diff --git a/docs/cloud-adoption/appendix/cloud-operating-model.md b/docs/cloud-adoption/appendix/cloud-operating-model.md index af6c6f39f55..58b2a1646b1 100644 --- a/docs/cloud-adoption/appendix/cloud-operating-model.md +++ b/docs/cloud-adoption/appendix/cloud-operating-model.md @@ -35,7 +35,7 @@ COM established a scope comprised of the following components: - **Business strategy:** Establish clear business objectives and outcomes that are to be supported by cloud adoption. - **Technology strategy:** Align the overarching strategy to guide adoption of the cloud in alignment with the business strategy. -- **People strategy:** Develop a strategy for training the people and evolving the culture to enable business success. +- **People strategy:** Develop a strategy for training the people and changing the culture to enable business success. The high-level scopes of the Cloud Operating Model and the Cloud Adoption Framework are similar. Business, culture, and technology are reflected throughout the guidance and each methodology within the Cloud Adoption Framework. diff --git a/docs/cloud-adoption/appendix/roadmap.md b/docs/cloud-adoption/appendix/roadmap.md index f8f7d879c3a..0110cd79f1a 100644 --- a/docs/cloud-adoption/appendix/roadmap.md +++ b/docs/cloud-adoption/appendix/roadmap.md @@ -93,7 +93,7 @@ This first release helped test the Cloud Adoption Framework's unification of an 1. Define a customer end state based on a common methodology. 2. Provide an assessment to define gaps and areas of governance investment. 3. Define a minimum viable product (MVP) to help the customer iterate rapidly. -4. Provide a way to evolve the MVP to mitigate risks and meet business requirements. +4. Provide a way to incrementally improve the MVP to mitigate risks and meet business requirements. **Q2 2019 release (April 15, 2019):** Cloud migration tools can easily migrate tens of thousands of IT assets to the cloud. However, customer feedback indicates that cloud migrations are blocked by culture and technical readiness. The spring release addresses these blockers by defining an iterative approach to cloud migration. The core methodology includes a streamlined Azure migration guide for learning the tools and basic processes, with expanded scope and best practices sections for building on this baseline guidance. diff --git a/docs/cloud-adoption/business-strategy/first-adoption-project.md b/docs/cloud-adoption/business-strategy/first-adoption-project.md index c120143af0b..af5639c45d1 100644 --- a/docs/cloud-adoption/business-strategy/first-adoption-project.md +++ b/docs/cloud-adoption/business-strategy/first-adoption-project.md @@ -14,7 +14,7 @@ ms.subservice: strategy # First cloud adoption project -There's a learning curve and a time commitment associated with cloud adoption planning. Even for experienced teams, proper planning takes time: time to align stakeholders, time to collect and analyze data, time to validate long-term decisions, and time to align people, processes, and technology. In the most productive adoption efforts, planning evolves in parallel with adoption, improving with each release and with each workload migration to the cloud. It's important to understand the difference between a cloud adoption plan and a cloud adoption strategy. You need a well-defined strategy to facilitate and guide the implementation of a cloud adoption plan. +There's a learning curve and a time commitment associated with cloud adoption planning. Even for experienced teams, proper planning takes time: time to align stakeholders, time to collect and analyze data, time to validate long-term decisions, and time to align people, processes, and technology. In the most productive adoption efforts, planning grows in parallel with adoption, improving with each release and with each workload migration to the cloud. It's important to understand the difference between a cloud adoption plan and a cloud adoption strategy. You need a well-defined strategy to facilitate and guide the implementation of a cloud adoption plan. The Cloud Adoption Framework for Azure outlines the processes for cloud adoption and the operation of workloads hosted in the cloud. Each of the processes across the Define strategy, Plan, Ready, Adopt, and Operate phases require slight expansions of technical, business, and operational skills. Some of those skills can come from directed learning. But many of them are most effectively acquired through hands-on experience. diff --git a/docs/cloud-adoption/business-strategy/motivations-why-are-we-moving-to-the-cloud.md b/docs/cloud-adoption/business-strategy/motivations-why-are-we-moving-to-the-cloud.md index 9237e0ad761..8bd3cc83520 100644 --- a/docs/cloud-adoption/business-strategy/motivations-why-are-we-moving-to-the-cloud.md +++ b/docs/cloud-adoption/business-strategy/motivations-why-are-we-moving-to-the-cloud.md @@ -32,7 +32,7 @@ Business transformations that are supported by cloud adoption can be driven by v Your motivations for cloud adoption will likely fall into multiple categories. As you're building the list of motivations, trends will likely emerge. Motivations tend to be associated more with one classification than with others. Use the predominant classification to help guide the development of your cloud adoption strategy. -When a response to critical business events is the highest priority, it's important to engage early in [cloud implementation](../getting-started/migrate.md#cloud-implementation), often in parallel with strategy and planning efforts. Taking this approach requires a growth mindset and a willingness to iterate and evolve processes, based on direct lessons learned. +When a response to critical business events is the highest priority, it's important to engage early in [cloud implementation](../getting-started/migrate.md#cloud-implementation), often in parallel with strategy and planning efforts. Taking this approach requires a growth mindset and a willingness to iteratively improve processes, based on direct lessons learned. When migration is the highest priority, [strategy and planning](../getting-started/migrate.md#cloud-strategy-and-planning) will play a vital role early in the process. We recommend that you [implement the first workload](../getting-started/migrate.md#cloud-implementation) in parallel with planning, to help the team understand and anticipate any learning curves that are associated with cloud adoption. diff --git a/docs/cloud-adoption/digital-estate/rationalize.md b/docs/cloud-adoption/digital-estate/rationalize.md index 83783cfb46d..11831b320b5 100644 --- a/docs/cloud-adoption/digital-estate/rationalize.md +++ b/docs/cloud-adoption/digital-estate/rationalize.md @@ -119,7 +119,7 @@ In parallel with continued rationalization, the cloud adoption team can begin mi - Strengthen skills with the cloud provider’s platform. - Define the core services (and Azure standards) needed to fit the long-term vision. -- Better understand how operations might need to evolve later in the transformation. +- Better understand how operations might need to change later in the transformation. - Understand any inherent business risks and the business' tolerance for those risks. - Establish a baseline or minimum viable product (MVP) for governance based on the business' risk tolerance. diff --git a/docs/cloud-adoption/getting-started/migrate.md b/docs/cloud-adoption/getting-started/migrate.md index d61f6e43d30..3b616029242 100644 --- a/docs/cloud-adoption/getting-started/migrate.md +++ b/docs/cloud-adoption/getting-started/migrate.md @@ -35,7 +35,7 @@ Cloud migrations can help companies deliver on their desired business outcomes. -When a response to critical business events is the highest priority, it is important to engage in [cloud implementation](#cloud-implementation) early, often in parallel with strategy and planning efforts. Taking such an approach requires a growth mindset and a willingness to iterate and evolve processes, based on direct lessons learned. +When a response to critical business events is the highest priority, it is important to engage in [cloud implementation](#cloud-implementation) early, often in parallel with strategy and planning efforts. Taking such an approach requires a growth mindset and a willingness to iteratively improve processes, based on direct lessons learned. When migration motivations are a priority, [strategy and planning](#cloud-strategy-and-planning) will play a vital role early in the process. However, it is highly suggested that [implementation](#cloud-implementation) of the first workload is conducted in parallel with planning, to help the team understand and plan for any learning curves associated with the cloud. diff --git a/docs/cloud-adoption/governance/cost-management/policy-statements.md b/docs/cloud-adoption/governance/cost-management/policy-statements.md index 909980e8c9d..1179b697ab5 100644 --- a/docs/cloud-adoption/governance/cost-management/policy-statements.md +++ b/docs/cloud-adoption/governance/cost-management/policy-statements.md @@ -76,7 +76,7 @@ Use the samples mentioned in this article as a starting point to develop policie To begin developing your own custom policy statements related to Cost Management, download the [Cost Management template](./template.md). -To accelerate adoption of this discipline, choose the [actionable governance journey](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. +To accelerate adoption of this discipline, choose the [actionable governance guide](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. > [!div class="nextstepaction"] -> [Actionable governance journeys](../journeys/index.md) +> [Actionable governance guides](../journeys/index.md) diff --git a/docs/cloud-adoption/governance/deployment-acceleration/compliance-processes.md b/docs/cloud-adoption/governance/deployment-acceleration/compliance-processes.md index 0ce32aab093..6f1b2f41763 100644 --- a/docs/cloud-adoption/governance/deployment-acceleration/compliance-processes.md +++ b/docs/cloud-adoption/governance/deployment-acceleration/compliance-processes.md @@ -29,7 +29,7 @@ The best Deployment Acceleration tools in the cloud are only as good as the proc **Quarterly review and planning:** Conduct a quarterly review of operational audit data and incident reports to identify any changes required in Deployment Acceleration policy. As part of this process, review current DevOps and DevTechOps best practices, and update policy as appropriate. After the review is complete, align application and systems design guidance with updated policy. -This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or evolving policy and risks related to DevOps and Deployment Acceleration. