Who's paying for all this?

Factors that affect costs

In Azure you pay for what you use, so many things move the bill:

• Resource type: each service has its own meters; size, tier and redundancy change the rate
• Consumption: pay-as-you-go for what you use, or commit up front with Azure Reservations (1 or 3 years) for big discounts
• Geography: prices differ between regions
• Network traffic: most data coming into Azure is free; data going out (egress) and between regions is billed
• Subscription type: free accounts and some offers include credits
• Azure Marketplace: third-party products bought there add their own charges
• Maintenance: leftovers, like the disks or internet protocol (IP) addresses of a deleted virtual machine (VM), keep billing

Exam tip A stopped (deallocated) VM stops compute charges, but its disks still bill. Delete leftovers you don't need.

Pricing calculator and TCO calculator

The Azure pricing calculator estimates the cost of resources you plan to build: pick services, region, tier, billing option (pay-as-you-go or reserved) and support options, and it shows a monthly estimate you can save and share. The Total Cost of Ownership (TCO) calculator answers a different question: what would our on-premises servers, storage, networking and labor cost compared with running the same in Azure?

Dev: I priced the new order tracker before building it. The estimate is the start; the real bill follows real usage.

Exam tip Planned Azure resources = pricing calculator. On-premises vs Azure = TCO calculator. Both only estimate; neither creates or bills anything.

Microsoft Cost Management

Microsoft Cost Management (in the portal under Cost Management + Billing) shows what you've actually spent and what you're forecast to spend. Cost analysis breaks costs down by subscription, resource group, service, region or tag. Budgets set a spending limit for a scope and alert people when actual or forecast spending crosses thresholds you choose. You can also schedule cost data exports.

Three kinds of cost alerts

Cost Management alerts come in three types:

• Budget alerts: spending reached a threshold of a budget you set
• Credit alerts: your Azure credit (a prepaid commitment) is being used up; for Enterprise Agreement customers
• Department spending quota alerts: a department reached its fixed spending quota; for Enterprise Agreement customers

Exam tip A budget alerts; it doesn't stop resources by itself. To act automatically, connect the budget to an action group that runs automation.

Tags

A tag is a name-value pair you attach to a resource, resource group or subscription, such as dept: grooming. Tags help with cost reporting (who spent what), operations (which app is this?), security (how sensitive is this data?) and automation (shut down everything tagged env: test at night). Resources don't inherit tags from their resource group by default; Azure Policy can add or require them.

env      : production
dept     : grooming
owner    : sam.kowalski
costcode : PP-104

Rosa: So it's a price tag that says whose price it is.

Dev: Exactly. Unlabeled boxes get lost in your warehouse. Untagged resources get lost on the bill.

Rules for resources

Azure Policy lets you create, assign and manage rules, called policy definitions, and then evaluates your resources against them. A policy can deny a non-compliant deployment, audit and flag it, or modify it, for example by adding a missing tag. Examples: 'only US regions are allowed', 'only these VM sizes', 'every resource needs a costcode tag'. Azure includes many built-in definitions, so you rarely start from scratch.

Initiatives, scope and remediation

An initiative groups related policy definitions so you can assign them together, such as a set of security rules. You assign policies and initiatives at a management group, subscription or resource group, and child scopes inherit them. The compliance view shows which resources break which rules, and many policies can remediate existing resources, not just block new ones.

Sam: So an 'allowed locations: US only' policy means my 14 VMs abroad never would have deployed?

Dev: Denied at the door.

Exam tip Azure Policy = what resources may look like (their settings). Azure role-based access control (RBAC) = what users may do. The exam loves this pair.

Resource locks

A resource lock prevents accidental deletion or change, even by someone with Owner rights. There are two kinds:

• CanNotDelete (shown as Delete in the portal): people can read and modify the resource, but not delete it
• ReadOnly: people can read the resource, but not change or delete it, as if everyone were a Reader

Maya: The orders database gets a delete lock today.

Ranger: sits on the server rack like a paperweight

Exam tip Locks apply to a subscription, resource group or resource and are inherited downward. To change or delete a locked resource, someone must remove the lock first.

Microsoft Purview

Microsoft Purview is a family of data governance, risk and compliance solutions that help you see and govern data across your whole estate: on premises, multiple clouds and software as a service (SaaS) apps like Microsoft 365. It discovers and maps your data (the Data Map and Unified Catalog), classifies sensitive data like customer emails or card numbers, tracks data lineage (where data came from and where it went), and helps meet regulations with tools such as data loss prevention, retention and audit.

Priya: So Purview could tell us which of Pawsome's databases hold customer addresses?

Dev: That's exactly its kind of question.

Exam tip Purview governs the data itself: where sensitive data is and how it's used. Azure Policy governs resource settings. Locks stop deletes.