>> Hey, everybody, stay tuned,
where Deepa and I will be talking about
governance and introducing that methodology.
[MUSIC]
>> Welcome to the Azure Enablement show.
In this show, we're talking to Microsoft expert about some of
the technical questions or obstacles you
may encounter along your Cloud adoption journey.
Now, in previous episodes,
we were talking about landing zones and how they can
help accelerate your deployment within Azure.
Today, we're changing topic and
we're going to be introducing governance,
and to help introduce that topic with me is Deepa.
Welcome to the show, Deepa.
>> Hi, Sarah. Nice to be here.
>> It's awesome to have you back.
Now, governance is one of those words or
topics that often gets a collective groan when you mention it
in a room because it can often mean that your leadership team
is trying to make you do something or make your job harder,
or at least that's how it feels sometimes.
Deepa, could you maybe explain
what governance actually means
and what we're going to be talking about?
>> Absolutely. Governance is really all about striking a balance,
the balance between heavy control and compliance on
one side and delivering on speed and results on the other side.
We need this balance to
satisfy the needs of finance, IT operations,
security, risk management with
the business units who need to
deliver services to their customers.
We need to implement
proper Cloud governance and this requires proper business policy,
protective guardrails, and skilled people that take
a consistent disciplined approach to governance.
It's a continuous cycle of evaluating risk and
defining or optimizing policies to address the risk.
There is really no endpoint as such,
but we do need this balance.
>> Awesome. It's good to hear that.
Now, governance sounds like it's going to be a big topic.
Do we split it up into
different sections to make it more digestible?
How does our methodology work?
>> Yeah. So governance is one topic,
but we approach it in steps.
First of all, when we approach the governance methodology,
we need to start with understanding
the risks to the business in moving to
the Cloud and understand the risks based on data classification,
the need for service availability, and application criticality.
It is important to gauge the tolerance for
risk as this will determine the scrutiny of the policies.
Once you have the risk factors that have been determined,
you would need to document policy statements which would
mitigate the risks and draw boundaries for Cloud adoption.
Another important step in defining
corporate policy is to have a clear statement on how to monitor,
enforce, and remediate against any violations of those policies.
Now, this is one of the most fundamental shifts
within a digital operating model,
the move from a process-based model of
security and compliance to a policy-based one.
In Azure, we have a whites or four policies to Azure policies.
An Azure policy allows defining complex set of
rules which can be enforced at both provisioning time and ongoing.
Once we have the corporate policy defined,
the next step is to begin implementing these policies around
the five key disciplines of governance
as we have defined in the Cloud Adoption Framework.
The five disciplines as you can see on
the screen in no specific order are cost management,
security baseline, resource consistency,
deployment acceleration, and identity baseline.
Now, these five disciplines we have learned that they
are consistent across most of our customers.
There are some minor nuances or there will be
some very minor nuances based on industry,
but you can expect a baseline governance to be
established across these five disciplines consistently.
Now, we have to keep in mind that this model for governance,
it does not align with organizational structure.
However, people from different parts of the organization
are critical component to a successful governance implementation.
>> That sounds really good,
and I'm quite intrigued about
the five disciplines that you mentioned.
Could you maybe introduce us to those, please?
>> Absolutely. Let's start with cost management.
From all our customer interactions,
cost is the number 1 area where they want to start the dialogue.
Customers are concerned about how the Cloud cost
can escalate without proper governance in place,
and they also want to have a good fiscal accountability.
The primary purpose of this discipline is to
identify the potential Cloud-related risks related to IT
spend and provide risk mitigation guidance to the business
and IT teams responsible for
deploying and managing Cloud resources.
Here within this discipline, customers will address policies
around cost control, budgeting, forecasting,
and cost allocation in various business units.
We discussed this at the platform level
here within the Cloud Adoption Framework,
but one may need to address cost at a workload level,
and that is where we can get
the required guidance and
support from the Well-Architected free book.
The second discipline is security baseline.
Now, the good news here with the security is that it is
no longer a big blocker as it was in the past.
It is, however, important that we help our customers identify
the key policies by which to
mitigate risks around the security of resources,
data, connectivity, and storage.
These policies could be related to data encryption, connectivity,
accessibility of public IPs,
or developing a standard for all Azure platform services.
The third discipline that we want to
talk about is resource consistency.
It is important for customers to have
a well-architected Cloud environment.
They need to set up for resilience,
management, and efficient operations.
In this discipline, we look at
ideas of self-service, service catalogs,
and a platform to efficiently enable various business units to
move at the speed which they require
without having to wait for IT.
Now, in this discipline,
we want to ensure that resources are
consistently configured in such a way that they can
be discovered by IT operations and they're included into
recovery solutions and can be onboarded
into repeatable operations processes.
