Downloaded 193 times
Uploaded byJonathan Wade
Azure Cloud Governance
The document discusses Azure cloud services, focusing on VPN, ExpressRoute, and naming conventions for resources. It highlights the importance of governance and organization using tags within Azure subscriptions. Additionally, it references various Azure documentation and guides for implementation and security.
![[Azure Governance] Lesson 4 : Azure Policy](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson4-azurepolicy-190519183014-thumbnail.jpg?width=640&height=640&fit=bounds)
Azure Cloud Governance
- 4.
- 10. naming rules andscope
- 22.
- 23. Examples of implementingAzure enterprise scaffold Naming conventions Azure Subscription Governance – Resource Group and Naming Convention Strategies Use tags to organize your Azure resources Azure Automation User Documentation Azure Security Center Documentation Azure Architecture Center Azure Strategy and Implementation Guide
Editor's Notes
- #5 Design of Governance is “why we do things?” Execution of Governance is “how we do things?”
- #10 https://docs.microsoft.com/en-au/azure/azure-resource-manager/resource-manager-subscription-governance Examples "Traditional IT" subscription for line-of-business applications Enforce Department and Owner tags on all resources Restrict resource creation to the North American Region Restrict the ability to create G-Series VMs and HDInsight Clusters "Agile" Environment for a business unit creating cloud applications To meet data sovereignty requirements, allow the creation of resources ONLY in a specific region. Enforce Environment tag on all resources. If a resource is created without a tag, append the Environment: Unknown tag to the resource. Audit when resources are created outside of North America but do not prevent. Audit when high-cost resources are created.
- #11 https://docs.microsoft.com/en-au/azure/architecture/best-practices/naming-conventions A recommended pattern for naming subscriptions is: <Company> <Department (optional)> <Product Line (optional)> <Environment> In general, avoid having any special characters (- or _) as the first or last character in any name. These characters will cause most validation rules to fail.
- #17 Resource locks currently support two values: CanNotDelete and ReadOnly. CanNotDelete means that users (with the appropriate rights) can still read or modify a resource but cannot delete it. ReadOnly means that authorized users can't delete or modify a resource. To create or delete management locks, you must have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Of the built-in roles, only Owner and User Access Administrator are granted those actions.