Azure management and governance - Best Practices

2. Transformation
IT is transforming to play a more
strategic role
Scale
Increased cloud adoption is driving the
need to better organize and govern
Modernization
Application modernization to
improve ROI is in full swing
Driving new management & security needs
Key customer trends
Security
The cloud is now perceived as an asset
in fighting evolving threats

3. Adopting new cloud technologies
Developers
Security
Business DevOps
IT
Ops

4. Built-in Azure services options to keep your Azure and hybrid resources secure and well-managed
Monitoring
Deep operational
insights with
rich intelligence
Automate
Powerful scripting,
configuration and
update management
Governance
Proactively apply
policies and optimize
cloud spend
Resiliency
High availability and
protection for VMs,
apps and data
Security
Industry leading
Security with Advanced
Threat Protection

6. Development IT Governance
Speed Control
Speed versus control

7. Speed Control
Azure Governance
Development Cloud Custodian
Templates
Policies
RBAC
Blueprints
Management
Groups
Cost
Management
Resource
Graph
Speed and control

12. Examples:
• Require SQL Server 12.0 on all resources
• Allowed Resource Type (list)
• Allowed Locations (list)
• Allowed Virtual Machine SKUs (list)
• Apply tag and its default value
• Not allowed resource types

14. Policy
Enforce or audit rules to
ensure compliance.
Blueprints
Quickly create multiple subscriptions
with resources, policies and users
already setup.
Management groups
Map your organizational structure into
Azure to enable governance in multi-
tenant and cross-regional scenarios
"policyRule": {
"if": {
"not": {
"field": "location",
"in":
"[parameters('listOfAllowedLocations
')]"
}
},
"then": {
"effect": "Deny"
}
}
Resources
Policies
RBAC
Azure Resource Manager + Azure Resource Graph

15. Now available in preview on Azure portal for EA customers
Monitor cloud usage and spend in a
single, unified view

19. $1B+ annual investments
Over 3500 security experts
Trillions of diverse signals
Gain
Unmatched
security

20. Threat
protection
Microsoft Antimalware
for Azure
Security
management
Azure Log Analytics
Azure Security Center
Network
security
VNET, VPN, NSG
Application Gateway
(WAF), Azure Firewall
DDoS Protection
Standard
ExpressRoute
Data
protection
Encryption
(Disks, Storage, SQL)
Azure Key Vault
Confidential
Computing
Identity & access
management
Azure Active Directory
Multi-Factor
Authentication
Role Based
Access Control
Azure Active Directory
(Identity Protection)
+ Partner Solutions

23. https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke

24. Spoke VNets
On-Premises

25. https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview

26. https://docs.microsoft.com/en-us/azure/architecture/vdc/networking-virtual-datacenter

28. Architecting for high availability in Azure
Single VM
Protection with
Premium Storage
VM SLA
99.9%
Availability sets
Protection against failures
within datacenters
Availability zones
Protection from entire
datacenter failures
Site Recovery & Region pairs
Protection from disaster with
data residency compliance
VM SLA
99.95%
VM SLA
99.99%
Regions
54
AZs available across US, Europe and Asia… more regions coming soon

30. Advanced querying and
analytics powered by machine
learning capabilities
Data Driven Insights
Rich ecosystem of popular
DevOps, issue management,
SIEM, and ITSM tools
Partner Integration
A common platform for
all metrics, logs and other
monitoring telemetry
Built-in Telemetry
Metrics Log
Common Store
Full observability for your infra, app and network

31. © Microsoft Corporation
Metrics
Logs
Stores
Application Container VM Monitoring
Solutions
Insights
Dashboards Views Power BI Workbooks
Visualize
Metrics Explorer Log Analytics
Analyze
Alerts Autoscale
Respond
Event Hubs Ingest &
Export APIs
Logic Apps
Integrate
Azure Monitor
Application
Infrastructure
Network
Custom

33. Enable consistent delivery and operations of cloud quickly and easily
Azure Resource Manager
Deliver repeatable and consistent
infrastructure as code with VM
extensions and resource manager
templates
Azure Cloud Shell
Use PowerShell or Bash to operate
your infrastructure and apps with
scripts authored in languages
including Python, Node.js and .NET.
Functions & Runbooks
Use functions, logic apps, runbooks
and Event Grid to automate and
deliver reliable and repeatable
solutions.
Simplify cloud management from the command line

35. Ensure that your production resources are secure and well managed
Monitoring AutomateGovernance
NEW
ResiliencySecurity
Azure
Policy &
Blueprints
Azure
Security
Center
Azure
Backup &
Site Recovery
Azure
Monitor
Azure
Automation
Visit: http://aka.ms/securewellmanaged

36. Security
BRK2395 Wed 9AM
Azure Security fundamentals:
Protecting infrastructure,
apps, and data in the cloud
BRK2038 Wed 2:15PM
Simplify protection of cloud
resources with Azure Security
Center
BRK2368 Tues 9AM
Practical guide for using
Azure Security Center to
protect hybrid cloud
environment
(workshop: WRK2010 Tues
10:45AM)
BRK3059 Thurs 3:15PM
Manage keys, secrets, and
certificates for secure apps
and data with Azure Key Vault
Automate
BRK3063 Fri 12:30PM
Azure Update, Inventory,
and Automation for Linux
and Windows VM
management
BRK3069 Wed 4PM
What's new in PowerShell
Governance
BRK3062 Tues 2:15PM
Architecting Security and
Governance Across your
Azure Subscriptions
BRK3085 Thurs 4PM
Deep dive into
Implementing governance
at scale through Azure
Policy
BRK2476 Thurs 9AM
Make the most of Azure by
optimizing your cloud
spend through Azure Cost
Management and
Reserved Instances
NEW
Security & management hands
on labs (to be updated CY18 Q4)
Learn more about
Azure Governance
Learn more about
Azure Security
Monitoring
BRK2270 Tues 4PM
Full stack monitoring
across application,
infrastructure and network
with Azure Monitor
(workshop: WRK2012 Wed
9AM)
BRK3354 Thurs 10:15AM
Monitor your
infrastructure and analyze
operational logs at scale
with Azure Monitory
BRK3349 Tues 11:30AM
Everything about Azure
Monitor telemetry and
building integration with
ITSM and SIEM tools
Learn more about
Azure Monitor
Learn more about
Azure Automation
Hands on experience
Resiliency
BRK3060 Mon 4PM
Backup your data with
Azure Backup
(workshop: WRK2011 Wed
12:30PM)
BRK3078 Wed 11:30AM
Ensure application
availability with cloud-
based disaster recovery,
Azure Site Recovery
BRK3064 Thurs 2:15PM
Implement Cloud Backup
and Disaster Recovery at
Scale in Azure
Learn more about
Azure resiliency
https://myignite.techcommunity.microsoft.com/videos