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. +This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or changing policy and risks related to DevOps and Deployment Acceleration. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. **Education and training:** On a bimonthly basis, offer training sessions to make sure IT staff and developers are up-to-date on the latest Deployment Acceleration strategy and requirements. As part of this process review and update any documentation, guidance, or other training assets to ensure they are in sync with the latest corporate policy statements. diff --git a/docs/cloud-adoption/governance/deployment-acceleration/policy-statements.md b/docs/cloud-adoption/governance/deployment-acceleration/policy-statements.md index 81f4ee45727..960f3ed5527 100644 --- a/docs/cloud-adoption/governance/deployment-acceleration/policy-statements.md +++ b/docs/cloud-adoption/governance/deployment-acceleration/policy-statements.md @@ -54,7 +54,7 @@ Use the samples mentioned in this article as a starting point to develop policie To begin developing your own custom policy statements related to identity management, download the [Identity Baseline template](./template.md). -To accelerate adoption of this discipline, choose the [actionable governance journey](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. +To accelerate adoption of this discipline, choose the [actionable governance guide](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. > [!div class="nextstepaction"] -> [Actionable governance journeys](../journeys/index.md) +> [Actionable governance guides](../journeys/index.md) diff --git a/docs/cloud-adoption/governance/getting-started.md b/docs/cloud-adoption/governance/getting-started.md index c437320ab68..db353ac99bf 100644 --- a/docs/cloud-adoption/governance/getting-started.md +++ b/docs/cloud-adoption/governance/getting-started.md @@ -37,7 +37,7 @@ The following are two different examples of initial governance foundations (or g

Small-to-Medium Enterprise

-

A governance journey for enterprises that own fewer than five datacenters and manage costs through a central IT or showback model.

+

A governance guide for enterprises that own fewer than five datacenters and manage costs through a central IT or showback model.

@@ -51,7 +51,7 @@ The following are two different examples of initial governance foundations (or g

Large Enterprise

-

A governance journey for enterprises that own more than five datacenters and manage costs across multiple business units.

+

A governance guide for enterprises that own more than five datacenters and manage costs across multiple business units.

@@ -62,7 +62,7 @@ The following are two different examples of initial governance foundations (or g ## Next steps -Once a governance foundation is in place, apply appropriate best practices to evolve the solution and protect against tangible risks. +Once a governance foundation is in place, apply appropriate best practices to improve the solution and protect against tangible risks. > [!div class="nextstepaction"] > [Mature the initial governance solution and apply best-practice controls](./best-practices.md) diff --git a/docs/cloud-adoption/governance/identity-baseline/compliance-processes.md b/docs/cloud-adoption/governance/identity-baseline/compliance-processes.md index fb2604d9b80..0130bedc3a0 100644 --- a/docs/cloud-adoption/governance/identity-baseline/compliance-processes.md +++ b/docs/cloud-adoption/governance/identity-baseline/compliance-processes.md @@ -29,7 +29,7 @@ Identity management tools offer capabilities and features that greatly assist us **Quarterly planning:** On a quarterly basis perform a general review of identity and access control audit data, and meet with the cloud adoption teams to identify any potential new risks or operational requirements that would require updates to identity policy or changes in access control strategy. -This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or evolving policy and risks related to identity. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. +This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or changing policy and risks related to identity. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. **Education and training:** On a bimonthly basis, offer training sessions to make sure IT staff and developers are up-to-date on the latest identity policy requirements. As part of this process review and update any documentation, guidance, or other training assets to ensure they are in sync with the latest corporate policy statements. diff --git a/docs/cloud-adoption/governance/identity-baseline/policy-statements.md b/docs/cloud-adoption/governance/identity-baseline/policy-statements.md index b6066b9d577..89aa5e32b01 100644 --- a/docs/cloud-adoption/governance/identity-baseline/policy-statements.md +++ b/docs/cloud-adoption/governance/identity-baseline/policy-statements.md @@ -78,7 +78,7 @@ Use the samples mentioned in this article as a starting point for developing pol To begin developing your own custom policy statements related to Identity Baseline, download the [Identity Baseline template](./template.md). -To accelerate adoption of this discipline, choose the [actionable governance journey](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. +To accelerate adoption of this discipline, choose the [actionable governance guide](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. > [!div class="nextstepaction"] -> [Actionable governance journeys](../journeys/index.md) +> [Actionable governance guides](../journeys/index.md) diff --git a/docs/cloud-adoption/governance/index.md b/docs/cloud-adoption/governance/index.md index dbe2b22875c..dc3d6142b89 100644 --- a/docs/cloud-adoption/governance/index.md +++ b/docs/cloud-adoption/governance/index.md @@ -17,7 +17,7 @@ The cloud creates new paradigms for the technologies that support the business. ## Get started with cloud governance -Cloud governance is an iterative process. For organizations with existing policies that govern on-premises IT environments, cloud governance should complement those policies. However, the level of corporate policy integration between on-premises and the cloud varies depending on cloud governance maturity and a digital estate in the cloud. As the cloud estate evolves over time, so do cloud governance processes and policies. The following exercises help you start building your initial governance foundation. +Cloud governance is an iterative process. For organizations with existing policies that govern on-premises IT environments, cloud governance should complement those policies. However, the level of corporate policy integration between on-premises and the cloud varies depending on cloud governance maturity and a digital estate in the cloud. As the cloud estate changes over time, so do cloud governance processes and policies. The following exercises help you start building your initial governance foundation. @@ -123,7 +123,7 @@ The cloud architect serves as the thought leader and facilitator to bring these If you want to follow this guide from beginning to end, this content aids in developing a robust cloud governance strategy in parallel with cloud implementation. The guidance walks you through the theory and implementation of such a strategy. -For a crash course on the theory and quick access to Azure implementation, get started with the [Governance guides overview](./journeys/index.md). Using this guidance, you can start small and evolve your governance needs in parallel with cloud adoption efforts. +For a crash course on the theory and quick access to Azure implementation, get started with the [Governance guides overview](./journeys/index.md). Using this guidance, you can start small and iteratively improve your governance needs in parallel with cloud adoption efforts. ## Next steps diff --git a/docs/cloud-adoption/governance/journeys/index.md b/docs/cloud-adoption/governance/journeys/index.md index 6bd2bdcfd90..c13c0795d62 100644 --- a/docs/cloud-adoption/governance/journeys/index.md +++ b/docs/cloud-adoption/governance/journeys/index.md @@ -14,7 +14,7 @@ layout: LandingPage # Actionable governance guides -The governance guides in this section illustrate the incremental approach of the Cloud Adoption Framework governance model. You can establish an agile governance platform that will evolve to meet the needs of any cloud governance scenario. +The governance guides in this section illustrate the incremental approach of the Cloud Adoption Framework governance model. You can establish an agile governance platform that will grow to meet the needs of any cloud governance scenario. ## Review and adopt cloud governance best practices @@ -59,7 +59,7 @@ To begin your cloud adoption journey, choose one of the following governance gui Adopting the cloud is a journey, not a destination. Along the way, there are clear milestones and tangible business benefits. However, the final state of cloud adoption is unknown when a company begins the journey. Cloud governance creates guardrails that keep the company on a safe path throughout the journey. -These governance guides describe the experiences of fictional companies, based