LAB 21: AZ-104 Azure Identity & Access Management

Navigate to: portal.azure.com → Microsoft Entra ID → Users → New user → Create new user USER DETAILS: - User principal name: john.doe@contoso.onmicrosoft.com (Or custom domain: john.doe@contoso.com) - Display name: John Doe - Password: Auto-generate or set manually ☑️ User must change password at next sign-in PROPERTIES (Optional but important): - First name: John - Last name: Doe - Job title: Cloud Engineer - Department: IT - Company name: Contoso - Usage location: United States ⚠️ Required for licensing! ASSIGNMENTS: - Groups: Add to relevant groups - Roles: Assign directory roles if needed → Review + Create USER TYPES: 1. Member - Full tenant member 2. Guest - External user (B2B) SOURCES: 1. Cloud identity - Created in Entra ID 2. Synced - From on-premises AD (Entra Connect) 3. External - B2B guest user

# Azure CLI - Create User az ad user create \ --display-name "Jane Smith" \ --user-principal-name "jane.smith@contoso.onmicrosoft.com" \ --password "P@ssw0rd123!" \ --force-change-password-next-sign-in true # List all users az ad user list --output table # Get specific user az ad user show --id "jane.smith@contoso.onmicrosoft.com" # Update user properties az ad user update \ --id "jane.smith@contoso.onmicrosoft.com" \ --job-title "Senior Engineer" \ --department "Engineering" # Delete user az ad user delete --id "jane.smith@contoso.onmicrosoft.com"

# PowerShell - Microsoft Graph Module Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "User.ReadWrite.All" # Create password profile $PasswordProfile = @{ Password = "P@ssw0rd123!" ForceChangePasswordNextSignIn = $true } # Create user New-MgUser -DisplayName "Bob Wilson" ` -UserPrincipalName "bob.wilson@contoso.onmicrosoft.com" ` -PasswordProfile $PasswordProfile ` -AccountEnabled ` -MailNickname "bob.wilson" ` -UsageLocation "US" # Get all users Get-MgUser -All | Select-Object DisplayName, UserPrincipalName # Update user Update-MgUser -UserId "bob.wilson@contoso.onmicrosoft.com" ` -JobTitle "Developer" ` -Department "Engineering" # Delete user Remove-MgUser -UserId "bob.wilson@contoso.onmicrosoft.com"

Navigate to: Entra ID → Users → Bulk operations BULK CREATE: → Bulk create → Download CSV template CSV Template Format: Name [displayName],User name [userPrincipalName],Initial password [passwordProfile],Block sign in [accountEnabled],First name [givenName],Last name [surname],Job title [jobTitle],Department [department],Usage location [usageLocation] John Doe,john.doe@contoso.onmicrosoft.com,P@ss123!,No,John,Doe,Engineer,IT,US Jane Smith,jane.smith@contoso.onmicrosoft.com,P@ss456!,No,Jane,Smith,Manager,HR,US → Upload completed CSV → Submit BULK DELETE: → Bulk delete → Download CSV template → Add user principal names to delete → Upload and submit BULK INVITE (Guests): → Bulk invite → Download CSV template → Add email addresses and redirect URLs → Upload and submit DOWNLOAD USERS: → Download users → Select columns needed → Download CSV of all users

Navigate to: Entra ID → Groups → New group GROUP TYPES: 1. SECURITY GROUPS - Used for: Resource access, RBAC assignments - Can be assigned to: Azure resources, apps - Membership types: Assigned, Dynamic user, Dynamic device 2. MICROSOFT 365 GROUPS - Used for: Collaboration (Teams, SharePoint, Outlook) - Includes: Shared mailbox, calendar, files - Membership types: Assigned, Dynamic user CREATE SECURITY GROUP: - Group type: Security - Group name: AZ104-Admins - Group description: Azure administrators for AZ-104 lab - Entra roles can be assigned: Yes (for role-assignable groups) - Membership type: Assigned - Owners: Select owner(s) - Members: Add members → Create MEMBERSHIP TYPES: ├── Assigned: Manual member management ├── Dynamic user: Automatic based on user attributes └── Dynamic device: Automatic based on device attributes

