Skip to content

Services at a glance

Service Purpose
Azure Policy Enforce and audit rules on resources
Resource locks Prevent accidental delete / change
Tags Metadata for organisation and cost reporting
Microsoft Purview Data governance and compliance
Azure Cost Management + Billing Analyse, budget and optimise spend
Pricing Calculator / TCO Calculator Estimate costs before deploying
Azure Advisor Personalised best-practice recommendations
Azure Monitor Metrics, logs and alerts
Log Analytics Query logs with KQL
Application Insights App performance monitoring
Service Health / Azure status Platform incidents and planned maintenance
Azure Arc Govern resources outside Azure

Governance

Azure Policy

Rules evaluated against resources. Effects include Deny, Audit, Append, Modify, DeployIfNotExists.

  • Example: only allow regions southafricanorth and westeurope; require a CostCenter tag
  • Group policies into initiatives (e.g. regulatory compliance packs)
  • Assign at management group, subscription or resource group
  • Policy answers "are resources compliant?"; RBAC answers "may this user act?"

Resource Locks

  • CanNotDelete: can read and modify, cannot delete
  • ReadOnly: can only read
  • Locks override RBAC, even for Owners, and inherit to child resources
$ az lock create --name keep --lock-type CanNotDelete -g rg-demo

Tags

Name/value pairs on resources and groups (env=prod, owner=sharif). Not inherited by default; use Policy to enforce or inherit.

Other governance tools

  • Azure Blueprints (deprecated, replaced by Template Specs + Policy + Deployment Stacks)
  • Management groups for hierarchy (1. Azure Core Concepts)
  • Microsoft Purview for data catalogue, classification and compliance
  • Azure Arc to apply policy to servers and clusters running anywhere

Cost Management

What affects cost

  • Resource type, size and region
  • Usage and consumption
  • Bandwidth: inbound is free, outbound is charged
  • Subscription type and offers
  • Reservations, Savings Plans, Hybrid Benefit (reuse Windows Server / SQL licences), Spot

Tools

  • Pricing Calculator: estimate a new workload
  • TCO Calculator: compare on-prem vs Azure over time
  • Cost Management + Billing: cost analysis, budgets and alerts, exports, tag-based breakdowns
  • Azure Advisor: right-size or shut down underused VMs

Ways to save

  1. Delete or deallocate idle resources
  2. Right-size VMs
  3. Reserved Instances (1 / 3 year) and Savings Plans
  4. Hybrid Benefit
  5. Autoscale rather than over-provision
  6. Move cold data to cooler 4. Azure Storage tiers
  7. Use dev/test pricing for non-production

Monitoring

Azure Monitor

Platform for collecting metrics (numeric time series) and logs (events).

  • Alerts with action groups (email, SMS, webhook, Logic App)
  • Dashboards and Workbooks
  • Autoscale rules driven by metrics
  • Diagnostic settings route resource logs to Log Analytics, Storage or Event Hubs

Log Analytics and KQL

Kusto Query Language over collected logs:

AzureActivity
| where TimeGenerated > ago(1d)
| where OperationNameValue endswith "delete"
| summarize count() by Caller

Application Insights

APM for apps: request rates, failures, dependencies, distributed traces, availability tests.

Azure Service Health

  • Azure status: global outages
  • Service Health: issues affecting your services and regions
  • Resource Health: health of individual resources

Activity Log

Control-plane audit of who did what to a resource (create, delete, role change), kept 90 days.

Compliance and Trust

  • Service Trust Portal: audit reports and certifications (ISO, SOC, etc.)
  • Compliance Manager: assess and track your compliance score
  • Regional / sovereign clouds for data residency requirements