on the journeys of real customers. Each journey follows the customer through the governance aspects of their cloud adoption. +These governance guides describe the experiences of fictional companies, based on the experiences of real customers. Each guide follows the customer through the governance aspects of their cloud adoption. ### Establishing an end state @@ -67,9 +67,9 @@ A journey without a target destination is just wandering. It’s important to es ![Infographic of the Cloud Adoption Framework governance model](../../_images/operational-transformation-govern-highres.png) -The Cloud Adoption Framework governance model identifies key areas of importance during the journey. Each area relates to different types of risks the company must address as it adopts more cloud services. Within this framework, the governance journey identifies required actions for the cloud governance team. Along the way, each principle of the Cloud Adoption Framework governance model is described further. Broadly, these include: +The Cloud Adoption Framework governance model identifies key areas of importance during the journey. Each area relates to different types of risks the company must address as it adopts more cloud services. Within this framework, the governance guide identifies required actions for the cloud governance team. Along the way, each principle of the Cloud Adoption Framework governance model is described further. Broadly, these include: -**Corporate policies:** Corporate policies drive cloud governance. The governance journey focuses on specific aspects of corporate policy: +**Corporate policies:** Corporate policies drive cloud governance. The governance guide focuses on specific aspects of corporate policy: - **Business risks:** Identifying and understanding corporate risks. - **Policy and compliance:** Converting risks into policy statements that support any compliance requirements. @@ -87,22 +87,22 @@ Essentially, corporate policies serve as the early warning system to detect pote ### Grow to the end state -Because governance requirements will evolve throughout the cloud adoption journey, a different approach to governance is required. Companies can no longer wait for a small team to build guardrails and roadmaps on every highway *before taking the first step*. Business results are expected more quickly and smoothly. IT governance must also move quickly and keep pace with business demands to stay relevant during cloud adoption and avoid "shadow IT." +Because governance requirements will change throughout the cloud adoption journey, a different approach to governance is required. Companies can no longer wait for a small team to build guardrails and roadmaps on every highway *before taking the first step*. Business results are expected more quickly and smoothly. IT governance must also move quickly and keep pace with business demands to stay relevant during cloud adoption and avoid "shadow IT." An **incremental governance** approach empowers these traits. Incremental governance relies on a small set of corporate policies, processes, and tools to establish a foundation for adoption and governance. That foundation is called a **minimum viable product (MVP)**. An MVP allows the governance team to quickly incorporate governance into implementations throughout the adoption lifecycle. An MVP can be established at any point during the cloud adoption process. However, it’s a good practice to adopt an MVP as early as possible. -The ability to respond rapidly to changing risks empowers the cloud governance team to engage in new ways. The cloud governance team can join the cloud strategy team as scouts, moving ahead of the cloud adoption teams, plotting routes, and quickly establishing guardrails to manage risks associated with the adoption plans. These just-in-time governance layers are known as **governance evolutions**. With this approach, governance strategy evolves one step ahead of the cloud adoption teams. +The ability to respond rapidly to changing risks empowers the cloud governance team to engage in new ways. The cloud governance team can join the cloud strategy team as scouts, moving ahead of the cloud adoption teams, plotting routes, and quickly establishing guardrails to manage risks associated with the adoption plans. These just-in-time governance layers are known as **governance iterations**. With this approach, governance strategy grows one step ahead of the cloud adoption teams. -The following diagram shows a simple governance MVP and three governance evolutions. During the evolutions, additional corporate policies are defined to remediate new risks. The Deployment Acceleration discipline then applies those changes across each deployment. +The following diagram shows a simple governance MVP and three governance iterations. During the iterations, additional corporate policies are defined to remediate new risks. The Deployment Acceleration discipline then applies those changes across each deployment. -![Example of Incremental Governance evolutions](../../_images/governance/incremental-governance-example.png) +![Example of incremental governance improvement](../../_images/governance/incremental-governance-example.png) > [!NOTE] > Governance is not a replacement for key functions such as security, networking, identity, finance, DevOps, or operations. Along the way, there will be interactions with and dependencies on members from each function. Those members should be included on the cloud governance team to accelerate decisions and actions. -## Choosing a governance journey +## Choosing a governance guide -The journeys demonstrate how to implement a governance MVP. From there, each journey shows how the cloud governance team can work ahead of the cloud adoption teams as a partner to accelerate adoption efforts. The Cloud Adoption Framework governance model guides the application of governance from foundation through subsequent improvements. +The guides demonstrate how to implement a governance MVP. From there, each guide shows how the cloud governance team can work ahead of the cloud adoption teams as a partner to accelerate adoption efforts. The Cloud Adoption Framework governance model guides the application of governance from foundation through subsequent improvements. To begin a governance journey, choose one of the two options below. The options are based on synthesized customer experiences. The titles are based on the size of the enterprise for ease of navigation. However, the reader's decision may be more complex. The following tables outline the differences between the two options. @@ -110,7 +110,7 @@ To begin a governance journey, choose one of the two options below. The options > A more robust governance starting point may be required. In such cases, consider the [Azure Virtual Datacenter](#azure-virtual-datacenter) approach briefly described [below](#azure-virtual-datacenter). This approach is commonly suggested during enterprise-scale adoption efforts, and especially for efforts which exceed 10,000 assets. It is also the de facto choice for complex governance scenarios when any of the following are required: extensive third-party compliance requirements, deep domain expertise, or parity with mature IT governance policies and compliance requirements. > [!NOTE] -> It’s unlikely that either journey aligns completely to your situation. Choose whichever journey is closest and use it as a starting point. Throughout the journey, additional information is provided to help you customize decisions to meet specific criteria. +> It’s unlikely that either guide aligns completely to your situation. Choose whichever guide is closest and use it as a starting point. Throughout the guide, additional information is provided to help you customize decisions to meet specific criteria. ### Business characteristics @@ -129,7 +129,7 @@ To begin a governance journey, choose one of the two options below. The options | Networking | No WAN, or 1 – 2 WAN providers | Complex network or global WAN | | Identity | Single forest, single domain. No requirement for claims-based authentication or third-party multi-factor authentication devices. | Complex, multiple forests, multiple domains. Applications require claims-based authentication or third-party multi-factor authentication devices. | -### Desired future state after evolving cloud governance +### Desired future state after incremental improvement of cloud governance | State | Small-to-medium enterprise | Large enterprise | |----------------------------------------------|---------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------| @@ -137,7 +137,7 @@ To begin a governance journey, choose one of the two options below. The options | Security Baseline – protected data | Company financial data and IP. Limited customer data. No third-party compliance requirements. | Multiple collections of customers’ financial and personal data. May need to consider third-party compliance. | | Resource Consistency – mission-critical applications | Outages are painful but not financially damaging. Existing IT Operations are relatively immature. | Outages have defined and monitored financial impacts. IT operations are established and mature. | -These two journeys represent two extremes of experience for customers who invest in cloud governance. Most companies reflect a combination of the two scenarios above. After reviewing the journey, use the Cloud Adoption Framework governance model to start the governance conversation and modify the baseline journeys to more closely meet your needs. +These two guides represent two extremes of experience for customers who invest in cloud governance. Most companies reflect a combination of the two scenarios above. After reviewing the guide, use the Cloud Adoption Framework governance model to start the governance conversation and modify the baseline guides to more closely meet your needs. ## Azure Virtual Datacenter @@ -162,9 +162,9 @@ For more information, visit the [Azure Virtual Datacenter](/azure/architecture/v ## Next steps -Choose one of these journeys: +Choose one of these guides: > [!div class="nextstepaction"] -> [Small-to-medium enterprise governance journey](./small-to-medium-enterprise/index.md) +> [Small-to-medium enterprise governance guide](./small-to-medium-enterprise/index.md) > -> [Large enterprise governance journey](./large-enterprise/index.md) +> [Large enterprise governance guide](./large-enterprise/index.