1.3 Manage access to subscriptions and governance

Question 1

What is Azure policy?

Answer 1

1.Enables you to create, assign, and manage policies to enforce compliance within your Azure environment.
- Runs evaluations and scans on your resources to make sure they are compliant

2.It provides a way to ensure that your resources in Azure adhere to organizational standards and meet regulatory requirements.

3. Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management.

Things to know about Azure Policy:
1. Enforce rules and compliance
2. Apply policies at scale
3. Perform remediation
4. Exercise governance

Know the differences between policy Initiative and a initiative definition

Policy is a single
Initiative definition is a grouping of policy

Question 2

Implement and manage azure policy - Create azure policies

Answer 2

Step 1 - Create Policy definition
- A policy definition is a set of rules and conditions that define the properties and behaviors of resources in the Azure environment

Step 2 - Create Policy Initiative definition
- An Initiative definition is a collection of policy definitions which allows you to group related policies together for a common goal.

Step 3 - Scope the initiative definition
You can set the scope of an initiative definition to a specific management group , subscription or resource group.

Step 3 : Determine compliance
After you assign an initiative definition you can then evaluate the state of compliance for all your resources. Individual resources , resource groups , management groups and subscriptions can be excluded from having the policy rules affect it

Question 3

Implement and manage azure policy - Create policy definitions

Answer 3

!!A policy definition is a set of rules and conditions that define the properties and behaviors of resources in an azure environment!!

Azure policy offers built -in policy definitions , you can also create your own definitions or import definitions from other sources.

-built in policy can be sorted by category

Examples of built in policy definitions are:
1. Allowed vm size SKUs:
Specify a set of VM SKU’s that your organization can deploy. This policy is under the compute category

2. Allowed locations:
   Restrict the locations users can specify when deploying resources.
   Use this policy to enforce geo compliance requirements.
   Located under general category

• You can add or create a new definition. Policy definitions can imported into Azure policy from the Github

Example use case
Policy def might specify that all vm’s must have encryption enabled.

Question 4

Implement and manage azure policy - Create an initiative definition

Answer 4

!!A policy initiative definition is a set or grouping of policy definitions. This allows you to group related policies together under a common goal , making it easier to manage and assign multiple polices!!

After policy definitions has been selected , the next step is to create an initiative definition.
The initiative definition contains one or more policy definitions.

This is to ensure your resources are compliant with security regulations

Examples of built in Initiative definition:
1. Audit machines with insecure password security settings

2. Configure windows machines to run azure monitor agent and associate them with a data collection rule
3. Configure Azure defender to be enabled on SQL servers

Example use case
can be created for security best practices , for encryption , NSG and identity and access management

Question 5

Implement and manage azure policy - Scope the initiative definition

Answer 5

After you create an initiative definition . the next step is to assign the initiative to establish the scope for the policies. The scope determines what resource or grouping of resources are affected by the conditions of the policies.

Question 6

Implement and manage azure policy - Determine compliance

Answer 6

Once the polices are defined , your initiative definition created and your policies assigned to affected resources , you can then evaluate the state of compliance for your scoped resources.

Policy conditions are evaluated against your existing scoped resources

Question 7

Configure resource locks

Answer 7

Resource locks prevent accidental deletion of resources in azure.

*A resource lock can be enforced at the subscription , resource group and resource level.

*Locks are inherited by child resources.

Lock types:
1. Read only locks
Prevents any changes being made to the resource

2. Delete locks
   Prevents deletion

Note: To delete a locked VM , An owner or user access admin needs to be contacted to do so.

Question 8

Apply and manage tags on resources

Answer 8

Tags are used for sorting , searching , managing and doing analysis on your resources.

A tag consists of a name and value

Things to know about resource tags:
1. each resource tag has a name and value

2. The tag name remains constant
3. There is defined set of values that can be set for the tag value
4. Resource or resource group can have a maximum of 50 tag name/value pairs
5. Tags set to resource group is not inherited by the resources.

Things to consider when using resource tags:

Question 9

Manage resource groups

Answer 9

Resource groups are containers that holds related resources.

*Resource groups cannot be nested

*Resources can only belong in one resource group at a time

*All resources must be a part of a resource group

*Many resources can be moved between resource groups with some having limitations.

• Can contain resources that are from different regions
• Resource groups cannot be renamed

Resources can be moved between resource groups , subscriptions and regions.

Question 10

What is an Azure subscription?

Answer 10

it is a logical unit of azure services that linked to an azure account.

An azure account is an identity in Microsoft Entra ID thats trusted by Microsoft Entra ID , such as a work or school account.

Helps organize access to azure cloud service resources
Helps control how resource usage is reported , billed and paid.

Question 11

Manage subscriptions

Answer 11

Things to know about subscriptions:
1. Every cloud service belongs to a subscription

2. Each subscription an have a separate billing and payment setup
3. Multiple subscriptions can be linked to the same azure account
4. Billing is done on a subscription basis

Subscriptions can be obtained in 4 different ways:
1. Enterprise agreement
- Make an upfront agreement to azure

2. Microsoft reseller
   buy azure through the open licensing program
3. Microsoft partner
   - use a Microsoft partner who can design and implement your azure cloud solution.
4. Personal account
   - sign up for free trial

There are 4 different types of subscriptions
1. Free

2. Pay as you go
   charges you monthly for the services that you used in the billing period.
3. Enterprise agreement
4. Student

Question 12

Manage costs by using alerts , budgets , and Azure recommendations.

Answer 12

Cost management is a tool used to monitor and control azure spending and also helps optimize resource usage

Azure has several tools to help with cost saving :
1. Reservations

2. Azure Hybrid benefits
3. Azure credits
4. Azure regions
5. budgets
6. pricing calculator

Question 13

Configure management groups

Answer 13

Often used if there is multiple subscriptions in. Provides a level of scope and control of subscriptions

• Management groups can be used as containers where you can manage access , policy and compliance across your subscriptions

Things to know about management groups

1. by default , all new subscriptions are placed under the top level management group called the root
2. There can be up 6 layers of depth
3. all subscriptions inherit the conditions applied to the management group they belong in
4. Azure RBAC authorization for management groups is not enabled by default.