Azure Locks can be applied at resource, resource group or subscription level

So, for VMs deployed with the Azure Resource Manager deployment, for un-encrypted disk, we can:

Activity logs (When state changes for an Azure resource)

can send logs from azure resources to one or multiple workspaces.

Explicitly we have scope picker in Azure Log Analytics Workspace or under Logs tab under a resource

Monitoring is available for all azure resources

ARM evaluates the property expressions before the conditionals on the resources.

In How to interact with Azure, everything goes through ARM

There is no state management, ARM knows what resources are present

Querying ARM can be slow and expensive. There is a quota. So we use Azure Resource Graph

Related to azure resources

Monitoring resources (ARM) - 93 days

Can enable IPv6 for existing resources

should be applied at resources level for better visibility

Does not apply to existing resources (need to update resource)

Applies to all items in control plane (management groups,resource groups, resources)

Another construct for grouping together resources. Things that run together, might get decommissioned together, policies, etc.

Different from azure roles (they apply to Azure resources)