☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview
  • Hierarchy Resources
  • Key Concepts
  • Additional Concepts
  • Organization Example
  • Resource Organization Documentation
  1. Azure Fundamentals
  2. Azure Fundamentals Overview

Azure Hierarchy

Last updated 9 months ago

Overview

Azure's hierarchy is structured to organize resources, manage permissions, and control costs. Here is an overview of the main components in the Azure hierarchy:

Hierarchy Resources

1. Tenant (Azure Active Directory)

  • Top-Level Identity and Directory Service: The tenant is linked to an instance of Azure Active Directory (Azure AD). It provides identity, access management, and directory services for users, groups, and applications.

  • Single Tenant per Organization: Typically, an organization will have a single tenant that spans across all its Azure services.

2. Management Groups

  • Organizational Containers: Management groups allow you to organize subscriptions into containers. You can apply governance policies and access control across multiple subscriptions.

3. Subscriptions

  • Billing and Access Control: Each subscription is linked to a billing account. Subscriptions provide a way to manage and isolate resources and access control. Billing and usage reporting are done at the subscription level.

4. Resource Groups

  • Logical Containers: Resource groups are logical containers for resources like virtual machines, databases, and storage accounts. All resources in a resource group should share the same lifecycle and management policies.

5. Resources

  • Individual Services: Resources are the actual services you deploy, such as virtual machines, web apps, databases, etc. Each resource is created within a resource group and a specific region.

Key Concepts

  • Tenant (Azure AD): Provides identity, access management, and directory services for the entire organization.

  • Management Groups: Useful for applying policies and RBAC (Role-Based Access Control) across multiple subscriptions.

  • Subscriptions: Act as boundaries for billing, resource management, and quotas. Each subscription has its own set of policies and RBAC settings.

  • Resource Groups: Logical grouping of related resources for easier management and lifecycle operations (like deployment, updating, and deleting).

  • Resources: The actual Azure services you use and manage.

Additional Concepts

  • Azure Active Directory (Azure AD): Centralized identity and access management service. It is used to control access to resources in Azure.

  • Policies: Used to enforce organizational standards and to assess compliance at various scopes: management groups, subscriptions, or resource groups.

  • Role-Based Access Control (RBAC): Provides fine-grained access management for Azure resources. Roles can be assigned at different levels (management group, subscription, resource group, or resource).

Organization Example

Suppose your organization is Fintech company and has multiple departments, each with its own set of applications and services:

Tenant: FinTech Inc
  ├── Management Group: Root Management Group
        ├── Management Group: Finance
        │     ├── Subscription: Finance-Prod
        │     │     ├── Resource Group: Finance-Prod-RG1
        │     │     └── Resource Group: Finance-Prod-RG2
        │     ├── Subscription: Finance-Dev
        │     │     ├── Resource Group: Finance-Dev-RG1
        │     │     └── Resource Group: Finance-Dev-RG2
        │     └── Subscription: Finance-Test
        │           ├── Resource Group: Finance-Test-RG1
        │           └── Resource Group: Finance-Test-RG2
        ├── Management Group: IT
        │     ├── Subscription: IT-Prod
        │     │     ├── Resource Group: IT-Prod-RG1
        │     │     └── Resource Group: IT-Prod-RG2
        │     ├── Subscription: IT-Dev
        │     │     ├── Resource Group: IT-Dev-RG1
        │     │     └── Resource Group: IT-Dev-RG2
        │     └── Subscription: IT-Test
        │           ├── Resource Group: IT-Test-RG1
        │           └── Resource Group: IT-Test-RG2
        ├── Management Group: Product Development
        │     ├── Subscription: ProdDev-Prod
        │     │     ├── Resource Group: ProdDev-Prod-RG1
        │     │     └── Resource Group: ProdDev-Prod-RG2
        │     ├── Subscription: ProdDev-Dev
        │     │     ├── Resource Group: ProdDev-Dev-RG1
        │     │     └── Resource Group: ProdDev-Dev-RG2
        │     └── Subscription: ProdDev-Test
        │           ├── Resource Group: ProdDev-Test-RG1
        │           └── Resource Group: ProdDev-Test-RG2
        ├── Management Group: Central Services
              ├── Subscription: Central-Shared
              │     ├── Resource Group: Central-Shared-RG1
              │     └── Resource Group: Central-Shared-RG2
              └── Subscription: Central-Security
                    ├── Resource Group: Central-Security-RG1
                    └── Resource Group: Central-Security-RG2

Key Points:

  • Tenant (FinTech Inc): Represents the organization.

  • Root Management Group: The top-level management group.

  • Finance Management Group: Contains subscriptions and resource groups for the Finance department.

    • Finance-Prod, Finance-Dev, Finance-Test: Subscriptions for production, development, and testing environments within the Finance department.

  • IT Management Group: Contains subscriptions and resource groups for the IT department.

    • IT-Prod, IT-Dev, IT-Test: Subscriptions for production, development, and testing environments within the IT department.

  • Product Development Management Group: Contains subscriptions and resource groups for the product development teams.

    • ProdDev-Prod, ProdDev-Dev, ProdDev-Test: Subscriptions for production, development, and testing environments within the product development teams.

  • Central Services Management Group: Manages shared services and security resources across the organization.

    • Central-Shared, Central-Security: Subscriptions for shared services and security resources.

Resource Organization Documentation

Resource organization design area overview - Cloud Adoption FrameworkMicrosoftLearn
Logo