What are the different Azure subscription plans and design best practices?

Because every organization is different, Azure management groups are designed to be flexible. While subscriptions can be moved between different management groups, it is helpful to design an initial management group hierarchy that reflects your anticipated organizational needs.

The following subscription patterns reflect an initial increase in subscription design sophistication, followed by several more advanced hierarchies that may align well to your organization:

Single Subscription

A single subscription per account may suffice for organizations that need to deploy a small number of cloud-hosted assets. This is the first subscription pattern when beginning your Azure adoption process to explore the more capabilities of the cloud.

Production-and-Preproduction Pattern

Once you’re ready to deploy a workload to a production environment, you should add an additional subscription. This helps you keep your production data and other assets out of your dev/test environments. You can also easily apply two different sets of policies across the resources in the two subscriptions.

Workload Separation Pattern

As an organization adds new workloads to the cloud, different ownership of subscriptions or basic separation of responsibility may result in multiple subscriptions in both the production and preproduction management groups. While this approach does provide basic workload separation, it doesn’t take significant advantage of the inheritance model to automatically apply policies across a subset of your subscriptions.

Application Category Pattern

As an organization’s cloud footprint grows, additional subscriptions are typically created to support applications with fundamental differences in business criticality, compliance requirements, access controls, or data protection needs.

Each organization will categorize their applications differently, often separating subscriptions based on specific applications or services or along the lines of application archetypes. Some workloads that might justify a separate subscription under this pattern include:

• Mission-critical workloads.
• Applications with protected data.
• Experimental applications.
• Applications subject to regulatory requirements (such as HIPAA or FedRAMP).
• Batch workloads.
• Big data workloads such as Hadoop.
• Containerized workloads using deployment orchestrators such as Kubernetes.
• Analytics workloads.

Functional pattern

The functional pattern organizes subscriptions and accounts along functional lines, such as finance, sales, or IT support, using a management group hierarchy.

Business Unit pattern

The business unit pattern groups subscriptions and accounts based on profit and loss category, business unit, division, profit center, or similar business structure using a management group hierarchy.

Geographic pattern

For organizations with global operations, the geographic pattern groups subscriptions and accounts based on geographic regions using a management group hierarchy.

Design Considerations

One of the most critical items in the process of designing a subscription is assessing your current environment and needs.

Understanding how each component is limited and how each impacts the others is critical to a solution that can scale and be flexible enough to support the needs of the business.

Specifically, it is important to have a thorough understanding of the following aspects:

• Business requirements such as availability, recoverability, performance, cost Centers and chargebacks.
• Technical requirements like network connectivity, AD requirement, and considerations around management tools.
• Security considerations like policies, subscription administrators, and implementation of a least privilege administrative model among others.
• Additional considerations include Scalability plans, subscription owner, Office 365 AAD tenant set up, trial Power BI evaluation, trust issues between owners of a subscription and the owner of resources to be deployed.
• Rigid financial or geopolitical controls might require separate financial arrangements for specific subscriptions.

Speaking of security concerns in Azure, read the part-3 of this article series for to know how to put together an effective operational security plan to safeguard your data, applications, and other assets in Azure.