# Dynamic Group Membership Rules # REQUIREMENT: Entra ID P1 or P2 license # Navigate to: Groups → New group → Membership type: Dynamic user # → Add dynamic query # RULE SYNTAX: # (property operator "value") # Example 1: All users in IT department (user.department -eq "IT") # Example 2: All users with job title containing "Engineer" (user.jobTitle -contains "Engineer") # Example 3: Users in US or UK (user.usageLocation -eq "US") -or (user.usageLocation -eq "UK") # Example 4: All users except guests (user.userType -eq "Member") # Example 5: Users with specific manager (user.manager -eq "manager-object-id") # Example 6: Complex rule - IT Engineers in US (user.department -eq "IT") -and (user.jobTitle -contains "Engineer") -and (user.usageLocation -eq "US") # Example 7: All users with email containing company domain (user.mail -contains "@contoso.com") # VALIDATE RULES: → Validate Rules tab → Add users to test → Validate to see if they match # Note: Dynamic membership can take up to 24 hours to fully process

Navigate to: Entra ID → Password reset PROPERTIES: Self-service password reset enabled: ○ None - Disabled ○ Selected - Specific groups only ● All - All users → Select group if "Selected" AUTHENTICATION METHODS: Number of methods required to reset: 1 or 2 Methods available to users: ☑️ Mobile app notification (Authenticator) ☑️ Mobile app code ☑️ Email ☑️ Mobile phone (SMS) ☐ Office phone ☑️ Security questions Security questions: - Required to register: 5 - Required to reset: 3 REGISTRATION: Require users to register when signing in: Yes Days before users are asked to re-confirm: 180 NOTIFICATIONS: Notify users on password resets: Yes Notify all admins when other admins reset their password: Yes ON-PREMISES INTEGRATION: Write back passwords to on-premises directory: Yes (Requires Entra Connect with password writeback enabled) Allow users to unlock accounts without resetting password: Yes

Navigate to: Entra ID → Security → Authentication methods POLICIES: 1. MICROSOFT AUTHENTICATOR → Enable: Yes → Target: All users → Authentication mode: Any (push, passwordless, TOTP) → Additional settings: - Number matching: Enabled (Required) - Show additional context: Enabled - Show app name: Enabled 2. FIDO2 SECURITY KEY → Enable: Yes → Target: Selected groups → Allow self-service setup: Yes → Enforce attestation: No 3. TEMPORARY ACCESS PASS → Enable: Yes → Target: All users → Minimum lifetime: 1 hour → Maximum lifetime: 24 hours → Default lifetime: 1 hour → One-time use: Yes 4. SMS → Enable: Yes → Target: All users (or selected groups) → Use for sign-in: Yes 5. EMAIL OTP → Enable: Yes → Target: All users AUTHENTICATION STRENGTHS: Navigate to: Authentication methods → Authentication strengths - MFA - Passwordless MFA - Phishing-resistant MFA - Custom strengths

Navigate to: Entra ID → User settings USER SETTINGS: App registrations: Users can register applications: Yes/No (If No, only admins can register apps) Administration portal: Restrict access to Entra admin center: No (If Yes, non-admins can't access admin center) LinkedIn account connections: Allow users to connect work account with LinkedIn: Yes --- EXTERNAL COLLABORATION SETTINGS: Navigate to: Entra ID → External Identities → External collaboration settings Guest user access: ● Guest users have same access as members ○ Guest users have limited access to properties ○ Guest user access is restricted (most restrictive) Guest invite settings: ○ Anyone in organization can invite guests ○ Member users and specific admin roles can invite ● Only users assigned to specific admin roles can invite ○ No one can invite (disable invitations) Collaboration restrictions: ○ Allow invitations to any domain ● Allow invitations only to specified domains (allowlist) ○ Deny invitations to specified domains (blocklist) Domains: contoso.com, partner.com

Navigate to: Entra ID → Administrative units PURPOSE: - Delegate administration to specific users/groups - Restrict admin scope to subset of organization - Similar concept to OUs in on-premises AD CREATE ADMINISTRATIVE UNIT: → New administrative unit - Name: US-Operations - Description: Users and groups in US operations MEMBERSHIP: → Add members → Users → Select users to include in this AU → Add members → Groups → Select groups to include in this AU ASSIGN ADMINISTRATORS: → Roles and administrators → Select role (e.g., User Administrator) → Add assignments → Select user who will administer this AU RESULT: - Assigned admin can only manage users/groups IN this AU - Cannot manage users/groups outside AU - Scoped administration without global access EXAMPLE SCENARIO: - AU: "Sales-Department" - User Admin: sales-manager@contoso.com - Sales manager can: - Reset passwords for Sales users - Update Sales user profiles - Manage Sales groups - Cannot touch: IT, HR, Finance users Requires: Entra ID P1 or P2 license

