Subscriptions, Governance & Cost Management

Azure Management Hierarchy

Entra ID Tenant
  └── Management Groups (up to 6 levels deep)
        └── Subscriptions
              └── Resource Groups
                    └── Resources

Management Groups

• Containers for organising multiple subscriptions into a hierarchy.
• Apply governance controls (RBAC, Azure Policy) at the management group level - inherited by all subscriptions below.
• Root management group = tenant root (all subscriptions belong here by default).
• Max 6 levels of management group depth (not counting root).
• Each management group or subscription can have only one parent.
• Use case: separate management groups for Production, Development, and Sandbox subscriptions with different policies applied at each level.

Subscriptions

• Billing boundary: each subscription has its own invoice and payment method.
• Access boundary: RBAC scope; limits for resources (VMs, cores, etc.) are per-subscription.
• Types: Pay-As-You-Go, Enterprise Agreement, CSP, Free Trial, Dev/Test.
• Multiple subscriptions can be linked to the same Entra ID tenant.

Resource Groups

• Logical container for related Azure resources that share the same lifecycle.
• All resources in a group are deployed, managed, and deleted together.
• A resource can only be in one resource group.
• Resource groups have a region (for metadata storage), but resources inside can be in different regions.
• Access control and policies can be applied at the resource group level.

Resource Tags

• Key-value pairs applied to subscriptions, resource groups, or individual resources.
• Used for: cost allocation, automation, governance, RBAC conditions (ABAC).
• Not inherited: tags on resource group are NOT automatically applied to resources inside.
• Max 50 tags per resource; tag names up to 512 chars, values up to 256 chars.
• Exam tip: Use Azure Policy with append or modify effect to enforce tags automatically.

Azure Policy

Enforces organisational standards and assesses compliance across your Azure environment.

Components

• Policy Definition: a JSON document defining the conditions to evaluate and the effect to apply.
• Initiative Definition (Policy Set): a collection of policy definitions grouped for a common goal (e.g., "Enable Monitoring in Azure Security Center").
• Assignment: applies a policy or initiative to a scope (management group, subscription, resource group).

Policy Effects

Exam tip: Deny prevents bad resources. Audit lets them in but flags them. DeployIfNotExists auto-remediates missing dependencies. Modify fixes resource properties.

Policy Evaluation

• Evaluated during resource creation/update and as a scheduled scan.
• New assignments take up to 30 minutes to evaluate existing resources.
• Use Remediation Tasks to bring existing non-compliant resources into compliance (for Modify and DeployIfNotExists effects).

Azure Blueprints

• Package of RBAC roles + policies + resource groups + ARM templates into a single reusable definition.
• Apply the entire blueprint to a subscription to set up a standard environment quickly.
• Blueprint assignments are tracked: you can see which resources were deployed by a blueprint and lock them against changes.
• Difference from Policy: Blueprints orchestrate multiple governance artefacts at once; Policies enforce individual rules.
• Being superseded by Azure Deployment Environments and Policy + ARM/Bicep in practice.

Resource Locks

• Prevent accidental modification or deletion of Azure resources.

• Locks are inherited: a lock on a resource group applies to all resources in it.
• Locks override RBAC - even an Owner cannot perform locked actions without first removing the lock.
• Exam tip: Resource locks and RBAC are additive but locks always win for the locked operations. Must remove lock before deletion.

Azure Cost Management + Billing

Cost Analysis

• Visualise spending by subscription, resource group, tag, service, location.
• Identify top cost drivers and trends.

Budgets

• Set a spending threshold for a scope (subscription, resource group, etc.).
• Configure alerts at % of budget (e.g., alert at 80%, 100%).
• Can trigger action groups (email, webhook, automation runbook) on alert.
• Budgets do NOT stop spending - they only alert.

Cost Allocation

• Distribute shared costs across subscriptions/departments using tags.
• Azure Cost Management can split costs based on tag rules.

Reservations & Savings Plans

• Azure Reservations: 1- or 3-year commitment for specific VM sizes, SQL databases, storage - up to 72% savings.
• Azure Savings Plan for Compute: flexible commitment ($/hour) for compute - up to 65% savings.

Azure Advisor

• Personalised cloud consultant providing recommendations in 5 areas:
  1. Cost: rightsizing, unused resources, reserved instance recommendations
  2. Security: vulnerabilities, missing MFA, security centre recommendations
  3. Reliability (formerly High Availability): redundancy, backup recommendations
  4. Operational Excellence: service health alerts, resource health
  5. Performance: throttling issues, caching, CDN recommendations
• Free service; refreshes daily.
• Exam tip: Azure Advisor = recommendations. Azure Policy = enforcement. Azure Monitor = monitoring.