Tutorial / Cram Notes
Managing subscriptions in Azure is a critical task for administrators who need to maintain control over resources, costs, and permissions. The AZ-104 Microsoft Azure Administrator exam tests candidates on their ability to manage Azure subscriptions effectively, among other skills.
Understanding Azure Subscriptions
Azure subscriptions are a fundamental entity in Azure, acting as a container for resources. They define the boundary of Azure services, resource management, and billing. Each subscription can have a different billing model and access control policies.
To manage Azure subscriptions, you need to understand the relationship between Azure Active Directory (Azure AD) and Azure subscriptions. An Azure subscription is associated with a single Azure AD tenant, and this relationship dictates who can access resources within that subscription.
Access Management for Subscriptions
Access to Azure subscriptions is managed through Role-Based Access Control (RBAC). RBAC ensures that only authorized users can perform specific actions within a subscription. Here’s an example of how permissions can be structured in RBAC:
| Role | Permissions |
|---|---|
| Owner | Full access to all resources |
| Contributor | Create and manage all resources but cannot grant access to others |
| Reader | View resources but cannot make changes |
In practice, you would assign roles to users, groups, service principals, or managed identities at the subscription level or scope them to specific resources.
Managing Costs and Billing
A key part of subscription management is keeping track of costs and billing. Azure provides tools like Cost Management and Billing to help administrators monitor and control Azure spending.
Here’s a simple breakdown of cost management features you can use:
- Budgets: Set up budgets to monitor and control spending across subscriptions.
- Cost Analysis: View and analyze current and past usage and costs.
- Recommendations: Implement Azure Advisor recommendations to optimize costs.
It’s important to regularly review and adjust budgets in line with actual spending and organizational changes.
Example: Setting a Budget
To manage costs within a subscription, an administrator can create a budget. For instance, you can set a monthly budget of $500 with the following steps:
- Navigate to the ‘Cost Management + Billing’ section in the Azure Portal.
- Select ‘Budgets’ and then click ‘Add’.
- Choose the subscription for which you want to set the budget.
- Configure the budget, specifying the amount, the period (monthly, quarterly, or annually), and the start date.
- Set up alerts to notify designated individuals when spending reaches certain percentages of the budget.
Transferring and Managing Multiple Subscriptions
Organizations may need to transfer subscriptions or manage multiple subscriptions due to changes in project ownership or company structures.
To transfer ownership of an Azure subscription, you must have the Owner role at the subscription scope. The new owner must also accept the transfer by providing their account information. The process involves updating the subscription directory in the Azure Account Center.
For managing multiple subscriptions, Azure Lighthouse provides a way to manage resources across multiple subscriptions and even across multiple Azure AD tenants. This is especially useful for service providers who manage resources for multiple clients.
Subscription Policies and Compliance
Azure Policy is a service that helps enforce organizational standards and assess compliance. Administrators can assign policies to a subscription to ensure that resources comply with the organization’s requirements.
For example, a policy could enforce that all resources deployed in a subscription should be located in a specific Azure region to comply with data residency regulations.
Conclusion
Effective subscription management encompasses access control, cost management, transfers, multiple subscription oversight, and compliance. Mastery of these areas is essential for Azure administrators and is rigorously tested in the AZ-104 exam. Keeping up-to-date with Azure’s tools and best practices is crucial for ensuring efficient, secure, and cost-effective operations in the cloud.
Practice Test with Explanation
True or False: In Azure, you can assign different roles to users at the subscription level to control their access to resources.
- Answer: True
Azure provides Role-Based Access Control (RBAC) which allows you to assign roles to users at different scopes, including the subscription level, to manage their access permissions to resources.
True or False: Cost Management and Billing is only available for Enterprise Agreement customers in Azure.
- Answer: False
Cost Management and Billing is available to various types of accounts including Enterprise Agreement, Pay-As-You-Go, and Microsoft Customer Agreement accounts in Azure.
Which of the following can be used to manage subscriptions in Azure? (Select all that apply)
- A) Azure Portal
- B) Azure CLI
- C) PowerShell
- D) Azure Active Directory
- Answer: A, B, C
You can manage Azure subscriptions using the Azure Portal, Azure Command-Line Interface (CLI), and PowerShell. Azure Active Directory is used for identity services but does not directly manage subscriptions.
True or False: Azure subscriptions have a hard limit on the number of resource groups that you can create.
- Answer: False
Azure subscriptions do not have a hard limit on the number of resource groups; you can create as many resource groups as your management needs deem necessary.
Which Azure service can help you organize resources and manage costs by grouping together related resources?
- A) Azure Resource Manager
- B) Azure Resource Groups
- C) Azure Service Health
- D) Azure Policy
- Answer: B
Azure Resource Groups help to organize resources and manage costs by grouping together related resources.