Navigate to: portal.azure.com → Management groups FIRST TIME SETUP: → Start using management groups - Creates "Tenant Root Group" automatically - All subscriptions initially under root CREATE MANAGEMENT GROUP: → Add management group - Management group ID: mg-production (immutable!) - Display name: Production Environment → Create HIERARCHY EXAMPLE: Tenant Root Group ├── mg-platform │ ├── mg-identity (Identity subscription) │ └── mg-management (Management subscription) ├── mg-production │ ├── sub-prod-east │ └── sub-prod-west ├── mg-nonproduction │ ├── sub-development │ ├── sub-staging │ └── sub-testing └── mg-sandbox └── sub-sandbox MOVE SUBSCRIPTION: → Select subscription → Move → Select destination management group → Save ⚠️ Important: - Max 6 levels deep (excluding root and subscription) - Max 10,000 management groups per tenant - Management group ID cannot be changed after creation

Navigate to: Subscriptions SUBSCRIPTION PROPERTIES: - Subscription ID: Unique GUID (immutable) - Subscription name: Can be changed - Directory: Associated Entra ID tenant - Offer type: Pay-As-You-Go, Enterprise, etc. SUBSCRIPTION TYPES: 1. Free - $200 credit, limited services 2. Pay-As-You-Go - Standard billing 3. Enterprise Agreement - Volume licensing 4. CSP - Cloud Solution Provider 5. MSDN/Visual Studio - Dev/test benefits 6. Sponsorship - Microsoft programs CHANGE SUBSCRIPTION DIRECTORY: ⚠️ Requires careful planning! → Subscription → Change directory - All RBAC assignments are REMOVED - Resources remain but access is lost - Must be Global Admin in target tenant CANCEL SUBSCRIPTION: → Subscription → Cancel subscription - Data retained for 90 days - Can reactivate within 90 days - After 90 days: Permanently deleted RENAME SUBSCRIPTION: → Subscription → Rename - Update display name - ID remains unchanged

Navigate to: Cost Management + Billing → Cost Management COST ANALYSIS: → Cost analysis - View costs by: Resource, Resource group, Service, Location - Time range: Last 7 days, month, quarter, custom - Granularity: Daily, Monthly - Group by: Tag, Resource type, etc. CREATE BUDGET: → Budgets → Add - Scope: Subscription or Resource group - Name: Monthly-Production-Budget - Reset period: Monthly - Creation date: 1st of month - Expiration date: (optional) - Budget amount: $10,000 ALERT CONDITIONS: → Add alert condition - Type: Actual or Forecasted - % of budget: 50%, 75%, 90%, 100% - Action group: Email, SMS, webhook Example alerts: - 50% Actual: Email finance team - 75% Actual: Email IT managers - 90% Forecasted: Email executives - 100% Actual: Trigger automation (webhook) COST ALERTS: - Anomaly alerts (automatic) - Budget alerts (configured) - Credit alerts (approaching limit) - Department spending quota alerts (EA)

ROLE ASSIGNMENT FORMULA: Security Principal + Role Definition + Scope = Access EXAMPLE: john@contoso.com + Contributor + /subscriptions/xxx/resourceGroups/rg-web = "John can create/manage resources in rg-web but cannot manage access" INHERITANCE: Management Group └── Subscription (inherits MG roles) └── Resource Group (inherits Sub roles) └── Resource (inherits RG roles) EFFECTIVE ACCESS = All inherited roles + directly assigned roles DENY ASSIGNMENTS: - Block specific actions even if role allows - Can only be created by Azure Blueprints - Not directly configurable (exam trick question!)

