![Governance – a definition
Establishment of policies, and
continuous monitoring of their proper
implementation, by the members of
the governing body of an
organization[…]1
1Source: BusinessDictionary](https://image.slidesharecdn.com/cloudbrewcommonsensegovernancepublicdeck-181013101310/75/CloudBrew-2018-Azure-Governance-3-2048.jpg)
![Resource Tags
• Name:Value, e.g. CostCenter:ProdIT, ResourceOwner:Tom
• Help to define responsibility and view consolidated billing
• Always tag RGs
• Owner
• Dept
• CostCenter
• […]
• Tag resources as needed
• Define tags in advance](https://image.slidesharecdn.com/cloudbrewcommonsensegovernancepublicdeck-181013101310/75/CloudBrew-2018-Azure-Governance-22-2048.jpg)
![Role-based access control
1. Security principal = user, group, service principal
2. Role definition = set of management rights
3. Scope = MG, subscription, RG, resource
Owner
Contributor
Reader
…
Backup Operator
Security Reader
User Access Administrator
Virtual Machine Contributor
Reader Support Tickets
Virtual Machine Operator
Built in
Custom
Contributor
"permissions": [
{
"actions": [
"*"
],
"notActions": [
"Authorization/*/Delete"
"Authorization/*/Write"
"Authorization/elevateAccess/Action"
],
"dataActions": [
],
"notDataActions": [
],
}
],
Azure
subscription
Resource
group
Management Group](https://image.slidesharecdn.com/cloudbrewcommonsensegovernancepublicdeck-181013101310/75/CloudBrew-2018-Azure-Governance-29-2048.jpg)
![Role-based access control – Role assignment
Owner
Contributor
Reader
…
Backup Operator
Security Reader
User Access Administrator
Virtual Machine Contributor
Reader Support Tickets
Virtual Machine Operator
Built in
Custom
"actions": [
"*"
],
"notActions": [
"Auth/*/Delete"
"Auth/*/Write"
"Auth/elevate…
],
Azure
subscription
Resource
group
Management Group
DevOps Group
Contributor
DevOps Resource
Group
Role
Assignment](https://image.slidesharecdn.com/cloudbrewcommonsensegovernancepublicdeck-181013101310/75/CloudBrew-2018-Azure-Governance-30-2048.jpg)
More Related Content
![[Azure Governance] Lesson 3 : Azure Tags](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson3-azuretags-190207132448-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Azure Governance] Lesson 4 : Azure Policy](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson4-azurepolicy-190519183014-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Azure Governance] Lesson 2 : Azure Locks](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson2-azurelocks-190120120003-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Azure Governance] Lesson 1 : Azure Naming Convention](https://cdn.slidesharecdn.com/ss_thumbnails/azuregovernance-lesson1-azurenamingconvention-181027154955-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to CloudBrew 2018 - Azure Governance
CloudBrew 2018 - Azure Governance
- 1. Common sense in theworld of Azure Governance Tom Janetscheck Lead Consultant | Microsoft Azure MVP
- 2. Tom Janetscheck Lead Consultant– Business Line Enterprise Focussed on Azure Infrastructure, Governance, Security Microsoft Azure MVP & P-CSA Twitter: @azureandbeyond Blog: https://blog.azureandbeyond.com About me
- 3. Governance – adefinition Establishment of policies, and continuous monitoring of their proper implementation, by the members of the governing body of an organization[…]1 1Source: BusinessDictionary
- 4. Azure Governance Scaffold Source:https://docs.microsoft.com/en-us/azure/architecture/cloud-adoption/appendix/azure-scaffold
- 5. Azure Account Ownervs. Azure AD Global Admin
- 6. Define your hierarchy Azure Enterprise Enrollment 1to many Departments 1 to many Accounts 1 to many Subscriptions
- 7. Plan first, actsecond! Subscriptions Accounts Departments Enterprise Contoso Inc. IT Account Owner Project 1 Dev Project 1 Test Finance Account Owner Production Web Sites Subscriptions Accounts Departments Enterprise Contoso Inc. Auto Account Owner Application 1 Aerospace Account Owner Application 2 Application 3 Functional Pattern Business Unit Pattern
- 8. Plan first, actsecond! Subscriptions Accounts Departments Enterprise Contoso Inc. EU Account Owner Project 1 Project 2 USA Account Owner Project 3 Geographic Pattern
- 9. Naming conventions • Itis difficult to change a name later. • Names must meet the requirements of their specific resource type. • Consistent naming conventions make resources easier to locate. They can also indicate the role of a resource in a solution.
