Management groups, subscriptions, resource groups and tags – Azure architecture (AZ-305, lesson 7)

What you learn in this lesson

design and justify a structure of management groups, subscriptions and resource groups for a growing company

tell from a requirement whether a boundary should be a subscription, a resource group, a management group or a tag

name the limits of management groups and tags that flip a design decision

describe a tag strategy with required tags, inheritance and enforcement through Azure Policy

record the decision as a decision record with a Bicep sketch

Nordlicht Reisen GmbH, a fictional travel agency, has so far put everything into one subscription, which was enough for practicing in AZ-104. Now the portal, the partner interface, the file archive and the sales analytics are added, plus a team for network and identity that does not work on the applications. Who may change what, which rule applies where, and who pays for the file archive when 25 travel offices use it? The exam calls this: recommend a structure of management groups, subscriptions and resource groups, and a strategy for tags. The answer consists of boundaries, and every boundary has a price.

Prior knowledge. What subscriptions and management groups are is covered in "AZ-900 compact", lesson 2.2. How to create them, move resources and set tags and policies is shown in AZ-104, lessons 1.4 and 1.5. The three levels of the Kladde (management, policies, tags as plain text, budgets per stamp) are taught in K4, lesson 4.7.7. That is not repeated here. What is new is the decision: which boundary goes where. The Cloud Adoption Framework with landing zones comes in lesson 5.1; here it is enough that Microsoft proposes the same structure as the basis for landing zones.

The requirement

The sheet of Nordlicht Reisen for this lesson (all numbers are assumptions of the task):

Requirement	Source	Measure (assumption)
Test and production separated, test must not change production	Management	Developers have only read permissions in production
Platform team (network, identity, logs) separate from the application teams	IT management	4 people on the platform, 13 people in three application teams
One rule "EU regions only" for everything	Data protection	applies to all subscriptions, new ones too
Costs visible per travel office	Controlling	25 offices, monthly analysis
Experimenting allowed without touching production	Development	one area with looser rules and a budget
Partners (about 400 external users) reach only their interface	Security	the interface is separate from the portal and the archive
New subscriptions should land correctly without manual work	Operations	one request, no pile of tickets

This lesson belongs to course AZ-305

You will see the rest of this lesson and its video once you have bought the course. The goals above show what you learn here.

€129.00

incl. VAT, one-time payment

Access to all of the course's lessons with their exercises, solutions and videos on this site, for 24 months from the purchase. A self-study course: no tutoring, no exams or grading by us, and no certificate.

Withdraw from contract here