Free AZ-305 Exam Dumps Preview

Instead use Azure Network Watcher IP Flow Verify, which allows you to detect traffic filtering issues at a
VM level.

Note: IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

References:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

Allowed authentication methods: GET only

Authorization level: Anonymous
The option is Allow Anonymous requests. This option turns on authentication and authorization in App Service, but defers authorization decisions to your application code. For authenticated requests, App Service also passes along authentication information in the HTTP headers.

This option provides more flexibility in handling anonymous requests.

References:
https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

On App1: Turn on the managed identity
To use Service Bus with managed identities, you need to assign the identity the role and the appropriate scope. The procedure in this section uses a simple application that runs under a managed identity and
accesses Service Bus resources.

Once the application is created, follow these steps: Go to Settings and select Identity.
Select the Status to be On.
Select Save to save the setting.

On Queue1: Configure Access Control (IAM)
Azure Active Directory (Azure AD) authorizes access rights to secured resources through role-based access control (RBAC). Azure Service Bus defines a set of built-in RBAC roles that encompass common sets of permissions used to access Service Bus entities and you can also define custom roles for accessing the data.

Assign RBAC roles using the Azure portal

In the Azure portal, navigate to your Service Bus namespace. Select Access Control (IAM) on the left menu to display access control settings for the namespace. If you need to create a Service Bus namespace.
Select the Role assignments tab to see the list of role assignments. Select the Add button on the toolbar and then select Add role assignment.

References:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/authenticate-application
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity

Gateway Load Balancer is a fully managed service enabling you to deploy, scale, and enhance the availability of third party network virtual appliances (NVAs) in Azure. You can add your favorite third party appliance whether it's a firewall, inline DDoS appliance, deep packet inspection system, or even your own custom appliance into the network path transparently ?all with a single action.

References:
https://learn.microsoft.com/en-us/azure/load-balancer/whats-new

Resource locks are not used for compliance purposes. Resource locks prevent changes from being made to resources.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Microsoft recommends that you use a GPv2 storage account for most scenarios. It supports up to 5 PB, and blob storage including Data Lake storage.

Note: A key mechanism that allows Azure Data Lake Storage Gen2 to provide file system performance at object storage scale and prices is the addition of a hierarchical namespace. This allows the collection of objects/files within an account to be organized into a hierarchy of directories and nested subdirectories in the same way that the file system on your computer is organized. With a hierarchical namespace enabled, a storage account becomes capable of providing the scalability and cost-effectiveness of object storage, with file system semantics that are familiar to analytics engines and frameworks.

References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview
https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-namespace

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-syntax

Compliance Report using Azure Policy
Azure Policy is a powerful tool for Azure Governance. With Azure Policy we can define rules for all Azure Subscriptions the we manage. We can use this rules for simple limitation actions, like permitting only specific VM Series and Sizes that can be created and also more complex rule sets that helps you standardize the whole Azure deployment.

Enforce tags for resource creation
So, why tags? Why we need to add tags to all Azure resources? The Microsoft Azure environments are getting bigger and bigger and managed by multiple people and teams. That makes it difficult to understand who created a resource and what is the purpose of that resource. Another critical matter that we need tags is Cost Management. At the Azure Cost Management Portal, we can sort and arrange the resource cost using the Tags. This way we can provide an expense dashboard with the actual cost of the resources per department, project or whatever tags we have added to the Resource.

References:
https://www.cloudcorner.gr/microsoft/azure/compliance-report-using-azure-policy/
https://www.cloudcorner.gr/microsoft/azure-policy-enforce-tags-for-resource-creation/

Account Type: StorageV2
Replication solution: Zone-redundant storage (ZRS)
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy#supported-azure-storage-services
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview#types-of-storage-accounts

Data must be available if a single Azure datacenter fails. It means the storage account must support ZRS replication. Also, solution should support storage tiers. Only General-purpose V2 supports ZRS and storage tiers.

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

Scenario: To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app.

Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens.

References:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azureresources/overview

https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability#limitations

Box 1: Pass-through Authentication with Azure AD Seamless SSO Azure AD Seamless SSO versus Active Directory Federation Services Companies with a security requirement to immediately enforce on-premises user account states, password policies, and sign-in hours might use Azure AD Pass-through Authentication.
You can combine Pass-through Authentication with the Seamless Single Sign-On feature.

Note: Azure AD supports the following authentication methods for hybrid identity solutions.
Azure AD password hash synchronization
Azure AD Pass-through Authentication

Box 2: Azure MFA
One key benefit with Azure AD Pass-through Authentication is that it works seamlessly with Azure MFA.

References:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn

https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-overview

The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends it collected data to your Log Analytics workspace in Azure Monitor.

