Why Governance Matters

As organizations grow in Azure, resource sprawl and inconsistent policies can cause security gaps, compliance issues, and cost overruns. Governance structures like Management Groups, Subscriptions, and Resource Groups help ensure proper organization, policy enforcement, and accountability.

As a Solution Architect, you must design governance structures that balance flexibility for teams with control for compliance.

Core Governance Layers

1. Management Groups

• Top-level containers for organizing subscriptions.

• Policies and RBAC applied at this level inherit down.

• Example: “All subscriptions under Finance MG must enforce MFA.”

2. Subscriptions

• Billing and access boundary.

• Used to separate environments (Prod vs Dev) or business units.

• Can have multiple subscriptions under one tenant.

3. Resource Groups (RGs)

• Logical containers for resources (VMs, databases, storage).

• Provide lifecycle management → delete RG = delete all resources inside.

• Used for grouping by application, workload, or lifecycle.

Governance Design Principles

1. Separation of Duties

• One subscription per environment (Dev, Test, Prod).

• Critical workloads isolated from experimentation workloads.

2. Inheritance of Policies

• Use Management Groups for org-wide governance.

• Example: Apply cost policies or security baselines across multiple subscriptions.

3. Resource Group Design

• Group resources that share the same lifecycle (e.g., web app + its DB + its storage).

• Avoid mixing unrelated workloads in the same RG.

4. Tagging Strategy

• Use tags for cost tracking and ownership (e.g., Department, Owner, Environment).

Example Enterprise Scenario

A multinational enterprise requires:

• Central IT wants to enforce security policies across all business units.

• Finance needs its own subscription for compliance and billing.

• Each application team wants flexibility to manage resources independently.

Correct design:

• Create Management Groups by department (Finance, HR, IT).

• Apply Azure Policy at MG level (MFA, region restrictions).

• Assign Subscriptions to departments for billing separation.

• Design Resource Groups per application workload.

Confusion Buster

• Management Groups vs Subscriptions

  • MG = governance container.

  • Sub = billing + access boundary.

• Subscription vs Resource Group

  • Sub = high-level billing/security boundary.

  • RG = workload-level logical container.

• RG vs Tags

  • RG = groups related resources.

  • Tags = metadata applied across resources for reporting.

Exam Tips

• “Which construct is used for billing boundaries?” → Subscription.

• “Which ensures policy inheritance across multiple subscriptions?” → Management Group.

• “Which grouping helps manage lifecycle of related resources?” → Resource Group.

• “Which tool helps track cost ownership?” → Tags.

What to Expect in the Exam

• Direct Q: “Which governance layer organizes multiple subscriptions?” → Management Groups.

• Scenario Q: “Company needs separate billing for Finance and HR but wants central policy control.” → Subscriptions under MGs.

• Scenario Q: “App team wants to delete all components of an app in one go.” → Place in a single RG.

• Trick Q: “Deleting a subscription deletes its tenant.” → False (tenant remains).