1. Azure Governance
Udaiappa Ramachandran ( Udai )
https://udai.io

2. Who am I?
• Udaiappa Ramachandran ( Udai )
• CTO, Akumina, Inc.,
• Consultant
• Focus on Cloud Computing
• Microsoft Azure, Amazon Web Services and Google
• New Hampshire Cloud User Group (http://www.meetup.com/nashuaug )
• https://udai.io

3. Agenda
• Azure Governance
• Management Group
• RBAC (role-based access control)
• Policies
• Blueprints

4. Azure Management
https://docs.microsoft.com/en-us/azure/governance/azure-management

5. Management Groups
• Subscriptions:
• Logical boundaries between account and workload
• Subscription  Resource Group(s)Resources(s)
• Level of Scope above Subscriptions
• 10,000 management groups can be supported in a single directory.
• A management group tree can support up to six levels of depth.
• This limit doesn't include the Root level or the subscription level.
• Each management group and subscription can only support one parent.
• Each management group can have many children.
• All subscriptions and management groups are within a single hierarchy in each
directory

6. Simple Enterprise Govern
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/guides/standard/

7. Complex Enterprise Govern
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/guides/complex/

8. RBAC
• RBAC Security Principal (Assign access to)
• Users
• Groups
• Service Principal
• Managed Identity
• RBAC Scope (Assign Levels)
• Management Groups
• Subscriptions
• Resource Groups
• Resources

9. RBAC –Role Definitions
• Built-In Roles
• Custom Roles

10. RBAC – Custom Role Sample
#Connect-AzAccount
#New-AzRoleDefinition -
inputfile contributor_restricted.json
#Set-AzRoleDefinition -
inputfile contributor_restricted.json
#Get-AzRoleDefinition -
Name "Contributor - ReadOnly" -
Scope "/providers/Microsoft.Management/ma
nagementGroups/<MANAGEMENTGROUPID>“
#Remove-AzRoleDefinition -Id "d4377770-
c5e9-4bf9-ad93-fe783406cba0" -
Scope "/providers/Microsoft.Management/ma
nagementGroups/<MANAGEMENTGROUPID>"

11. Policies
• Declarative
• Composed of 3 components; Policy definition, assignment and parameters
• Turn on Built-in or Custom policies
• Realtime policy evaluation and enforcement
• Always On- Periodic and On-demand compliance evaluation
• Apply policies to Management Group or Subscriptions or resource
• Exclusion scope
• Policy Initiative
• Remediation

12. Policies – Effects and Evaluation
• Supported Effects
• Append
• Audit
• AuditIfNotExists
• Deny
• DeployIfNotExists
• Disabled
• Modify
• Order of Evaluation
• Disabled
• Append and Modify
• Deny
• Audit

13. Policies – Rules & Parameters
{
"if": {
"allOf": [
{
"field": "type",
"in": [
"Microsoft.Compute/virtualMachines"
]
},
{
"not": {
"field": "name",
"match": "[parameters('namePattern')]"
}
}
]
},
"then": {
"effect": "deny"
}
}
{
"namePattern": {
"type": "String",
"metadata": {
"description": "Pattern to us
e for names. Can include ? for letters an
d # for numbers."
}
}
}
$definition = New-AzPolicyDefinition -Name "Virtual-Machine-Name-pattern" -
DisplayName "Virtual Machine Name pattern" -
description "Virtual Machine Name pattern" -Policy 'matchPattern.rules.json' -
Parameter 'matchPattern.parameters.json' -Mode All
$definition
#$assignment = New-AzPolicyAssignment -Name <assignmentname> -Scope <scope> -
PolicyDefinition $definition
#$assignment

14. Blueprints
• Declarative way to orchestrate the deployment
• Resource as artifacts of
• Resource Groups
• ARM template
• Policy Assignment
• Role Assignment
• Stored in Management Group or Subscription
• Can pass parameters to policy/initiative or ARM template
• Publishing support – ability to store and assign multiple version of the blueprints
• Static and Dynamic Parameters
• Sequencing Order using dependsOn
• Resource Locking

15. Blueprints - Formats

16. Blueprints
#Install-Module -Name Az.Blueprint
#Import-Module -Name Az.Blueprint
#Get-Command -Module 'Az.Blueprint' -CommandType 'Cmdlet'
#Get-Help Import-AzBlueprintWithArtifact
#Import-AzBlueprintWithArtifact -Name "MyBlueprint" -
InputPath "."
# Get the blueprint we just created
#$myBluePrint = Get-AzBlueprint -Name "MyBlueprint"
# Publish version 1.0
#Publish-AzBlueprint -Blueprint $myBluePrint -Version 1.0

17. References
• https://docs.microsoft.com/en-us/azure/cloud-adoption-
framework/govern/guides/
• https://docs.microsoft.com/en-us/azure/governance/management-groups/
• https://docs.microsoft.com/en-us/azure/role-based-access-control
• https://docs.microsoft.com/en-us/azure/governance/policy/
• https://github.com/Azure/azure-policy
• https://docs.microsoft.com/en-us/azure/governance/blueprints/
• https://docs.microsoft.com/en-us/rest/api/blueprints/
• https://github.com/Azure/azure-blueprints
• https://docs.microsoft.com/en-us/cli/azure/ext/blueprint/blueprint?view=azure-
cli-latest
• https://docs.microsoft.com/en-us/powershell/module/az.blueprint/?view=azps-
4.3.0