8:19
Benefits and Usage of Subscriptions - AZ-900 Certification Course
John Savill's Technical Training
Overview
This video explains Azure subscriptions, defining them as the fundamental agreement unit between a customer and Microsoft. It details how subscriptions act as billing and security boundaries, are linked to a single Azure Active Directory tenant for identity management, and allow for the application of policies, budgets, and role-based access control. The video also discusses subscription limits and provides reasons for using multiple subscriptions, such as separating environments, managing billing, or overcoming resource limits.
How was this?
Save this permanently with flashcards, quizzes, and AI chat
Chapters
- A subscription is the basic agreement unit between a customer and Microsoft for Azure services.
- Each subscription has a specific billing model (e.g., pay-as-you-go, enterprise agreement).
- Subscriptions serve as a billing boundary and a default security boundary.
- A subscription trusts exactly one Azure Active Directory (Azure AD) tenant for user and group management.
Understanding subscriptions is crucial because they define how you are billed for Azure services and how access to your resources is managed, forming the foundation of your Azure environment.
A 'development subscription' is shown, illustrating the link to a specific Azure AD tenant and the ability to manage permissions and settings at the subscription level.
- Azure AD tenants contain users, groups, and devices, and are separate from subscriptions.
- A subscription is configured to trust a single Azure AD tenant, which dictates who can be granted permissions.
- It is possible to move a subscription to trust a different Azure AD tenant, provided the necessary permissions are held.
This relationship is key to understanding how identity and access management works in Azure; it ensures that only authorized users from a specific directory can manage resources within a subscription.
The video shows the 'directory' setting within a subscription's properties, demonstrating where the trust relationship to an Azure AD tenant is established and can potentially be changed.
- Like resource groups, subscriptions allow for role-based access control (RBAC) assignments.
- Permissions assigned at the subscription level are inherited by all resource groups and resources within it.
- Budgets can be set at the subscription level to monitor and control spending.
- Policies can be applied at the subscription level to enforce organizational standards and compliance.
Applying management controls like RBAC, budgets, and policies at the subscription level provides a broad stroke of governance that cascades down, simplifying management and ensuring consistent application of rules across all contained resources.
The presenter navigates to the 'Budgets' and 'Policies' sections within a subscription's settings, illustrating where these management controls are configured.
- Subscriptions have various limits (e.g., number of resource groups, deployments) that can be soft (adjustable) or hard.
- These limits can influence architectural decisions, such as how many subscriptions are needed.
- Resource groups exist within a subscription and also have their own limits.
Understanding subscription limits is essential for designing scalable and compliant Azure architectures, preventing service disruptions caused by hitting predefined boundaries.
The video briefly shows the 'Azure subscription limits' documentation, highlighting examples like '980 resource groups per subscription' and '50 tags per subscription'.
- Separating environments (e.g., production, development, testing) allows for different access controls, policies, and resource restrictions.
- Subscriptions can be used for billing purposes, making it easier to track costs for different departments or projects.
- Multiple subscriptions are necessary when hitting resource limits within a single subscription.
- If different Azure AD tenants are required for various parts of an organization, separate subscriptions are needed as each subscription links to only one tenant.
Strategically using multiple subscriptions enables better cost management, enhanced security through isolation, and more organized resource deployment tailored to specific needs.
The example of having a 'prod subscription' and a 'test subscription' is given, explaining how permissions and policies might differ between them.
Key takeaways
- An Azure subscription is the foundational unit for billing and resource management, acting as a boundary for both.
- Every subscription is tied to a single Azure AD tenant, which manages the identities that can access resources within that subscription.
- Management controls like Role-Based Access Control (RBAC), budgets, and policies can be applied at the subscription level and are inherited by resources within.
- Azure imposes limits on resources and operations per subscription, which can necessitate the creation of additional subscriptions.
- Using multiple subscriptions is a common practice for separating environments, managing costs, and adhering to organizational policies.
- Tagging can be a powerful tool for cost allocation and tracking, even when using multiple subscriptions.
Key terms
SubscriptionAzure Active Directory (Azure AD) TenantBilling BoundarySecurity BoundaryRole-Based Access Control (RBAC)Resource GroupPolicyBudgetLimits (Soft and Hard)Tagging
Test your understanding
- What is the primary function of an Azure subscription in terms of billing and security?
- How does an Azure AD tenant relate to an Azure subscription, and why is this relationship important for access management?
- What are some examples of management controls that can be applied at the subscription level, and how do they affect resources within?
- Why might an organization choose to create multiple Azure subscriptions instead of using a single one?
- How do subscription limits influence the design and architecture of an Azure environment?