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/best-practice-explained.md b/docs/cloud-adoption/governance/journeys/large-enterprise/best-practice-explained.md index 766ad14e5e4..1877a2a37bf 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/best-practice-explained.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/best-practice-explained.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Best practice explained" +title: "Large enterprise guide: Best practice explained" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Best practice explained +description: "Large enterprise guide: Best practice explained" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -13,7 +13,7 @@ ms.custom: governance # Large enterprise: Best practice explained -The governance journey starts with a set of initial [corporate policies](./initial-corporate-policy.md). These policies are used to establish a minimum viable product (MVP) for governance that reflects [best practices](./index.md). +The governance guide begins with a set of initial [corporate policies](./initial-corporate-policy.md). These policies are used to establish a minimum viable product (MVP) for governance that reflects [best practices](./index.md). In this article, we discuss the high-level strategies that are required to create a governance MVP. The core of the governance MVP is the [Deployment Acceleration](../../deployment-acceleration/index.md) discipline. The tools and patterns applied at this stage will enable the incremental improvements needed to expand governance in the future. @@ -86,7 +86,7 @@ Logging and reporting decisions determine how your store log data and how the mo - Additional analysis is required before the release of any protected data or mission-critical workloads. - Before supporting protected data or mission-critical workloads, the existing on-premises operational monitoring solution must be granted access to the workspace used for logging. Applications are required to meet security and logging requirements associated with the use of that tenant, if the application is to be supported with a defined SLA. -## Evolution of governance processes +## Incremental of governance processes Some of the policy statements cannot or should not be controlled by automated tooling. Other policies will require periodic effort from IT Security and on-premises Identity Baseline teams. The cloud governance team will need to oversee the following processes to implement the last eight policy statements: @@ -104,7 +104,7 @@ Some of the policy statements cannot or should not be controlled by automated to ## Alternative patterns -If any of the patterns chosen in this governance journey don't align with the reader's requirements, alternatives to each pattern are available: +If any of the patterns chosen in this governance guide don't align with the reader's requirements, alternatives to each pattern are available: - [Encryption patterns](../../../decision-guides/encryption/index.md) - [Identity patterns](../../../decision-guides/identity/index.md) @@ -119,7 +119,7 @@ If any of the patterns chosen in this governance journey don't align with the re Once this guidance is implemented, each cloud adoption team can proceed with a solid governance foundation. The cloud governance team will work in parallel to continually update the corporate policies and governance disciplines. -Both teams will use the tolerance indicators to identify the next set of improvements needed to continue supporting cloud adoption. The next step for the company in this journey is to evolve their governance baseline to support applications with legacy or third-party multi-factor authentication requirements. +Both teams will use the tolerance indicators to identify the next set of improvements needed to continue supporting cloud adoption. The next step for this company is incremental improvement of their governance baseline to support applications with legacy or third-party multi-factor authentication requirements. > [!div class="nextstepaction"] -> [Identity Baseline evolution](./identity-baseline-evolution.md) +> [Improving the Identity Baseline](./identity-baseline-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/cost-management-evolution.md b/docs/cloud-adoption/governance/journeys/large-enterprise/cost-management-evolution.md index 5cde9fb73e2..9e923d70df7 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/cost-management-evolution.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/cost-management-evolution.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Cost Management evolution" +title: "Large enterprise guide: Improving Cost Management" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Cost Management evolution +description: "Large enterprise guide: Improving Cost Management" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,17 +11,17 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Cost Management evolution +# Large enterprise guide: Improving Cost Management -This article evolves the narrative by adding cost controls to the minimum viable product (MVP) governance. +This article advances the narrative by adding cost controls to the minimum viable product (MVP) governance. -## Evolution of the narrative +## Advancing the narrative Adoption has grown beyond the tolerance indicator defined in the governance MVP. The increases in spending now justifies an investment of time from the cloud governance team to monitor and control spending patterns. -As a clear driver of innovation, IT is no longer seen primarily as a cost center. As the IT organization delivers more value, the CIO and CFO agree that the time is right to evolve the role IT plays in the company. Amongst other changes, the CFO wants to test a direct pay approach to cloud accounting for the Canadian branch of one of the business units. One of the two retired datacenters was exclusively hosted assets for that business unit’s Canadian operations. In this model, the business unit’s Canadian subsidiary will be billed directly for the operating expenses related to the hosted assets. This model allows IT to focus less on managing someone else’s spending and more on creating value. However, before this transition can begin Cost Management tooling needs to be in place. +As a clear driver of innovation, IT is no longer seen primarily as a cost center. As the IT organization delivers more value, the CIO and CFO agree that the time is right to shift the role IT plays in the company. Amongst other changes, the CFO wants to test a direct pay approach to cloud accounting for the Canadian branch of one of the business units. One of the two retired datacenters was exclusively hosted assets for that business unit’s Canadian operations. In this model, the business unit’s Canadian subsidiary will be billed directly for the operating expenses related to the hosted assets. This model allows IT to focus less on managing someone else's spending and more on creating value. However, before this transition can begin Cost Management tooling needs to be in place. -### Evolution of current state +### Changes in the current state In the previous phase of this narrative, the IT team was actively moving production workloads with protected data into Azure. @@ -31,11 +31,11 @@ Since then, some things have changed that will affect governance: - The application development teams have implemented CI/CD pipelines to deploy some cloud-native applications, significantly affecting customer experiences. - The BI team has created aggregation, curation, insight, and prediction processes driving tangible benefits for business operations. Those predictions are now empowering creative new products and services. -### Evolution of future state +### Incrementally improve the future state -- Cost monitoring and reporting is to be added to the cloud solution. Reporting should tie direct operating expenses to the functions that are consuming the cloud costs. Additional reporting should allow IT to monitor spending and provide technical guidance on cost management. For the Canadian branch, the department will be billed directly. +- Cost monitoring and reporting should be added to the cloud solution. Reporting should tie direct operating expenses to the functions that are consuming the cloud costs. Additional reporting should allow IT to monitor spending and provide technical guidance on cost management. For the Canadian branch, the department will be billed directly. -## Evolution of tangible risks +## Changes in risk **Budget control:** There is an inherent risk that self-service capabilities will result in excessive and unexpected costs on the new platform. Governance processes for monitoring costs and mitigating ongoing cost risks must be in place to ensure continued alignment with the planned budget. @@ -45,7 +45,7 @@ This business risk can be expanded into a few technical risks: - Business conditions change. When they do, there will be cases when a business function needs to consume more cloud services than expected, leading to spending anomalies. There is a risk that these additional costs will be considered overages as opposed to a required adjustment to the plan. If successful, the Canadian experiment should help remediate this risk. - There is a risk of systems being overprovisioned, resulting in excess spending. -## Evolution of the policy statements +## Changes to the policy statements The following changes to policy will help remediate the new risks and guide implementation. @@ -53,12 +53,13 @@ The following changes to policy will help remediate the new risks and guide impl 2. All costs must be allocated to a business function for accountability purposes. 