🔧 Azure Account Setup - Advanced

Advanced Governance and Management

Enterprise Scale Landing Zone

# Deploy enterprise scale landing zone
az deployment tenant create \
  --name es-deploy \
  --template-file template.json \
  --location eastus \
  --parameters environment=production

Management Group Hierarchy

# Create management group
az account management-group create \
  --name "Production"

# Move subscription
az account management-group subscription add \
  --name "Production" \
  --subscription {subscription-id}

# Create policy at management group
az policy definition create \
  --name "require-encryption" \
  --rules @policy-rules.json

Cross-Subscription Resource Management

# Grant access across subscriptions
az role assignment create \
  --role "Management Group Contributor" \
  --assignee user@example.com \
  --scope /providers/Microsoft.Management/managementGroups/Production

Cost Governance

Azure Policy for Cost Control

{
  "mode": "All",
  "policyRule": {
    "if": {
      "field": "type",
      "equals": "Microsoft.Compute/virtualMachines"
    },
    "then": {
      "effect": "deny",
      "details": {
        "message": "Only approved VM sizes allowed"
      }
    }
  }
}

Budget Enforcement with Automation

# Enforce budget via automation runbook
az account create-budget \
  --name "Departmental Budget" \
  --category cost \
  --amount 50000 \
  --time-grain monthly \
  --start-date 2024-01-01

Key Takeaways

• **Management Groups** organize subscriptions at scale

• **Azure Policy** enforces governance

• **Cost governance** automates financial controls

• **Enterprise scale** patterns guide large deployments

Next Steps

Explore advanced resource deployment patterns with IaC.