Before we start with the objectives that are required for the exam, which involves how to manage the Azure subscriptions and resource groups, we will cover some high-level information about Azure subscriptions and resource groups.

Azure subscriptions are basically the billing accounts in Azure. Aside from billing, access to the Azure portal and the creation of the different Azure services in the portal are done through the use of Azure subscriptions.

If you look at the Azure account hierarchy, you will see where Azure subscriptions actually fit in. In the following diagram, the account hierarchy is shown:

It is divided into Enterprise...

There are two ways to assign administrator permissions to your users. The first is done inside Azure Active Directory and is used to assign global administrator permissions. The second is done by using role-based access control (RBAC) and can be set from the subscription level.

In the following sections, we'll look at both possibilities.

With global administrator permissions, you can manage all subscriptions and management groups. A management group provides a level of scope above permissions and can be used to manage multiple subscriptions together.

When a user is assigned to the global administrator role, it is able to see all Azure subscriptions...

With Azure Policy, you can create, assign, and manage policies. These policies can be used so that you stay compliant with your corporate standards and SLAs by enforcing different rules and effects over your Azure resources. Your resources are evaluated by the assigned policies for non-compliance. For instance, you can create a policy that only allows virtual machines from a certain SKU size in your environment. When this policy is assigned, all new and existing resources are evaluated for compliance with this policy.

To configure subscription policies, perform the following steps:

1. Navigate to the Azure portal by opening https://portal.azure.com.
2. In the left-hand menu, select Subscriptions (this is if you added it to your favorites; otherwise, take the steps that we described in the previous demonstration).
3. In the Subscriptions overview...

You can apply tags to all of your Azure resources. This way, you add extra metadata to the resource group, which can be used to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For instance, you can set the name to Environment and the value to Demo, or you can set the name to Maintenance Window and the value to Saturday 9 AM. After applying these tags, you can easily retrieve all the resources with the same tag name and value. This can be a useful feature for billing or management purposes.

For billing based on your tags, you can use the assigned tags to group the billing for certain resources; for example, if you run VMs and databases for different environments (test, pre-production, and production), you can use tags to categorize the costs. These tags will then show up in the different...

Quotas in Azure are basically the limits of creating an amount of resources in Azure. For example, there is a limit of 2,000 availability sets that can be created inside an Azure subscription. However, you can contact Microsoft support if you wish to increase this quota. We need to perform the following steps:

1. Navigate to the Azure portal by opening https://portal.azure.com.
2. In the left-hand menu, select Subscriptions.
3. Select the right subscription. In the Subscriptions overview blade, under Settings, select Usage + quotas. There, you can select a provider:

4. Select Microsoft.Compute.
5. You will see the amount of available availability sets for this subscription. If you want to increase this, select the Request Increase button on the right-hand side of the screen:

6. A new blade will open, where you can...

Administrators can set locks on your Azure resources to prevent other users from deleting the resource or making any changes to it. You can set two different lock levels on your subscriptions, resource groups, or resources:

• CanNotDelete: This level prevents authorized users from deleting the resource. They can still read and modify the resource.
• ReadOnly: Within this level, authorized users can read a resource, but they cannot delete or update it. This level is similar to assigning all authorized users to the reader role using RBAC.

To apply a lock on your resource group, you have to perform the following steps:

1. Navigate to the Azure portal by opening https://portal.azure.com.
2. In the left-hand menu, select Resource groups. Select the resource group that we created in the previous demonstration.

3. In the Resource Group overview blade, under Settings...

You can easily move your resources across different resource groups and subscriptions by using the Azure portal, PowerShell, the CLI, and the REST API. During the move operation, both the source group and the target group are locked. This blocks all write and delete operations on the resource group until the movement is complete. This means that you cannot update, add, or delete resources in the resource group, but the resources aren't frozen. There will be no downtime for these resources. However, the location of the resources will remain the same, even when the new resource group is created in a different location.

Resource groups can be removed using the Azure portal, PowerShell, the CLI, and the REST API. You can remove the resource group and all the resources inside of it at once.

In the following demonstration, we are going to remove PacktResourceGroup1, which we used for the previous demonstration:

1. Navigate to the Azure portal by opening https://portal.azure.com.
2. In the left-hand menu, select Resource groups. Select PacktResourceGroup1. In the top menu, select Delete resource group:

3. To confirm that you want to delete the resource group, you have to specify the name. Enter the name of the resource group and select Delete:

The resource group will now be deleted.

In this chapter, we introduced the various aspects of Azure subscriptions and resource groups. We assigned administrator permissions and described how to create policies to stay compliant. We also covered cost center quotas and resource locks. At the end of this chapter, we moved and removed resource groups completely.

In the next chapter, we'll cover the second part of this exam objective by describing how to analyze resource utilization and consumption.

Answer the following questions to test your knowledge of the information in this chapter. You can find the answers in the Assessments section at the end of this book:

1. Suppose that you have a VM using managed disks that is deployed inside an availability set, and you want to move resources to another resource group. Is this possible?
   • Yes
   • No
2. Suppose that you want to create a resource group using PowerShell. Is this possible?
   
   • Yes
   • No
3. Suppose that you want to delete a resource group using the CLI. Is this possible?
   
   • Yes
   • No

You can check out the following links for more information about the topics that were covered in this chapter:

• Associate or add an Azure subscription to your Azure Active Directory tenant: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory
• Resource access management in Azure: https://docs.microsoft.com/en-us/azure/architecture/cloud-adoption/getting-started/azure-resource-access
• Elevate access to manage all Azure subscriptions and management groups: https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
• Understand Azure Policy effects: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects
• Prevent unexpected charges with Azure billing and cost management: https://docs.microsoft.com/en-us/azure/billing/billing-getting-started
• Use tags...