3. Cloud assets should be continually monitored for optimization opportunities. 4. Cloud Governance tooling must limit Asset sizing options to an approved list of configurations. The tooling must ensure that all assets are discoverable and tracked by the cost monitoring solution. -5. During deployment planning, any required cloud resources associated with the hosting of production workloads should be documented. This documentation will help refine budgets and prepare additional automations to prevent the use of more expensive options. During this process consideration should be given to different discounting tools offered by the cloud provider, such as Reserved Instances or License cost reductions. -6. All application owners are required to attend a training on cost management practices for optimizing workloads to better control cloud costs. +5. During deployment planning, any required cloud resources associated with the hosting of production workloads should be documented. This documentation will help refine budgets and prepare additional automation tools to prevent the use of more expensive options. During this process consideration should be given to different discounting tools offered by the cloud provider, such as Reserved Instances or License cost reductions. +6. All application owners are required to attend trained on practices for optimizing workloads to better control cloud costs. -## Evolution of the best practices -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. +## Incremental improvement of the best practices + +This section of the article will improve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. 1. Changes in the Azure Enterprise Portal to bill the Department administrator for the Canadian deployment. 2. Implement Azure Cost Management. @@ -76,7 +77,7 @@ Adding the above processes and changes to the governance MVP helps remediate man ## Next steps -As cloud adoption continues to evolve and deliver additional business value, risks and cloud governance needs will also evolve. For the fictional company in this journey, the next step is using this governance investment to manage multiple clouds. +As cloud adoption grows and delivers additional business value, risks and cloud governance needs will also change. For this fictional company, the next step is using this governance investment to manage multiple clouds. > [!div class="nextstepaction"] -> [Multicloud evolution](./multi-cloud-evolution.md) +> [Multicloud improvement](./multicloud-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/identity-baseline-evolution.md b/docs/cloud-adoption/governance/journeys/large-enterprise/identity-baseline-evolution.md index d246449526b..7533ffe900b 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/identity-baseline-evolution.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/identity-baseline-evolution.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Identity Baseline evolution" +title: "Large enterprise guide: Improving the Identity Baseline" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Identity Baseline evolution +description: "Large enterprise guide: Improving the Identity Baseline" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,11 +11,11 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Identity Baseline evolution +# Large enterprise guide: Improving the Identity Baseline -This article evolves the narrative by adding Identity Baseline controls to the governance MVP. +This article advances the narrative by adding Identity Baseline controls to the governance MVP. -## Evolution of the narrative +## Advancing the narrative The business justification for the cloud migration of the two datacenters was approved by the CFO. During the technical feasibility study, several roadblocks were discovered: @@ -26,15 +26,15 @@ The business justification for the cloud migration of the two datacenters was ap The first two roadblocks are being managed in parallel. This article will address the resolution of the third and fourth roadblocks. -### Evolution of the cloud governance team +### Expanding the cloud governance team The cloud governance team is expanding. Given the need for additional support regarding identity management, a systems administrator from the Identity Baseline team now participates in a weekly meeting to keep the existing team members aware of changes. -### Evolution of the current state +### Changes in the current state The IT team has approval to move forward with the CIO and CFO's plans to retire two datacenters. However, IT is concerned that 750 (15%) of the assets in those datacenters will have to be moved somewhere other than the cloud. -### Evolution of the future state +### Incrementally improve the future state The new future state plans require a more robust Identity Baseline solution to migrate the 750 virtual machines with legacy authentication requirements. Beyond these two datacenters, this challenge is expected to affect similar percentages of assets in other datacenters. @@ -42,7 +42,7 @@ The future state now also requires a connection from the cloud provider to the c The changes to current and future state expose new risks that will require new policy statements. -## Evolution of tangible risks +## Changes in tangible risks **Business interruption during migration.** Migration to the cloud creates a controlled, time-bound risk that can be managed. Moving aging hardware to another part of the world is much higher risk. A mitigation strategy is needed to avoid interruptions to business operations. @@ -56,7 +56,7 @@ This business risk can be expanded into a few technical risks: - The speed and stability of the VPN might impede migration. - Traffic entering the cloud could cause security issues in other parts of the global network. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. @@ -65,9 +65,9 @@ The following changes to policy will help remediate the new risks and guide impl 3. A high-speed private connection should be established between the cloud provider and the company’s telco provider, connecting the cloud provider to the global network of datacenters. 4. Until sufficient security requirements are established, no inbound public traffic may access company assets hosted in the cloud. All ports are blocked from any source outside of the global WAN. -## Evolution of the best practices +## Incremental improvement of the best practices -The governance MVP design evolves to include new Azure policies and an implementation of Active Directory on a virtual machine. Together, these two design changes fulfill the new corporate policy statements. +The governance MVP design changes to include new Azure policies and an implementation of Active Directory on a virtual machine. Together, these two design changes fulfill the new corporate policy statements. Here are the new best practices: @@ -89,7 +89,7 @@ Adding these changes to the governance MVP helps remediate many of the risks in ## Next steps -As cloud adoption evolves and delivers additional business value, risks and cloud governance needs will also evolve. The following are a few evolutions that may occur. For the fictional company in this journey, the next trigger is the inclusion of protected data in the cloud adoption plan. This change will require additional security controls. +As cloud adoption continues and delivers additional business value, risks and cloud governance needs will also change. The following are a few changes that may occur. For this fictional company, the next trigger is the inclusion of protected data in the cloud adoption plan. This change requires additional security controls. > [!div class="nextstepaction"] -> [Security Baseline evolution](./security-baseline-evolution.md) +> [Improving the Security Baseline](./security-baseline-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/index.md b/docs/cloud-adoption/governance/journeys/large-enterprise/index.md index 2817744fd93..883ec01abeb 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/index.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/index.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise governance journey" +title: "Large enterprise governance guide" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise governance journey +description: Large enterprise governance guide author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,13 +11,13 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise governance journey +# Large enterprise governance guide ## Overview of best practices -This governance journey follows the experiences of a fictional company through various stages of governance maturity. It is based on real customer journeys. The suggested best practices are based on the constraints and needs of the fictional company. +This governance guide follows the experiences of a fictional company through various stages of governance maturity. It is based on real customer experiences. The suggested best practices are based on the constraints and needs of the fictional company. -As a quick starting point, this overview defines a minimum viable product (MVP) for governance based on best practices. It also provides links to some governance evolutions that add further best practices as new business or technical risks emerge. +As a quick starting point, this overview defines a minimum viable product (MVP) for governance based on best practices. It also provides links to some governance improvements that add further best practices as new business or technical risks emerge. > [!WARNING] > This MVP is a baseline starting point, based on a set of assumptions. Even this minimal set of best practices is based on corporate policies driven by unique business risks and risk