Chapter 9: Azure Governance

In Chapter 8, Azure Identity Services, you learned the skills that covered the identity and access management aspects available in Azure, including Azure Active Directory (AD), Active Directory, hybrid identity authentication, authorization, single sign-on, multi-factor authentication, and Conditional Access.

This chapter will outline various governance services in Azure, including resource tags, resource locks, role-based access control (RBAC), Azure Policy, Azure Blueprints, and the Cloud Adoption Framework (CAF) for Azure.

This chapter aims to provide coverage of the AZ-900 Azure Fundamentals Skills Measured section known as Describe identity, governance, privacy, and compliance features.

By the end of this chapter, you will be able to do the following:

• Describe the functionality and usage of resource tags, resource locks, RBAC, Azure Policy, and Azure Blueprints.
• Describe the CAF for Azure.

To support your learning with some...

Technical requirements

To carry out the hands-on labs in this chapter, you will require the following:

• An Azure subscription that can create and delete resources in the subscription. If you do not have an Azure subscription, you can create a free Azure account at https://azure.microsoft.com/free.
• Access to an internet browser to log into the Azure portal: https://portal.azure.com.
• Alternatively, you can use the Azure desktop app: https://portal.azure.com/App/Download.

Resource tags

Resource tags are used to provide metadata or descriptive information for Azure resources; metadata is a way to describe data; think of it like a sticky note, comments in a document, or a tooltip – a sticky label that provides further information on the object it is describing. This is why it's called a tag.

Resource tags can be created via the Azure portal, PowerShell, the Azure CLI, ARM templates, or the REST API; they can also be managed via Azure Policy (which we will cover in the Azure Policy section of this chapter). Up to 15 resource tags for each resource can be created, and there is no automatic inheritance by resources; if a tag is set at the resource group level, the resource tag only applies to the resource it is attached to; this may be useful if we want to group things logically by a resource group, but have a way to independently label the resource with metadata that is not tied to a resource group or subscription.

Each resource tag consists...

Resource locks

Resource locks are used to prevent resources from being modified, but more importantly, they are used to prevent resources from being accidentally deleted; locks override any permissions that have been set through RBAC.

Resource locks are managed at the subscription, resource group, and resource level and can be one of the following types:

• Read-only lock: Admins cannot delete or update a resource.
• CanNotDelete lock: Admins can update a resource but not delete one.

Unlike resource tags, resource locks are inherited by child resources. This means that all the resources in that scope will inherit a parent scope lock. You can add both lock types to resources; multiple locks could be applied to a resource, with the most restrictive inherited lock applying and taking precedence. The following diagram aims to visualize the levels that locks can be applied and inherited at:

Figure 9.2 – Azure resource locks

Resource locks...

Role-based access control

We learned about the basic concepts of RBAC in Chapter 3, Core Azure Architectural Components, when we looked at assigning access to manage Azure subscriptions for billing and resource management.

To recap this functionality provided by Azure AD, RBAC is a concept that refers to authorized user access based on defined roles that have been assigned. It allows you to create granular access control to Azure resources through defined roles, as well as through custom roles, and you can segregate duties by granting only the access that's required to perform the required tasks.

It is a good practice for governance to only allow the minimum access required to complete a task. This is the basis for the principle of least privilege and should always be adopted. So, users are only given access through a role(s) that's the most appropriate for the tasks they need to carry out.

This enhances governance and control of user access management as the permissions...

Azure Policy

Azure Policy is a set of rules for resource creation and management that apply across multiple subscriptions; it defines what actions are allowed within a subscription and assesses resources to ensure that compliance standards are met or enforce organization mandates drift, or that non-compliance can be remediated through automation.

Some typical example use cases of Azure Policy could limit what regions can be accessed for resources to be created so that data sovereignty can be complied with. You can even limit VM types or storage types so that expensive or operationally inefficient resources are not created.

The following are the key differences to understand between Azure Policy and Azure RBAC:

• Azure Policy:
  • Controls what can be done (regardless of the user)
  • Focuses on resource properties
  • Applied to resources

  An example of Azure Policy would be that you are the contributor of a resource group, but a policy blocks you from deploying a VM in WestUS or you cannot...

Azure Blueprints

Azure Blueprints is much the same as we can think of blueprints outside of a technology discussion; it provides patterns, designs, and definitions for creating something. We can think of this along the lines of a blueprint for a house, a car, a space rocket, and so on; an Azure blueprint is no different from this concept.

An Azure blueprint is a package or representation of a collection of defined, prescribed, repeatable resources to be deployed that conform to an organization's governance standards and patterns when implemented. This allows governance and design parameters to be defined that rapidly allow teams to repeatedly stand up projects and initiatives within the blueprint's control.

Azure blueprints can be created through the Azure portal, Azure PowerShell, the Azure CLI, ARM templates, or the REST API; blueprint definitions are saved to a management group or subscription, which requires contributor access.

Blueprints are represented as objects...

The Cloud Adoption Framework for Azure

The CAF is a collection of proven tools and documentation, including best practices, reference architectures, and implementation guidance. This allows business and technology strategies to be aligned so that they accelerate cloud adoption in a controlled and governed manner. The focus for this content is the cloud architect, who is the conduit for discussions and activity between the business and operations teams, and acts as the thought leader for the organization.

The CAF provides various methodologies, as per the following diagram:

Figure 9.6 – Azure CAF methodologies

Let's look at these in more detail:

• Strategy: Define justification and outcomes.
• Plan: Align business outcomes to actionable adoption plans.
• Ready: Preparation of the cloud environment.
• Migrate: Existing workloads move and are modernized.
• Innovate: New workload development using cloud-native or hybrid solutions.
...

Hands-on exercises

To support your learning with some practical skills, we will create some of the resources that were covered in this chapter.

The following exercises will be carried out:

• Exercise 1 – assigning access with RBAC
• Exercise 2 – creating a custom RBAC role
• Exercise 3 – adding a resource lock to a resource group
• Exercise 4 – enabling resource tagging with Azure Policy
• Exercise 5 – limiting the resource creation location with Azure Policy

Getting started

To get started with these hands-on exercises, you will need an Azure subscription that has access to create and delete resources in the subscription; you can use an existing account that you have created as part of the exercises from any chapter in this book. Alternatively, you can create a free Azure account by going to https://azure.microsoft.com/free.

This free Azure account provides the following:

• 12 months of free services
• $200 credit...

Summary

This chapter covered the AZ-900 Azure Fundamentals exam skills area known as Describe identity, governance, privacy, and compliance features.

In this chapter, you learned about the various governance services in Azure, including resource tags, resource locks, RBAC, Azure Policy, Azure Blueprints, and the CAF for Azure.

The next chapter covers Microsoft's core tenets of security, privacy, and compliance.

Further reading

This section provides links to additional exam information and study references:

• Exam AZ-900: Microsoft Azure fundamentals:

  https://docs.microsoft.com/en-us/learn/certifications/exams/az-900

• Exam AZ-900: skills outline:

  https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VwUY

• Microsoft Learn: Azure Fundamentals – Describe identity, governance, privacy, and compliance features:

  https://docs.microsoft.com/en-gb/learn/paths/az-900-describe-identity-governance-privacy-compliance-features

Skills check

Challenge yourself with what you have learned in this chapter:

1. Explain a common use for resources tags.
2. Explain the two types of resource locks.
3. Explain RBAC and its scopes.
4. Explain how Azure Policy differs from RBAC.
5. Explain Azure Blueprints.
6. Describe the CAF for Azure.