SOP — Create and Manage Microsoft Azure for Enterprise

Biggest advantage over AWS/GCP: you already have the identity foundation. Azure subscriptions trust your existing Microsoft Entra tenant (mptwork.onmicrosoft.com / mptwork.com) from Microsoft 365 — no separate identity to create. Don't run workloads in the management/platform subscriptions, and don't use Global Admins for daily resource work.

0. Plan the foundation

Azure resource hierarchy (top to bottom): Tenant Root Management Group → Management Groups → Subscriptions → Resource Groups → Resources. RBAC and Azure Policy inherit downward. Recommended Azure Landing Zone (Cloud Adoption Framework) layout:

Tenant Root Group
└── Intermediate root MG: "mptwork"
    ├── Platform MG
    │     ├── Management subscription   (Log Analytics, automation, monitoring)
    │     ├── Connectivity subscription (hub network, firewall, gateways)
    │     └── Identity subscription     (domain controllers, if any)
    ├── Landing Zones MG
    │     ├── Corp     → internal workload subscriptions
    │     └── Online   → internet-facing workload subscriptions
    ├── Sandbox MG
    └── Decommissioned MG

For a governed baseline, deploy the Azure Landing Zone (ALZ) accelerator (Bicep/Terraform) rather than hand-building.

Part 1 — Establish billing and the first subscription

1. Sign in to portal.azure.com with an Entra account from your tenant (e.g., an admin on @mptwork.com).
2. Create an Azure subscription under the right purchasing vehicle:
   • Microsoft Customer Agreement (MCA) or Enterprise Agreement (EA) for enterprise (billing account → billing profiles → invoice sections → subscriptions), or pay-as-you-go to start.
3. Confirm the subscription is associated with the mptwork.com Entra tenant (it inherits that directory for identity).
4. Assign billing roles (Billing account owner / contributor) to a finance/cloud group.

Part 2 — Secure foundational access

1. MFA is mandatory and now enforced in two phases — ensure every interactive user has MFA before the deadlines:
   • Phase 1 (portal, Entra/Intune admin centers): already enforced.
   • Phase 2 (Azure Resource Manager — CLI, PowerShell, mobile app, REST/SDK, IaC like Terraform/Bicep) for Create/Update/Delete: rolling out since Oct 1, 2025; final postponement deadline July 1, 2026. Use Conditional Access to require MFA for all users now; prefer passkeys/FIDO2.
2. Service identities are exempt from the MFA mandate — migrate user-based service accounts to workload identities (managed identities or service principals with federated credentials); avoid client secrets/keys.
3. Break-glass accounts are NOT exempt — secure your two emergency-access Global Admins with strong (FIDO2) MFA, store offline, and exclude from Conditional Access but ensure they can still satisfy the mandate.
4. Bootstrap RBAC: a Global Admin can temporarily elevate access (Entra → Properties → Access management for Azure resources = Yes) to get User Access Administrator at root scope, assign initial roles, then turn it back off.

Part 3 — Build the management-group hierarchy

1. In the portal → Management groups, create the intermediate root mptwork under the Tenant Root Group.
2. Create the child MGs: Platform, Landing Zones (with Corp / Online), Sandbox, Decommissioned.
3. Create the platform subscriptions (Management, Connectivity, Identity) and workload subscriptions, and move each subscription under the correct management group.

Part 4 — (Recommended) Deploy the Azure Landing Zone accelerator

1. Deploy the ALZ accelerator (CAF) to provision the MG hierarchy, platform subscriptions, baseline Azure Policy assignments, a central Log Analytics workspace, and hub networking in one governed package.
2. Use it as the template for vending future subscriptions so they inherit policy and logging automatically.

Part 5 — RBAC and privileged access

1. Assign Azure RBAC roles (Owner / Contributor / Reader / custom) to Entra groups (e.g., az-platform-owners@mptwork.com) at management-group or subscription scope — never per-user, never broad Owner in production.
2. Distinguish Entra directory roles (e.g., Global Administrator — identity/tenant) from Azure RBAC (resource access) — they're separate planes.
3. Enable Privileged Identity Management (PIM) (Entra P2) for just-in-time, approved, time-bound activation of privileged Azure and Entra roles.

Part 6 — Azure Policy (guardrails)

Assign Azure Policy definitions/initiatives at MG scope (parallel to AWS SCPs / GCP Org Policy), for example:

• Allowed locations — restrict to approved regions (e.g., US/Japan/UK).
• Require tags (CostCenter, Environment, Owner, Subsidiary).
• Deny public IPs, require encryption, require Defender plans.
• Assign the built-in MFA-for-ARM policy (audit then enforce) to align with Phase 2.

Part 7 — Security and monitoring

1. Microsoft Defender for Cloud: enable across the MG/subscriptions for CSPM (Secure Score, recommendations) and workload protection plans.
2. Microsoft Sentinel: deploy on the central Log Analytics workspace (in the Management subscription) for SIEM/SOAR.
3. Diagnostic settings: route Activity Logs and resource logs org-wide to the central Log Analytics workspace; set retention.

Part 8 — Cost management and billing

1. Consolidated billing via the MCA/EA billing account.
2. Set Budgets with alerts, use Cost analysis, and enable anomaly alerts.
3. Enforce a tagging policy (via Azure Policy) for cost allocation; evaluate Reservations / Savings Plans for steady workloads.

Part 9 — Networking baseline (align to the IPAM plan)

1. Allocate VNet CIDRs from the enterprise IPAM plan — Azure blocks are US 10.8.0.0/14, Japan 10.24.0.0/14, UK 10.40.0.0/14 — and carve region/environment/VNet ranges per that scheme.
2. Build a hub-and-spoke (or Azure Virtual WAN) topology with the hub VNet, Azure Firewall, and gateways in the Connectivity subscription; spokes peer to the hub.
3. For AKS, use the planned pod/service ranges from the CGNAT space (e.g., pods 100.66.0.0/16) per the Azure VNet use-case design; remember Azure regions like West US lack availability zones (use a zone-capable region such as West US 2).
4. Connect to the global network (Site-to-Site VPN/ExpressRoute to the Transit hub) per the network reference architecture; ensure no overlapping CIDRs.

Part 10 — Ongoing operations

Appendix — Three-cloud mapping and caveats

AWS ↔ GCP ↔ Azure

Caveats

• MFA is mandatory: portal (done) and ARM/CLI/PowerShell/IaC by the July 1, 2026 deadline. Service principals/managed identities are exempt (use them for automation); break-glass accounts are not — secure with FIDO2.
• Don't run workloads in the management/platform subscriptions; keep them for governance, connectivity, and logging.
• Identity is the existing Entra tenant — protecting Entra Global Admins protects Azure; reuse the Conditional Access and PIM you built in the Entra SOP.
• No broad Owner in production; grant RBAC to groups at MG/subscription scope; prefer PIM for elevation.
• Verify current steps in Microsoft Learn — portal layout, ALZ accelerator, and the MFA enforcement timeline change periodically.