tolerances. To see if these assumptions apply to you, read the [longer narrative](./narrative.md) that follows this article. @@ -45,14 +45,14 @@ These patterns provide room for growth without complicating the hierarchy unnece [!INCLUDE [governance-of-resources](../../../../../includes/caf-governance-of-resources.md)] -## Governance evolutions +## Incremental governance improvements -Once this MVP has been deployed, additional layers of governance can be quickly incorporated into the environment. Here are some ways to evolve the MVP to meet specific business needs: +Once this MVP has been deployed, additional layers of governance can be quickly incorporated into the environment. Here are some ways to improve the MVP to meet specific business needs: - [Security Baseline for protected data](./security-baseline-evolution.md) - [Resource configurations for mission-critical applications](./resource-consistency-evolution.md) - [Controls for Cost Management](./cost-management-evolution.md) -- [Controls for multicloud evolution](./multi-cloud-evolution.md) +- [Controls for incremental multicloud improvement](./multicloud-evolution.md) @@ -62,11 +62,11 @@ In the MVP, practices and tools from the [Deployment Acceleration](../../deploym ![Example of an incremental governance MVP](../../../_images/governance/governance-mvp.png) -## Evolving the best practice +## Incremental improvements to best practices -Over time, this governance MVP will be used to evolve the governance practices. As adoption advances, business risk grows. Various disciplines within the Cloud Adoption Framework governance model will evolve to manage those risks. Later articles in this series discuss the evolution of corporate policy affecting the fictional company. These evolutions happen across four disciplines: +Over time, this governance MVP will be used to incrementally improve governance practices. As adoption advances, business risk grows. Various disciplines within the Cloud Adoption Framework governance model will adapt to manage those risks. Later articles in this series discuss the changes in corporate policy affecting the fictional company. These changes happen across four disciplines: -- Identity Baseline, as migration dependencies evolve in the narrative. +- Identity Baseline, as migration dependencies change in the narrative. - Cost Management, as adoption scales. - Security Baseline, as protected data is deployed. - Resource Consistency, as IT Operations begins supporting mission-critical workloads. @@ -75,7 +75,7 @@ Over time, this governance MVP will be used to evolve the governance practices. ## Next steps -Now that you’re familiar with the governance MVP and have an idea of the governance evolutions to follow, read the supporting narrative for additional context. +Now that you’re familiar with the governance MVP and the forthcoming governance changes, read the supporting narrative for additional context. > [!div class="nextstepaction"] > [Read the supporting narrative](./narrative.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/initial-corporate-policy.md b/docs/cloud-adoption/governance/journeys/large-enterprise/initial-corporate-policy.md index 4da0d6ad4ca..c82efae2700 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/initial-corporate-policy.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/initial-corporate-policy.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Initial corporate policy behind the governance strategy" +title: "Large enterprise guide: Initial corporate policy behind the governance strategy" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Initial corporate policy behind the governance strategy. +description: "Large enterprise guide: Initial corporate policy behind the governance strategy" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,9 +11,9 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Initial corporate policy behind the governance strategy +# Large enterprise guide: Initial corporate policy behind the governance strategy -The following corporate policy defines the initial governance position, which is the starting point for this journey. This article defines early-stage risks, initial policy statements, and early processes to enforce policy statements. +The following corporate policy defines the initial governance position, which is the starting point for this guide. This article defines early-stage risks, initial policy statements, and early processes to enforce policy statements. > [!NOTE] >The corporate policy is not a technical document, but it drives many technical decisions. The governance MVP described in the [overview](./index.md) ultimately derives from this policy. Before implementing a governance MVP, your organization should develop a corporate policy based on your own objectives and business risks. @@ -22,13 +22,13 @@ The following corporate policy defines the initial governance position, which is The CIO recently held a meeting with the IT Governance team to understand the history of the PII and mission-critical policies and review the effect of changing those policies. She also discussed the overall potential of the cloud for IT and the company. -After the meeting, two members of the IT Governance team requested permission to research and support the cloud planning efforts. Recognizing the need for governance and an opportunity to limit shadow IT, the Director of IT Governance supported this idea. With that, the cloud governance team was born. Over the next several months, they will inherit the cleanup of many mistakes made during exploration in the cloud from a governance perspective. This will earn them the moniker of _cloud custodians_. In later evolutions, this journey will show how their roles change over time. +After the meeting, two members of the IT Governance team requested permission to research and support the cloud planning efforts. Recognizing the need for governance and an opportunity to limit shadow IT, the Director of IT Governance supported this idea. With that, the cloud governance team was born. Over the next several months, they will inherit the cleanup of many mistakes made during exploration in the cloud from a governance perspective. This will earn them the moniker of _cloud custodians_. In later iterations, this guide will show how their roles change over time. [!INCLUDE [business-risk](../../../includes/governance/business-risks.md)] ## Tolerance indicators -The current risk tolerance is high and the appetite for investing in cloud governance is low. As such, the tolerance indicators act as an early warning system to trigger the investment of time and energy. If the following indicators are observed, it would be wise to evolve the governance strategy. +The current risk tolerance is high and the appetite for investing in cloud governance is low. As such, the tolerance indicators act as an early warning system to trigger the investment of time and energy. If the following indicators are observed, it would be wise to advance the governance strategy. - **Cost Management:** Scale of deployment exceeds 1,000 assets to the cloud, or monthly spending exceeds $10,000 USD per month. - **Identity Baseline:** Inclusion of applications with legacy or third-party multi-factor authentication requirements. diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/multicloud-evolution.md b/docs/cloud-adoption/governance/journeys/large-enterprise/multicloud-evolution.md index 5234a28b523..d2bf3fe0b1c 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/multicloud-evolution.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/multicloud-evolution.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Multicloud evolution" +title: "Large enterprise guide: Multicloud improvement" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: "Large enterprise: Multicloud evolution" +description: "Large enterprise guide: Multicloud improvement" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,32 +11,32 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Multicloud evolution +# Large enterprise guide: Multicloud improvement -## Evolution of the narrative +## Advancing the narrative -Microsoft recognizes that customers are adopting multiple clouds for specific purposes. The fictional company in this journey is no exception. In parallel to the Azure adoption journey, the business success has led to the acquisition of a small, but complementary business. That business is running all of their IT operations on a different cloud provider. +Microsoft recognizes that customers are adopting multiple clouds for specific purposes. The fictional company in this guide is no exception. In parallel to the Azure adoption journey, the business success has led to the acquisition of a small, but complementary business. That business is running all of their IT operations on a different cloud provider. -This article describes how things change when integrating the new organization. For purposes of the narrative, we assume this company has completed each of the governance evolutions outlined in this customer journey. +This article describes how things change when integrating the new organization. For purposes of the narrative, we assume this company has completed each of the governance iterations outlined in this governance guide. -### Evolution of the current state +### Changes in the current state In the previous phase of this narrative, the company had begun to implement cost controls and cost monitoring, as cloud spending becomes part of the company's regular operating expenses. Since then, some things have changed that will affect governance: - Identity is controlled by an on-premises instance of Active Directory. Hybrid Identity is facilitated through replication to Azure Active Directory. -- IT Operations or Cloud Operations are largely managed by Azure Monitor and related automations. -- Disaster Recovery / Business Continuity is controlled by Azure Vault instances. +- IT Operations or Cloud Operations are largely managed by Azure Monitor and related automation capabilities. +- Disaster recovery and business continuity (DRBC) is controlled by Azure Vault instances. - Azure Security Center is used to monitor security violations and attacks. - Azure Security Center and Azure Monitor are both used to monitor governance of the cloud. - Azure Blueprints, Azure Policy, and management groups are used to automate compliance to policy. -### Evolution of the future state +### Incrementally improve the future state The goal is to integrate the acquisition company into existing operations wherever possible. -## Evolution of tangible risks +## Changes in tangible risks **Business acquisition cost:** Acquisition of the new business is estimated to be profitable in approximately five years. Because of the slow rate of return, the board wants to control acquisition costs, as much as possible. There is a risk of cost control and technical integration conflicting with one another. @@ -45,7 +45,7 @@ This business risk can be expanded into a few technical risks - There is risk of cloud migration producing additional acquisition costs. - There is also a risk of the new environment not being properly governed or resulting in policy violations. