As Azure adoption grows, so does the risk of inconsistency. Different teams create subscriptions their own way, choose their own regions and skip the controls that auditors expect. Governance built on management groups and Azure Policy keeps that growth safe without slowing teams down.
Design the management group hierarchy
Management groups sit above subscriptions and let you apply access and policy once for many subscriptions. A common hierarchy follows the Cloud Adoption Framework: a top-level group for the organization, a platform branch for identity, connectivity and management subscriptions, a landing zones branch split into corporate and online workloads, plus sandbox and decommissioned groups.
Keep the hierarchy shallow and based on governance needs rather than the org chart. Departments change often; the controls an internet-facing workload needs do not.
Use Azure Policy as guardrails
Azure Policy evaluates resources against rules and can audit, deny, append or deploy settings automatically. Initiatives group related policies, such as the Microsoft cloud security benchmark or a regulatory standard, so they can be assigned and tracked together.
- Deny: block resources in unapproved regions or public IPs on sensitive subnets.
- Modify and append: add required tags or enforce secure transfer settings.
- DeployIfNotExists: enable diagnostic settings, backup or monitoring agents automatically.
- Audit: report on rules not yet ready for enforcement.
Start new policies in audit mode, review the impact, then move to enforcement. Remediation tasks can fix existing non-compliant resources once a policy is assigned.
Control access with RBAC and PIM
Role-based access control should be assigned to Entra ID groups at the highest sensible scope, never to individuals one resource at a time. Privileged Identity Management makes owner and contributor roles eligible rather than permanent, with approval, justification and time limits. Regular access reviews remove assignments that are no longer needed.
Make governance someone's job
Separate break-glass accounts, excluded from conditional access but closely monitored, provide emergency access if Entra ID configuration ever locks administrators out. Their use should trigger an immediate alert and review.
Policies drift when nobody owns them. New services appear, exemptions accumulate and initiatives fall behind Microsoft's updates. Organizations that rely on microsoft azure managed services often place this ownership with the partner, who keeps policy definitions in source control, tests changes in a non-production management group and reports compliance every month.
Ownership also means a regular cadence. A monthly governance review covering new Microsoft built-in policies, compliance trends, open exemptions and upcoming changes keeps the guardrails current. Quarterly reviews with security and finance stakeholders confirm that the rules still match business priorities, data residency obligations and regulatory commitments.
Clear documentation helps workload teams too. When a deployment is denied, the error should point to a page explaining the rule, why it exists and how to request an exemption, so guardrails feel like guidance rather than obstacles.
Manage governance as code
Policy definitions, initiatives, assignments and exemptions belong in a Git repository, deployed through pipelines with Bicep or Terraform. Enterprise Policy as Code and similar frameworks make it easy to review changes, roll them out across environments and roll back mistakes. Subscription vending automation can create new subscriptions already placed in the right management group with budgets, tags and networking in place.
Tie governance to cost
Governance is also financial. Required tags for cost center and owner make Cost Management reports meaningful. Budgets with alerts at each subscription catch overspend early, and policies can restrict expensive SKUs in sandbox environments. Reviewing cost and compliance together shows which teams need help.
Manage exemptions and compliance reporting
Exemptions are sometimes necessary, but each one should carry a category, justification and expiry date. The compliance dashboard in Azure Policy, combined with Azure Resource Graph queries, shows non-compliant resources by subscription and rule. Track the trend monthly and treat long-lived exemptions as risks to be resolved, not permanent fixtures.
Defender for Cloud regulatory compliance views map these results to standards such as ISO 27001, SOC 2 and PCI DSS, giving auditors evidence without manual spreadsheet work.
Getting started
If your tenant has no structure today, begin with the hierarchy, a small set of high-value policies in audit mode and PIM for privileged roles. Expand enforcement gradually, and the estate will become easier to secure, audit and run.