Azure management and governance

Cost management

Factors that affect cost

Ways to cut cost: right-size or stop idle VMs, deallocate rather than just shut down, autoscale, pick cooler storage tiers, use reservations for steady load, use Spot for interruptible work, and apply Hybrid Benefit. Azure Advisor flags many of these.

Pricing calculator

The Azure pricing calculator is a free web tool that estimates the monthly cost of services you plan to use: choose services, region, size, tier and quantity and it shows a running estimate you can export and share. It is for future costs. The Azure TCO calculator (where available) compared a move from on-premises with Azure running costs; Microsoft has been steering people to the pricing calculator and Azure Migrate business cases for this.

Cost Management capabilities

Microsoft Cost Management (in the portal, with billing) is for spending you already have or are on track to have:

• Cost analysis: break down and visualise costs by resource, resource group, tag, service and time.
• Budgets: set a spending limit for a scope and trigger alerts (email or action groups) at thresholds. Budgets alert, they don’t stop resources.
• Cost alerts for budgets, credits and anomalies, plus recommendations and exports for reporting.
• Resources can be allocated to teams using tags and scopes (chargeback and showback).

Tags

Tags are name/value pairs (for example environment: prod, costcenter: 1234) attached to resources, resource groups and subscriptions. Uses: group costs and report by team or project, organise resources, automation and operations.

Key facts:

• Tags are not inherited by default: a tag on a resource group doesn’t appear on its resources. Azure Policy can enforce a tag or copy it down from the group.
• A resource can have up to 50 tags in most cases.
• Tags are metadata: they don’t control access or change behaviour.

Governance and compliance

Microsoft Purview

Microsoft Purview is a family of data governance, risk and compliance solutions. In Azure, it helps you:

• Discover and map data across on-premises, multicloud and SaaS (a data catalogue), classify sensitive data and trace lineage.
• Manage compliance: information protection, data loss prevention, retention, audit and eDiscovery, insider risk, and a Compliance Manager that gives a compliance score.

Think “know where data is, classify it and meet regulations”, not “enforce a configuration on resources”.

Azure Policy

Azure Policy evaluates resources against rules and either audits or enforces compliance. It governs resource properties, not user permissions.

• A policy definition holds the rule; an initiative is a group of definitions toward one goal (for example a regulatory standard); an assignment applies it at a scope (management group, subscription, resource group) and is inherited downward, with optional exclusions.
• Common effects: Audit (flag non-compliance), Deny (block creation or update), Modify (change properties such as add tags), DeployIfNotExists (deploy a related resource if missing), Append.
• Examples: allow only certain regions, allow only specific VM sizes, require a tag, require HTTPS on storage, require encryption.
• Policy checks existing resources too and shows compliance. Remediation tasks can fix non-compliant resources.

Resource locks

A resource lock prevents accidental deletion or modification whatever a user’s permissions. Two types:

• Applied to a subscription, resource group or resource, and inherited by everything beneath.
• Even an Owner is blocked; to remove the resource you must first remove the lock (needs the right permission).
• ReadOnly can have surprising side effects: some operations that look like reads (such as listing storage keys) are blocked.

Policy vs RBAC vs locks

Managing and deploying resources

Azure portal

The Azure portal is the browser-based graphical console for creating, managing and monitoring resources. It offers dashboards, resource blades, and Cloud Shell. Good for exploring and one-off tasks; poor for repeatable bulk changes.

Cloud Shell, CLI and PowerShell

CLI and PowerShell do the same job; choose by preferred syntax. Both enable scripting and automation, which is more repeatable than clicking in the portal. Cloud Shell is the way to run either with no local installation.

Azure Arc

Azure Arc extends Azure management to resources outside Azure: on-premises servers, other clouds, Kubernetes clusters and (through Arc-enabled data services) databases. You can apply Azure Policy, tags, RBAC, monitoring, and Defender to them from one control plane, and run Azure services on them. It’s the answer for “manage on-premises and other clouds the Azure way”.

Infrastructure as code

Infrastructure as code (IaC) describes infrastructure in text files that you version, review and deploy automatically. Benefits: repeatable and consistent environments, fewer manual errors, version history and peer review, faster provisioning, and easy teardown. Approaches:

• Declarative: describe the desired end state and the platform works out how (ARM templates, Bicep, Terraform).
• Imperative: write the steps (scripts with CLI or PowerShell).

Azure Resource Manager and ARM templates

• Azure Resource Manager (ARM) is the management layer for Azure. Every request from the portal, CLI, PowerShell, SDKs or REST APIs goes through it, where it is authenticated, authorised (RBAC, Policy, locks) and then passed to the resource provider. It gives consistent results from any tool, and lets you deploy, update and delete resources together as a group.
• ARM templates are declarative JSON files describing resources and their properties. Deploying the same template repeatedly yields the same result (idempotent). They support parameters, variables and dependencies between resources.
• Bicep is a simpler, cleaner language that compiles to ARM JSON and is the preferred way to author. Terraform is a non-Microsoft multi-cloud IaC tool that also works on Azure.

Monitoring tools

Azure Advisor

Azure Advisor is a free personalised consultant that analyses your existing resources and gives recommendations across five pillars: reliability, security, operational excellence, performance and cost. It can show estimated savings and let you act on or postpone each item.

Azure Service Health

Shows how Azure’s own services are affecting you, in three parts:

Use Service Health when an Azure outage or planned maintenance may affect you; use Azure Monitor for the state of your own application.

Azure Monitor

Azure Monitor collects, analyses and acts on metrics and logs from Azure, on-premises and other clouds.

• Metrics are numeric time series (CPU %). Logs are records and events.
• Log Analytics is the tool and workspace for querying logs with Kusto Query Language (KQL).
• Azure Monitor alerts notify or act when a condition is met (metric threshold, log query result, activity log event). Alerts use action groups (email, SMS, push, webhook, runbook, Logic App).
• Application Insights is application performance monitoring (APM) for web apps: request rates, response times, failures, dependencies, exceptions, user behaviour, live metrics and distributed traces.
• Also in the family: autoscale settings, workbooks and dashboards, the activity log (subscription-level control-plane events such as who deleted a VM).

Which monitoring tool?