Using Azure Blueprints

In the previous two sections, we looked at how to apply rules so that deployed resources meet the compliance rules as defined by the business. However, these constraints are on the resources themselves.

When new subscriptions are created within an Azure tenant, there will often be a set of components that always need to be in place. For example, every new subscription may need a VNet with a pre-defined set of network security group rules, a user-defined route table, a storage account to store encryption certificates, and so on.

One option would be to create a set of ARM templates within which all these items are defined and deploy them through a DevOps pipeline for each new subscription. The problem with this method is that once the components have been deployed, they can be modified. For some services, especially networking and security-related artifacts, this is not what we want.

Azure Blueprints allows us to define and deploy resource groups, resources...