What is the maximum number of co-administrators you can have for an Azure subscription?
- A) 10
- B) 200
- C) No limit
- D) 500
- Answer: B
You can have a maximum of 200 co-administrators for an Azure subscription.
True or False: You can move resources from one subscription to another using the Azure Portal.
- Answer: True
The Azure Portal provides the functionality to move resources from one subscription to another, provided you have the necessary permissions.
True or False: You must always delete all resources inside a subscription before you can cancel it.
- Answer: False
It is not always necessary to delete all resources before canceling a subscription, but to avoid unnecessary charges, it is recommended to clean up resources you no longer need.
Which of the following statements about Azure subscriptions is true?
- A) Each Azure subscription can be associated with multiple Azure Active Directory tenants.
- B) Azure subscriptions are global and can contain resources from multiple geographical regions.
- C) An Azure subscription is required to have at least one Virtual Machine.
- D) Azure subscriptions are tied to a single geographical region.
- Answer: B
Azure subscriptions are global and can contain resources from multiple geographical regions. They are not restricted to a single region or to having specific resources such as a Virtual Machine.
When transferring billing ownership of an Azure subscription, which of the following is a requirement?
- A) The recipient must be a user in the same Azure Active Directory tenant.
- B) The recipient’s email address must be Outlook.com.
- C) The subscription must be in a suspended state.
- D) All resources in the subscription must first be migrated to the recipient.
- Answer: A
When transferring billing ownership of an Azure subscription, the recipient must be in the same Azure Active Directory tenant as the current owner. This ensures that billing ownership stays within the same organizational control.
True or False: You can use Azure Policies to enforce tagging rules on resources across your subscriptions.
- Answer: True
Azure Policies can be applied to resources across your subscriptions to enforce tagging and other compliance-related rules.
Which feature allows you to receive alerts when your Azure spending reaches a certain amount?
- A) Azure Budgets
- B) Cost Management + Billing
- C) Azure Advisor
- D) Azure Monitor
- Answer: A
Azure Budgets allows you to set thresholds for your spending and receive alerts when your spending reaches those thresholds.
Interview Questions
What is a subscription in Azure?
A subscription is an agreement with Microsoft to use one or more Azure services.
How can you create a subscription in Azure?
You can create a subscription in Azure by signing up for a free account, purchasing a new subscription, or by getting added to an existing subscription as a co-administrator.
Can you switch Azure offers after creating a subscription?
Yes, you can switch Azure offers after creating a subscription.
What is an Azure offer?
An Azure offer is a set of Azure services with a specific pricing model.
Can you change the Azure offer for an existing subscription?
No, you cannot change the Azure offer for an existing subscription. You need to create a new subscription and move your resources to it.
What is the process for creating a new subscription in Azure?
To create a new subscription in Azure, you need to provide some basic information such as your name, email address, phone number, company name, and country. You also need to choose a subscription type and a payment method.
What is the purpose of a management group in Azure?
A management group is a logical container for managing access, policies, and compliance across multiple subscriptions.
How can you switch the Azure offer for a subscription?
You can switch the Azure offer for a subscription by following the steps in the Azure portal. You need to select the subscription you want to modify and then choose the new Azure offer you want to switch to.
How can you remove a subscription from your Azure account?
To remove a subscription from your Azure account, you need to open the Subscriptions page in the Azure portal, select the subscription you want to remove, and then click the Delete button.
How can you add a co-administrator to an Azure subscription?
To add a co-administrator to an Azure subscription, you need to go to the Subscriptions page in the Azure portal, select the subscription you want to modify, and then click the Access control (IAM) button. From there, you can add the co-administrator with the appropriate role.
How can you limit spending for an Azure subscription?
You can limit spending for an Azure subscription by setting up cost alerts, creating budgets, or using Azure reservations.
What is an Azure reservation?
An Azure reservation is a discount on the cost of running a specific Azure resource for a specified period.
Can you delete a subscription that contains resources?
No, you cannot delete a subscription that contains resources. You need to move or delete the resources first.
How can you transfer ownership of an Azure subscription?
To transfer ownership of an Azure subscription, you need to create a support ticket with Microsoft and provide the necessary information, such as the email address of the new owner.
What is a resource group in Azure?
A resource group is a logical container for managing Azure resources that share the same lifecycle and permissions.
Great blog post on managing subscriptions for the AZ-104 exam.
Can someone explain how to manage resource groups under a subscription effectively?
Good overview, but I think the blog could use more detailed steps on setting up cost management.
Thanks, this was really helpful!
Is there a way to automate subscription creation using ARM templates?
How do you handle subscriptions in a multi-tenant environment?
Anyone having issues with subscription limits?
Appreciate the detailed write-up!