Skip to content

Structure

Disclaimer

This page is still under development and is not ready for use. The information provided is subject to change. Use at your own risk.

Overview

This document outlines the structure of management groups in an Azure landing zone, leveraging the Microsoft Well-Architected Framework to ensure a robust and scalable architecture.

Management Group Hierarchy

The management group hierarchy is designed to provide a logical structure for resource management and governance. Below is a breakdown of the management group structure:

Root Management Group

The root management group serves as the top-level container for all other management groups and subscriptions.

graph TD
    classDef standard stroke-width:0px,fill:transparent,color:#000;
    %%classDef standard stroke-width:0px,fill:#FFFFFF;
    TenantRootGroup:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: TenantRootGroup};
    Platform:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Platform};
    Solution:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Solution};
    Sandbox:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Sandbox};
    Archive:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Archive};
    Identity:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Identity};
    Shared:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Shared};
    Connectivity:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Connectivity};
    Security:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: Security};
    DataPlatform:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: DataPlatform};
    VirtualDesktop:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: VirtualDesktop};
    AI:::standard@{img: https://www.azureperiodictable.com/azure/icons/Management/Management%20Group.png, h: 60, constraint: on, label: AI};

    TenantRootGroup --> Platform;
    TenantRootGroup --> Solution;
    TenantRootGroup --> Sandbox;
    TenantRootGroup --> Archive;
    subgraph PLZ[Platform Landing Zone];
      Platform --> Identity;
      Platform --> Shared;
      Platform --> Connectivity;
      Platform --> Security;
    end;
    subgraph SLZ[Solution Landing Zone];
      Solution --> DataPlatform;
      Solution --> VirtualDesktop;
      Solution --> AI;
    end;

    style PLZ fill:#008AD7,stroke:#008AD7,fill-opacity:0.2,stroke-dasharray: 5 5;
    style SLZ fill:#008AD7,stroke:#008AD7,fill-opacity:0.2,stroke-dasharray: 5 5;

Subscription Groups

Subscription groups are used to organize subscriptions based on their purpose or function.

  • Subscription Group 1: Contains subscriptions related to operational workloads.
  • Subscription Group 2: Contains subscriptions related to development and testing workloads.

Management Groups

Management groups are used to organize and govern resources at a higher level.

  • Operational Management Group: Contains management groups related to operational resources.
  • Security Management Group: Contains management groups related to security resources.
  • Compliance Management Group: Contains management groups related to compliance resources.
  • Operational Insights Management Group: Contains management groups related to operational insights resources.

Management Group Components

Each management group can contain the following components:

  • Policies: Define governance rules and enforce compliance.
  • Role Assignments: Assign permissions to users, groups, or applications.
  • Resource Groups: Organize resources logically.
  • Templates: Define standardized resource configurations.
  • Tags: Apply metadata to resources for cost management and resource identification.
  • Governance Framework: Integrate with Microsoft Well-Architected Framework for continuous improvement.

Management Group Policies

Policies are used to enforce governance rules and ensure compliance. Below are some example policies:

  • Subscription Creation Policy: Ensures that only authorized subscriptions are created.
  • Resource Tagging Policy: Ensures that all resources are tagged with necessary metadata.
  • Security Policy: Enforces security best practices.
  • Compliance Policy: Ensures compliance with regulatory requirements.

Role Assignments

Role assignments define permissions for users, groups, or applications. Below are some example role assignments:

  • Subscription Owner: Grants full access to a subscription.
  • Subscription Reader: Grants read-only access to a subscription.
  • Resource Manager: Grants permissions to manage resources.

Resource Groups

Resource groups are used to organize resources logically. Below are some example resource groups:

  • Operational Resources: Contains resources related to operational workloads.
  • Development Resources: Contains resources related to development workloads.
  • Test Resources: Contains resources related to testing workloads.

Templates

Templates define standardized resource configurations. Below are some example templates:

  • Virtual Network Template: Defines a standardized virtual network configuration.
  • Storage Account Template: Defines a standardized storage account configuration.
  • Web App Template: Defines a standardized web app configuration.

Tags

Tags apply metadata to resources for cost management and resource identification. Below are some example tags:

  • Project: Identifies the project or initiative associated with a resource.
  • Environment: Identifies the environment (e.g., PROD, ACC, TST).
  • Cost Center: Identifies the cost center associated with a resource.

Governance Framework

The Microsoft Well-Architected Framework is integrated into the management group structure to ensure continuous improvement. Below are some example governance practices:

  • Governance Dashboard: Provides a view of governance status and recommendations.
  • Operational Readiness Reviews: Conducts periodic reviews to ensure operational readiness.
  • Security Audits: Conducts regular security audits to identify and remediate vulnerabilities.
  • Compliance Assessments: Conducts regular compliance assessments to ensure adherence to regulatory requirements.

Conclusion

The structure of management groups in an Azure landing zone is designed to provide a logical and scalable architecture for resource management and governance. By leveraging the Microsoft Well-Architected Framework, the structure ensures continuous improvement and compliance with regulatory requirements.