Azure landing zones, Policy/PIM, hybrid và operations
Management group/subscription hierarchy là governance scope; landing zone phải codify identity, policy, connectivity, management, security và application vending.
Tenant hierarchy và landing zones
Microsoft Entra tenant → management groups → subscriptions → resource groups/resources. Azure Landing Zone platform/application subscriptions và archetypes đặt policy/RBAC/connectivity/management baselines; accelerator là implementation starting point, cần versioned IaC/customization and upgrade path.
Policy và RBAC
Azure Policy evaluates resource properties with deny/audit/modify/deployIfNotExists effects; initiatives group definitions, assignments inherit down scope, exemptions require owner/expiry. Policy does not replace RBAC; RBAC grants data/control-plane actions by principal/role/scope and deny assignments may constrain. Test policy remediation/managed identity and existing-resource compliance.
PIM và identity
Entra PIM makes eligible time-bound role activation with MFA/approval/justification/access reviews. Managed identities avoid stored workload secrets; federated credentials for CI. Conditional Access, emergency access accounts, privileged access groups and identity logs; subscription Owner/User Access Administrator assignments tightly governed.
Connectivity
Hub-spoke or Virtual WAN, Azure Firewall/NVA, Private Link/private endpoints, DNS Private Resolver and DDoS/WAF patterns. Peering is non-transitive unless routing appliance; UDR/BGP propagation/asymmetry/SNAT and centralized egress costs matter. ExpressRoute plus VPN redundancy and zone/region/provider failure tests.
Management và security
Azure Monitor/Log Analytics, Activity Logs, diagnostic settings, Defender for Cloud and Microsoft Sentinel centralization. Diagnostic settings/resource types/retention/export vary; policy deploys but identity/region/data residency/cost need design. Immutable storage/WORM where required and separation of security operations access.
Quotas
Subscriptions/regions/resources/VM families/network/IP/API have default limits; quota increase capacity differs by region/availability. Inventory via Quotas/Resource Graph/metrics, reserve failover and scale headroom, include deployment concurrency and provider throttling. Subscription split can isolate quotas but increases governance/network/data complexity.
Migration
Azure Migrate discovery/assessment/dependency, landing zone readiness and migration waves. Database Migration Service, Data Box, Storage Mover/Data Factory and app modernization by downtime/data/change constraints. Cutover includes DNS, identity/RBAC, private connectivity, monitoring, backup, rollback and source decommission.
Security incident
Scope tenant/subscription/resource identities, sign-ins/audit/activity/resource logs and Defender/Sentinel evidence. Revoke sessions/credentials, disable or isolate identities/resources, preserve disks/snapshots/logs, inspect persistence via role assignments, app registrations, federation, automation/runbooks and policies. Tenant Global Administrator compromise crosses cloud resources and SaaS.
DR
Availability Zones vs paired/multiple regions; Site Recovery, Backup vaults/immutability, geo-redundant data options and application-level consistency. Test target quotas, private DNS/routes, Key Vault/managed identities, dependencies and failback. Region pairing does not guarantee automatic application recovery.
FinOps
Management-group/subscription/resource-group/tag cost scopes, Cost Management exports/budgets/anomaly and Azure Advisor. Reservations/savings plans/Spot after stable usage; Hybrid Benefit/license constraints. Audit idle compute/IP/disks/snapshots, Log Analytics ingestion/retention, Firewall/NAT/egress/peering and zone/region transfer; allocate shared platform costs transparently.