- Coming up, if you're a cloud architect
or ops manager, we'll review the latest updates
to governing your Azure subscriptions.
We'll look at Microsoft's approach
to Azure Governance overall,
which now includes more granular control
of policy across different apps
and departments in your organization
with management groups,
new Azure blueprint templates
that simplify setting up your environment
to meet specific compliance requirements such as ISO,
as well as easier tracking of policy changes
and their impact.
And stay tuned as we show you how you can now
apply governance capabilities
across your Kubernetes workloads in Azure.
[techno music]
I'm joined today by Satya Vel,
from the Azure Governance Team.
Nice to have you on the show for the first time.
Welcome!
- Thanks for having me.
- So the last time we covered Azure governance,
Jeremy Winter was on the show and we looked at
how you can control the implementation of policy
even retroactively throughout your Devos process,
across your subscriptions,
and we also introduced Azure blueprints,
to establish repeatable
architectural infrastructure patterns for your environment.
To be clear, though, when we talk about Azure Governance,
we're talking about a set of capabilities that we give
cloud architects and cloud engineers
to be able to better assert control over Azure subscriptions
in their organization.
- Yeah, that's absolutely right.
When you think about Azure governance,
as a set of capabilities that we give cloud architects
and cloud engineers to quickly and easily set
the right guardrails for things such as security,
compliance, and even your everyday cost management
for all your Azure subscriptions.
And this essentially is important during the DevOps process,
as the apps are being built, deployed, and managed
in production at a rapid cadence.
- Right, so this clearly places the business
and operation requirements front and center,
and it's an added dimension to the ops in DevOps.
- It does, and of course,
you can use all these capabilities individually,
but the real value is using them in unison,
as they help put into play
a core set of governance practices,
which have been developed based on how we at Microsoft
manage our own subscriptions.
For example, one of the top customer pain points
for any cloud architect is keeping track of
all the subscriptions in their environment.
We often see dozens of subscriptions per tenant,
or even hundreds if you're a large customer.
- Right, so, how do we solve for this?
- So we've developed a capability and core practice
called Management groups,
which is the highest level grouping
construct under your tenant
for your subscription, resource groups, and resources.
- So to be clear,
management groups are the top level grouping construct
that essentially organizes all your subscriptions
and resources?
- Right, and that's really the point.
This is where you want to start
to get the structure right,
and as all your policies, cost controls,
will be applied to everything within the management group.
For example, you can align these to specific departments
within your organization,
and you can nest management groups
to align with policy structures,
and even organizational hierarchies that you want.
And from there, you can use Azure Policy
to set the operational rules across your subscriptions,
you can apply a different set of operational requirements
across different management groups
that cover specific applications
within those subscriptions.
As part of that, you can establish Azure Blueprints,
which is comprised of a combination of
Azure management templates to provision resources,
your role based access controls, and policies, as well.
And finally, you can oversee and set budget thresholds
using capabilities within Azure cost management.
- Okay, great.
And that makes sense as you staff with
organizing your subscriptions,
so these capabilities combined help me to establish
a working model for governance across your organization.
Can we see it in action?
- Sure, let's take a look.
So let's start at the heart of the governance strategy,
which is Management groups.
Over here I have a root management group
which hangs off my tenant,
and underneath that I created a management group
for each of my business units.
I can also see that some of the new subscriptions
that got created are hanging off this
root management group.
I can click into my application management group,
and what you'll notice is I've created
a production management group,
as well as a pre-production management group.
The reason I did this is because I wanted to have
specific policies and cost controls
for my pre-production environment.
I can drill into this further
and see management groups for each of the applications
that I've created,
and I can see the various different subscriptions
that roll under that particular application.
One of the things that I've noticed
is I need to create a new management group
for a new e-commerce application that we have started.
When I click "add management group",
I can easily provide a unique name
for my management group that I want to create,
and hit save.
In order to create a management group,
you need to be an active directory admin,
and you need elevated permissions in the Azure portal.
Now that my management group's created,
I can very easily go back into my root node,
select the new subscription that got created,
and move it under that specific management group
I just created.
As you can see, it's become really easy
for me to now manage all my subscriptions
in my environment.