COMMON BUILT-IN ROLES BY CATEGORY: GENERAL: ├── Owner (full access + RBAC) ├── Contributor (full access, no RBAC) ├── Reader (view only) └── User Access Administrator (RBAC only) COMPUTE: ├── Virtual Machine Administrator Login ├── Virtual Machine User Login ├── Virtual Machine Contributor └── Classic Virtual Machine Contributor NETWORKING: ├── Network Contributor ├── DNS Zone Contributor └── Traffic Manager Contributor STORAGE: ├── Storage Account Contributor ├── Storage Blob Data Contributor ├── Storage Blob Data Reader ├── Storage Queue Data Contributor └── Storage File Data SMB Share Contributor SECURITY: ├── Security Admin ├── Security Reader └── Key Vault Administrator MONITORING: ├── Monitoring Contributor ├── Monitoring Reader └── Log Analytics Contributor

Navigate to: Resource (or RG or Subscription) → Access control (IAM) → Add → Add role assignment STEP 1: SELECT ROLE → Role tab → Search for role (e.g., "Contributor") → Select role → Next STEP 2: SELECT MEMBERS → Members tab → Assign access to: User, group, or service principal → Select members → Search and select user/group → Next STEP 3: CONDITIONS (Optional - Entra ID P2) → Conditions tab → What user can do: All actions or specific → Add condition (for eligible assignments) STEP 4: REVIEW → Review + assign → Verify: Role, Members, Scope → Assign VERIFY ASSIGNMENT: → Access control (IAM) → Role assignments → Find assignment in list → Check scope (this resource or inherited)

# Create role assignment with Azure CLI # Assign Contributor to user at resource group scope az role assignment create \ --assignee "john@contoso.com" \ --role "Contributor" \ --scope "/subscriptions/{sub-id}/resourceGroups/rg-production" # Assign Reader to group at subscription scope az role assignment create \ --assignee-object-id "{group-object-id}" \ --assignee-principal-type "Group" \ --role "Reader" \ --scope "/subscriptions/{sub-id}" # Assign custom role at resource scope az role assignment create \ --assignee "jane@contoso.com" \ --role "Virtual Machine Operator" \ --scope "/subscriptions/{sub-id}/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-web" # List role assignments az role assignment list --resource-group rg-production --output table # Delete role assignment az role assignment delete \ --assignee "john@contoso.com" \ --role "Contributor" \ --scope "/subscriptions/{sub-id}/resourceGroups/rg-production"

Navigate to: Resource → Access control (IAM) → Check access CHECK ACCESS: → Enter user/group/service principal name → View their effective permissions OUTPUT SHOWS: - Role assignments (direct and inherited) - Effective permissions (Actions and NotActions) - Deny assignments (if any) --- TROUBLESHOOTING ACCESS ISSUES: 1. USER CANNOT ACCESS RESOURCE: □ Verify user is assigned a role □ Check scope - role might be at wrong level □ Check if role has required permissions □ Check for deny assignments □ Verify user is in correct group (if group-based) 2. ROLE ASSIGNMENT NOT WORKING: □ Wait up to 5 minutes for propagation □ Sign out and sign back in □ Check if Conditional Access is blocking □ Verify correct subscription selected 3. CANNOT CREATE ROLE ASSIGNMENT: □ You need Owner or User Access Admin role □ Check at correct scope level □ Verify RBAC limit not reached (2000 per sub) VIEW ACTIVITY LOG: → Activity log → Filter by operation → "Create role assignment" → View who, when, what

{ "Name": "Virtual Machine Operator", "Id": "88888888-8888-8888-8888-888888888888", "IsCustom": true, "Description": "Can start, stop, and restart virtual machines.", "Actions": [ "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action", "Microsoft.Compute/virtualMachines/restart/action", "Microsoft.Compute/virtualMachines/read", "Microsoft.Resources/subscriptions/resourceGroups/read" ], "NotActions": [], "DataActions": [], "NotDataActions": [], "AssignableScopes": [ "/subscriptions/{subscription-id}" ] } ROLE DEFINITION COMPONENTS: Name: Display name for the role Id: Auto-generated GUID (omit when creating) IsCustom: true for custom roles Description: What the role is for Actions: Control plane operations allowed - Example: "Microsoft.Compute/*/read" (wildcard) NotActions: Exceptions to Actions (subtracted) - Example: "Microsoft.Compute/virtualMachines/delete" DataActions: Data plane operations (blobs, queues) - Example: "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read" NotDataActions: Exceptions to DataActions AssignableScopes: Where role can be assigned - Management group, subscription, or resource group - NOT individual resources!

