AZ-104 Objective 1.3: Manage Azure Subscriptions and Governance

Governance Components:

• Azure Policy: Enforce compliance and governance rules
• Resource Locks: Prevent accidental deletion or modification
• Tags: Organize and track resources for cost and management
• Resource Groups: Logical containers for related resources
• Subscriptions: Billing and access control boundaries
• Management Groups: Hierarchical organization of subscriptions
• Cost Management: Monitor and optimize spending

Policy Definition:

• Policy Rule: JSON definition of the policy logic
• Parameters: Configurable values for policy flexibility
• Effect: What happens when policy is evaluated (Audit, Deny, Modify, etc.)
• Conditions: When the policy applies

Policy Effects:

• Audit: Logs non-compliant resources but doesn't prevent creation
• Deny: Prevents resource creation or modification
• Modify: Adds or updates properties during resource creation
• DeployIfNotExists: Deploys resources if they don't exist
• AuditIfNotExists: Audits if required resources don't exist

Step-by-Step Process:

1. Navigate to Policy: Go to Azure Portal → Policy
2. Create Policy Definition: Click "Definitions" → "Policy definition"
3. Define Policy: Enter name, description, and policy rule JSON
4. Assign Policy: Go to "Assignments" → "Assign policy"
5. Select Scope: Choose management group, subscription, or resource group
6. Configure Parameters: Set any required parameters
7. Review and Create: Review assignment and create

Policy Management Commands:

# Connect to Azure
Connect-AzAccount

# Create policy definition
$policyDefinition = @{
    Name = "RequireTag"
    DisplayName = "Require Tag"
    Description = "Requires a specific tag"
    Policy = @'
{
    "if": {
        "not": {
            "field": "tags[Environment]",
            "exists": true
        }
    },
    "then": {
        "effect": "deny"
    }
}
'@
}

New-AzPolicyDefinition @policyDefinition

# Assign policy
$policyAssignment = @{
    Name = "RequireTagAssignment"
    PolicyDefinition = Get-AzPolicyDefinition -Name "RequireTag"
    Scope = "/subscriptions/{subscription-id}"
}

New-AzPolicyAssignment @policyAssignment

# Get policy compliance
Get-AzPolicyState -PolicyAssignmentName "RequireTagAssignment"

Common Built-in Policies:

• Allowed locations: Restrict resource deployment to specific regions
• Allowed virtual machine SKUs: Control VM sizes
• Require tag and its value: Enforce tagging requirements
• Storage account should use a virtual network service endpoint: Security compliance
• SQL servers should have vulnerability assessment configured: Security compliance
• Audit VMs that do not use managed disks: Best practice enforcement

CanNotDelete Lock:

• Purpose: Prevents resource deletion
• Effect: Resource can be read and modified but not deleted
• Use Case: Critical production resources

ReadOnly Lock:

• Purpose: Prevents any modifications
• Effect: Resource can only be read
• Use Case: Compliance or audit requirements

Step-by-Step Process:

1. Navigate to Resource: Go to the resource or resource group
2. Access Locks: Click "Locks" in the left navigation
3. Add Lock: Click "Add" to create a new lock
4. Configure Lock: Enter name, lock type, and notes
5. Save Lock: Click "OK" to apply the lock

Lock Management Commands:

# Create CanNotDelete lock on resource group
New-AzResourceLock -LockName "ProductionLock" -LockLevel CanNotDelete -ResourceGroupName "ProductionRG" -LockNotes "Production environment - do not delete"

# Create ReadOnly lock on resource
New-AzResourceLock -LockName "ReadOnlyLock" -LockLevel ReadOnly -ResourceName "MyStorageAccount" -ResourceType "Microsoft.Storage/storageAccounts" -ResourceGroupName "MyRG"

# Get all locks
Get-AzResourceLock

# Remove lock
Remove-AzResourceLock -LockName "ProductionLock" -ResourceGroupName "ProductionRG"

Key Benefits:

• Cost Management: Group resources for billing and cost analysis
• Resource Organization: Categorize resources by purpose, owner, environment
• Governance: Enforce tagging policies and standards
• Automation: Use tags in automation scripts and policies
• Reporting: Generate reports based on tag values

Recommended Tags:

• Environment: dev, test, staging, prod
• Owner: Team or individual responsible
• Project: Project or application name
• CostCenter: Financial tracking
• Department: Organizational unit
• CreatedDate: Resource creation date
• BackupRequired: Backup policy indicator

Tag Operations:

# Add tags to resource group
$tags = @{
    Environment = "Production"
    Owner = "IT Team"
    Project = "WebApp"
    CostCenter = "12345"
}

Set-AzResourceGroup -Name "MyRG" -Tag $tags

# Add tags to individual resource
$resource = Get-AzResource -ResourceName "MyVM" -ResourceGroupName "MyRG"
$resource.Tags += @{
    BackupRequired = "Yes"
    CreatedDate = (Get-Date).ToString("yyyy-MM-dd")
}
Set-AzResource -ResourceId $resource.ResourceId -Tag $resource.Tags

