EEdukron DevOps Library
Microsoft AzureFoundation15 submodules

Azure Fundamentals and Governance

Structure Azure estates so ownership, policy, access, cost, resilience, and lifecycle rules apply consistently from the tenant down to individual resources.

How this module works

From concept to production evidence

Use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Learning outcomes

  • Navigate the Azure control plane
  • Design management-group and subscription hierarchy
  • Apply tags, locks, policy, and RBAC
  • Select regions and availability zones
  • Track and optimize cloud cost

Flow diagram

Azure Fundamentals and Governance end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

  1. 01
    Design hierarchyAzure Fundamentals and Governance stage 1: design hierarchy with an auditable result before the next stage begins.
  2. 02
    Assign ownershipAzure Fundamentals and Governance stage 2: assign ownership with an auditable result before the next stage begins.
  3. 03
    Apply policyAzure Fundamentals and Governance stage 3: apply policy with an auditable result before the next stage begins.
  4. 04
    Deploy resourcesAzure Fundamentals and Governance stage 4: deploy resources with an auditable result before the next stage begins.
  5. 05
    Protect changesAzure Fundamentals and Governance stage 5: protect changes with an auditable result before the next stage begins.
  6. 06
    Measure cost and complianceAzure Fundamentals and Governance stage 6: measure cost and compliance with an auditable result before the next stage begins.

Integrated hands-on lab

Create a governed Azure landing structure

  1. Design management groups and subscriptions
  2. Define resource-group standards
  3. Apply tags and policy
  4. Assign least-privilege RBAC
  5. Configure budgets and compliance reporting

Complete module contents

15 full submodule notes

Read in order
01

Subscriptions

Subscriptions governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
02

Management Groups

Management Groups provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
03

Resource Groups

Resource Groups provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
04

Azure Regions

Azure Regions provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
05

Availability Zones

Availability Zones turns service behavior into evidence that supports detection, diagnosis, capacity decisions, and measurable reliability within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
06

Azure Portal

Azure Portal governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
07

Azure CLI

Azure CLI provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
08

Azure PowerShell

Azure PowerShell provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
09

ARM

ARM provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
10

Azure Resource Manager

Azure Resource Manager defines the major responsibilities, boundaries, and control flow that engineers use before selecting an implementation detail within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
11

Tags

Tags provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
12

Resource Locks

Resource Locks controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
13

Azure Policy

Azure Policy controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
14

RBAC

RBAC controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes
15

Cost Management

Cost Management provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Fundamentals and Governance. It is not an isolated definition: its value appears when it supports use the Azure hierarchy deliberately: organize subscriptions under management groups, place related resources in lifecycle-aligned resource groups, then enforce policy, locks, tags, RBAC, and budgets.

Open full notes