Navigate to: Subscription → Access control (IAM) → Roles → Create custom role BASICS: - Custom role name: VM Operator - Description: Start, stop, restart VMs only - Baseline permissions: ○ Clone a role (start from existing) ○ Start from scratch ● Start from JSON PERMISSIONS: → Add permissions → Search: "Microsoft.Compute" → Expand virtualMachines → Select: ☑️ Read ☑️ Start ☑️ Power Off ☑️ Restart → Add additional permissions → Search: "Microsoft.Resources" → Select: ☑️ subscriptions/resourceGroups/read EXCLUDE PERMISSIONS (NotActions): → Exclude permissions → Search for actions to exclude → Select actions to deny ASSIGNABLE SCOPES: → Add assignable scope → Select subscription(s) or management group(s) → Role can only be assigned at these scopes → Review + Create

# Create JSON file: vm-operator-role.json { "Name": "VM Operator", "IsCustom": true, "Description": "Can monitor, start, stop, and restart virtual machines.", "Actions": [ "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action", "Microsoft.Compute/virtualMachines/restart/action", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Insights/alertRules/*", "Microsoft.Insights/metrics/read" ], "NotActions": [], "AssignableScopes": [ "/subscriptions/00000000-0000-0000-0000-000000000000" ] } # Create the custom role az role definition create --role-definition vm-operator-role.json # List custom roles az role definition list --custom-role-only true --output table # Update custom role az role definition update --role-definition vm-operator-role-updated.json # Delete custom role (must remove all assignments first!) az role definition delete --name "VM Operator" # Get role definition details az role definition list --name "VM Operator" --output json

# Example 1: Support Ticket Reader # Can view VMs and support tickets but not modify { "Name": "Support Ticket Reader", "Actions": [ "Microsoft.Compute/virtualMachines/read", "Microsoft.Support/*" ], "AssignableScopes": ["/subscriptions/{sub-id}"] } # Example 2: Network Watcher # Can view network resources and run diagnostics { "Name": "Network Diagnostics", "Actions": [ "Microsoft.Network/*/read", "Microsoft.Network/networkWatchers/*/action", "Microsoft.Compute/virtualMachines/read" ], "NotActions": [ "Microsoft.Network/networkSecurityGroups/write", "Microsoft.Network/networkSecurityGroups/delete" ], "AssignableScopes": ["/subscriptions/{sub-id}"] } # Example 3: Storage Data Reader (includes data plane) { "Name": "Blob Data Viewer", "Actions": [ "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/blobServices/containers/read" ], "DataActions": [ "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read" ], "AssignableScopes": ["/subscriptions/{sub-id}"] }

POLICY EFFECTS (in evaluation order): 1. Disabled - Policy is off, no evaluation - Use for testing or temporary disable 2. Append - Add properties to resources - Example: Add required tags 3. Modify - Add, update, or remove properties - Example: Add managed identity 4. Audit - Log non-compliance but allow - Creates warning, doesn't block 5. AuditIfNotExists - Audit if related resource missing - Example: Audit VMs without extensions 6. Deny - Block non-compliant resources - Prevents create/update operations 7. DeployIfNotExists (DINE) - Deploy related resources if missing - Example: Auto-deploy diagnostics EVALUATION ORDER: Disabled → Deny → Append/Modify → Audit/AuditIfNotExists → DeployIfNotExists

Navigate to: Policy → Definitions BROWSE BUILT-IN POLICIES: - Filter by Category: Compute, Storage, Network, etc. - Type: Policy (single) or Initiative (group) POPULAR BUILT-IN POLICIES: ├── Allowed locations ├── Allowed virtual machine SKUs ├── Require tag and its value on resources ├── Inherit a tag from resource group ├── Storage accounts should use private link ├── Deploy Diagnostic Settings for Storage └── Kubernetes cluster should not allow privileged containers ASSIGN POLICY: → Select policy → Assign BASICS: - Scope: Select MG, Subscription, or RG - Exclusions: Exclude specific RGs or resources - Assignment name: Auto-generated or custom - Policy enforcement: Enabled or Disabled PARAMETERS (if required by policy): - Allowed locations: Select regions - Allowed VM SKUs: Select VM sizes - Required tag name: Enter tag name NON-COMPLIANCE MESSAGES: - Custom message shown when resource denied - Example: "VMs must be deployed in East US or West US" REMEDIATION: - Create remediation task: Yes (for DINE policies) - Managed identity: System-assigned - Location: Select region → Review + Create

