u/denstorepingvin

Hey folks,

As we are transitioning more and more workloads to Azure, we have started to look into setting up some sort of access and naming structure for the ressources.

To begin with, i've been looking at the Azure landing zone architecture and been trying to understand the logic. Moreso, i've been using Microsoft own naming convention standard:

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming

I now have a task to setup an automation account, which will handle more or less all automation jobs in the company both for on-premise workloads and cloud.

I then tried to identify based on the architecture where that would fit in.

Based on the logic, i would assume it should be located under the "Management" management group. I've then created a sub with naming convention sub-mgmt-prod-001 --> rg-automation-prod-001 & rg-automation-dev-001.

I've created 2 Entra groups for RBAC for both rg's. One granting contributer access role and one for reader.

So my question is two sided, how do you come to conclusion as to where the ressources should be located? And would you have done the structure differently? I'm a bit worried, that moving RBAC down to RG level, will be a management headache, but with this structure it's to broad privilege wise to set on sub-mgmt-prod-001.

Was also wondering if it was better to make an automation account subscription under the "Management" mg, then RBAC management may be easier as we go.

Curious to hear your thoughts.