I85PREP
⌘ K
Azure AZ-305 study materials
Azure AZ-305 study resources

Contoso Retail: governing 42 subscriptions after two acquisitions

Azure AZ-305 · Put your knowledge to work in context.

All case studies

Contoso Retail: governing 42 subscriptions after two acquisitions

Contoso has grown from 4 to 42 Azure subscriptions through two acquisitions, and two of the acquired subscriptions sit in separate Microsoft Entra tenants. The CISO requires that all activity logs and VM telemetry land in one Log Analytics workspace, that no NIC anywhere has a public IP except resources in a single Lab-RG used for training, and that developers can manage their own resource groups without being able to grant access to anyone else. Ingestion is currently 9 TB per month, roughly 60% of it verbose Windows Security events that nobody queries, and finance has flagged the workspace cost. Twenty contractors from a staffing agency need read-only access to production for six months, after which access must be removed automatically. The platform team is four engineers.

1. Recommend a tenant, management group, and policy structure for the 42 subscriptions. State where the public-IP rule is enforced, how Lab-RG is exempted, and how developers get Contributor-like rights without role-assignment rights.

Read the worked answer

One tenant, guardrails at an intermediate management group, RBAC shaped by custom roles.

  • Tenant sprawl is the first decision. Azure Policy and management groups are tenant-scoped, so a policy assigned in Contoso's tenant has zero effect on subscriptions sitting in the acquired tenants. Either migrate those subscriptions into Contoso's tenant, or accept that the CISO rule cannot be enforced there. Azure Lighthouse gives delegated visibility and RBAC across tenants - it is not a policy control, and presenting it as one is the classic wrong answer.
  • Hierarchy. Tenant Root Group → Contoso → Platform and LandingZones → Corp / Online. Assign guardrails at Contoso or LandingZones so the 30 new subscriptions inherit them automatically. Per-subscription assignments do not scale to four engineers.
  • Public IPs. A Deny policy on Microsoft.Network/publicIPAddresses (plus the NIC public-IP configuration) assigned at LandingZones - not an RBAC rule, because RBAC cannot express 'this resource property is forbidden'. Exempt Lab-RG with a notScopes entry on the assignment, or a time-bound policy exemption on the resource group if Lab-RG lives inside a governed subscription.
  • Developer autonomy. Built-in Contributor can create role assignments, which breaks the CISO rule. Clone Contributor into a custom role and remove Microsoft.Authorization/*/write and Microsoft.Authorization/elevateAccess/Action.

2. The workspace ingests 9 TB/month and 60% is unqueried Windows Security event noise. Explain how to cut cost without losing the audit data the CISO requires, including what you must not move off the Analytics plan.

Read the worked answer

Reduce what you send before you shop for discounts.

  • Measure. Use the Usage table (or the workspace health blade) to rank tables by billable volume; do not guess which event IDs dominate.
  • Filter at collection. Data collection rules should collect specific event IDs via XPath rather than 'All Events'. Ingestion you never send is cheaper than any retention or tier discount, and filtering at the agent also cuts bandwidth.
  • Table plans. Move high-volume, rarely-queried verbose tables to the Basic or Auxiliary plan at a fraction of the Analytics price. The judgement call: Basic and Auxiliary tables do not support log alerts or Sentinel analytics rules, so anything feeding a detection must stay on the Analytics plan. Cheap and alertable are mutually exclusive per table.
  • Commitment tier. After trimming, buy a commitment tier at or just below measured daily volume; tiers start around 100 GB/day, so a small workspace gains nothing.
  • Retention. Keep 30–90 days interactive and move audit-only data to long-term retention rather than paying interactive rates for a year.
  • Do not split workspaces to save money - cross-workspace queries work, but you add per-GB ingestion cost and lose a single pane for the CISO dashboard.

3. Design the contractor access model so that read-only production access exists for exactly six months and is provably removed, with minimal admin effort.

Read the worked answer

Use entitlement management, not manual role assignments.

  • Access package containing the read-only role on the production resource groups, with an assignment policy of 180 days, approval by the resource owner, and an access review at expiry. Expiry removes the assignment automatically - no ticket-driven cleanup.
  • Identities. If the agency has its own Entra tenant, invite them as B2B guests; guest accounts get the same access package. Do not create member accounts for contractors - offboarding and credential ownership get messy.
  • Conditional Access applied to guests: MFA required, sign-in from unmanaged devices restricted to browser-only or blocked, session limits.
  • Least privilege. Reader at the resource-group scope, never subscription. If they need logs, grant Log Analytics Reader on the workspace rather than Reader on everything.
  • Monitor. Alert on any assignment outside the access package and on guest sign-ins from new countries. A six-month guarantee is worthless if someone grants a permanent role 'temporarily' on day two.