This is Part 7 of Azure tutorial. In our previous two videos, we discussed azure resource groups and
the benefits they provide. In this video, we'll discuss azure management groups and subscriptions.
Now, if there are only a few subscriptions in your organization, then it's relatively simple
to manage them independently. However, in an organization there are usually many employees
and maybe, many applications. If all these employees are provided azure subscriptions
and if they start creating azure resources at will, it may soon become difficult to control,
manage and track who is creating what resources and eventually the costs may go out of control.
So, azure has four levels of management scope to organize, secure, manage and track the costs. So,
the following image from MSDN shows the four levels of management scope and the relationship
between them. Management group is at the top of the hierarchy. All subscriptions in a management
group automatically inherit the conditions or settings specified at a management group level.
So, a management group is like a container for all your subscriptions. Just like how there can be
multiple subscriptions there can also be multiple management groups in an organization. Again,
the following image is from MSDN and it shows, how we can build a flexible structure of management
groups and subscriptions to organize our resources into a hierarchy for unified policy and access
management. Now, for whatever reason, let's say in our organization we want to allow azure resources
to be created only in the East US azure region. One easy way to do this is to create such a policy
at the IT management group level. This policy is then automatically enforced on all the management
groups and subscriptions that are descendants of the IT management group. The descendants will not
be able to alter the security policy in any way and it is also applicable to all resources under
those subscriptions. So, obviously governance becomes much easier. Let's quickly look at this
in action. At the moment, I'm on the azure portal home page. One way to create a management group
is to click on this "Management groups" icon. If you don't find it here, as usual click on this
"More services" link. This takes us to azure "All Services" page. Search for "management"
and then click "Add management group". Two things that we need to provide when creating a management
group is the management group id and the display name. Management group id cannot be changed after
creation. We can change the display name if we want to. Since we are creating a management group,
let's use the prefix "mg" for management group and let's say
we're creating this management group for the IT department, so I named it mg-it,
it for information technology. Let's also make the display name same and then click "Save".
There we go, our management group is created. Let's click on the name and navigate to it
and then click on this details link to see the details of this management group. At the moment
as you can see within this management group we don't have any subscriptions. So, let's add
a subscription. At the moment, we only have one subscription - the free trial subscription. So,
let me select that and click save. There we go our free trial subscription is added to this
management group. Next, let's create a policy. For that, obviously click on this policies link.
At the moment we don't have any policies assigned at this management group level and we can see that
message right here - No assignments to display within the given scope and this is the reason
why we have at the moment 100% overall resource compliance. Now, let's assign a policy. For that,
click on this link. As you can see, at the moment the scope is IT management group, that is,
we want to enforce this policy at our IT management group level, but we can
change the scope if we want to, by clicking on this "launch scope selector" button and here
we can see our management group. From here, we can drill down to the subscription level.
When I select the free trial subscription, we can further drill down to the resource group level,
but we want to apply this policy at the management group level. So, let me cancel this.
Next, Exclusions. If you want to, you can exclude certain resources from this policy assignment.
Again, for that click on this button and from this drop down list select all your subscriptions. In
our case, you only have one subscription. From there, we drill down further to our resource
group and here we can optionally select the resources that we want to exclude from this policy
assignment. In our case, we want this policy to be applicable to all resources. So, let's cancel.
Next policy definition. For that, click on this button. As you can see, as of this course
recording there are 472 built-in policies. By the time you watch this course, this may change. Now,
if none of these built-in policies meet your requirement, you can always create your own
custom policy. Now, you can use the search text box to search for the policy that we
are looking for. In our case, we are looking for this "Allowed locations" policy. As you can see
from the description here, this policy enables you to restrict the locations your organizations
can specify when deploying resources. Use this to enforce your geo-compliance requirements. So this
is the policy that we want. Let's select that. Assignment name - It defaulted to the policy name.
You can change it, if you want to and then you can also provide a meaningful description if you want
to and then click next. On this page, you specify the locations that you want to allow. In our case,
we want to allow only East US region. So, let's select that and then review and create.
There we go. Our policy "Allowed locations"
is now assigned at this scope that is at our IT management group level. Now,
let's navigate to "All services" page and then create a storage account.
Subscription is free trial. Let's select a resource group and then provide a meaningful name.
and location let's leave it at South India. Try to review and create this and see what happens
There we go. Validation failed and if we click here to view details. So, the resource
that we are trying to create, in our case, the storage account was disallowed by this policy
"Allowed locations". If you remember we assigned this policy at the IT management group level. So,
this means, if any subscription under this IT management group tries to create a resource
in a region other than East US, they will violate this policy and run into this error.
So, management settings like policies and role-based access control can be applied at
any of the management levels. The level you select determines, how widely the setting is applied.
Lower levels inherit settings from higher levels. For example, when you apply a policy
to a subscription, that policy is also applied to all resource groups and resources in that
subscription. In general, it makes sense to apply critical settings at higher levels and project
specific settings at lower levels. Now, what is a subscription? Well, a subscription sits under
a management group. It associates user accounts and the resources that were created by those user
accounts. Each subscription has limits or quotas on the amount of resources you can create and use.
Organizations can use subscriptions to manage costs and the resources that are created by
users, teams or projects. Resource groups and resources. We discuss them in detail
in our previous videos in this series. Let's quickly recap. A resource group,
as the name implies is a group of related azure resources. It's basically a logical container into
which azure resources like web apps, databases and storage accounts are deployed and managed.
An azure resource is any service instance that you create. For example, virtual machine,
azure sql database, storage account etc. That's it in this video. Thank you for listening.