AZ-104 AZ-305 Governance

Blast Radius 💥

Here is the hierarchy. Here is the governance objective. Pick the right instrument and put it at the right node — then watch the blast radius ripple through inheritance and find out how much of Contoso you just froze.

The one line that answers half of these: a lock stops the operation even for Owner. RBAC stops the person. Policy stops the shape. If the objective says “nobody, including admins”, you are reaching for a lock. If it says “this team”, RBAC. If it says “resources like this”, policy.

How a round works
  • Read the objective. Pick one instrument and one node.
  • Right instrument at the right node = full marks + a combo step.
  • Right instrument at a node that works but over-reaches = partial marks and a lecture about blast radius.
  • Wrong instrument = a strike. Run out of strikes and the run ends — you get 5 at Foundation, 2 at Architect.
  • The tier sets the pressure: how many instruments are on the bench, how many nodes are in play, the clock, the strikes and the score multiplier. Best scores are kept per tier.
  • Some rounds add a 5-second snap check for bonus points — managed identity, evaluation timing, remediation.
  • The clock shortens every 5 rounds. It bottoms out at genuinely uncomfortable.
Reading the tree
Nested boxes = real inheritance. An instrument placed on a box applies to that box and everything drawn inside it. The animation shows you exactly how far it reached — including the subscriptions you did not mean to hit.

Keyboard: 1–90 pick the instrument · A–T pick the node by its letter badge · Y/N answer a snap check. Touch: tap the box.

Expert

—

AZ-104 track personal best: —
▸ What this drills (and where to go read it)

Concepts in the bank

  • Policy effects — Deny, Audit, AuditIfNotExists, Append, Modify, DeployIfNotExists, DenyAction, Disabled — and exactly which two families need a managed identity on the assignment.
  • Initiative vs single assignment — when a policy set earns its keep, and shared parameters.
  • Exemptions vs exclusions (notScopes) — the two ways to carve out the sandbox, and why one has an expiry date and a category.
  • Remediation tasks — new resources vs the thousand that already exist, and why compliance state alone changes nothing.
  • Evaluation timing — deployment-time enforcement vs the periodic compliance scan.
  • Policy vs RBAC vs locks — the shape, the person, the operation.
  • Lock inheritance and lock traps — ReadOnly breaking legitimate operations, CanNotDelete blocking a scale-set change, locks beating Owner, and why the lock survives your RBAC removal.
  • Tags — inheritance from RG/subscription via Modify, tag policies, and what tags do NOT do automatically.
  • Management group design — depth limits, root-group assignments, subscription placement.
  • Resource move rules — what moves, what does not, and what locks do to a move.

Whiteboards that cover it

Sister game

  • RBAC Roulette — same hierarchy, but roles and scopes instead of policy and locks.