- Okay, so that's how you can start to organize
your subscriptions under management groups.
What types of things can you now do?
- Yeah, this is the beauty of management groups,
because now it gives me the ability to
actually use it to do things as cost controls, as well.
So, over here I have the new
Azure Cost Management experience,
and I can actually filter my cost views
by the different management groups I've created.
I can then pivot and see what my costs have been
over the last month.
I can even see a breakdown of my costs by the services,
the various different regions,
as well as the resource groups in my environment.
And this is extremely important
in cases where you may want to do charge back
for your various different business groups.
- Okay, so how would you go about setting policy
in this case, to manage cost?
- So let's take a look.
Now this is the Azure policy experience,
where I can define various different policies
for my different cost controls.
We give you about four or five hundred different policies
that we ship out of the box,
so you don't need to author these,
you can just leverage the built-in policies.
And one of these that I created
is a standard tag policy.
The standard tag policy essentially ensures
that any new resource that gets created
has a tag for the business owner and the cost code.
And for existing resources, I can do an audit
and see which of the resources do not have
these tags applied to them.
And what we made really easy with Azure policy,
is now you can assign these policies,
to the management groups I just created.
So here, for example, I can go and target
this specific policy
at the root management group,
so any new resource that gets created
will automatically inherit these tags
from the resource group.
Or, if they're specific business unit policies,
I can target it at those nested management groups,
as well.
- Okay, and how many different tags can we apply, roughly?
- That's really up to you.
We support up to fifteen tags today,
and we're gonna increase that limit up to 50, as well.
- Great, now given that Dev and production environments
are pretty dynamic,
how as an Ops manager and a cloud architect
can you start to track policy compliance?
And also look at the compliance state of existing services?
- So we introduced an Azure policy compliance dashboard,
which is a single view to get the entire
compliance of your entire Azure environment.
I have 43% of my resources that are compliant,
and about 2000 resources that are non-compliant, as well.
I can see the top five policies
with the most non-compliant resources,
and I also get a great view into my compliance
over the last seven days.
- Okay, so what happens if a resource that was
previously compliant falls out of compliance?
Can we see what actually changed?
- Yeah, so we have a new capability called change history.
So, for example, one of the things that I want to ensure
is that the cost code is applied to all my resources
in my environment,
and I want to search for this one VM by the name of "Matt,"
which I think you're pretty familiar with.
- [Matt] Yeah.
- And see what actually changed
on that particular resource.
- [Matt] Now nothing, I didn't change anything.
- [Satya] Ah, let's find out.
(laughter)
So I can click into this particular virtual machine,
and I can click on the change history tab
that tells me what exactly changed in the environment.
We track changes for all the changes
that happen to that particular VM.
And I'm gonna pick one particular change history item.
One of the things I quickly see is
the items in red in the left are things that got removed,
and the things on the right which are in green
actually got modified.
So looks like, Matt, you went and actually
removed the cost code tag,
and took clear your tracks,
you actually removed the created by tag, as well.
- Nope, don't know what you're talking about.
Nothing to do with me at all.
- But this is really a simple example.
But take something more complex, such as changes
to a network security group rule, right?
To really be able to tell what exactly
changed in the environment is pretty powerful.
- Okay, right, so this new change history capability
helps you understand what the change was
that caused the resource to fall out of compliance
in the first place.
Cool.
So how far back can you actually track the changes?
- Great question.
We can go back as far as 14 days,
and change history's something that's enabled by default
on all Azure resources.
You can also export this data
out to your own storage account
if you need to keep it for compliance purposes.
And you can create an alert on top of the Azure
activity logs to get notified
as soon as the change happens.
- Okay, cool. So what can you do beyond policy,
to ensure that new solutions are compliant
right from the start?
- This is an area where we help templatize
your environment set up.
You can use Azure blueprints
to set up hub and spoke infrastructure.
But we also started to deliver built in blueprints
to help get compliant with regulations
and various different standards.
At Microsoft, we've done a lot at a service level
ourselves to be compliant with Azure,
and we're taking our own internal best practices
and offering them as blueprints.
- Can we take a look?
- Let's do it!
So this is the Azure Blueprints experience.
You can get to it by searching
for Azure Blueprints in the Azure portal search.
