Design identity, governance and monitoring solutions

Logging and monitoring

Azure Monitor building blocks

• Metrics are numeric time series, stored for 93 days, near real time, cheap to alert on. Logs are records in a Log Analytics workspace, queried with KQL.
• Activity log: subscription-level control plane events (who created, deleted or changed a resource). Kept 90 days; send it to a workspace for longer.
• Resource logs (data plane) are not collected until you create a diagnostic setting. This is a frequent trap.
• Entra ID logs (sign-in, audit) are routed through Entra diagnostic settings, not through the resource’s own setting.
• Application Insights is application performance monitoring, now workspace-based, collecting requests, dependencies, exceptions and traces through the OpenTelemetry based Azure Monitor distro.
• VM insights gives performance and dependency maps using the Azure Monitor Agent. Container insights does the same for AKS. Network Watcher (connection monitor, flow logs, topology) covers network diagnostics.

Recommending a logging solution: workspace design

• One workspace is the default recommendation: simplest queries, cross-resource correlation, one place for Sentinel.
• Multiple workspaces only when forced by: data residency (a workspace is in one region), separate ownership and RBAC that table-level or resource-context access can’t solve, different retention needs, or a need to split billing.
• Access modes: workspace-context (access to everything the role grants on the workspace) vs resource-context (users see only logs for resources they can access). Table-level RBAC narrows further.
• Retention: interactive retention 30 days by default (90 for Sentinel-enabled and App Insights tables), configurable up to 2 years; long-term retention up to 12 years at low cost, searchable through search jobs and restore.
• Table plans: Analytics (full query, alerting), Basic (cheap, limited query, for high-volume low-value logs), Auxiliary (cheapest, long-term, rare use). Pick Basic or Auxiliary to cut cost on verbose logs you rarely query.
• Commitment tiers lower per-GB price at steady high ingestion. Dedicated clusters (from 100 GB/day commitment) add customer-managed keys and cross-workspace perks.
• Data collection rules (DCRs) define what an agent collects and transformations filter or reshape data before ingestion, which is the cost-control tool.

Routing logs

A diagnostic setting sends resource logs, metrics and the activity log to up to five destinations.

• Storage and Event Hubs must be in the same region as the resource for resource logs (workspaces can be anywhere).
• For a policy that ensures every resource has a diagnostic setting, use Azure Policy with DeployIfNotExists.
• Cross-tenant or multi-tenant collection: Azure Lighthouse for delegated access.
• Agent-based collection (VMs, Arc servers) uses the Azure Monitor Agent with DCRs. The Log Analytics (MMA) agent is retired.

Recommending a monitoring solution

An action group (email, SMS, webhook, Logic App, Function, ITSM) is reused by any alert. Alert processing rules suppress alerts during maintenance. Smart detection and dynamic thresholds avoid hard-coded limits.

Authentication

Microsoft Entra ID

• Entra ID (formerly Azure AD) is the cloud identity provider. Tenants hold users, groups, devices and apps. Licences: Free, P1 (Conditional Access, dynamic groups, hybrid features), P2 (PIM, Identity Protection, access reviews), plus Entra ID Governance add-on (entitlement management, lifecycle workflows).
• Conditional Access is the policy engine: signals (user, group, app, device state, location, sign-in risk) lead to decisions (block, require MFA, require compliant device, require terms of use, session limits). It needs P1.
• MFA and passwordless (Windows Hello for Business, FIDO2 keys, Microsoft Authenticator passkeys) are the strong authentication options. Authentication strengths require phishing-resistant methods for sensitive apps. Security defaults are the free baseline for tenants without Conditional Access. Identity Protection (P2) scores user and sign-in risk and drives risk-based policies.
• Self-service password reset with password writeback (needs Entra Connect) lets cloud resets reach on-premises AD.

External users

Hybrid identity

• Entra Connect Sync is the full-featured agent (multi-forest, device writeback, large attribute filtering). Entra Cloud Sync is a lightweight agent managed from the cloud, good for disconnected forests and simple topologies. Both can run in staging mode for a standby server.
• Seamless SSO signs domain-joined devices in without prompts with PHS or PTA. Hybrid join registers AD-joined devices in Entra. Entra join is for cloud-first devices managed by Intune.
• Add Entra Connect Health to monitor sync and AD FS.

Identity management for workloads

• Managed identities remove stored credentials. System-assigned is tied to one resource and deleted with it. User-assigned is a standalone resource shared by many resources (pick it when several VMs or apps need the same access, or the identity must exist before the resource). Assign RBAC to the identity, and the app asks IMDS for a token.
• Service principals are the app’s identity in a tenant. Use a certificate over a secret, and prefer a managed identity wherever the workload runs in Azure.
• Workload identity federation lets GitHub Actions, Kubernetes and other external issuers exchange their tokens for Entra tokens with no secret. Use it for CI/CD outside Azure.
• Microsoft Entra Domain Services is a managed domain controller (LDAP, Kerberos, NTLM, group policy) for lifting legacy apps that need domain services, without running DCs on VMs. It is a one-way sync from Entra and a separate managed domain.
• App registration defines the application object (redirect URIs, permissions); the enterprise application is its service principal in each tenant, where you assign users and manage SSO and consent. Admin consent workflow controls delegated and application permissions. Use application permissions for daemons and delegated for user-present apps.

