Azure Design Best Practice for Hybrid Cloud

[sc2317]

Hi Team,

I am looking for best practices or Diagrams that can assist me in designing Azure hybrid environment. I am beginner and don't have much experience on Azure. I want to prepare landing zones to start with Azure in Hybrid Model.

Currently, we don't have any design and don't use Azure services(Except Azure AD) for production environment. This is going to be initial setup that will act as base for future deployments so I want to configure things based on best practices.

Some ideas like hierarchal diagrams(Including Management Groups, Subscriptions, Resource Groups etc) for Management, Security  and deployment of resources would be really helpful.

Can someone please suggest.

[#2]

@sc2317,

it is impossible to give a detailed recipe that works for every scenario. However, Microsoft has very good content that will help you into your decision making process. I guess you heard about the Cloud Adoption Framework. I am sharing the link to the Landing Zones documentation, but you'll find many other topics of interest around Azure adoption:

What is an Azure landing zone? - Cloud Adoption Framework | Microsoft Docs

[#3 · Accepted solution]

Hi
Depending on your use case can follow the either the Standard enterprise governance guide :
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/guides/standard/
Or Governance guide for complex enterprises :
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/guides/complex/
You will be able with those documents to build Governance, Indentity and Security baseline .on top of your Network.
To build your network an esay starting point is to use secure hybrid network architecture :
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs...
Then look at the Hub and Spoke topology :
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-sp...
Check the different virtual network segmentation patterns
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/networ...
Then the Hybrid availability and performance monitoring reference architecture
https://docs.microsoft.com/en-us/azure/architecture/hybrid/hybrid-perf-monitoring
At this stage you should be your end to end design MVP
You can of course each component if applicable by a third a third party tool especially if you already have Licences .

The architecture center have many reference which can help you to start
https://docs.microsoft.com/en-us/azure/architecture/browse/
Finally check the different implementation options
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/implementation-op...

[#4]

@ibnmbodji 

Thanks for your feedback and time. I'll go through this and see if it helps.

One more thing, that I would like to know is that what is the general or most widely used method of organizing resources in Azure. For example - Is it good to have separate resource groups or separate subscriptions for different resources/services that we use in Azure.

[#5]

@sc2317 

Hi ,  you're welcome

From my experience i've seen two patterns : 

- Group resources  sharing the same lifecycle . It can be an application or a solution so you have all the components in the same resource group . 

- Group resources by area so you will have monitoring tools in the same rg the security tools in other the networking tools or components in a different one . The idea behind is to leverage Role based access control and provide least privilege. For example a network engineer should able to manage networking components only and nothing else . 

The  subscription is at an higher level so you can have subscription for each environment

Dev Preprod Prod for example and in each subscription have the relevant resource groups whether they belong to this or that environment .Since there is a quota for some resources per subscription one subscription may not be enough ( Thousand and thousand of vms or containers) but you can still differenciate prod and non prod subscriptions and for the billing purpose it's quite interesting.  

[#6]

@ibnmbodji 

Hi,
Many thanks for your suggestions. This has helped me a lot to understand and will certainly help me to take decisions going forward.