🏛️ Governance and Enterprise Organization in Azure
Organizational design guide for large companies based on Microsoft's Cloud Adoption Framework (CAF): Management Group structure, isolation boundaries in subscriptions, tag automation and guardrails with Azure Policy and Security Initiatives.
01. Structure of Management Groups & Landing Zones (CAF)
The enterprise-scale architecture standard is organized under a hierarchy of Management Groups (MGs) that ensure that any new subscription automatically inherits network and security controls upon creation.
Root Management Group (Tenant Root)
Global anchor point. Direct policy assignments are avoided except for strict global exceptions.
Platform Management Group
Contains shared subscriptions centrally managed by the infrastructure team:
• Identity: Subscription for Domain Controllers or directory services.
• Management: Log Analytics subscription, SIEM (Microsoft Sentinel) and monitoring.
• Connectivity: Subscription for Network Hub (ExpressRoute, Azure Firewall, NVA).
Landing Zones Management Group
Contains business workload subscriptions. Typically divided by type of connectivity:
• Corp: Subscriptions connected to the corporate/on-premise network via the Network Hub.
• Online: Subscriptions exposed to the Internet with their own ingress (App Gateway/WAF) isolated from the internal network.
Sandbox Management Group
Isolated experimentation subscriptions with relaxed policies for learning. Disconnected from the corporate network.
Decommissioned Management Group
Subscriptions in the process of withdrawal before final cancellation.
Subscription as an Isolation Unit: In Azure, the subscription represents the main billing limit, service quotas (quotas), API limits (rate limits) and blast radius (radius of impact of failures or security breaches).
02. Azure Policy vs Azure RBAC: Access Control vs Guardrails
RBAC and Azure Policy are complementary mechanisms that operate on completely different dimensions of the control plane.
Authorization of Subjects
Azure RBAC
Answers the question: Does this identity have permission to perform this action?
- Evaluates the identity (User, Service Principal or Managed Identity).
- Assign roles (Owner, Contributor, Reader) over a specific scope.
- You cannot condition the attributes of the deployed resource.
Rule Compliance
Azure Policy
Answers the question: Does this resource comply with state configuration standards?
- Evaluate the properties and configuration of the resource.
- It works regardless of who executes the action (even an Owner must comply with the policy).
- Applies impassable guardrails (effect
deny,audit,modify).
03. Mandatory Tags & Region Restriction
Strategic policy assignment ensures that infrastructure complies with data residency standards and cost allocation models (Chargeback / Showback).
Region Restriction
The built-in policy "Allowed locations" assigned at the root Management Group or Landing Zones level with effect deny is used. Prevents any team from provisioning resources outside of compliance-authorized geographic regions (e.g. eastus2 and brazilsouth only).
Force Required Tags
| Strategy | Azure Policy Effect | Behavior & Recommendation |
|---|---|---|
| Strict Lockdown | Deny | Reject the creation of the Resource Group if it does not include the required tags (e.g. cost-center, environment, owner). Ideal at the Resource Group level. |
| Automatic Inheritance | Modify | Automatically propagates tags from the parent Resource Group to child resources upon deployment using a remediation Managed Identity. Eliminates daily operational friction. |
04. Security Initiatives & Exemption Management
Initiatives (Policy Sets)
An Initiative groups multiple policy definitions under a single assignment with centralized parameters. Allows you to audit and enforce complete compliance baselines such as:
- Microsoft Cloud Security Benchmark (MCSB)
- CIS Microsoft Azure Foundations Benchmark
- HIPAA / PCI-DSS Compliance Sets
Provides a unified compliance score for the entire organization instead of auditing hundreds of individual policies.
Policy Exemptions (Audited Exception Management)
When a project requires moving away from the security baseline for justified operational reasons, formalized Policy Exemptions are used instead of removing the policy from the scope.
Category A
Waiver
The organization explicitly accepts the risk of not complying with the policy for that particular resource or subscription.
Category B
Mitigated
Security control is satisfied by an alternative mechanism (e.g. a third-party firewall instead of the Azure Native Firewall).
💡 Governance Requirement: All Policy Exemptions must include a mandatory expiration date and be recorded in the Azure Resource Manager audit logs, ensuring periodic security reviews.