Internal Presenter Notes: What Attendees Should Take Away

 Understand RBAC as a governance technology to

control permissions
 Understand Azure Policies as a governance technology
to control properties of deployed resources
 Understand management groups and blueprints as a
method of controlling RBAC and policies across
multiple subscriptions
aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour
Governance Fundamentals
Speaker name
Title

aka.ms/AFUN80 #MSIgniteTheTour
Resources

Session Resources Hub

aka.ms/AFUN80

Session Code on GitHub

aka.ms/AFUN80Repo

All Event Session Resources 

aka.ms/mymsignitethetour

aka.ms/AFUN80 #MSIgniteTheTour
 Governance allows you to enforce a set of
rules on how resources in the cloud are
configured

aka.ms/AFUN80 #MSIgniteTheTour
Azure Governance Challenges
Control which VMs specific users can manage in the Azure
portal

Limit VM deployment to specific VM SKUs

Ensure that resources are identified as either belonging to

production or development environments
Manage access, policy, and compliance across multiple
subscriptions

Ensure that new subscriptions apply existing policies

aka.ms/AFUN80 #MSIgniteTheTour
 Tailwind Traders can overcome these
challenges by implementing Governance
technologies built into Azure

aka.ms/AFUN80 #MSIgniteTheTour
 How does Tailwind Traders restrict users so
that they can only manage specific VMs
through the Azure portal?

aka.ms/AFUN80 #MSIgniteTheTour
Role Based Access Control
(RBAC) Demo

aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour
Role-based access control (RBAC)

Grant only the amount of access to users that they need to

perform their jobs.

Can also grant

access for
resources,
resource groups
or subscriptions.
aka.ms/AFUN80 #MSIgniteTheTour
Security Principal

Individuals represented as Azure AD users

Collections of individuals represented as
Azure AD groups
Services and applications represented by
Service Principals

aka.ms/AFUN80 #MSIgniteTheTour
Role Definition

A collection of permissions
Role definitions are defined as a set of
operations that can be performed

Examples: Read, Write, Delete

aka.ms/AFUN80 #MSIgniteTheTour
Scope
Access boundary
Assigned to:
• Management group
• Subscription
• Resource group
• Resource
Structured in parent-child relationship
• Access at parent scope is inherited at child
scope

aka.ms/AFUN80 #MSIgniteTheTour
Role Assignment

aka.ms/AFUN80 #MSIgniteTheTour
Azure RBAC Roles Vs Azure AD Admin Roles

Azure RBAC Roles Azure AD Administrator Roles

Use these to manage Use these to manage
permissions to Azure permissions to Azure AD
resources resources

aka.ms/AFUN80 #MSIgniteTheTour
 Key RBAC Info
• Restrict who can perform what
operations on which resources
• Inherited to all children of the
assigned scope
• Can be applied to all levels of your
hierarchy, all scope types
• Custom roles allow you to change
the operations that a role can
perform
aka.ms/AFUN80 #MSIgniteTheTour
 How does Tailwind Traders limit the VM
SKUs can be deployed to DS2_v2, DS3_v2
and DS4_v2?

aka.ms/AFUN80 #MSIgniteTheTour
Limit VM SKU through
Azure policy

aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour
 How does Tailwind Traders ensure that
production and development resources are
identifiable?

aka.ms/AFUN80 #MSIgniteTheTour
Azure Tag Policy

aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour
 Azure Policies Policy: A rule that will be enforced

Initiative: A collection of policies

Assignment: The scope where the policy applies

aka.ms/AFUN80 #MSIgniteTheTour
Azure Policy: Control and Audit Configuration
• Examples
• Enforce VM – Password settings
(min/max length, age, previous passwords)
• Audit: VM – Internal Configuration
• Enforce: Allowed Azure locations
• Enforce: Resource tags
• Enforce: Encryption of storage

aka.ms/AFUN80 #MSIgniteTheTour
Policy definition
$policy = New-AzureRmPolicyDefinition -Name costCenterTagPolicyDefinition -Descript
"Policy to deny resource creation if no costCenter tag is provided" -Policy '{
  "if": {
    "not" : {
      "field" : "tags
      "containsKey" : "costCenter"
    }
  },
  "then" : {
    "effect" : "deny"
  }
aka.ms/AFUN80
}' #MSIgniteTheTour
Enforce naming convention
{
  "if": {
    "not": {
      "field": "name",
      "like": "namePrefix*nameSuffix"
    }
  },
  "then": {
    "effect": "deny"
  }
aka.ms/AFUN80 #MSIgniteTheTour
Enforce VM SKUs of basic A series
"properties": {
  "displayName": "Allowed VM Skus",
  "description": “Specifies a set of VM SKUs that your org can deploy.“ },
"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Compute/virtualMachines“
      },
      {
aka.ms/AFUN80
        "not": { #MSIgniteTheTour
Enforce VM SKUs using parameters
"properties": {
"displayName": "Allowed VM Skus",
"description": “Specifies a set of VM SKUs that your organization can deploy.",
"parameters": {
"listOfAllowedSKUs": {"type": "array"}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines“
aka.ms/AFUN80 #MSIgniteTheTour
Comparison Slide
RBAC
• Focuses on actions that can
be taken at a specific scope
• “User has permission to
deploy virtual machines”
• Default deny unless explicitly
allowed
aka.ms/AFUN80
Policy
• Focuses on the properties of
resources during deployment
and for already existing
resources
• “Can deploy only DS series
VMs if has the permission to
deploy VMs”
• Default allow unless explicitly
denied
#MSIgniteTheTour
Azure Policy repository
https://github.com/Azure/azure-policy/

aka.ms/AFUN80 #MSIgniteTheTour
 How does Tailwind Traders ensure
that consistent policies apply across
multiple subscriptions?