- 10. Naming conventions -subscription Company Department Product Line or Service Environment Full Name Contoso SocialGaming AwesomeService Production Contoso SocialGaming AwesomeService Production Contoso SocialGaming AwesomeService Dev Contoso SocialGaming AwesomeService Dev Contoso IT InternalApps Production Contoso IT InternalApps Production Contoso IT InternalApps Dev Contoso IT InternalApps Dev
- 11. Naming conventions • Useaffixes to avoid ambiguity • SvcCalculationEngine (prefix) • CalculationEngineSvc (suffix) • Naming rules and restrictions • https://docs.microsoft.com/en-us/azure/architecture/best-practices/naming-conventions
- 12.
- 13. Azure governance featuresand capabilities Common Sense Resource Locks Resource Groups Management Groups Resource Tags Resource Policies RBAC
- 14. Common sense… …is notso common. - Voltaire
- 15.
- 16. Resource Locks • Locksprotect resources • Delete locks • ReadOnly locks • Define locks in advance • Use them in combination with common sense (e.g. read only means read only!)
- 17.
- 18. Resource Groups • Managementcontainers for Azure resources • RGs contain resources with the same deployment lifecycle • RGs stick to one region but can contain resources that reside in different regions • Every resource can only exist in one RG • Resources can be moved between RGs
- 19.
- 20. Management Groups • efficientlymanage access, policies, and compliance • level of scope above subscriptions
- 21.
- 22. Resource Tags • Name:Value,e.g. CostCenter:ProdIT, ResourceOwner:Tom • Help to define responsibility and view consolidated billing • Always tag RGs • Owner • Dept • CostCenter • […] • Tag resources as needed • Define tags in advance
- 23. Resource Tags • Billing;Grouping resources and associating them with billing or charge back codes. • Service Context Identification; Identify groups of resources across Resource Groups for common operations and grouping • Access Control and Security Context; Administrative role identification based on portfolio, system, service, app, instance, etc.
- 24.
- 25. Resource Policies • Ruleenforcements on MG, subscription or RG level • Initiative definitions vs. Policy definitions • Effect types: • Append • Deny • Audit
- 26.
- 27. Resource Policies • Createinitiatives on MG level • Assign initiatives on MG or subscription level • Resource ownership • Geo-compliance • Cost management • Assign RG initiatives if needed
- 28.
- 29. Role-based access control 1.Security principal = user, group, service principal 2. Role definition = set of management rights 3. Scope = MG, subscription, RG, resource Owner Contributor Reader … Backup Operator Security Reader User Access Administrator Virtual Machine Contributor Reader Support Tickets Virtual Machine Operator Built in Custom Contributor "permissions": [ { "actions": [ "*" ], "notActions": [ "Authorization/*/Delete" "Authorization/*/Write" "Authorization/elevateAccess/Action" ], "dataActions": [ ], "notDataActions": [ ], } ], Azure subscription Resource group Management Group
- 30. Role-based access control– Role assignment Owner Contributor Reader … Backup Operator Security Reader User Access Administrator Virtual Machine Contributor Reader Support Tickets Virtual Machine Operator Built in Custom "actions": [ "*" ], "notActions": [ "Auth/*/Delete" "Auth/*/Write" "Auth/elevate… ], Azure subscription Resource group Management Group DevOps Group Contributor DevOps Resource Group Role Assignment
- 31. Just announced: Azure Blueprints& Quickstart Center public previews
- 32. Azure Blueprints Deployment orchestrationof • ARM templates • Role assignments • Policy assignments • Resource groups • Resource Locks
- 33. Azure Portal QuickstartCenter
- 34. Key take-aways 1. Planfirst, act second 2. Use templates (ARM, PowerShell,…) to automatically deploy Azure resources 3. Use NoDelete Resource Locks to prevent accidental deletion of key resources 4. Always use Resource Tags 5. Leverage Resource Policies to enforce Resource Tag usage and compliance rules 6. Adhere to the Principle of least privilege (POLP)
- 35. Further information • AzureManagement - Governance • https://docs.microsoft.com/en-us/azure/governance/ • Azure Quickstart Center • https://azure.microsoft.com/en-us/blog/azure-portal-october-update • Naming rules and restrictions • https://docs.microsoft.com/en-us/azure/architecture/best-practices/naming-conventions
- 36.