Note: You may also see the Log Analytics agent referred to as the Microsoft Monitoring Agent (MMA) or
OMS Linux agent.
Data is collected using the Log Analytics agent, which reads various security-related configurations and event logs from the machine and copies the data to your workspace for analysis.

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/log-analytics-agent
https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection

Option A: The Conditional Access feature in Azure Active Directory (Azure AD) offers one of several ways that you can use to secure your app and protect a service. Conditional Access enables developers and enterprise customers to protect services in a multitude of ways including:
1. Multi-factor authentication 2. Allowing only Intune enrolled devices to access specific services
3. Restricting user locations and IP ranges

Option B: Conditional Access policies are powerful tools, we recommend excluding the following accounts from your policy: Service accounts and service principals.If your organization has these accounts in use in scripts or code, consider replacing them with managed identities.

Incorrect Answers:
Option E: Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups

References:
https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-conditional-access-dev-guide
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management

Box 1: A Recovery Services vault Ensure that all the resources in Sub1 are backed up by using Azure Backup.

A Recovery Services vault is an entity that stores the backups and recovery points created over time. The Recovery Services vault also contains the backup policies that are associated with the protected virtual machines.

Azure Backup automatically handles storage for the vault.

Box 2: A Resource Guard Require that User1 first be assigned a role for Sub2 before the user can make major changes to the backup configuration.

A Resource Guard is an Azure resource that can be created in the same subscription, a different subscription in the same Azure AD tenant, or even a subscription in a different Azure AD tenant! When associated to an RSV (Recovery Service Vault), a user looking to make risky modifications to it (such as removing soft delete) must have permissions on BOTH the Resource Guard and the RSV. This means it can support separate authorization boundaries at the subscription level or even completely separate identity and authentication boundaries at the tenant.

References:
https://learn.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview
https://journeyofthegeek.com/2022/10/18/protecting-azure-backups-with-resource-guard-part-1/

A data factory can have one or more pipelines. A pipeline is a logical grouping of activities that together perform a task.
The activities in a pipeline define actions to perform on your data.
Data Factory has three groupings of activities: data movement activities, data transformation activities, and control activities. Azure Functions is now integrated with Azure Data Factory, allowing you to run an Azure function as a step in your data factory pipelines.

References:
https://docs.microsoft.com/en-us/azure/data-factory/concepts-pipelines-activities

Box 1: A server in the same paired region
The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets.

Box 2: Delete
During failover, your key vault is in read-only mode. Requests that are supported in this mode are: List certificates
Get certificates
List secrets
Get secrets
List keys
Get (properties of) keys Encrypt Decrypt Wrap Unwrap Verify Sign Backup

References:
https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance

Box 1: A stored access policy and a service shared access signature (SAS)
A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side. Establishing a stored access policy serves to group shared access signatures and to provide additional restrictions for signatures that are bound by the policy.

The following storage resources support stored access policies:
1. Blob containers
2. File shares
3. Queues
4. Tables

Box 2: Modify the stored access signature (SAS)
You can use a stored access policy to change the start time, expiry time, or permissions for a signature, or to revoke it after it has been issued.

References:
https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy

Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your Azure file share.

You need an Azure file share in the same region that you want to deploy Azure File Sync.

References:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide

Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Note: Wire Data looks at network data at the application level, not down at the TCP transport layer. The solution doesn't look at individual ACKs and SYNs.

References:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

Box 1: Azure Application Gateway
Azure Application Gateway provides an application delivery controller (ADC) as a service. It offers various layer 7 load-balancing capabilities for your applications.

Box 2: Web Application Firwewall (WAF)
Application Gateway web application firewall (WAF) protects web applications from common vulnerabilities and exploits.

This is done through rules that are defined based on the OWASP core rule sets 3.0 or 2.2.9.
There are rules that detects SQL injection attacks.

References:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq
https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview

https://docs.microsoft.com/bs-cyrl-ba/azure/sql-database/sql-database-managed-instancemigrate

Quote from that page "Azure SQL Database and SQL Server databases in an Azure Virtual Machine. DMS is the recommended method of migration for your enterprise workloads. If you use SQL Server Integration Services (SSIS) on your SQL Server on premises, DMS does not yet support migrating SSIS catalog (SSISDB) that stores SSIS packages, but you can provision Azure-SSIS Integration Runtime (IR) in Azure Data Factory (ADF) that will create a new SSISDB in a managed instance and then you can redeploy your packages to it, see Create Azure-SSIS IR in ADF. To learn more about this scenario and configuration steps for DMS, see Migrate your onpremises database to managed instance using DMS."
https://docs.microsoft.com/en-us/azure/data-factory/how-to-migrate-ssis-job-ssms

Quantity: The amount of compute resources being purchased within the capacity reservation. The quantity is a number of vCores in the selected Azure region and Performance tier that are being reserved and will get the billing discount. For example, if you run or plan to run multiple databases with the total compute capacity of Gen5 16 vCores in the East US region, then you would specify the quantity as 16 to maximize the benefit for all the databases.

