Azure Subscriptions and Management Groups

Azure Subscriptions and Management Groups are key tools for resource organisation.

Subscriptions group your resource groups, making them simpler to handle.

They separate costs and keep resources distinct. With the right configuration, subscriptions can also help control access. It's best to think of them as handy containers that organise and protect your resources.

Subscription Identification 

Every Azure subscription comes with both a name and a unique ID. While multiple subscriptions can share the same name, each one has a unique ID. This unique ID is crucial for precise identification and management. For example, a subscription ID might look like:

164452d7-fd41-479d-aef2-16bf045aabb4

An Azure Subscription name and Subscription Id

Subscriptions are Global

Azure subscriptions are not tied to a specific location only resource groups and individual resources have regions. This means a subscription can contain resources spread across multiple regions.

A subscription can have resource groups and resources in different regions. However, this can make it harder to apply policies that are region-specific, such as compliance, security, or data residency rules.

Subscription Costs

Creating additional Azure subscriptions does not increase costs. You are only charged for the resources deployed within a subscription, not for the subscription itself.

Deleting a Subscription

When you delete an Azure subscription, it can still be restored within 90 days. During this period, you can reactivate the subscription and regain access to its resources. After 90 days, the subscription and all associated resources are permanently deleted and cannot be recovered.

Management Groups organise multiple subscriptions, think of them as folders.

They add an extra layer of organisation and governance.

They let you apply consistent policies across subscriptions.

Let's look at the key features and benefits they offer.

Key Features and Benefits

• Cost Tracking: Subscriptions group related projects for easier expense monitoring. This grouping helps track costs per project, independent of policy settings.

• Centralised Control: Management Groups let you group related subscriptions together. When grouped, you can apply policies at the management group level to control security, access, and compliance across all contained subscriptions.

• Security & Access Control: Role-Based Access Control (RBAC) manages permissions effectively. You can apply RBAC at the management group level or at individual subscriptions. However, applying it at both levels can get complicated.

• Compliance: Policies at the management group level help enforce standards consistently. This ensures compliance across all subscriptions in the group while cost tracking remains managed at the subscription level.

  
  

Lifecycle and Cost Management

Subscriptions form the basis for billing cycles. They help track costs over time and simplify budgeting. You can monitor spending per project or department. This makes long-term management easier.

Practical Use Cases & Problem Solving A startup can use separate subscriptions for different projects. This keeps costs separate and simplifies budgeting. Management Groups enforce consistent security policies across projects. They are ideal for rapidly growing teams.

Real-world examples include:

• A marketing team using one subscription for campaigns.

• An IT team grouping infrastructure in another subscription.

• Separate subscriptions for test and production environments.

Security Nuances 

Subscriptions help control access via RBAC. They are not complete security boundaries on their own. Additional measures like network segmentation can enhance security. They work well as part of a broader security strategy.

Hierarchical Organisation with Management Groups 

Management Groups allows nesting groups within one another up to six levels deep. They act like folders that hold subscriptions. This supports centralised governance in large environments. It simplifies policy enforcement across multiple teams.

Management Group Recommendations 

A few best practices for organising management groups include:

• Keep It Simple: Create a hierarchy that reflects your business structure. Although Management Groups allow nesting up to six levels, avoid overly deep nesting.

• Apply Policies at the Top: Set security, compliance, and governance policies at the management group level so they flow down to all subscriptions. This will help you from applying the same settings to similar subscriptions every time you create a new one.

Note:

Management Groups were introduced into Azure after Subscriptions. As a result, some features may work better at the subscription level than at the Management Group level.

Limitations & Considerations

• Overlapping responsibilities may occur in growing teams.

• Subscriptions alone do not offer complete security isolation.

• Misconfiguration can lead to accidental deletions.

• Additional measures are necessary for robust security.

For more details on resource groups, please see my LinkedIn article: Azure Resource Groups by Gurbhajan S Bagh.

Conclusion A well-structured approach improves cost control and security. This method benefits overall cloud management. Review your current setup and consider a trial restructuring. Harness these tools to streamline and secure your Azure environment.