Authorization

Azure RBAC

• A role assignment = security principal + role definition + scope. Scopes inherit downward: management group, subscription, resource group, resource.
• Built-in roles: Owner (all, plus assign roles), Contributor (all except assign roles), Reader, User Access Administrator (manage access only). Data plane roles are separate (Storage Blob Data Reader, Key Vault Secrets User).
• Custom roles (actions and dataActions, assignable scopes) when no built-in role fits. Limit of 5,000 custom roles per tenant and 4,000 assignments per subscription.
• Deny assignments are created by Blueprints or managed apps, and block actions even from Owners. Conditions (ABAC) on assignments restrict by attributes such as blob tags.
• Entra roles (Global Administrator, User Administrator) are separate from Azure RBAC roles. Global Administrator can elevate access to manage all subscriptions.
• Privileged Identity Management (PIM, P2) gives just-in-time, time-bound, approval-based activation of roles, with MFA on activation, notifications, and access reviews of the assignments. Use eligible rather than permanent assignments. It covers Entra roles, Azure resource roles and groups (PIM for Groups).
• Prefer groups for assignments, keep to least privilege, and scope as narrowly as the requirement allows.

On-premises resources

Secrets, certificates and keys

• Authorization: prefer Azure RBAC for the data plane (Key Vault Secrets User, Crypto User, Administrator). Access policies are the older model.
• Enable soft delete (always on now, 7-90 days) and purge protection (prevents purging during retention). Required for customer-managed keys in most services.
• Private endpoint plus firewall rules to keep the vault off the public internet. Key rotation policies and certificate auto-renewal with integrated CAs (DigiCert, GlobalSign).
• Key choices for encryption: platform-managed keys (default), customer-managed keys (CMK) in Key Vault or Managed HSM, customer-provided keys (storage per request), and double encryption/infrastructure encryption. Azure Disk Encryption (BitLocker/dm-crypt) vs server-side encryption with CMK and encryption at host (encrypts temp disks and caches too).
• Applications read secrets through Key Vault references (App Service, Functions, App Configuration) using a managed identity. Never put secrets in code, config files or tags.

Governance

Management groups, subscriptions, resource groups

• Hierarchy: tenant root group > up to 6 levels of management groups (excluding root and subscription) > subscriptions > resource groups > resources. Policy and RBAC assigned high up inherit down.
• Management groups apply governance to many subscriptions. Typical design (Cloud Adoption Framework landing zone): Platform (identity, connectivity, management) and Landing zones (Corp, Online) plus Sandbox and Decommissioned.
• Use separate subscriptions for different environments or workloads that need isolation, different limits and quotas, billing separation or distinct RBAC boundaries. A subscription is a unit of scale and billing.
• Resource groups hold resources that share a lifecycle. Deleting the group deletes everything. Resource group location only stores metadata.
• Tagging strategy: enforced by Azure Policy (require tag, inherit from resource group with modify effect). Standard tags: cost centre, environment, owner, application, data classification. Tags are not inherited by default and don’t affect access. They drive cost analysis and chargeback, and each resource allows 50 tags.
• Naming conventions follow the CAF abbreviations (rg-, vnet-, st-). Azure Cost Management budgets and alerts work at management group, subscription and resource group scope.

Managing compliance

• Azure Policy evaluates resources against rules. Effects: Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, Disabled. Group definitions in initiatives and assign at a scope with exclusions.
• Policy governs resource properties (allowed regions, SKUs, required tags). RBAC governs who can act. Policy doesn’t grant access.
• Remediation tasks fix existing non-compliant resources (needs a managed identity on the assignment). Deny affects only new or updated requests.
• Azure Blueprints is deprecated (retiring July 2026). Use Template Specs, Bicep and deployment stacks with policy for repeatable environments.
• Resource locks: CanNotDelete and ReadOnly, inherited down, and override RBAC for the locked action. Use them to guard critical resources.
• Defender for Cloud: Secure Score, recommendations, regulatory compliance dashboard (Microsoft cloud security benchmark, PCI DSS, ISO 27001). Microsoft Purview classifies and governs data across estates (sensitivity labels, data map, DLP).
• Azure landing zone accelerators and Policy-as-code (Bicep or Terraform in a pipeline) keep guardrails consistent.

Identity governance

Most of these need Entra ID Governance or P2 licensing. For guests, use access reviews or entitlement expiry to remove stale accounts.