Inventory and visibility considerations
As your organization designs and implements your cloud environment, the basis for your platform management and platform services monitoring is a key consideration. To ensure a successful cloud adoption, you must structure these services to meet the needs of your organization as your environment scales.
The cloud operating model decisions you make in early planning phases directly influence how management operations are delivered as part of your landing zones. The degree to which management is centralized for your platform is a key example.
Use the guidance in this article to consider how you should approach inventory and visibility in your cloud environment.
Basic inventory considerations
- Consider using tools such as an Azure Monitor Log Analytics workspace as administrative boundaries.
- Determine which teams should use the system-generated logs from the platform and who needs access to those logs.
Consider the following items related to logging data to inform what types of data you might want to collate and use.
| Scope | Context |
|---|---|
| Application-centric platform monitoring |
Include both hot and cold telemetry paths for metrics and logs, respectively. Operating system metrics, such as performance counters and custom metrics. Operating system logs, such as:
|
| Security audit logging | Aim to achieve a horizontal security lens across your organization's entire Azure estate.
|
| Azure data retention thresholds and archiving requirements |
|
| Operational requirements |
|
Visibility considerations
- Which teams need to receive alert notifications?
- Do you have groups of services that need multiple teams to be notified?
- Do you have existing Service Management tools in place that you need to send alerts to?
- Which services are considered business critical and require high priority notifications of issues?
Inventory and visibility recommendations
Use a single monitor logs workspace to manage platforms centrally, except where Azure role-based access control (Azure RBAC), data sovereignty requirements, and data retention policies mandate separate workspaces. Centralized logging is critical to the visibility required by operations management teams and drives reports about change management, service health, configuration, and most other aspects of IT operations. Focusing on a centralized workspace model reduces administrative effort and the chances for gaps in observability.
Export logs to Azure Storage if your log retention requirements exceed seven years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.
Use Azure Policy for access control and compliance reporting. Azure Policy lets you enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. For more information, see Understand Azure Policy effects.
Use Network Watcher to proactively monitor traffic flows through Network Watcher NSG flow logs v2. Traffic Analytics analyzes NSG flow logs to gather deep insights about IP traffic within virtual networks. It also provides critical information you need for effective management and monitoring, such as:
- Most communicating hosts and application protocols
- Most conversing host pairs
- Allowed or blocked traffic
- Inbound and outbound traffic
- Open internet ports
- Most blocking rules
- Traffic distribution per an Azure datacenter
- Virtual network
- Subnets
- Rogue networks
Use resource locks to prevent accidental deletion of critical shared services.
Use deny policies to supplement Azure role assignments. Deny policies help prevent resource deployments and configurations that don't meet defined standards by blocking requests from being sent to resource providers. Combining deny policies and Azure role assignments ensures that you have appropriate guardrails in place to control who can deploy and configure resources and which resources they can deploy and configure.
Include service and resource health events as part of your overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.
Don't send raw log entries back to on-premises monitoring systems. Instead, adopt the principle that data born in Azure stays in Azure. If you require on-premises SIEM integration, send critical alerts instead of logs.
Azure landing zone accelerator and management
The Azure landing zone accelerator includes opinionated configuration to deploy key Azure management capabilities that help your organization quickly scale and mature.
The Azure landing zone accelerator deployment includes key management and monitoring tools like:
- A Log Analytics workspace and Automation account
- Microsoft Defender for Cloud monitoring
- Diagnostic settings for activity logs, virtual machines, and platform as a service (PaaS) resources sent to Log Analytics
Centralized logging in the Azure landing zone accelerator
In the context of the Azure landing zone accelerator, centralized logging is primarily concerned with platform operations.
This emphasis doesn't prevent use of the same workspace for VM-based application logging. Within a workspace configured in resource-centric access control mode, granular Azure RBAC is enforced, which ensures that your application teams only have access to the logs from their resources.
In this model, application teams benefit from the use of existing platform infrastructure as it reduces their management overhead.
For non-compute resources, like web apps or Azure Cosmos DB databases, your application teams can use their own Log Analytics workspaces. They can then route diagnostics and metrics to those workspaces.