Retention Policies

Retention policies help manage the lifecycle of data.

• Ensure data is kept for compliance (e.g., 7 years).

• Automatically delete or archive data when it’s no longer needed.

• Can be applied in Microsoft 365 (emails, docs) and Azure services like Storage or Backup.

Example:

• Keep daily VM backups for 30 days.

• Retain HR files for 7 years due to regulatory compliance.

Resource Governance Tools

1. Tags

• Key-value pairs assigned to resources.

• Used for organization, cost management, and automation.

• Example: Environment=Prod, Department=Finance.

Exam trap: Tags don’t enforce security — they’re for classification & billing.

2. Resource Locks

• Protect resources from accidental deletion or modification.

• Two types:

  • ReadOnly → cannot modify, only read.

  • Delete → prevents deletion.

Exam trap: Locks override RBAC. Even an Owner role cannot delete a resource with a lock unless they remove the lock first.

3. Management Groups

• Container to manage multiple subscriptions at once.

• Apply RBAC roles and Azure Policies consistently across all subscriptions.

• Hierarchy: Management Group → Subscription → Resource Group → Resource.

Exam trap: If scenario says “apply policy across all company subscriptions”, the answer is Management Groups, not just a resource group.

Confusion Buster 🚨

• Tags vs Policies

  • Tag = label, informational.

  • Policy = enforcement (e.g., require a tag).

• Locks vs RBAC

  • RBAC = who can access/modify.

  • Lock = prevents changes, even for Owners, unless lock is removed.

Simple Example

A company ensures governance by:

• Applying tags to track cost per department.

• Setting a Delete Lock on production resource groups to prevent accidental deletion.

• Using a Management Group to enforce encryption policies across all subscriptions.

• Configuring Retention Policies to store backups for 30 days automatically.

Exam Tip

• “Track costs by department” → Tags.

• “Prevent accidental resource deletion” → Resource Lock (Delete).

• “Apply rules across all subscriptions” → Management Groups.

• “Keep VM backups for 30 days” → Retention Policy.