# Bulk tag resources
$resources = Get-AzResource -ResourceGroupName "MyRG"
foreach ($resource in $resources) {
    $resource.Tags += @{
        Environment = "Production"
        Owner = "IT Team"
    }
    Set-AzResource -ResourceId $resource.ResourceId -Tag $resource.Tags
}

# Get resources by tag
Get-AzResource -TagName "Environment" -TagValue "Production"

Design Guidelines:

• Lifecycle Alignment: Group resources with same lifecycle
• Access Control: Use resource groups for RBAC assignments
• Billing: Group resources for cost tracking
• Deployment: Use resource groups for ARM template deployments
• Naming Convention: Consistent naming for easy identification

Management Commands:

# Create resource group
New-AzResourceGroup -Name "MyResourceGroup" -Location "East US"

# Get resource groups
Get-AzResourceGroup

# Get resources in resource group
Get-AzResource -ResourceGroupName "MyResourceGroup"

# Move resources between resource groups
$resource = Get-AzResource -ResourceName "MyVM" -ResourceGroupName "SourceRG"
Move-AzResource -DestinationResourceGroupName "DestinationRG" -ResourceId $resource.ResourceId

# Delete resource group (with confirmation)
Remove-AzResourceGroup -Name "MyResourceGroup" -Force

# Export resource group template
Export-AzResourceGroup -ResourceGroupName "MyResourceGroup" -Path "template.json"

Subscription Categories:

• Free Account: Limited services for learning and testing
• Pay-as-you-go: Pay for what you use
• Enterprise Agreement: Volume licensing for large organizations
• Student: Educational discounts for students
• Sponsorship: Microsoft-sponsored subscriptions

Administration Commands:

# Get all subscriptions
Get-AzSubscription

# Set default subscription
Set-AzContext -SubscriptionId "subscription-id"

# Get subscription details
Get-AzSubscription -SubscriptionId "subscription-id"

# Get subscription usage
Get-AzConsumptionUsageDetail -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date)

# Get subscription billing
Get-AzBillingInvoice -MaxCount 10

Key Features:

• Cost Analysis: Visualize and analyze spending patterns
• Budgets: Set spending limits and track progress
• Alerts: Notifications when spending thresholds are reached
• Azure Advisor: Recommendations for cost optimization
• Reserved Instances: Cost savings for predictable workloads

Budget Creation Process:

1. Navigate to Cost Management: Go to Azure Portal → Cost Management + Billing
2. Create Budget: Click "Budgets" → "Add"
3. Configure Budget: Set scope, amount, and time period
4. Set Alerts: Configure alert thresholds (50%, 80%, 100%)
5. Add Recipients: Specify email addresses for notifications
6. Save Budget: Create the budget and alerts

Cost Management Commands:

# Get cost analysis
Get-AzConsumptionUsageDetail -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date)

# Get cost by resource group
Get-AzConsumptionUsageDetail -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Group-Object ResourceGroup | Select-Object Name, @{Name="TotalCost";Expression={(Get-AzConsumptionUsageDetail -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Where-Object {$_.ResourceGroup -eq $_.Name} | Measure-Object -Property PretaxCost -Sum).Sum}}

# Get Azure Advisor recommendations
Get-AzAdvisorRecommendation

# Get cost recommendations
Get-AzAdvisorRecommendation | Where-Object {$_.Category -eq "Cost"}

Common Cost Recommendations:

• Right-size VMs: Optimize VM sizes for actual usage
• Reserved Instances: Purchase reserved capacity for predictable workloads
• Unused Resources: Identify and remove unused resources
• Storage Optimization: Optimize storage tiers and redundancy
• Database Optimization: Right-size database resources

Key Benefits:

• Hierarchical Organization: Organize subscriptions in a tree structure
• Policy Inheritance: Apply policies to multiple subscriptions
• Access Control: Manage access across subscriptions
• Billing: Consolidated billing and cost management
• Governance: Centralized governance and compliance

Structure Guidelines:

• Root Management Group: Top-level container for all subscriptions
• Environment-based: Separate groups for production, development, testing
• Department-based: Organize by business units or departments
• Geographic: Separate groups for different regions
• Project-based: Group subscriptions by projects or applications

Management Commands:

# Create management group
New-AzManagementGroup -GroupName "Production" -DisplayName "Production Environment"

# Get management groups
Get-AzManagementGroup

# Add subscription to management group
New-AzManagementGroupSubscription -GroupName "Production" -SubscriptionId "subscription-id"

# Remove subscription from management group
Remove-AzManagementGroupSubscription -GroupName "Production" -SubscriptionId "subscription-id"

# Get management group hierarchy
Get-AzManagementGroup -Expand -Recurse

# Delete management group
Remove-AzManagementGroup -GroupName "Production"

Sample Exam Questions:

1. What is the difference between Audit and Deny policy effects?
2. Which PowerShell cmdlet is used to create a resource lock?
3. How do you apply tags to multiple resources using PowerShell?
4. What is the purpose of management groups in Azure?
5. How do you set up cost budgets and alerts?
6. What are the benefits of using resource groups?
7. How do you move resources between resource groups?
8. What is the difference between CanNotDelete and ReadOnly locks?
9. How do you get Azure Advisor cost recommendations?
10. What is the maximum depth of management group hierarchy?