I can click create, and one of the things you notice
is we give you a bunch of built in templates that you can
get started from.
The first one I see here is a blank blueprint,
so I can go and compose this the way I want it,
but to make things a little easier,
we've actually published a bunch of built in blueprints,
that you can take advantage of.
We're working on about ten to twelve
very specific compliance blueprints,
such as Fed RAM, NYST, CIS, and PCI.
But one of the first ones we released this quarter
is the ISO 27001.
So let's start by taking a look at that.
I can very simply provide a unique name for this blueprint.
I can specify where this blueprint definition is saved,
and the benefit of this is,
now that any subscription that gets created
under the management group
can get automatically stamped
with this particular blueprint.
I can click next artifacts,
and this is really the beauty of these built-in blueprints,
is now I come with a prepackaged set of policies
and infrastructure resources that I can take advantage of
because I know that these will help me meet my
different regulations and standards in my environment.
I can even customize these to add things such as
my custom R back roles,
and once I'm done composing my blueprint,
it becomes really easy for me to stamp it out.
And the stamping experience is really me going,
and selecting the various different subscriptions
I want this blueprint to be applied to.
So here for example, I want my dev test,
my pre-production, and production to have the same
exact blueprint, so I know that my application
can work in all three different environments.
I can fill in a set of parameters for my blueprint,
but one of the key capabilities that I wanted to emphasize
is the blueprint locking mechanism.
The blueprint lock essentially allows me
as a Cloud architect to define what goes
into a susbcription.
And even though I hand that subscription over
to an application team,
they can unmodify
or change any of the infrastructure capabilities.
And now for the sake of time,
I'm actually going to deploy this blueprint,
and now you can see all the policies got applied
to the subscription,
and all the different infrastructure resources
got created successfully into that environment.
- Nice, and I suppose this also sets you up nicely
if you need to show proof of compliance
and produce an audit report.
- Exactly, now this gives me the one-stop shop
for me to come and see what are the different resources?
And because of the blueprint logs,
I can rest assured that there's no configuration change
that's happened on those resources that I deployed.
To make things easier for auditors,
we've also published some really good documentation
for each of the blueprints,
showing what are the different resources I've got created.
Additionally, mapping the various different
ISO compliance controls to the different policies, as well.
- And you can learn more about this at the link shown.
Now this looks like it's gonna save operators
and cloud architects a ton of time,
and we know this is great for traditional
infrastructure resources,
such as VMs, storage, and databases,
but, how does this then extend to modern
application services,
such as containers?
- So we are really excited to announce
that Azure governance now extends
to Azure Kubernetes service, as well.
One of the challenges we heard from a lot of enterprises
is that we've seen that while Kubernetes is great to be able
to take advantage
of the infinite scale and near instant scale out,
it's been really hard for them to manage
and enforce compliance,
and see what may be causing compliance issues.
Now you can manage policy across the AKS clusters
in your environment.
Similar to the other policies we have released,
we have built in-policies for Azure Kubernetes service.
This policy definition, for example,
Enforce unique and Ingress hostnames across your name space,
allows me to control what host names
can access the services inside your Kubernetes clusters.
And you can use the same exact experience
that you'd used earlier,
to now target and assign this policy
to a specific management group in your environment.
And if there are special cases where I might want to
exclude this policy from a dev test subscription
or a dev test management group,
we provide you the flexibility to do that, as well.
- Awesome, this is great to see,
because AKS is one of the fastest growing services
in Azure.
- Right, as I've shown you today,
our goal is to really give you
a consistent way to govern your entire Azure environment.
And all these capabilities I've shown you today,
are actually free of charge.
- Great. Thanks so much for joining us, Satya.
Where can people go to learn more?
- Azure Management groups, cost management,
policy, and blueprints are capabilities
that are available today.
And as I mentioned we'll continue to add more
compliance blueprints over time, as well.
You can learn more at the link shown below.
And you can sign up
for the preview of Azure Governance Capabilities
for Kubernetes at the following link, as well.
- Fantastic stuff.
And of course, keep watching Microsoft Mechanics
for the latest in tech updates.
Click here to subscribe, and thanks for watching.
[techno Music]