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. @@ -53,9 +53,9 @@ The following changes to policy will help remediate the new risks and guide impl 2. All organizational units must be integrated into the existing identity provider. 3. The primary identity provider should govern authentication to assets in the secondary cloud. -## Evolution of the best practices +## Incremental improvement of the best practices -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. +This section of the article improves the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. 1. Connect the networks. Executed by Networking and IT Security, supported by governance. 1. Adding a connection from the MPLS or leased-line provider to the new cloud will integrate networks. Adding routing tables and firewall configurations will control access and traffic between the environments. @@ -73,9 +73,9 @@ This section of the article will evolve the governance MVP design to include new 2. Virtual machines in the secondary cloud might be compatible with Azure Monitor agents, allowing them to be included in Azure Monitor for operational monitoring. 6. Governance enforcement tools. 1. Governance enforcement is cloud-specific. - 2. The corporate policies established in the governance journey are not cloud-specific. While the implementation may vary from cloud to cloud, the policy statements can be applied to the secondary provider. + 2. The corporate policies established in the governance guide are not cloud-specific. While the implementation may vary from cloud to cloud, the policy statements can be applied to the secondary provider. -As multicloud adoption grows, the design evolution above will continue to mature. +As multicloud adoption grows, the governance design above will continue to mature. ## Next steps diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/multiple-layers-of-governance.md b/docs/cloud-adoption/governance/journeys/large-enterprise/multiple-layers-of-governance.md index 5d7b50f74c5..c5974849449 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/multiple-layers-of-governance.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/multiple-layers-of-governance.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Multiple layers of governance in large enterprises" +title: "Large enterprise guide: Multiple layers of governance" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Multiple layers of governance in large enterprises. +description: "Large enterprise guide: Multiple layers of governance" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,7 +11,7 @@ ms.subservice: govern ms.custom: governance --- -# Multiple layers of governance in large enterprises +# Large enterprise guide: Multiple layers of governance When large enterprises require multiple layers of governance, there are greater levels of complexity that must be factored into the governance MVP and later governance improvements. @@ -25,13 +25,13 @@ This article explores some ways to navigate this type of complexity. ## Large enterprise governance is a team sport -Large established enterprises often have teams or employees who focus on the disciplines mentioned throughout this journey. This journey demonstrates one approach to making governance a team sport. +Large established enterprises often have teams or employees who focus on the disciplines mentioned throughout this guide. This guide demonstrates one approach to making governance a team sport. In many large enterprises, the Five Disciplines of Cloud Governance can be blockers to adoption. Developing cloud expertise in identity, security, operations, deployments, and configuration across an enterprise takes time. Holistically implementing IT governance policy and IT security can slow innovation by months or even years. Balancing the business need to innovate and the governance need to protect existing resources is delicate. -The inherent capabilities of the cloud can remove blockers to innovation but increase risks. In this governance journey, we showed how the example company created guardrails to manage the risks. Rather than tackling each of the disciplines required to protect the environment, the cloud governance team leads a risk-based approach to govern what could be deployed, while the other teams build the necessary cloud maturities. Most importantly, as each team reaches cloud maturity, governance applies their solutions holistically. As each team matures and adds to the overall solution, the cloud governance team can open stage gates, allowing additional innovation and adoption to thrive. +The inherent capabilities of the cloud can remove blockers to innovation but increase risks. In this governance guide, we showed how the example company created guardrails to manage the risks. Rather than tackling each of the disciplines required to protect the environment, the cloud governance team leads a risk-based approach to govern what could be deployed, while the other teams build the necessary cloud maturities. Most importantly, as each team reaches cloud maturity, governance applies their solutions holistically. As each team matures and adds to the overall solution, the cloud governance team can open stage gates, allowing additional innovation and adoption to thrive. -This model illustrates the growth of a partnership between the cloud governance team and existing enterprise teams (Security, IT Governance, Networking, Identity, and others). The journey starts with the governance MVP and grows to a holistic end state through governance evolutions. +This model illustrates the growth of a partnership between the cloud governance team and existing enterprise teams (Security, IT Governance, Networking, Identity, and others). The guide starts with the governance MVP and grows to a holistic end state through governance iterations. ## Requirements to supporting such a team sport @@ -51,4 +51,4 @@ The important aspect of each of these tools is the ability to apply multiple blu - **Regional or Business Unit IT:** Various IT teams can apply an additional layer of governance by creating their own blueprint. Those blueprints would create additive policies and standards. Once developed, Corporate IT could apply those blueprints to the applicable nodes within the management group hierarchy. - **Cloud adoption teams:** Detailed decisions and implementation about applications or workloads can be made by each cloud adoption team, within the context of governance requirements. At times the team can also request additional Azure Resource Consistency templates to accelerate adoption efforts. -The details regarding governance implementation at each level will require coordination between each team. The governance MVP and governance improvements outlined in this journey can aid in aligning that coordination. +The details regarding governance implementation at each level will require coordination between each team. The governance MVP and governance improvements outlined in this guide can aid in aligning that coordination. diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/narrative.md b/docs/cloud-adoption/governance/journeys/large-enterprise/narrative.md index 3abc9070976..0bb2c841fd5 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/narrative.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/narrative.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: The narrative behind the governance journey" +title: "Large enterprise: The narrative behind the governance guide" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: This narrative establishes a use case for a large enterprise governance journey. +description: This narrative establishes a use case for governance during a large enterprise's cloud adoption journey. author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -13,7 +13,7 @@ ms.custom: governance # Large enterprise: The narrative behind the governance strategy -The following narrative establishes a use case for a [large enterprise governance journey](./index.md). Before implementing the journey, it's important to understand the assumptions and reasoning that are reflected in this narrative. Then you can better align the governance strategy to your own organization's journey. +The following narrative establishes a use case for [governance during large enterprise's cloud adoption journey](./index.md). Before acting on the recommendations in the guide, it's important to understand the assumptions and reasoning that are reflected in this narrative. Then you can better align the governance strategy to your own organization's cloud adoption journey. ## Back story diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/resource-consistency-evolution.md b/docs/cloud-adoption/governance/journeys/large-enterprise/resource-consistency-evolution.md index c8fd48f0f51..fabd8c961b3 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/resource-consistency-evolution.