Azure Basics · Module 02

Governance – Regions, Subscriptions, Policy and RBAC

Choose regions and subscriptions, track costs with tags, enforce configuration rules with Azure Policy and grant least privilege with Azure RBAC.

Practice interactively →

What you will learn

• Choose regions and understand region pairs and subscription types
• Use Cost Management, tags and cost-saving options
• Assign Azure Policy and initiatives and check compliance
• Assign Azure RBAC roles by principal, role and scope
• Tell Azure RBAC roles from Entra roles

Lessons

1. Regions and Subscriptions

   A region is a set of datacenters to place resources near users and within data rules; a subscription is the billing and access-management boundary for resources.

2. Cost Management, Tags and Saving Money

   Cost Management analyses spend and sets budgets; name=value tags group costs by environment or owner; Reservations and Hybrid Benefit cut prices.

3. Management Groups and Azure Policy

   Azure Policy controls how resources are configured (region, SKU, tags); it is assigned at a management group, subscription or resource group and inherited downwards.

4. Azure RBAC — Role Definitions and Role Assignments

   A role assignment is security principal + role definition + scope; rights granted at a higher scope are inherited downwards, and you should grant the least privilege possible.

5. Azure RBAC Roles and Entra Roles

   Azure RBAC roles control access to Azure resources at several scopes; Entra roles control objects in the tenant. A Global Administrator has no subscription rights by default.