Series
Azure Governance: Subscriptions, Cost, Policy, and Access Control
Getting Azure governance right is less about any single feature and more about knowing which lever to pull for which problem. A subscription boundary versus a management group, a tag versus a lock, an Azure Policy assignment versus an RBAC role.
This series works through that whole stack: the identity and billing fundamentals underneath every resource (accounts, tenants, subscriptions, and management groups), the everyday mechanics of moving resources and keeping cost under control, the organisational layer of resource groups, tags, and locks, Azure Policy from its core concepts through writing and assigning a custom policy definition, and the design-level questions — how to structure management groups and subscriptions as an organisation grows, what a landing zone actually provides, and when to reach for Azure Policy versus Azure RBAC.
It also covers a live change worth knowing about if you're building governance tooling now: Azure Blueprints' retirement and what replaces it.
8 parts
- 1 Azure Accounts, Tenants, and Subscriptions: The Building Blocks of Governance What an Azure account, tenant, and subscription each represent, how they relate to one another, and how management groups extend governance above the subscription level.
- 2 Azure Cost Management: Advisor, Quotas, Budgets, and Alerts How to track and control Azure spend day to day — Cost Analysis breakdowns, budgets and their alerts, anomaly detection, regional quotas, and where Azure Advisor's cost recommendations come from.
- 3 Azure Policy Fundamentals: Governance Disciplines, Definitions, and Compliance How Azure Policy actually works — the governance disciplines it supports, the definition/assignment/effect model, initiatives, exemptions, remediation, and how and when compliance gets evaluated.
- 4 Choosing Between Azure Policy and RBAC for Governance Azure Policy and Azure RBAC solve different governance problems — resource state versus user permissions — and understanding which one actually applies to a given requirement, including how to design custom RBAC roles, is what keeps a governance design coherent.
- 5 Creating and Assigning Custom Azure Policies A hands-on walkthrough of writing a custom Azure Policy definition in JSON, assigning it through the portal, and doing the same through PowerShell and Cloud Shell.
- 6 Designing Azure Governance at Scale: Management Groups, Subscriptions, and Landing Zones Design principles for structuring management groups and subscriptions as an organisation grows, what a landing zone is for, and how Azure Blueprints' upcoming retirement changes the recommended tooling for deploying governance consistently.
- 7 Moving Azure Resources Across Resource Groups, Subscriptions, Regions, and Tenants How resource moves work in Azure depending on what's changing — resource group, subscription, region, or tenant — including which resource types are supported for each and what Azure Resource Mover actually covers.
- 8 Organising and Protecting Azure Resources: Resource Groups, Tags, and Locks How to structure resource groups, apply tags consistently, and use resource locks to protect Azure resources from accidental changes or deletion — the everyday organisational layer underneath policy and RBAC.