Designing Cloud-Native on Azure with Entra ID–centric RBAC

1Tenant Root Group
2└─ <org> (mg: contoso)
3   ├─ Platform (mg: contoso-platform)
4   │  ├─ Management (sub: mgmt)
5   │  │   ├─ Monitoring - Log Analytics, Monitor, Sentinel
6   │  │   └─ Automation - Image gallery, update mgmt
7   │  └─ Connectivity (sub: hub)
8   │      ┌──────── Hub VNet ────────┐
9   │      │ Azure Firewall           │
10   │      │ Private DNS Resolver     │
11   │      │ DDoS Plan, Bastion       │
12   │      │ ER/VPN GW, NAT Gateway   │
13   │      └───────────┬──────────────┘
14   │                  │
15   ├─ LandingZones (mg: contoso-lz)
16   │   ├─ Corp (mg)
17   │   │   ├─ App1 Sub - Spoke VNet - PE to hub - Private Endpoints
18   │   │   └─ App2 Sub - Spoke VNet - PE to hub - Private Endpoints
19   │   └─ Online (mg)
20   │       └─ App3 Sub - Internet facing
21   └─ Sandboxes (mg)
22
23Identity plane: Microsoft Entra ID
24 - Groups: Platform-Admins, NetOps, SecOps, AppTeam-App1
25 - PIM eligible assignments for Azure RBAC
26 - Workload identities: Managed Identities, Entra Workload ID for AKS and CI pipelines
27 - Access Packages for governed onboarding

1// target: tenant
2// Deploy with elevated permissions at tenant scope
3
4targetScope = 'tenant'
5
6@description('Org short name')
7param org string = 'contoso'
8@description('Parent MG id, usually the tenant root MG id')
9param parentMgId string
10@description('Policy definition id to assign at LandingZones')
11param policyDefId string
12
13resource mgPlatform 'Microsoft.Management/managementGroups@2020-05-01' = {
14  name: '${org}-platform'
15  properties: {
16    displayName: 'Platform'
17    parent: {
18      id: '/providers/Microsoft.Management/managementGroups/${parentMgId}'
19    }
20  }
21}
22
23resource mgLz 'Microsoft.Management/managementGroups@2020-05-01' = {
24  name: '${org}-lz'
25  properties: {
26    displayName: 'LandingZones'
27    parent: {
28      id: '/providers/Microsoft.Management/managementGroups/${parentMgId}'
29    }
30  }
31}
32
33resource assignLz 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
34  name: 'lz-guardrails'
35  scope: tenantResourceId('Microsoft.Management/managementGroups', mgLz.name)
36  properties: {
37    displayName: 'Landing Zones guardrails'
38    policyDefinitionId: policyDefId
39    enforcementMode: 'Default'
40  }
41}

1provider "azurerm" { features {} }
2
3variable "org" { default = "contoso" }
4variable "parent_mg_id" {}
5variable "policy_def_id" {}
6
7resource "azurerm_management_group" "platform" {
8  display_name = "Platform"
9  name         = "${var.org}-platform"
10  parent_management_group_id = "/providers/Microsoft.Management/managementGroups/${var.parent_mg_id}"
11}
12
13resource "azurerm_management_group" "lz" {
14  display_name = "LandingZones"
15  name         = "${var.org}-lz"
16  parent_management_group_id = "/providers/Microsoft.Management/managementGroups/${var.parent_mg_id}"
17}
18
19resource "azurerm_management_group_policy_assignment" "lz_guardrails" {
20  name                 = "lz-guardrails"
21  management_group_id  = azurerm_management_group.lz.id
22  policy_definition_id = var.policy_def_id
23}

1# Create MGs
2az account management-group create --name contoso-platform --display-name Platform --parent /providers/Microsoft.Management/managementGroups/<rootMgId>
3az account management-group create --name contoso-lz --display-name LandingZones --parent /providers/Microsoft.Management/managementGroups/<rootMgId>
4
5# Assign a built-in policy at the LZ MG
6az policy assignment create \
7  --name lz-guardrails \
8  --display-name "Landing Zones guardrails" \
9  --policy "/providers/Microsoft.Authorization/policyDefinitions/<policyDefId>" \
10  --scope "/providers/Microsoft.Management/managementGroups/contoso-lz"
11
12# RBAC via group-based assignment
13az role assignment create \
14  --assignee-object-id <entraGroupObjectId> \
15  --assignee-principal-type Group \
16  --role "Network Contributor" \
17  --scope "/providers/Microsoft.Management/managementGroups/contoso-platform"
18
19# Budget at subscription scope.
20# Parameter names matter here: the command takes --budget-name, not --name, and it
21# exposes no notification or contact-email parameters at all. Alert thresholds need
22# az consumption budget create-with-rg, ARM, or the portal. The command group is
23# still marked preview. Set a window that has not already closed: a budget with an
24# end date in the past is accepted without complaint and then does nothing.
25az consumption budget create \
26  --budget-name sub-monthly \
27  --amount 1000 \
28  --category cost \
29  --time-grain monthly \
30  --start-date 2026-10-01 --end-date 2027-09-30 \
31  --subscription <subId>

1Connect-AzAccount
2
3# Create MGs
4New-AzManagementGroup -GroupName &#039;contoso-platform' -DisplayName 'Platform' -ParentId '/providers/Microsoft.Management/managementGroups/<rootMgId>'
5New-AzManagementGroup -GroupName &#039;contoso-lz' -DisplayName 'LandingZones' -ParentId '/providers/Microsoft.Management/managementGroups/<rootMgId>'
6
7# Assign policy
8New-AzPolicyAssignment -Name &#039;lz-guardrails' -DisplayName 'Landing Zones guardrails' `
9  -Scope &#039;/providers/Microsoft.Management/managementGroups/contoso-lz' `
10  -PolicyDefinitionId &#039;/providers/Microsoft.Authorization/policyDefinitions/<policyDefId>'
11
12# RBAC assignment to an Entra group
13New-AzRoleAssignment -ObjectId <entraGroupObjectId> -RoleDefinitionName &#039;Network Contributor' `
14  -Scope &#039;/providers/Microsoft.Management/managementGroups/contoso-platform'