Azure governance

Last time, I told you WHAT is cloud governance, and WHY you need it at your organization. Today, I will show you HOW to implement it.

This post has originally been published on Apr 11, 2019. It has since been split into 2 parts and updated for better readability. You can find part 1 here.

In the previous article, we talked about the basics of a cloud governance framework. To recap: it is a way to help you manage your cloud more quickly, consistently, in a controlled way. It has to cover the business aspect of your operations, include the right people, and relevant technology.

Some of the final aspect we’ll cover today, as we finally arrive at the How part of our model. But before jumping to the tools, a few words of caution.

Preparation is everything

Do not aim to address all the aspects and concerns in one big shot (OBS for the acronym game). This is not going to work. When you start this journey, you might not even know what you are going to deploy.

Start with the Minimal Viable Product (or Policies, MVP) in place. First, set up a governance framework for a single type of your subscription (e.g. development environments) with a minimal set of policies.

For instance:

• All assets must be grouped and tagged
• All assets deployed must use the same deployment model
• Each resource needs to be allocated to a cost center.

Once that’s in place, then you can build around it.

Iterations

After building and deploying your MVP, set up a process for incremental growth. Review and iterate your governance model in sprints. Base it on the following:

• New resource types being added/deployed
• The growth of your environment/cloud usage
• New policy elements defined based on your business objectives.

Set up triggers for your policy updates. For example: every time your cloud consumption grows by 20%, you need to review our policies on cost management. Or every time you deploy a new service, you need to review security and auditing controls applied within your framework.

Monitor those triggers! In the beginning, it might be a manual process. For instance, your Cloud Strategy Team needs to review every prepared deployment. They need to identify if it includes new types of resources, and that all deployments are prepared in the right way.

Friendly advice: Automation is cool and needed. Still, don’t aim to automate everything right from the start. Most certainly, don’t delay your first iterations of cloud governance just because you need to automate them!

Would you rather work with a document? Scroll down to find the complete guide available for download!

Setting up Azure governance

Now, let’s take a look at the practical solutions. They include plenty of tools to help you set up governance for your Azure services.

Subscriptions

First of all, accept the fact that you will have multiple subscriptions and environments.

Arrange your subscriptions using Management Groups. This is how you can group them within a single management unit.

As a design strategy, create Management Groups for your environments such as development and/or production.

Within Management Groups, arrange subscriptions based on your organizational approach. These may include the following:

• Departments
• Cost centers
• Application categorization (e.g. critical, non-critical, vendor-managed).

Some organizations use this to simplify billing: one subscription per billing unit.

Within subscriptions, create resource groups per app or workload.

Policies

Define your business goals, risk model, and constraints. Put them all in writing as policies.

Your objective here is to set a foundation for clear and faster adoption of the cloud. Since this might be an early stage of your journey, some things might go wrong (become risks). These may include:

• Team awareness of the cloud and development skills
• You don’t know the exact cost structure of resource usage
• The security model is new to you. You don’t know if it will be applied consistently across all resources and deployments
• Many people and teams will share the environment. They might apply conflicting standards and ways of doing things
• Wrong use of identities might lead to security risks and leakage of data
• Data deployed to the cloud might be against your compliance policies.

Based on those goals and risks, you can identify policies for your environment, e.g.:

Deployment

• All resources need to be deployed with the appropriate tagging and within a resource structure
• All resources must follow a defined deployment model.

Identity

• Only organizational accounts from Azure AD and partners through B2B mechanisms are allowed within the environment
• RBAC model to apply across all resources with specific roles (like a company-wide auditor). All elevated privileges are assigned and mapped to groups only.

Security

• Connectivity between the cloud and the on-prem network goes through a dedicated subscription and its networking setup
• All data needs to be encrypted with the available encryption for services
• Usage of credentials is limited with Managed Service Identity. Additionally, all credentials are stored within the Key Vault.

Cost management

• All resources need to be placed within the management structure
• All resources need to be tagged for the cost center assignment.

This is only the initial set. The next iteration needs to be more in-depth and detailed.

Those policies will be mapped to specific Azure tools. Their implementation will then be based on particular categories. You may also onboard third-party tools and external services. They may help you apply the policies in the environment.