Offer Design for an Isolated Department with Strict Data Residency
A government department wants to consume Azure Stack Hub services but must keep all data on-premises. The department has three teams: a research team that needs IaaS VMs and VNet isolation, a data team that needs a SQL database with point-in-time restore, and a citizen-services team that needs a web tier with TLS termination. The platform operator has one user subscription model available and a single offer. The department's security office requires that each team's resources be isolated from the others and that no team can view another team's resources. The operator also wants to charge back costs per team and must report monthly consumption. The department has a strict change-control process: any new plan requires a two-week review. The citizen-services team has a hard deadline in three weeks.
1. Design the offer, plan, and subscription structure that satisfies isolation, chargeback, and the deadline.
Read the worked answer
Use separate subscriptions per team, grouped under offers that map to the service catalog the teams need. Isolation of resources and visibility is achieved at the subscription boundary, not at the plan level. Plans control which services and quotas a subscriber can use; subscriptions control resource boundaries and access.
Design:
- Create three offers: Research, Data, and Citizen Services. Each offer contains plans with only the services that team needs. Research gets compute and network plans. Data gets a SQL plan with the appropriate quota. Citizen Services gets a web/app plan with the TLS-capable services.
- Create one subscription per team under the matching offer. This gives each team a separate resource boundary and prevents cross-team visibility.
- Use quotas on each plan to cap consumption per team, and use the stamp's usage data to drive monthly chargeback reporting.
- For the deadline: the Citizen Services offer can be built from existing plans already in the catalog if the required services are present. Reuse an existing plan rather than creating a new one to avoid the two-week change-control review.
The judgment: plans do not provide tenant isolation; subscriptions do. Reusing existing plans is the only way to meet a three-week deadline under a two-week review cycle.
2. The security office asks whether a single offer with multiple plans would meet isolation. How should the operator respond?
Read the worked answer
A single offer with multiple plans does not meet the isolation requirement. A plan is a service and quota bundle; an offer is a collection of plans that a user can subscribe to. A user who subscribes to an offer receives a subscription and can use any plan in that offer. Plans do not create separate resource boundaries or separate role assignments.
Therefore, if all three teams subscribe to the same offer, they share the same subscription model and can potentially see each other's resources depending on role assignments. Even if each team gets its own subscription, if all subscriptions come from the same offer, the offer's plans must include every service any team needs, which over-provisions access for all teams.
The correct response: isolation requires separate subscriptions, and least-privilege service access requires separate offers with scoped plans. The operator should explain that plans are a catalog and quota mechanism, while subscriptions and RBAC are the isolation mechanism. If the security office wants a documented control, the operator should show the RBAC assignments per subscription and the plan service lists per offer.