Azure provides a rich set of governance tools for large enterprises. Azure Policy creates, assigns, and manages rules that enforce standards over resources, such as allowed SKUs, regions, or required tags. Resource locks at the CanNotDelete level prevent deletion while permitting configuration changes, while ReadOnly locks block both deletion and modification regardless of RBAC permissions. Azure Blueprints historically orchestrated repeatable packages of policies, role assignments, and ARM templates, and Microsoft now recommends landing zone accelerators along with deployment stacks. Azure Lighthouse enables service providers to manage resources across multiple customer tenants with delegated administration, providing scalability and visibility for managed-service scenarios.
Monitoring and diagnostics are unified under Azure Monitor, which collects metrics and logs from Azure resources, on-premises machines, and other clouds. Log Analytics workspaces allow centralized log queries using the Kusto Query Language (KQL), and metrics provide lightweight numerical time-series data for real-time alerting. Azure Monitor Alerts trigger notifications or automated actions when metric thresholds or log query results are met. Application Insights provides application performance monitoring with distributed tracing, dependency tracking, failure analysis, and Apdex scoring. Azure Service Health delivers personalized alerts and guidance for Azure service incidents, planned maintenance, and health advisories affecting specific subscriptions, while Resource Health reports the status of individual resources. Azure Advisor analyzes resource configurations and telemetry to recommend improvements across cost, security, reliability, operational excellence, and performance.
Security posture management is delivered through Microsoft Defender for Cloud, a Cloud Security Posture Management and Cloud Workload Protection Platform that continuously assesses Azure, on-premises, and multicloud environments, providing security recommendations, vulnerability assessments, compliance scores, and threat protection for servers, containers, storage, and SQL. Azure Information Protection, now part of Microsoft Purview Information Protection, classifies, labels, and protects documents and emails with persistent encryption and access restrictions based on sensitivity. The Service Trust Portal provides access to Microsoft compliance documentation, audit reports, and certifications to support regulatory requirements.
Cost management on Azure is supported by Azure Cost Management + Billing, which provides cost analysis dashboards, budgets with email alerts, exports, and recommendations for optimization. Customers can use the Azure Pricing Calculator to estimate costs before deployment and Azure Advisor to identify rightsizing and reservation opportunities. Reserved Instances offer up to about 72% discount for one- or three-year commitments to specific VM SKUs, databases, or other services. Savings Plans for Compute provide up to about 65% discount in exchange for a flexible hourly commitment that applies across regions and VM families. The Azure Hybrid Benefit lets organizations apply existing Windows Server and SQL Server licenses with Software Assurance to Azure VMs and SQL Database to reduce compute charges. Tags provide name-value pairs on resources for categorization and chargeback, and subscriptions define billing boundaries, quotas, and access control, while management groups extend governance across many subscriptions.