References:
https://docs.microsoft.com/en-us/azure/azure-sql/database/reserved-capacity-overview

https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to Azure Monitor where a corresponding record is created.

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-custom-logs

References:
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

The Azure Databricks Data Science & Engineering data lands in a data lake for long term persisted storage, in Azure Blob Storage or Azure Data Lake Storage.

References:
https://docs.microsoft.com/en-us/azure/databricks/scenarios/what-is-azure-databricks-ws

Time-based retention policy support: Users can set policies to store data for a specified interval. When a time-based retention policy is set, blobs can be created and read, but not modified or deleted. After the retention period has expired, blobs can be deleted but not overwritten.

Note:
Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-specified interval. For the duration of the retention interval, blobs can be created and read, but cannot be modified or deleted. Immutable storage is available for general-purpose v2 and Blob storage accounts in all Azure regions.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

Instead, you should deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager profile.

Network security groups
A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more).

Use FQDN filtering in network rules
A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more).

Virtual network gateways VPN gateways. A VPN gateway is a specific type of virtual network gateway that is used to send traffic between an Azure virtual network and an on-premises location over the public internet. You can also use a VPN gateway to send traffic between Azure virtual networks. Each virtual network can have at most one
VPN gateway.

Virtual network gateways support Point-to-Site (P2S) VPN connections.

Gateway transit
Virtual network peering and VPN Gateways can also coexist via gateway transit

Gateway transit enables you to use a peered virtual network's gateway for connecting to on-premises, instead of creating a new gateway for connectivity. As you increase your workloads in Azure, you need to scale your networks across regions and virtual networks to keep up with the growth. Gateway transit allows you to share an ExpressRoute or VPN gateway with all peered virtual networks and lets you manage the connectivity in one place. Sharing enables cost-savings and reduction in management overhead.

Incorrect:
Not D: Azure Route Server and Azure Network Function Manager do not support FQDNs filtering.

Note:
Azure Route Server
Azure Route Server simplifies dynamic routing between your network virtual appliance (NVA) and your virtual network. It allows you to exchange routing information directly through Border Gateway Protocol (BGP) routing protocol between any NVA that supports the BGP routing protocol and the Azure Software Defined Network (SDN) in the Azure Virtual Network (VNet) without the need to manually configure or maintain route tables. Azure Route Server is a fully managed service and is configured with high availability.

Note:
Number of routes that Azure Route Server can advertise to ExpressRoute or VPN gateway: 200

Azure Network Function Manager
Azure Network Function Manager offers an Azure Marketplace experience for deploying network functions such as mobile packet core, SD-WAN edge, and VPN services to your Azure Stack Edge device running in your on-premises environment. You can now rapidly deploy a private mobile network service or SD-WAN solution on your edge device directly from the Azure management portal

References:
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
https://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering-network-rules
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vnet-peering
https://learn.microsoft.com/en-us/azure/route-server/overview
https://learn.microsoft.com/en-us/azure/network-function-manager/overview

Azure App Service provides built-in authentication and authorization capabilities (sometimes referred to as "Easy Auth"), so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions.

Azure App Service provides built-in authentication and authorization capabilities (sometimes referred to as "Easy Auth"), so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions. Microsoft Identity Platform Facebook Google Twitter
Any OpenID Connect provider

Note:
A managed identity from Azure Active Directory (Azure AD) allows your app to easily access other Azure AD-protected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any secrets. For more about managed identities in Azure AD, see Managed identities for Azure resources.

Your application can be granted two types of identities:

A system-assigned identity is tied to your application and is deleted if your app is deleted. An app can only have one system-assigned identity. A user-assigned identity is a standalone Azure resource that can be assigned to your app. An app can have multiple user-assigned identities.

References:
https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity

Box 1: DeployIfNotExists
DeployIfNotExists
Similar to AuditIfNotExists, a DeployIfNotExists policy definition executes a template deployment when the condition is met.

DeployIfNotExists evaluation
DeployIfNotExists runs after a configurable delay when a Resource Provider handles a create or update subscription or resource request and has returned a success status code. A template deployment occurs if there are no related resources or if the resources defined by ExistenceCondition don't evaluate to true. The duration of the deployment depends on the complexity of resources included in the template.

During an evaluation cycle, policy definitions with a DeployIfNotExists effect that match resources are marked as non-compliant, but no action is taken on that resource.

Incorrect:
EnforceRegoPolicy
No such thing in this context.