# Assign built-in policy: Allowed locations az policy assignment create \ --name "allowed-locations" \ --display-name "Allowed Locations - US Only" \ --policy "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" \ --scope "/subscriptions/{subscription-id}" \ --params '{"listOfAllowedLocations": {"value": ["eastus", "westus", "centralus"]}}' # Assign built-in policy: Require tag az policy assignment create \ --name "require-cost-center-tag" \ --display-name "Require Cost Center Tag" \ --policy "/providers/Microsoft.Authorization/policyDefinitions/1e30110a-5ceb-460c-a204-c1c3969c6d62" \ --scope "/subscriptions/{subscription-id}/resourceGroups/rg-production" \ --params '{"tagName": {"value": "CostCenter"}}' # List policy assignments az policy assignment list --scope "/subscriptions/{subscription-id}" --output table # Get compliance state az policy state list --subscription "{subscription-id}" --output table # Delete policy assignment az policy assignment delete --name "allowed-locations" # Trigger policy evaluation (on-demand) az policy state trigger-scan --subscription "{subscription-id}"

Navigate to: Policy → Definitions → Initiative definitions POPULAR BUILT-IN INITIATIVES: ├── Azure Security Benchmark ├── CIS Microsoft Azure Foundations Benchmark ├── NIST SP 800-53 Rev. 5 ├── ISO 27001:2013 ├── PCI DSS 3.2.1 └── HIPAA/HITRUST ASSIGN INITIATIVE: → Select initiative → Assign → Same process as policy assignment → Configure parameters for all included policies CREATE CUSTOM INITIATIVE: → Policy → Definitions → Initiative definition Basics: - Name: Corporate Security Standards - Category: Create new or select existing Policies: → Add policy definition(s) → Select multiple policies to group → Configure parameters for each Example custom initiative: ├── Allowed locations ├── Allowed VM SKUs ├── Require tag on resources ├── Enable Azure Defender └── Diagnostic settings to Log Analytics Benefits of initiatives: - Single assignment for multiple policies - Easier compliance reporting - Consistent parameter management - Regulatory compliance mapping

Navigate to: Policy → Remediation REMEDIATION FOR EXISTING RESOURCES: - Policies only evaluate NEW resources by default - Existing non-compliant resources need remediation - Works with: Modify, Append, DeployIfNotExists effects CREATE REMEDIATION TASK: → Remediation → New remediation task 1. Select policy/initiative assignment 2. Select specific policy (if initiative) 3. Configure remediation settings: - Scope: Where to remediate - Locations: Filter by region - Resource count: Max resources per task REMEDIATION TASK STATUS: - Total resources to remediate - Completed - Failed - In progress PERMISSIONS REQUIRED: - DeployIfNotExists: Contributor + Managed Identity - Modify: Managed Identity with required permissions - Policy creates managed identity automatically RE-EVALUATE COMPLIANCE: → Policy → Compliance → Re-evaluate - Triggers policy evaluation scan - Default: Every 24 hours - On-demand: Manual trigger EXEMPTIONS: → Policy → Exemptions → Create exemption - Waiver: Permanent exemption - Mitigated: Temporary, expires after date - Scope: Specific resource or RG

Navigate to: Resource → Settings → Locks LOCK TYPES: 1. ReadOnly (CanNotDelete + no modifications) - Prevents ALL changes - Cannot modify resource settings - Cannot delete resource - Like "read-only" file attribute 2. Delete (CanNotDelete) - Prevents deletion only - CAN still modify resource - Protects against accidental deletion LOCK SCOPE & INHERITANCE: - Subscription level: All resources inherit - Resource Group level: All resources in RG inherit - Resource level: Only that resource CREATE LOCK: → Add lock - Lock name: PreventDelete-Production - Lock type: Delete - Notes: Critical production resource LOCK BEHAVIOR: - Locks apply to ALL users, including Owners - Must remove lock before protected action - Only Owner or User Access Admin can manage locks ⚠️ IMPORTANT LIMITATIONS: - ReadOnly on storage blocks data plane too - ReadOnly on VMs prevents many operations - Locks don't prevent all indirect changes - Some Azure operations bypass locks

# Create delete lock on resource group az lock create \ --name "PreventDelete" \ --lock-type CanNotDelete \ --resource-group "rg-production" \ --notes "Critical production resources" # Create read-only lock on resource az lock create \ --name "ReadOnly-Production-VM" \ --lock-type ReadOnly \ --resource-group "rg-production" \ --resource-name "vm-web-prod" \ --resource-type "Microsoft.Compute/virtualMachines" # List locks az lock list --resource-group "rg-production" --output table # Delete lock az lock delete --name "PreventDelete" --resource-group "rg-production"

Navigate to: Resource → Tags TAGGING BASICS: - Key-value pairs for organizing resources - Max 50 tags per resource - Key: 512 characters max - Value: 256 characters max - Case-insensitive for storage accounts COMMON TAG CATEGORIES: Cost Management: ├── CostCenter: "CC-1234" ├── Project: "Project-Alpha" ├── BillingCode: "DEPT-IT-001" └── BudgetOwner: "john.doe@contoso.com" Operations: ├── Environment: "Production" ├── Application: "WebApp" ├── Owner: "IT-Operations" └── MaintenanceWindow: "Sunday-2AM" Compliance: ├── DataClassification: "Confidential" ├── Compliance: "HIPAA" ├── BusinessUnit: "Finance" └── CreatedBy: "Terraform" ⚠️ IMPORTANT: - Tags do NOT inherit! - Each resource must be tagged individually - Use Azure Policy to enforce/inherit tags

# Add tags to resource group az group update \ --name "rg-production" \ --tags Environment=Production CostCenter=CC-1234 Owner=IT-Ops # Add tags to resource (merge with existing) az resource tag \ --tags Application=WebApp DataClass=Public \ --ids "/subscriptions/{sub}/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-web" # Replace all tags on resource az resource update \ --ids "/subscriptions/{sub}/resourceGroups/rg-prod/providers/Microsoft.Compute/virtualMachines/vm-web" \ --set tags.Environment=Production tags.CostCenter=CC-5678 # List resources by tag az resource list --tag Environment=Production --output table # Query costs by tag (Cost Management) # Use Azure Portal: Cost Management → Cost analysis → Group by Tag

# Policy 1: Require tag on resources (Deny) # Built-in: "Require a tag on resources" az policy assignment create \ --name "require-environment-tag" \ --display-name "Require Environment Tag" \ --policy "/providers/Microsoft.Authorization/policyDefinitions/871b6d14-10aa-478d-b590-94f262ecfa99" \ --scope "/subscriptions/{sub-id}/resourceGroups/rg-production" \ --params '{"tagName": {"value": "Environment"}}' # Policy 2: Inherit tag from resource group (Modify) # Built-in: "Inherit a tag from the resource group" az policy assignment create \ --name "inherit-costcenter-tag" \ --display-name "Inherit CostCenter from RG" \ --policy "/providers/Microsoft.Authorization/policyDefinitions/cd3aa116-8754-49c9-a813-ad46512ece54" \ --scope "/subscriptions/{sub-id}" \ --params '{"tagName": {"value": "CostCenter"}}' \ --mi-system-assigned \ --location "eastus" # Policy 3: Add tag with default value (Append) # Adds tag if missing, doesn't overwrite existing # Remediate existing resources az policy remediation create \ --name "remediate-costcenter-tag" \ --policy-assignment "inherit-costcenter-tag" \ --scope "/subscriptions/{sub-id}"

Navigate to: Resource Group → Overview → Move MOVE OPTIONS: 1. Move to another resource group (same subscription) 2. Move to another subscription (same or different tenant) MOVE VALIDATION: → Select resources to move → Azure validates if move is supported → Check for blocking issues RESOURCES THAT CANNOT MOVE: ├── Azure Active Directory resources ├── Azure Backup vaults (with items) ├── Azure Databricks workspaces ├── Classic deployment resources ├── Recovery Services vaults (with protected items) └── Some networking resources (with dependencies) MOVE REQUIREMENTS: - Source RG: Requires delete permission - Target RG: Requires write permission - Subscription move: Requires contributor on both AFTER MOVE: - Resource IDs change! - Scripts and automation may break - Some services require reconfiguration MOVE STEPS: 1. Select resources 2. Validate move 3. Review dependencies 4. Acknowledge ID changes 5. Execute move Note: Can take several minutes to hours depending on resources

Navigate to: Blueprints → Blueprint definitions BLUEPRINT COMPONENTS (Artifacts): ├── Role Assignments - RBAC at subscription/RG level ├── Policy Assignments - Assign policies/initiatives ├── ARM Templates - Deploy resources └── Resource Groups - Create RGs with specific names BLUEPRINT WORKFLOW: 1. CREATE: Define blueprint (draft) 2. PUBLISH: Version the blueprint 3. ASSIGN: Deploy to subscription BLUEPRINT vs ARM TEMPLATE: ┌─────────────────┬────────────────┬───────────────────┐ │ Feature │ Blueprint │ ARM Template │ ├─────────────────┼────────────────┼───────────────────┤ │ RBAC │ ✓ Built-in │ ✗ Separate │ │ Policy │ ✓ Built-in │ ✗ Separate │ │ Versioning │ ✓ Built-in │ Manual │ │ Update tracking │ ✓ Linked │ Disconnected │ │ Locking │ ✓ Deny assign │ ✗ Not available │ └─────────────────┴────────────────┴───────────────────┘ BUILT-IN BLUEPRINTS: - ISO 27001 Shared Services - CAF Foundation - CAF Migration Landing Zone - UK OFFICIAL and UK NHS

# Template Specs - Replacement for Blueprints # Create template spec from ARM template az ts create \ --name "WebAppTemplate" \ --version "1.0" \ --resource-group "rg-templates" \ --location "eastus" \ --template-file "./webapp-template.json" # List template specs az ts list --resource-group "rg-templates" --output table # Deploy from template spec az deployment group create \ --resource-group "rg-production" \ --template-spec "/subscriptions/{sub}/resourceGroups/rg-templates/providers/Microsoft.Resources/templateSpecs/WebAppTemplate/versions/1.0" \ --parameters appName="mywebapp" # Update template spec (new version) az ts create \ --name "WebAppTemplate" \ --version "2.0" \ --resource-group "rg-templates" \ --template-file "./webapp-template-v2.json" # Benefits of Template Specs: # - Versioned ARM templates stored in Azure # - RBAC controlled access # - Can be deployed via Portal, CLI, PowerShell # - Share across subscriptions via resource ID # - Supports linked templates

# Deployment Stacks - Modern governance approach # Create deployment stack at subscription level az stack sub create \ --name "production-stack" \ --location "eastus" \ --template-file "./main.bicep" \ --deny-settings-mode "DenyDelete" \ --deny-settings-apply-to-child-scopes # Deny settings options: # - None: No protection # - DenyDelete: Prevent deletion of managed resources # - DenyWriteAndDelete: Prevent modification and deletion # List deployment stacks az stack sub list --output table # Update deployment stack az stack sub create \ --name "production-stack" \ --location "eastus" \ --template-file "./main-updated.bicep" \ --deny-settings-mode "DenyWriteAndDelete" # Delete stack (and optionally resources) az stack sub delete \ --name "production-stack" \ --delete-resources # Also deletes managed resources # Benefits over Blueprints: # - Native deny assignments (no Blueprints service) # - Works with Bicep and ARM # - Better drift detection # - Cleaner resource lifecycle management

AZURE LANDING ZONES (ALZ): Reference architecture for enterprise Azure adoption - Cloud Adoption Framework (CAF) aligned - Pre-built governance and security - Scalable subscription organization LANDING ZONE COMPONENTS: ├── Management Groups (hierarchy) ├── Subscriptions (organized by purpose) ├── Azure Policy (governance baseline) ├── RBAC (role definitions and assignments) ├── Networking (hub-spoke or Virtual WAN) └── Logging (central Log Analytics) DEPLOYMENT OPTIONS: 1. Azure Portal Experience: portal.azure.com → Deploy a landing zone - Guided wizard - Best for getting started 2. Bicep/Terraform Modules: github.com/Azure/ALZ-Bicep github.com/Azure/terraform-azurerm-caf-enterprise-scale - Full customization - Infrastructure as Code 3. Azure Landing Zone Accelerator: aka.ms/caf/ready/accelerator - Automated deployment - Enterprise-scale architecture STANDARD MANAGEMENT GROUP HIERARCHY: Tenant Root Group ├── Platform │ ├── Identity │ ├── Management │ └── Connectivity ├── Landing Zones │ ├── Production │ └── Non-Production ├── Sandbox └── Decommissioned