Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceMedium
A global company has multiple Azure subscriptions organized under a management group named 'Corporate'. They need to ensure that all virtual machines across these subscriptions are deployed with a specific set of security extensions and diagnostic settings. Furthermore, they want to standardize the deployment of network security groups (NSGs) for all new subnets. This standardization should be applied consistently and automatically across all present and future subscriptions within the 'Corporate' management group. Which Azure service is best suited for this comprehensive, multi-resource and multi-subscription standardization?
- AAzure Blueprints
- BAzure Policy
- CAzure Security Center
- DAzure Resource Templates (ARM templates)
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Blueprints
Azure Blueprints allow you to define a repeatable set of Azure resources, policies, and role assignments that can be applied consistently across subscriptions. It orchestrates the deployment of various resource templates, policies, and role assignments, making it ideal for standardizing complex environments across multiple subscriptions and enforcing compliance over time.
Why the other options are wrong
- B. Azure Policy is excellent for enforcing rules and auditing compliance, but it doesn't orchestrate the initial deployment of multiple resource types and their configurations in a single package like Blueprints.
- C. Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection, but it's not designed for defining and deploying foundational resource configurations.
- D. ARM templates are good for deploying individual resources or resource groups but lack the inherent capability to enforce ongoing compliance or orchestrate policies and role assignments across subscriptions.
Azure Blueprints
A declarative way to orchestrate the deployment of various resource templates and other artifacts (like policies and RBAC) to meet organizational standards and compliance requirements across multiple subscriptions.
- Defines a repeatable set of Azure resources.
- Combines ARM templates, policies, RBAC, and resource groups.
- Ensures consistent deployment and ongoing compliance.
Memory trick: Blueprints are the master plan for your Azure infrastructure.