Using Azure Resource Manager (ARM)

Question 1

We might put all resources that are core infrastructure into this resource group. But we could also organize them strictly by resource type. For example, put all VNets in one resource group, all virtual machines in another resource group, and all Azure Cosmos DB instances in yet another resource group.

We could organize them by environment (prod, qa, dev).

We could organize them by department (marketing, finance, human resources).

Answer 1

Resource Group - Organizing principles

Question 2

Since resource groups are a scope of RBAC, you can organize resources by who needs to administer them.

Answer 2

Resource Group - Organizing for authorization

Question 3

placing resources in the same resource group is a way to group them for usage in billing reports. If you’re trying to understand how your costs are distributed in your Azure environment, grouping them by resource group is one way to filter and sort the data to better understand where costs are allocated.

Answer 3

Resource Group - Organizing for billing

Question 4

name/value pairs of text data that you can apply to resources and resource groups.

Answer 4

Tags

Question 5

ALI CLI “Tag”

Answer 5

az resource tag –tags Department=Finance \

   - -resource-group msftlearn-core-infrastructure-rg \
   - -name msftlearn-vnet1 \
   - -resource-type "Microsoft.Network/virtualNetworks"

Question 6

You can use tags to group your billing data. For example, if you’re running multiple VMs for different organizations, use the tags to group usage by cost center. You can also use tags to categorize costs by runtime environment, such as the billing usage for VMs running in the production environment. When exporting billing data or accessing it through billing APIs, tags are included in that data and can be used to further slice your data from a cost perspective.

Answer 6

tags for organization

Question 7

Azure Policy - Note

Answer 7

You can enforce naming conventions across your Azure environment. You can also enforce that specific tags are applied to resources. Let’s take a look at how policies work.

We could use policy to restrict which Azure regions we can deploy resources to.

We could use policy to restrict which types of virtual machine sizes can be deployed.

We could also use policy to enforce naming conventions.

Question 8

RBAC allows you to perform specific actions, such as read, write, or delete. Therefore, if one role assignment grants you read permissions to a resource group, and a different role assignment grants you write permissions to the same resource group, you will have both read and write permissions on that resource group.

Answer 8

RBAC - Allow Access

Question 9

a setting that can be applied to any resource to block modification or deletion.

Answer 9

Resource locks