Hierarchy, Tags & Locks
Management groups · Subscriptions · Resource groups · Tagging · Locks · Landing zones
Practice questions for this topic →
Hierarchy facts
| Item | Fact |
|---|---|
| Depth | Up to 6 levels below the root (excluding root and subscriptions); keep to 3–4 |
| Parents | Each management group or subscription has exactly one parent |
| New subscriptions | Land under the tenant root group by default (hierarchy settings can set a default group) |
| Design guidance | Assign Policy at management groups; workload RBAC at subscription or resource group |
| Subscriptions | Unit of billing, limits and isolation |
| Resource groups | Group by lifecycle |
Tags
| Item | Fact |
|---|---|
| Inheritance | Not inherited by default; use a Modify policy such as 'Inherit a tag from the resource group' plus a remediation task |
| Add vs replace | 'Add a tag' adds only when missing; 'Add or replace a tag' overwrites. Resource-level policies don't change tags on resource groups |
| Require a tag | Deny policy 'Require a tag on resources' (blocks, but adds nothing) |
Locks
| Item | Fact |
|---|---|
| CanNotDelete (Delete) | Read and modify allowed; delete blocked |
| ReadOnly | Like Reader for everyone; can break operations that use POST, such as listing storage keys |
| Inheritance | Inherited by all child resources, including ones added later; the most restrictive lock in the chain wins |
| Scope | Control plane only; data operations still work |
| Overrides | Locks override user permissions, including Owner |
| Resource group delete | One Delete lock on any child blocks the whole resource group delete: no partial deletion |
| Extension resources | Inherit the parent's lock (for example a diagnostic setting on a locked storage account can't be deleted) |
| Subscription cancel | A lock doesn't block subscription cancellation |
Exam Tips
Tick each tip once you can answer it without looking.
“Apply the same policy to all production subscriptions in one place” → Management group containing those subscriptions.
“Separate billing and enforce hard isolation between business units” → Separate subscriptions (under MGs).
“Resources should automatically get the CostCenter tag of their resource group” → Azure Policy Modify 'Inherit a tag from the resource group' + remediation task. Trap: Tags aren't inherited by default.
“Block deployment of any resource without an Owner tag” → Azure Policy deny (require tag).
“Prevent accidental deletion but allow updates” → CanNotDelete lock.
“Owner must not be able to delete a critical resource without first removing a lock” → Resource lock (overrides RBAC).
“ReadOnly lock on storage account and apps fail to list keys” → ReadOnly blocks POST operations, so use CanNotDelete instead.
“Does a lock prevent someone changing blob data?” → No: locks only affect the control plane.
“Standard enterprise-scale structure with policies, identity, connectivity, management” → Azure landing zones (CAF).
“Locks at several scopes” → Inherited downward; the most restrictive lock in the chain wins. Trap: Locks apply to control plane operations only.
“One resource has a Delete lock and its resource group is deleted” → The whole delete is blocked: no partial deletion. Trap: A lock doesn't block subscription cancellation.
“Delete a diagnostic setting on a locked storage account” → Blocked: extension resources inherit the parent's lock. Trap: Locks override user permissions, including Owner.