Why This Matters

Strong cloud governance is built on two pillars:

1. Architectural Controls → define who can deploy what, where, and how.

2. Data Security Controls → ensure data at rest and in transit is encrypted and only accessible by the right identities.

As a Solution Architect, you must combine RBAC, Policy, and Management Groups with encryption and key management features like TDE (Transparent Data Encryption) and Key Vault.

1. Governance Architecture Tools

a. Role-Based Access Control (RBAC)

• Controls who can do what at scope: MG → Subscription → RG → Resource.

• Best practices:

  • Assign to groups not individuals.

  • Follow least privilege principle.

  • Use PIM for just-in-time admin rights.

b. Management Groups

• Organize subscriptions into hierarchies.

• Apply RBAC and Policy at scale.

• Example: Finance MG → all subscriptions under Finance must use EU regions.

c. Azure Policy

• Controls what can be deployed and how.

• Common policies: enforce tags, region restrictions, require encryption, deny public IPs.

• Initiatives = groups of policies (e.g., PCI DSS baseline).

2. Security Features in Data Services

a. Transparent Data Encryption (TDE)

• Encrypts SQL Database and SQL Managed Instance at rest.

• Protects backups, transaction logs, and storage files.

• Enabled by default in Azure SQL.

• Uses service-managed keys (default) or customer-managed keys (via Key Vault).

b. Azure Key Vault Integration

• Store Customer-Managed Keys (CMK).

• Supports bring-your-own-key (BYOK).

• Enables rotation policies, access logging, and separation of duties.

• Used with SQL, Cosmos DB, Blob, and other services.

c. Always Encrypted (for SQL)

• Protects sensitive data (e.g., SSNs, credit card numbers).

• Data encrypted in transit and at rest, even DBAs can’t see plaintext.

d. Storage Service Encryption (SSE)

• Encrypts Azure Storage accounts (Blob, Table, Queue, File).

• Default is Microsoft-managed keys; can use CMK via Key Vault.

Example Enterprise Scenario

A financial services provider requires:

• Developers must deploy resources only in EU regions.

• Only DB admins should access production SQL Database.

• All customer data must be encrypted at rest with customer keys.

Correct design:

• Apply Azure Policy to restrict allowed regions.

• Use RBAC to grant SQL Admin role only to DB admins.

• Enable TDE with CMK stored in Key Vault.

• Store all storage account keys and secrets in Key Vault with RBAC.

Confusion Buster

• RBAC vs Policy

  • RBAC = who can act.

  • Policy = what can be deployed.

• TDE vs Always Encrypted

  • TDE = database-level encryption (storage & backups).

  • Always Encrypted = column-level encryption (sensitive fields).

• Service-Managed Keys vs Customer-Managed Keys

  • SMK = Azure controls.

  • CMK = customer provides keys via Key Vault.

Exam Tips

• “Which Azure feature enforces resource deployment compliance?” → Azure Policy.

• “Which feature ensures least-privilege access control?” → RBAC.

• “Which encryption protects SQL DBs at rest by default?” → Transparent Data Encryption.

• “Which service stores and manages CMKs for DB/storage encryption?” → Azure Key Vault.

• “Which encryption ensures even DBAs cannot read sensitive columns?” → Always Encrypted.

What to Expect in the Exam

• Direct Q: “Which Azure service organizes subscriptions into governance hierarchies?” → Management Groups.

• Scenario Q: “Company must ensure all SQL DB backups are encrypted.” → TDE.

• Scenario Q: “Company requires customer-managed encryption keys.” → Key Vault integration.

• Trick Q: “RBAC enforces whether VMs can be deployed in West US.” → False (Policy does).