Why Governance Frameworks?

In Azure, resources can quickly multiply across departments, regions, and business units. Without a strong governance model, organizations face sprawl, inconsistent security, compliance gaps, and cost leakage. Governance frameworks like Management Groups, Subscriptions, and Policies ensure order, compliance, and accountability.

1. Management Groups

Definition:

• Logical containers for organizing subscriptions.

• Allow policies and RBAC to apply consistently across multiple subscriptions.

Key Points:

• Inherit policies and RBAC assignments downwards.

• Hierarchy can be nested up to 6 levels.

• Ideal for separating governance by department, environment, or geography.

Example:

• “All subscriptions under Finance MG must enforce MFA and EU-only regions.”

2. Subscriptions

Definition:

• A billing and access boundary for Azure resources.

Key Points:

• Each subscription has its own billing account and role assignments.

• Useful for separating environments (Dev/Test/Prod) or departments.

• Governance + security can vary by subscription, but central IT enforces top-level policies via MGs.

Example:

• HR and Finance each have separate subscriptions under a shared Enterprise MG.

3. Azure Policy

Definition:

• A governance service that enforces rules on resources.

Key Features:

• Evaluate existing resources for compliance.

• Automatically deny, audit, or modify non-compliant resources.

• Assign at MG, Subscription, RG, or Resource scope.

• Examples:

  • Enforce tagging for cost tracking.

  • Restrict VM sizes or regions.

  • Require encryption on storage accounts.

Example Enterprise Scenario

A healthcare organization requires:

• Central IT must ensure compliance with HIPAA.

• Finance department needs its own subscription for billing.

• Developers must not deploy resources outside North America.

Correct design:

• Create Management Group for Healthcare Org.

• Apply HIPAA policy set at MG level.

• Provide Finance subscription under this MG.

• Apply region restriction policy at Dev subscription level.

Confusion Buster

• Management Groups vs Subscriptions

  • MG = policy/governance containers.

  • Subscriptions = billing + access boundaries.

• Policy vs RBAC

  • Policy = “what can be deployed.”

  • RBAC = “who can do what.”

• Resource Groups vs Tags

  • RG = lifecycle grouping.

  • Tags = metadata for ownership/cost tracking.

Exam Tips

• “Which Azure construct organizes subscriptions for governance?” → Management Groups.

• “Which governance tool enforces deployment compliance?” → Azure Policy.

• “Which boundary defines billing and access control?” → Subscription.

• “Which feature ensures all resources have cost-tracking metadata?” → Tags via Policy.

What to Expect in the Exam

• Direct Q: “Which Azure construct groups subscriptions to apply policies?” → Management Groups.

• Scenario Q: “Company wants to enforce that only Europe regions are used.” → Azure Policy.

• Scenario Q: “Finance and HR need separate billing accounts.” → Subscriptions.

• Trick Q: “RBAC controls whether VMs can be deployed in East US.” → False (Policy does).