aka.ms/AFUN80 #MSIgniteTheTour
Create Management
Group

aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour
Management Groups
• Allows you to organize access, policies and
compliance across multiple subscriptions
• Up to 10,000 management groups per
directory
• Management Group Tree can support up
to six levels of depth

aka.ms/AFUN80 #MSIgniteTheTour
Root Management Group
• Root management group allows for global
policies to be applied at the directory level
• Created automatically when you first
initiate management groups.
• Includes all subscriptions associated with
the default directory
• Azure AD Global Administrator cannot
assign RBAC roles through root
management group until they have
elevated themselves to User Access
Administrator
aka.ms/AFUN80 #MSIgniteTheTour
Management Group Hierarchy

aka.ms/AFUN80 #MSIgniteTheTour
 How does Tailwind Traders ensure that
existing policies are applied to new
subscriptions?

aka.ms/AFUN80 #MSIgniteTheTour
Azure Blueprints

aka.ms/AFUN80 #MSIgniteTheTour
aka.ms/AFUN80 #MSIgniteTheTour

Azure Blueprints
Enabling quick, repeatable creation of fully governed environments
Streamline
environment creation
Centralize environment
creation through templates
Add resources, policies and
role access controls
Track blueprint updates
through versioning
aka.ms/AFUN80
© Microsoft Corporation
Azure
Enable compliant
development
Empower developers to create
fully governed environments
through self-service
Create multiple dev-ready
environments and
subscriptions from a
centralize location
Leverage the integration with
Azure Policy on the DevOps
lifecycle
11 Ensure compliance
22 Empower DevOps
3 Manage costs
Lock foundational
resources
Ensure foundational
resources cannot be
changed by subscription
owners
Manage locks through a
centralize location
Update locked resource
through blueprint
definition updates
#MSIgniteTheTour
Azure Blueprints

Blueprint
2
ARM Templates Secure
foundational
resources Subscription A
Policy Definitions Subscription B
1

Cloud Create a Role-based access Subscription C

Blueprint controls
Engineer definition and
add artifacts
3
Custom Scripts*
Stamp out …
environments
Coming in June

4 Version and
Update
Blueprints

aka.ms/AFUN80 #MSIgniteTheTour
Azure Governance Technologies
Governance technology Function
Role Based Access Control Control what can be done and where it can be
done
Azure Policies Control the properties of resources during and
after deployment
Management Groups Collect together and managing multiple
subscriptions
Azure Blueprints Deploy resources, policies and RBAC controls
through a template

aka.ms/AFUN80 #MSIgniteTheTour
Azure Governance Challenges
Control which VMs specific users can manage in the Azure
portal

Limit VM deployment to specific VM SKUs

Ensure that resources are identified as either belonging to

production or development environments
Manage access, policy, and compliance across multiple
subscriptions

Ensure that new subscriptions apply existing policies

aka.ms/AFUN80 #MSIgniteTheTour
/Docs alert
Explore overviews, tutorials,
samples, and more.

Azure Governance
aka.ms/AzGovernance

Role Based Access Control

https://aka.ms/AzAccessControl
Azure Policy
aka.ms/AzurePolicies
Azure Blueprints
https://aka.ms/Az-Blueprints

aka.ms/AFUN80 #MSIgniteTheTour
/MS Learn alert
Complete interactive learning
exercises, watch videos, and
practice and apply your new
skills.
aka.ms/AFUN80MSLearnCollection

aka.ms/AFUN80 #MSIgniteTheTour
/Microsoft Certification alert
Microsoft Certified:
Azure Fundamentals

aka.ms/AzureFunCert

Get hired, stay ahead, and receive the

recognition you deserve

aka.ms/AFUN80 #MSIgniteTheTour
Exclusive offer for Microsoft Ignite The Tour attendees
Free Certification Exam
on fundamentals, role-based, or specialty certifications*  
Now is your chance
to stand out among your peers.
Get certified and prove your expertise to
employers and peers and get the recognition and
opportunities you've earned. Take advantage
of this offer by scheduling a free exam online
today.

Learn more about Microsoft Certifications

Microsoft.com/Certifications

Begin with free online training

aka.ms/FreeExam_MSIgnite Microsoft.com/Learn
Limited to one (1) per attendee. Subject to terms and conditions.
Please see website for details.
*Free exams include only those with the following prefixes:
Find a Learning Partner to help you prepare
AI, AZ, DP, MB, MD, MS, and PL aka.ms/LearningPartner

aka.ms/AFUN80 #MSIgniteTheTour
Resources

Session Resources Get Certified

aka.ms/AFUN80

Session Code on GitHub You’re onaka.ms/AzureFunCert

Azure Fundamentals: your way
aka.ms/AFUN80Repo
to being certified!
aka.ms/app10certification
All Event Resources 
aka.ms/mymsignitethetour

aka.ms/AFUN80 #MSIgniteTheTour
 Presenters
/Upcoming Session alert Please customize and use as
desired for you locale and related
sessions

INSERT RELATED SESSION NAME

TIME Room/Location

INSERT RELATED SESSION NAME

TIME Room/Location

APPS40: Managing Delivery of Your App via DevOps

3:15 p.m. Room 305

aka.ms/AFUN80 #MSIgniteTheTour
Invent with purpose.