This is one of
the most important areas to focus on because some of
the other capabilities of the Cloud rely on
a strong underlying hierarchy and established platform.
The fourth discipline that we will
talk about is identity baseline.
We do need to emphasize on identity in
the Cloud finally to have a strong set of policy
and on identity to enable accountability through
role-based authentication or RBAC and
giving our users correct access to the right data,
resource creation, servicing, reporting, and administration.
Last but not the least, deployment acceleration.
Now, this ties very closely with resource consistency.
Here, we want to ensure that we have
a consistent way of getting
resources deployed to the Cloud environment.
Templatized deployment and infrastructure as
code helps remove errors which can arise
from having people doing manual tasks,
and by doing this, we can manage,
or create patch, update,
and upgrade in a correct manner.
This discipline here ties to the speed and efficiency
aspect of the balance that we talked
about at the beginning of the episode.
We do have videos that go into each of these pillars in
much detail and we can understand how each can be implemented.
>> They all sound awesome.
What I'm unsure about is we have to actually start,
so how do I start to think about each of
the decisions I'm going to have to
make within each of those pillars?
Deepa, do we have anything that can help
prioritize where to start or guide us through that journey?
>> Yeah. The Cloud Adoption Framework or the
governance methodology within the framework,
it gives our customers the ability
to look at governance across their environments.
The implementation of governance will
differ depending on the Cloud they're intending to govern,
and we know that majority of our customers
today are choosing a multi-Cloud strategy.
Going back to one of
our principles for the Cloud Adoption Framework,
we want to make sure that we are truly helping
our customers take next steps in a tangible way,
and the governance benchmark assessment that we have
created enables our customers, our Microsoft representative,
or a partner that's working with
the customer in defining business goals and objectives,
and then by each discipline,
evaluating what is important and the current state.
At the end of this assessment,
we provide our customers a gap analysis and
suggested areas to focus on immediately for the next steps.
These are targeted areas where one can start to define MVPs or
a minimum viable product so they
have next set of actions and deployment plans.
The customers can have options on how to build or deploy the MVPs.
They can either self-serve using the resources we have pulled
together at the documentation for Cloud Adoption Framework,
and the documentation provides customers resources,
tools, and templates for implementation.
We also have partners who have offerings
that help build an evolve
based on the customer's need and complexity.
>> They sound really good and they've built
to help you guide you along that journey.
What I'm thinking about is,
when you should embark on that journey,
say, in your governance?
Is there a right point or a wrong point,
or is there any point you can do
it within your Cloud adoption journey?
>> Ideally, you want to start having
the conversations around governance
at the beginning of your journey.
But sometimes most of our innovations happen with the business,
and once the business team start creating many workloads,
there will come a critical mass where
striking that balance becomes important.
That's definitely where
the governance conversations start to take place
and the need for establishing that balance comes into play.
>> That's amazing. Thank you so much for that overview, Deepa.
If people are wanting to get started on
their governance journey, where can they go?
Is there any resources they should actually start to look at?
>> Yes. I talked about the governance benchmark assessment,
so that's definitely a place to start and that gives the
customers the gap analysis
that talks about whether you really need to plug in.
What I'm showing on the screen here is results of an assessment.
You can see that from this assessment here,
the resource consistency areas where there is a gap.
You can look at the next steps that talk about, hey,
go learn more about resource consistency,
go look into Azure Blueprints that can help you in the series,
or go find partners that can help with the governance setup.
This is definitely a place to start.
The other area is to look for the partners that we have.
You can get to this page by going into Azure.com, and there,
you can look at all the partners that we
have aligned to or that have
offers for the governance methodology
for the Cloud Adoption Framework.
We definitely have comprehensive documentation here,
and you can look into the Get
Started section of the Cloud Adoption Framework.
The Get Started section has multiple scenarios that we
have identified or some common scenarios
that we have identified across our customers,
and we have aggregated some scenarios
that revolve around the governance methodology.
You can definitely take a look at that.
Of course, the governance methodology
itself has a lot of guidance and a lot of details.
There are governance guides that talk
about some standard and enterprise
governance guides and governance guide
for complex enterprises as well.
This is definitely an area to dig into.
Last but not the least,
we have module in Microsoft Learn.
This is a self-paced learning module and you can go and look at
all the different guidance that we have here
and get a better understanding
of governance within the Cloud Adoption Framework.
>> Awesome. Thank you so much,
those resources look really helpful.
Also, thank you for your time, Deepa.
It's been good talking about governance.
If you want to check out some of
those resources that Deepa mentioned,
please do hit up our description box
where we'll be dropping links to them.
Stay tuned for future episodes of the Azure Enablement show.
We are going to be diving into
those five pillars that Deepa introduced us to.
[MUSIC]