Modify
Modify is used to add, update, or remove properties or tags on a subscription or resource during creation or update. A common example is updating tags on resources such as costCenter.

Modify evaluation
Modify evaluates before the request gets processed by a Resource Provider during the creation or updating of a resource. The Modify operations are applied to the request content when the if condition of the policy rule is met. Each Modify operation can specify a condition that determines when it's applied.
Operations with false condition evaluations are skipped.

Box 2: The identity required to perform the remediation task Policy assignments with effect set as DeployIfNotExists require a managed identity to do remediation.

Note: Each policy definition in Azure Policy has a single effect. That effect determines what happens when the policy rule is evaluated to match. The effects behave differently if they are for a new resource, an updated resource, or an existing resource.

These effects are currently supported in a policy definition:

Append
Audit
AuditIfNotExists
Deny
DenyAction (preview)
DeployIfNotExists
Disabled
Manual
Modify

References:
https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects

Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, lower latencies, and higher security than typical connections over the Internet.

References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

Azure Active Directory Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication Azure AD Domain Services (Azure AD DS)-This one could work since AAD DS will bring in the existing accounts from Azure AD which in turn are synchronised from on-premise AD over AD connect.
However, you would probably need to reconfigure the app and update the LDAP connection Azure Active Directory (Azure AD) supports LDAP Authentication via Azure AD Domain Services (AD DS).

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview

The Change Feed Processor and Bulk Executor Library, in Azure Cosmos DB can be leveraged to achieve a live migration of your data from one container to another. This allows you to re-distribute your data to match the desired new partition key scheme, and make the relevant application changes afterwards, thus achieving the effect of "updating your partition key".

References:
https://devblogs.microsoft.com/cosmosdb/how-to-change-your-partition-key/

1. Storage: Secret.
API keys are typically stored as secrets in Azure Key Vault. The key vault can store and manage secrets like API keys, passwords, or database connection strings.

2. Access: A managed service identity (MSI).
A managed service identity (MSI) is used to give your VM access to the key vault. The advantage of using MSI is that you do not have to manage credentials yourself. Azure takes care of rolling the credentials and ensuring their lifecycle. The application running on your VM can use its managed service identity to get a token to Azure AD, and then use that token to authenticate to Azure Key Vault.

Azure Container Instances enables a layered approach to orchestration, providing all of the scheduling and management capabilities required to run a single container, while allowing orchestrator platforms to manage multi-container tasks on top of it.

Because the underlying infrastructure for container instances is managed by Azure, an orchestrator platform does not need to concern itself with finding an appropriate host machine on which to run a single container.

Azure Container Instances can schedule both Windows and Linux containers with the same API.

Orchestration of container instances exclusively Because they start quickly and bill by the second, an environment based exclusively on Azure Container Instances offers the fastest way to get started and to deal with highly variable workloads.

References:
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-overview
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-orchestrator-relationship

App Service not only adds the power of Microsoft Azure to your application, such as security, load balancing, autoscaling, and automated management. You can also take advantage of its DevOps capabilities, such as continuous deployment from Azure DevOps, GitHub, Docker Hub, and other sources, package management, staging environments, custom domain, and TLS/SSL certificates.

Key features of App Service include:
1. Containerization and Docker - Dockerize your app and host a custom Windows or Linux container in App Service.
2. Scale up or out manually or automatically. Host your apps anywhere in Microsoft's global datacenter infrastructure, and the App Service SLA promises high availability. App Service can also host web apps natively on Linux for supported application stacks. It can also run custom Linux containers (also known as Web App for Containers).

References:
https://docs.microsoft.com/en-us/azure/app-service/overview

Identity and account types for single-and multi-tenant apps
You, as a developer, can choose if your app allows only users from your Azure Active Directory (Azure AD) tenant, any Azure AD tenant, or users with personal Microsoft accounts. You can configure your app to be either single tenant or multitenant during app registration in Azure.

Note: A required part of application registration in Azure AD is your selection of supported account types.
While IT Pros in administrator roles decide who can consent to apps in their tenant, you, as a developer, specify who can use your app based on account type. When a tenant doesn't allow you to register your application in Azure AD, administrators will provide you with a way to communicate those details to them through another mechanism.

You'll choose from the following supported account type options when registering your application.

Accounts in this organizational directory only (O365 only - Single tenant)
Accounts in any organizational directory (Any Azure AD directory - Multitenant)
Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) Personal Microsoft accounts only

Incorrect:
Configure Azure AD join.
Azure AD joined devices are signed in to using an organizational Azure AD account. Access to resources can be controlled based on Azure AD account and Conditional Access policies applied to the device.

Configure Azure AD Identity Protection
Identity Protection allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to other tools.

References:
https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

Scenario: Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.
As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources