REPLACED WITH V2 - Microsoft Azure Master Class Part 3 - Governance
Vložit
- čas přidán 24. 07. 2024
- THIS HAS BEEN REPLACED - • Azure Master Class v2 ...
In this 3rd part of the Azure Master Class we look at key aspects of governance including management groups, subscriptions, resource groups and how we use them. Large focus on RBAC, Azure Policy and budgets and then an examination of Tags, Azure Blueprints, Locks and some key Microsoft resources.
CZcams Playlist for the whole course - • Microsoft Azure Master...
GitHub Repo - github.com/johnthebrit/AzureM...
Key links from module:
00:00 Introduction
08:05 Microsoft Compliance Solutions
10:53 Management Groups
17:50 Subscriptions
19:50 Resource Groups
23:00 RBAC, Policy and Budget assignment points
29:18 ARM Overview
33:46 RBAC
47:10 Azure Policy
1:01:25 Cost Management and Budgets
1:12:18 Naming Standards
1:13:25 Tagging
1:17:00 Blueprints
1:25:08 Azure Resource Graph
Useful links mentioned:
The compliance overview site is -
www.microsoft.com/en-us/trust...
A detailed list is available at-
www.microsoft.com/en-us/trust...
Compliance Manager - servicetrust.microsoft.com/Co...
Azure Subscription Limits - docs.microsoft.com/en-us/azur...
Azure Naming Standards - docs.microsoft.com/en-us/azur...
Cloud Adoption Framework - azure.microsoft.com/en-us/clo...
docs.microsoft.com/en-us/azur...
Well-Architected Framework - docs.microsoft.com/en-us/azur...
Azure Architecture Center - docs.microsoft.com/en-us/azur... - Věda a technologie
I cannot believe this is free, what an amazing video to learn about policies
Glad it's useful! Thanks for watching.
Another one down in the series, really enjoying this informative and well presented course. On to the next. Thanks a million John!
Great video as always, starting to think I'm going to end up watching every single on of your videos at one point or another. Thanks John
Can't stress enough how good your lectures are! So easy to follow and with really good content at a perfect pace!
Glad you like them!
Some of the best free videos I've seen on Azure. These vids are great! thanks for sharing!!
Glad you like them!
Being a newcomer in this field, it is really hard to digest everything at once, so the timestamps within your videos and your hole way of organizing stuff sure helps a lot.
Keep it up and I might consider calling this series "Azure Master's Class". :D
Glad you like them!
Thanks John, its great to have access to this high quality content.
Glad it’s useful. Thanks for watching.
Great job John, I am getting prepared for the AZ-303, AZ-304 and AZ-305, and honestly your videos are superb, before I knew your videos on youtube I had trouble with some of the Azure architect solution concepts (that I am not working with them, company policy) and your videos helped me a lot to have a better understanding of those. a big thanks to you
Thank you very much for all your effort, and making all of this freely available!
What a video!!! Amazing John!! @Everyone, you cannot go wrong watching these videos!!
As always - brilliant! Lots of energy and passion about what you do!
Thank you, that's very kind.
Brilliant exposition of an essential topic to master Azure. Thanks a mil again John. Hero!!!
After trying multiple different youtube videos on Azure, this master class is AMAZING. Thank you John Savill for teaching something you obviously know in-depth and didn't study just to produce the video.
Thanks, glad it’s useful!
your videos are better than any paid resources available in the market :) Thanks for sharing your in-depth knowledge !
Glad you like them!
Thanks John. Your channel is terrific! All of the content is great and appreciated!
Thanks
I remember everything you teach me. I don't know what sort of wizardry this is but it's working.
Lol, spooky mind powers
Great explanation, definitely worthwhile watching this video.
Thanks!
Hi John, really appreciated your effort. This gives me lot more than even a paid course. Thank you very much.
Glad it’s useful!
Really one of the best cloud coach.
this is amazing, most videos they rushing to use the portal but you take your time explaining the idea and reasons. thank you
You're very welcome!
fantastic master course John
Another awesome lecture. I was able to implement what i learned into my environment/organization.
Thanks john for all the knowledge sharing and being so precise in explaining all the details and that too free
My pleasure, thanks for watching.
Great content about Azure Governance. Thanks a lot John.
My pleasure
Awesome thank you Sir, another well presented topic, going through the list of your Azure Master Class and learning everyday. You are awesome John, big bald and beautiful lectures.
Haha, thanks :)
merci John. A lot of valuable informations.
Great vid as always. I think one of the reasons for multiuple subscriptions is that service principles, by default, are scoped at subscription level - think automation accounts, DevOps connections etc. So if we have multiple teams working within the same sub, they all have line of site of each others' resources, which can be dangerous.
Great point. You c an change the scoping from the default but definitely something to consider.
This video is gold. The channel is goldmine
Thanks!
Great class on governance and how it can be applied. Thanks!
My pleasure. Thanks for watching.
Too good. Thankyou so much John :) No ads just great content!!!! Loving it 😊
Glad you enjoy it!
@@NTFAQGuy I loved it :)
Thank you so much John. This is great stuff!
Glad it was helpful!
sharing this to friends. Thank you so much!
John you are the best.
Fantastic ...information volume, quality and clarity! Thanks!
Thanks!
Hey John. well done. Great video. I personally think your training videos are better than the internal training contents for new Microsoft employees :)
Good stuff - planning to do the AZ-104 in December. :] Great session, thanks John!
Best of luck!
Great content! From the bottom of my heart - A big thank you!
Very welcome
Just awesome, so thankful !!
Glad you liked it!
So detailed and informative video and its all free.. keep-up the good work
Thanks and enjoy rest of the series!
Great work here, very well organised too
Thanks
Thanks for the amazing content John!
Glad you enjoy it!
Awseome, just awesome
Super useful great tutorial, learned a lot.
Thanks for a great video John
Glad you liked it.
You need to charge for this. I have read through the CAF and numerous other materials and this is by far the best explanation!
Thanks but don’t want to make money through the channel. It’s just my way of giving back to awesome community which is why no advertising either. Enjoy 😀
Thanks for a great content on azure governance. Appreciated🙏
Any time!
Very nicely explained John 👌
Appreciated! Enjoy
Great overview. thanks for such a lovely content
Very welcome
Thanks John
Great work John, thx a lot!
My pleasure!
Thanks, John Very nice explained
Glad it was helpful.
Ah.. one more Topic! Awesome
Thanks!
Amazing content thx a lot !
Thank you!!!
Great Teacher!
Thank you
Well done!
thank you!
Thanks a Lot!!! Lot of learning
Always good to have lots of learning :)
Thank you again John for another great video. Such a thorough explanation of rbac and policy and I'm learning so much going through your playlist. Really appreciate all the effort you into all your content.
For the recommended videos on your github repo for this masterclass, do you recommend going through the playlist first and then the supplemental videos?
Again, thank you for all your hard working on these. I've been using your masterclass as somewhat of a primer before I try tackling the az 303 / 304
The other videos are more info for specific areas if interested. Really can view however works best for you. Likely finish master class first for most.
A great video John, really well explained and extremely helpful. I find it is so often a topic that is forgotten about, everyone's so keen to see and show what Azure can do they can forget about how it can and should be controlled, both technically and financially. This feeling and fear of lack of control can be a major blocker to businesses adopting the cloud to it's full potential if indeed at all. Lots of great topics in here to counter that. The timeslots+section links are very useful too. Cheers.
Glad you enjoyed it, great to hear its useful!
Thank you so much
Welcome
Thank you
had to give a thumbs up for the admin drawing 😂
you are great
Thanks for the video John.Cant imagin you being an angry admin😁
Lol. Never :)
John, great video, I've learnt a lot from this - Do you have any resources on Azure lighthouse, or have any planned?
Never discuss future content
Hey John, thanks for your brilliant videos, I'm a happy subscriber just trying to get into Azure. I just booked my AZ-900 for the 6th of March and your content is helping me tremendously so thank you!
Just one thing I need clarification on, at 11:33 you said 'as soon as I create my first management group' but I thought the root Management group is created by default when you create a subscription?
To my knowledge it’s still only when you create the first mg and not there by default. In the future there is a goal to get by default for anything with azure resources.
Great video as usual. I would like to see examples and suggestions around Management Group and Subscription organization. I know Microsoft has a few in the Cloud Adoption Framework docs, but would be nice to know your thoughts and recommendations
I covered it briefly. It really comes down to how you want to apply policy, rbac and budgets. Models around department and region are common.
Thanks @@NTFAQGuy. Yeah, I meant maybe more concrete examples or your experience architecting and governing larger cloud environments, but maybe that's a topic for another day. When it comes to govern and management what's your thought on one subscription per application team? Too many subscriptions or actually a good pattern?
Give a Like if you would be fortunate enough to mentor under John....... Very Very Smart Guy
This video killed it....
Thanks as usual for your deep dive in Azure Governance. Can you please upload whiteboard images and slides if possible, those are super useful references ?
All there on the GitHub :)
Do the Additional References cover the same or are they more or less mandatory besiedes the Master Clas PArts to get it? Youre doing a great work. Thanks for your effort!
they don't cover the same, extra things if interested.
I've observed that when using policy for example to add a tag the managed identity that is created in aad and then assigned to rbac is a) given a guid for a display name that can't be changed and b) gets very broad rbac rights. Has anyone tripped across this? And how they manage it.
Amazing stuff John! Thanks for covering this. I am only 30min through this and already getting huge benefit out of it. Will finish this later once I am done for work today.
Quick note - this link : @t Microsoft-Cloud-Security-for-Legal-and-Compliance-Professionals.pdf returns 404 .. you might want to fix it.
John your videos are of great help - have you thought of a Patreon channel? I am confident that Professionals like me who are getting such amazing benefits out of your content wouldn't mind 1 bit chipping in for few dollars a month to show appreciation for your hard work. Funny enough your videos are of the same/higher quality than some of the learning platforms, and Patreon donation would be much cheaper than playing at those places !! haha.
Ok now I have come back and finished this video. Great stuff. What are the best practices around Blueprint? Would we need to create a Blueprint per resource type ?
Like : 1. a Blueprint for Storage account - that way all Storage accounts will be deployed using that Blueprint ? , 2. Another Blueprint for Virtual Machines ... so on so forth ?
Some use case/examples would be great!
Only just finished watching this, watched it in 3 parts, really good. I think I need look at Blueprints, I find myself setting up very similar but slightly different resource groups with a combination of Logic Apps, Storage Accounts etc, would blueprint be a good way to get the basic setup, permissions, policy and starting resources in place, then allow to build on it?
Definitely blueprints could work. Also could look at DevOps pipeline using ARM/terraform etc.
@@NTFAQGuy Yes, already looking into TF, almost finished my first pipeline in Azure DevOps to deploy infrastructure and app for upgrade testing, it also populates database and storage account with test data. Aiming to start using it for setting up prod stuff asap though. At which point TF modules I guess will provide the starting point and building blocks and make things more consistent and repeatable.
Hi John, You mentioned Infrastructure as a code module, is that going to be another Master class or there is a different playlist?
I am really amazed by your presentation skills and of course the knowledge you possess in every aspect. Apart from Azure, you are also motivating me to get fit :P :D
Will be another module in master class. Already have some videos around it on channel. Go get fit 🤙
For the algorithm! 😁
Please is there a frame work around global Administrator and how to structure subscriptions in a secured way
There are Microsoft docs, there are landing zones, etc.
Hey John, simple question: under PIM, filtering by 'resource state: All', the only resource types I'm showing are 'subscription' and 'management groups' as opposed to your types that include 'resource' and 'resource group' (@45:58). I'm accessing Azure with my global user and I have a VSTN subscription. PS... Thank you for your instructional videos; you have a gifted way to put Azure components into perspective with your scenarios and analogies!!!
make sure you have run discovery first.
@@NTFAQGuy I did.. I'm also not seeing any eligible groups... is there a specific type of group? Security, M365, email enabled? Thank you for the rapid response!!! feel free to slap me with a docs link or another video link where this might be explained in greater detail. I'm learning... lots by trial and error. :-)
no, this is before any assignment. you should in that filter drop down be able to select resource groups etc. i've never seen it not show. make sure you have an AAD P2 license.
Great Video. I would like to see the ability to create policy to enforce the naming standards, is this possible? Also make the tags use a list of values, when users enter tags with different cases or spelling, it makes reporting very difficult and inconsistent, has a big impact on cost reporting. And is it possible to lock the subscription when the budget goes over using an action group and a runbook?
Yes, in the conditions you can enforce naming standards, not regex but still possible. Array of possible also configurable.
And yes technically you could lock via budget threshold calling automation/function to apply lock but possibly dangerous :)
Great video as always! The first link doesn't seem to be working anymore, btw.
Thanks, removed.
Thank you John for another great lesson! I understand Policy implementation will be customer specific based on their business requirements/restrictions/governance design. But is there some real basic starter kind of Azure Policy Initiative which can get the customer started? I know we have policy like Location, SKU, Tags, etc.. but any best practices from Microsoft on recommended Policies to use (like the bear minimum ones) or any that you have seen with your customer experience that they use?
If you look at the include blueprint templates in Azure there are some around CAF which have baseline policies included. Look at those, for example docs.microsoft.com/en-us/azure/governance/blueprints/samples/caf-foundation/
@@NTFAQGuy Thank you John! appreciate your quick response. Have a great weekend!
@@NTFAQGuy is there a way to create Azure Blueprint from all existing components that are created on a subscription (RG, VNets, App Services RBAC,etc.) out of the box instead of writing Json? Something like we have that Exports out the template (ARM) for any component do we have something similar to that like Export as Blueprint if someone has built an environment and they want create blueprint now OR the only way is export each component template (ARM) and compose Blueprint from it. appreciate your opinion on this, thank you!
@@ketanshah9082 if you look at resources you can see the json etc
@@NTFAQGuy Thank you John, yup the Json is available for each resource but what I was trying to search for was a way to export out all components of a subscription (which lets say was all created from portal) and create a blueprint in one shot (Just like how I can export resource group using "export as template") but I think no such option exists and I would have to build a blue print using all the exported templates of all components that I want to include in the blue print.
Hi John, why would a Windows 10 domain-joined device fail to join Azure AD in our organization? It works for majority of the devices, but from time to time there are just such devices that cannot be found in Azure AD, when checking via dsregcmd /status, it shows AzureADJoined - No; Is there a limit of how many devices are allowed in one Azure AD tenant?
I don’t think there is a limit to number total but a user can only join a certain number unless has special role.
@@NTFAQGuy well they don't get registered in AAD no matter who logs on, we might have to open a case with Microsoft but just don't understand why it doesn't work only on some machines with the same image. By the way, in AAD, the error says those machines are not domain-joined but we are sure they are
@@NTFAQGuy Hi John, this turned out to be due to the devices failing to stick with our proxy configurations specified in IE settings when doing the device registration to AAD, however, it works when we explicitly define the Winhttp proxy on those devices (without that, it would take the default setting of WinHttp which is No Proxy, and the packets would be dropped by firewall) - just trying my luck, would you have an idea why that hybrid device registration process would only take the WinHttp proxy setting instead of the IE proxy setting? It's only happening to a small subset of devices
Hi John i've logged a call a couple of times with support asking to prevent random pay as you subs created by users being joined to my tenant and i always get told this isn't possible. You mentioned it here, is there something specific i need to ask?
It's only available for large enterprise customers to my knowledge. It's not a broadly available feature.
@@NTFAQGuy thank you for the quick reply!
❓QUESTION❓
*Where does the Policy live?*
It can be _applied_ to MG, Sub, RG as you described, but I've missed where is it stored. Is it in some particular Subscription or Storage account? Or is it "above" as AAD is?
And what is an ideal place to store "company-level" Policies that will be used on many places within the MG tree?
And btw, thank you for the great content, delivery and energy. Highly appreciated! Having done trainings myself I know _how much more time and effort it takes than it looks like..._
Kudos!!
It’s part of arm at subscription or management group when you define.
@@NTFAQGuy Thank you, sir!
Additional question :-D
You're a busy man handling many things and yet you answered the same day to random youtube question (you're not even tagged in question)?
So, do you have an automation for this or some habit... Just curious
@@mirahedl6446 habit
"Administrators are very angry because they cpnstantly get requests from people" - True story of my life.
lol :-)
An angry buffed admin is someone not to be taken lightly lol
We've all been any angry admin, I blame the users
lol, always :D
shut down your company @1:09:07 that was really good one ....