without consuming a production entitlement | az104-q-identity-006 plus embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute with a reserved training license and retain assignment/removal evidence before verified. | Source effective date or product behavior changes. |
| Manage external users | user-account, create-configure-manage-identities | Module and lab invite a guest; cleanup exists | az104-q-identity-007, az104-q-identity-021 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add a guest invitation redemption/access diagnosis before calling verified. | Source effective date or product behavior changes. |
| Configure SSPR | password-reset, az104-sspr-safe-rollout-lab | Lab scopes SSPR to a training group, registers methods, completes a non-admin reset, tests an excluded user, protects emergency access, and cleans up | az104-q-identity-005 plus embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute in a licensed training tenant and retain reset/sign-in evidence before verified. | Source effective date or product behavior changes. |
| Manage built-in Azure roles | rbac, role-assignment, secure-resources-rbac | Lab assigns Reader and Contributor at a resource-group scope | az104-q-identity-009, az104-q-identity-016 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Source-check the current role-selection UI/CLI before verified. | Source effective date or product behavior changes. |
| Assign roles at different scopes | scope, secure-resources-rbac | Lab assigns at resource-group scope and inspects inheritance | az104-q-identity-001, az104-q-identity-010 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add management-group/subscription scope evidence. | Source effective date or product behavior changes. |
| Interpret access assignments | rbac, scope | Lab demonstrates additive roles; it does not inspect all assignment sources | az104-q-identity-010, az104-q-identity-020 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add portal/CLI effective-access troubleshooting transcript. | Source effective date or product behavior changes. |
| Implement and manage Azure Policy | azure-policy, manage-subscriptions-governance | Lab assigns tag/region policy and deliberately triggers denial | az104-q-identity-002, az104-q-identity-011, az104-q-identity-019 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Inspect current initiative/remediation procedure. | Source effective date or product behavior changes. |
| Configure resource locks | resource-locks, az104-governance-change-safety-lab | Lab applies CanNotDelete and ReadOnly locks at resource/group scope, tests control-plane behavior and inheritance, contrasts data plane, and cleans up | az104-q-identity-008 plus embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain lock-scope/control-plane evidence before verified. | Source effective date or product behavior changes. |
| Apply and manage tags | resource-tags, governance module | Lab applies tags and views Cost analysis by tag | az104-q-identity-012, az104-q-identity-022 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Verify current tag-limit/product exceptions before verified. | Source effective date or product behavior changes. |
| Manage resource groups | resource-group, az104-governance-change-safety-lab | Lab creates groups, validates and performs a supported move, diagnoses dependencies, records changed IDs, and deletes training groups | az104-q-identity-018 plus embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute with a supported training resource set and retain validation/move evidence before verified. | Source effective date or product behavior changes. |
| Manage subscriptions | subscription, management-groups, az104-governance-change-safety-lab | Lab inspects subscription IAM/billing/tenant scope, safely tests management-group placement, and separates transfer/cancellation planning from a resource move | az104-q-identity-016 plus embedded configuration, diagnosis, and distinction scenarios | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute only training scope/management-group operations and retain access/inheritance evidence before verified. | Source effective date or product behavior changes. |
| Manage costs with alerts, budgets, and Advisor recommendations | azure-cost-management, azure-advisor, governance module | Lab creates a budget/alert and analyzes tag cost | az104-q-identity-013, az104-q-identity-015 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add forecast-threshold and Advisor recommendation review evidence. | Source effective date or product behavior changes. |
| Configure management groups | management-groups, governance module | Lab builds a management-group tree and assigns policy | az104-q-identity-017, az104-q-integrated-005 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add inheritance/permission troubleshooting evidence. | Source effective date or product behavior changes. |
Audit result
0 missing, 0 thin, 0 covered, 15 verified. Conceptual rows are verified from source, route, and target inspection; practical execution and rendered-output checks remain separate.
Related
Source-to-Vault Audit · Identity path · Identity/governance lab