Why These Matter
Governance in Azure doesn’t stop at management groups and policies. At the resource level, you still need ways to:
-
Organize resources.
-
Classify them for cost and ownership.
-
Protect them from accidental changes or deletion.
That’s where Resource Groups, Tags, and Locks come in.
Resource Groups
Definition:
A logical container that holds related Azure resources.
Key Characteristics:
-
Every resource must belong to one (and only one) resource group.
-
Deleting a resource group deletes all resources inside.
-
Used to manage lifecycle, permissions, and policies together.
Best Practices:
-
Group resources by lifecycle (all parts of an app together).
-
Don’t mix unrelated workloads in the same resource group.
-
Use consistent naming conventions.
Tags
Definition:
Key-value pairs assigned to resources or resource groups for classification.
Examples:
-
Department = HR
-
Environment = Production
-
Owner = JohnDoe
Why Tags Matter:
-
Enable cost tracking in Cost Management.
-
Help enforce governance (via Azure Policy).
-
Used in automation (shutdown/start resources by tag).
Best Practices:
-
Standardize tags across the organization.
-
Apply tags at creation using policies (Append/DeployIfNotExists).
-
Tag both RGs and individual resources.
Locks
Definition:
Locks protect resources from accidental deletion or modification.
Types:
-
Delete Lock → prevents deletion (common for critical resources like VNets).
-
Read-Only Lock → prevents changes but allows viewing.
Best Practices:
-
Apply delete locks to production-critical resources.
-
Combine with RBAC (locks override RBAC permissions).
-
Document locks clearly so admins understand restrictions.
Example Enterprise Scenario
A healthcare provider wants to:
-
Group all resources for a patient portal into one container.
-
Track costs by department.
-
Prevent accidental deletion of production VNets.
Correct design:
-
Place portal VMs, storage, and App Service in a single Resource Group.
-
Apply tags like Department=Healthcare, Environment=Production.
-
Add a Delete Lock to the production VNet.
Confusion Buster
-
Resource Group vs Management Group:
-
RG = container for resources.
-
MG = container for subscriptions.
-
-
Tags vs RBAC:
-
Tags = classification.
-
RBAC = permissions.
-
-
Tags vs Locks:
-
Tags = for tracking/governance.
-
Locks = for protection.
-
Exam Tips
-
“Which container holds Azure resources?” → Resource Group.
-
“Which feature prevents accidental deletion?” → Lock.
-
“Which feature classifies resources for cost tracking?” → Tags.
-
“Deleting a Resource Group deletes all resources inside.” → True.
What to Expect in the Exam
-
Direct Q: “Which feature applies cost-tracking metadata to resources?” → Tags.
-
Scenario Q: “Company wants to prevent deletion of production VNets.” → Delete Lock.
-
Trick Q: “Resource Groups can contain subscriptions.” → False.