thank you for joining us welcome to the
first episode of the azure academy's
windows virtual desktop
specialty study guide this is for the
az140 certification
in this video we're going to be focusing
in on our resource groups
subscriptions and management groups what
are they why do we need them
and what do they have to do with wvd
[Applause]
i'm dean sefola and this is the azure
academy well it's always a good practice
to begin with the
end in mind so i know you want to deploy
windows virtual desktop and get your
environment
up and running and get all prepared for
the certification
exam so before you start building and
deploying
your host pools and all of your clients
you need to prepare your azure
environment so today i want to share
with you a very high level on some azure
governance features
that will help you to organize your
resources control
costs and secure your organization now
don't worry if governance sounds like
something big and complicated and scary
it isn't it just think of it as the
rules of the environment
so this is the policies permissions and
compliance
in your azure world that should all be
there before you build
any kind of workload including windows
virtual desktop so this will just be a
short overview and if you're interested
in more on this topic just go right to
the azure academy channel and while
you're here
go ahead and click that subscribe button
if you haven't done so already as well
as the notification bell
on the video that you're currently
watching because the videos in this
study guide series are going to come out
just as fast as i can do them
so it won't be on my normal schedule of
every sunday
so that way you have enough time to
study everything before you go and take
the test
so more on governance you can find over
in the playlists
and you can see there's a bunch here on
a lot of different topics and the
governance playlist is
right over there so let's talk about
organizing the cloud now in the skill
sheet it talked about
recommending the right management group
subscription and resource group for your
wvd resources
so what does organizing those resources
have anything to do with wvd
well it's because of what those things
do it's all of the permissions
and policies compliance all of that
stuff that's going to
impact your wvd resources if you're
trying to get to
30 users on a particular vm but the only
skus that you're allowed to use
are ones that you can only get to 10
users on a vm
you're not going to get to the density
numbers that you want and this could
impact cost
this is where we're going to set up our
management hierarchy so we can
consistently
apply those rules the access controls
policies permissions and
compliance for all of our resources
across
all of azure now in azure we have four
possible
levels of management scope that is the
management groups
subscriptions resource groups and then
resources and this is a waterfall
hierarchy so
things that you apply at the top will
flow
down to the bottom now management groups
let's talk about that
if your organization has more than one
subscription you'll need a way to manage
everything
across those subscriptions and so
management groups are a container
that will help you apply your governance
conditions
those permissions policies and
compliance across
all of those subscriptions from one
place all of those subscriptions will
automatically
inherit all of those conditions that you
applied at the management group
above it and management groups
themselves can be
nested and we can have a hierarchy kind
of like this you can see we have at the
top a single
group and then different layers of
management groups and subscriptions and
of course underneath all of that is
resource groups and resources
one good thing to note here is that all
of the subscriptions that you want
under a single management group need to
all be associated with the same
azure active directory tenant going back
down our waterfall one level we have
subscriptions a subscription can be
thought of as a
billing entity it is also something that
is limited by quotas
which means the amount of resources that
you can create now some of these limits
can be
raised if you just put in a support
ticket for example the number of cores
for a vm sku
in one particular region subscriptions
also help you to
manage your cost because everything in
that resource group's cost will roll
up to the subscription as a whole and
all of those governance things that we
talked about in the management group
section will all be applied on top of
the subscription
and everything from here flows down to
our resource groups so let's talk about
that now a resource group is a logical
container in
azure in which resources are placed and
managed
resource groups must be located in a
azure region
and its purpose is to contain those
resources and
metadata about those resources like
permissions
locks deployments and more and the
reason for building out resource groups
is for organizational purposes
specifically around the area of life
cycle management
so you build a resource group it's
because everything in that group
is associated together so they should be
built together
updated together deleted together that's
the general idea
and just like with the subscriptions the
resource groups will inherit any
policies permissions etc
that's in the subscription above them
and at the bottom of the waterfall we
have our resources
these are instances of a service that
you would create like your wvd host
pools
virtual machine storage accounts
networks etc
all resources must be in a resource
group and they will inherit
those policies permissions and
everything just like everything
above it in the waterfall and one
important thing to keep in mind is that
your resources do not have to be in the
same region
as the resource group so you may be
wondering if a resource group has to
have a location
and the resources can have a different
location why does the resource group
location matter at all well it's the
resource group that stores
metadata about those resources so when
you specify
a location for a resource group you're
saying that's where i want the metadata
stored
so you may have some compliance or data
sovereignty restrictions
that need you to keep that data in a
specific region
now there's two final things that i'll
mention around this idea of governance
and organizing your resources and that
is a naming convention
and tags so having a good consistent
naming convention
across all of your different resource
types is going to help
everyone to know where things are and
what they do secondly
tags tags are additional metadata that
you can attach to your azure resources
or resource groups
and if you've watched any of my videos
in the past you know that everything
should always have
tags but why what do they do for us now
a tag is a key and
value pair and that's the greatest thing
about tags is i can make them anything
that i need to the bad thing about tags
is
i can make them anything i want to now
you may have a
tag like application and your values
could be like
windows virtual desktop devops networks
etc but what if somebody made a tag of
application
mickey mouse and that kind of tag
probably doesn't add value to you
so coming up with a good tagging
strategy of what adds value in
your environment will help you to not
only organize
things and understand the cost the
billing who owns it who's responsible
for it who supports it
now these things can be implemented
through azure policy automatically on
your resource groups and resources
but you can also automate against them
let me give you a quick example and
we're done i've deployed my brand new
vms in the month of february based on
my february updated image i've tagged
all of the systems with a
key of image and a value of february
now it's march my new march image is
ready and i've provisioned all of the
vms that i need for wvd
and now i need to clean up all those old
systems i have an
azure runbook and it is looking for any
vm that has a
tag of image equals february and the
runbook has
multiple steps where it will first put
all of those february systems into drain
mode
then it will turn them off and then it
will delete and clean up after them and
this process could be
further automated by tying it into your
devops pipeline
so that when you provision those march
vms that is a trigger
that initiates the runbook and now your
update stream is fully automated
so hope this has been a help to you and
knowing how to organize your resources
as well as understanding how this all is
going to impact wvd
the rest of the playlist for this study
guide is right over here as well as the
latest video
at the azure academy up top and i'm
going to keep these videos coming just
as fast as i can so go ahead and click
that playlist for the next episode
happy learning