Resource Groups
-
Logical containers that hold Azure resources (VMs, storage, VNets, etc.).
-
Resources in a group share the same lifecycle (create, update, delete).
-
A resource can only exist in one Resource Group at a time.
-
Deleting a Resource Group deletes all resources inside it.
Use Case: Organize all resources for a web app (VMs, storage, NICs) inside one group.
Tags
-
Key-value pairs used to organize resources.
-
Commonly used for:
-
Cost tracking:
Department=HR,Project=App1. -
Environment classification:
Environment=Prod,Environment=Dev. -
Automation: Scripts can filter by tags.
-
Limitations:
-
Tags apply to Resource Groups and Resources, but not inherited automatically.
-
Max 50 tags per resource (soft limit).
Exam trap: Tags don’t stop deletion or enforce security — they’re for organization and cost management.
Resource Locks
-
Prevent accidental deletion or modification.
-
Types of Locks:
-
Delete Lock → prevents deletion.
-
ReadOnly Lock → prevents modifications (like putting RBAC in read-only mode).
-
Key Point:
-
Locks override RBAC permissions.
-
Even an Owner cannot delete a locked resource until the lock is removed.
Confusion Buster 🚨
-
Tags vs Policies:
-
Tag = label for organization.
-
Policy = enforce rules (e.g., “all resources must have a tag”).
-
-
Locks vs RBAC:
-
RBAC = who can do what.
-
Lock = blocks the action regardless of role.
-
Exam trap: If scenario says “prevent accidental deletion” → Lock. Not RBAC, not Tags.
Simple Example
A company organizes resources like this:
-
Resource Group: “EcomAppRG” contains VMs, Load Balancer, SQL DB.
-
Tags: Each resource tagged with
Department=Sales. -
Lock: Delete lock applied to SQL DB to prevent accidental deletion.
Exam Tip
-
“Group resources logically” → Resource Group.
-
“Track costs by department” → Tags.
-
“Prevent accidental deletion” → Lock (Delete).
-
“Prevent changes but allow read” → Lock (ReadOnly).
What to Expect in the Exam
-
Direct Q: “Which feature prevents deletion of a resource?” → Resource Lock (Delete).
-
Scenario: “Company wants to track Azure costs per department.” → Tags.
-
Scenario: “Ensure related resources share the same lifecycle.” → Resource Group.
-
Trick Q: “Tags inherit automatically from Resource Group to resources.” (False — must apply manually or enforce via Policy).