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/resource-consistency-evolution.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise – Resource Consistency evolution" +title: "Large enterprise guide: Improving Resource Consistency" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Resource Consistency evolution +description: "Large enterprise: Improving Resource Consistency" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,27 +11,27 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Resource Consistency evolution +# Large enterprise guide: Improving Resource Consistency -This article evolves the narrative by adding Resource Consistency controls to the governance MVP to support mission-critical applications. +This article advances the narrative by adding Resource Consistency controls to the governance MVP to support mission-critical applications. -## Evolution of the narrative +## Advancing the narrative The cloud adoption teams have met all requirements to move protected data. With those applications come SLA commitments to the business and need for support from IT Operations. Right behind the team migrating the two datacenters, multiple application development and BI teams are ready to begin launching new solutions into production. IT Operations is new to cloud operations and needs to quickly integrate existing operational processes. -### Evolution of current state +### Changes in the current state - IT is actively moving production workloads with protected data into Azure. Some low-priority workloads are serving production traffic. More can be cut over as soon as IT Operations signs off on readiness to support the workloads. - The application development teams are ready for production traffic. - The BI team is ready to integrate predictions and insights into the systems that run operations for the three business units. -### Evolution of the future state +### Incrementally improve the future state - IT operations is new to cloud operations and needs to quickly integrate existing operational processes. The changes to current and future state expose new risks that will require new policy statements. -## Evolution of tangible risks +## Changes in tangible risks **Business interruption:** There is an inherent risk of any new platform causing interruptions to mission-critical business processes. The IT Operations team and the teams executing on various cloud adoptions are relatively inexperienced with cloud operations. This increases the risk of interruption and must be remediated and governed. @@ -50,7 +50,7 @@ This business risk can be expanded into several technical risks: - Deployed operating systems or applications might not meet OS and application hardening requirements. - There is a risk of inconsistency due to multiple teams working in the cloud. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. The list looks long, but the adoption of these policies may be easier than it would appear. @@ -71,11 +71,13 @@ The following changes to policy will help remediate the new risks and guide impl 15. Deployment scripts must be maintained in central repository accessible by the cloud governance team for periodic review and auditing. 16. Governance review processes must validate that deployed assets are properly configured in alignment with SLA and recovery requirements. -## Evolution of the best practices +## Incremental improvement of the best practices -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Site Recovery and Azure Monitor. These design changes will fulfill the new corporate policy statements. -Following the experience of this fictional example, it is assumed that the Protected Data evolution has already happened. Building on that best practice, the following will add operational monitoring requirements, readying a subscription for mission-critical applications. +This section of the article will improve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. + + +Following the experience of this fictional example, it is assumed that the Protected Data changes have already occurred. Building on that best practice, the following will add operational monitoring requirements, readying a subscription for mission-critical applications. **Corporate IT subscription:** Add the following to the Corporate IT subscription, which acts as a hub. @@ -107,7 +109,7 @@ Adding these processes and changes to the governance MVP helps remediate many of ## Next steps -As cloud adoption continues to evolve and deliver additional business value, the risks and cloud governance needs will also evolve. For the fictional company in this journey, the next trigger is when the scale of deployment exceeds 1,000 assets to the cloud or monthly spending exceeds $10,000 USD per month. At this point, the cloud governance team adds Cost Management controls. +As cloud adoption grows and delivers additional business value, the risks and cloud governance needs will also change. For the fictional company in this guide, the next trigger is when the scale of deployment exceeds 1,000 assets to the cloud or monthly spending exceeds $10,000 USD per month. At this point, the cloud governance team adds Cost Management controls. > [!div class="nextstepaction"] -> [Cost Management evolution](./cost-management-evolution.md) +> [Improving Cost Management](./cost-management-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/large-enterprise/security-baseline-evolution.md b/docs/cloud-adoption/governance/journeys/large-enterprise/security-baseline-evolution.md index 8a4b0c48a01..066eaa04493 100644 --- a/docs/cloud-adoption/governance/journeys/large-enterprise/security-baseline-evolution.md +++ b/docs/cloud-adoption/governance/journeys/large-enterprise/security-baseline-evolution.md @@ -1,7 +1,7 @@ --- -title: "Large enterprise: Security Baseline evolution" +title: "Large enterprise guide: Improving the Security Baseline" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Large enterprise – Security Baseline evolution +description: "Large enterprise guide: Improving the Security Baseline" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,25 +11,25 @@ ms.subservice: govern ms.custom: governance --- -# Large enterprise: Security Baseline evolution +# Large enterprise guide: Improving the Security Baseline -This article evolves the narrative by adding security controls that support moving protected data to the cloud. +This article advances the narrative by adding security controls that support moving protected data to the cloud. -## Evolution of the narrative +## Advancing the narrative The CIO has spent months collaborating with colleagues and the company’s legal staff. A management consultant with expertise in cybersecurity was engaged to help the existing IT Security and IT Governance teams draft a new policy regarding protected data. The group was able to foster board support to replace the existing policy, allowing sensitive personal and financial data to be hosted by approved cloud providers. This required adopting a set of security requirements and a governance process to verify and document adherence to those policies. For the past 12 months, the cloud adoption teams have cleared most of the 5,000 assets from the two datacenters to be retired. The 350 incompatible assets were moved to an alternate datacenter. Only the 1,250 virtual machines that contain protected data remain. -### Evolution of the cloud governance team +### Changes in the cloud governance team -The cloud governance team continues to evolve along with the narrative. The two founding members of the team are now among the most respected cloud architects in the company. The collection of configuration scripts has grown as new teams tackle innovative new deployments. The cloud governance team has also grown. Most recently, members of the IT Operations team have joined cloud governance team activities to prepare for cloud operations. The cloud architects who helped foster this community are seen both as cloud guardians and cloud accelerators. +The cloud governance team continues to change along with the narrative. The two founding members of the team are now among the most respected cloud architects in the company. The collection of configuration scripts has grown as new teams tackle innovative new deployments. The cloud governance team has also grown. Most recently, members of the IT Operations team have joined cloud governance team activities to prepare for cloud operations. The cloud architects who helped foster this community are seen both as cloud guardians and cloud accelerators. While the difference is subtle, it is an important distinction when building a governance-focused IT culture. A cloud custodian cleans up the messes made by innovative cloud architects, and the two roles have natural friction and opposing objectives. A cloud guardian helps keep the cloud safe, so other cloud architects can move more quickly with fewer messes. A cloud accelerator performs both functions but is also involved in the creation of templates to accelerate deployment and adoption, becoming an innovation accelerator as well as a defender of the Five Disciplines of Cloud Governance. -### Evolution of the current state +### Changes in the current state -In the previous phase of this narrative, the company had begun the process of retiring two datacenters. This ongoing effort includes migrating some applications with legacy authentication requirements, which required an evolution of the Identity Baseline, described in the [previous article](identity-baseline-evolution.md). +In the previous phase of this narrative, the company had begun the process of retiring two datacenters. This ongoing effort includes migrating some applications with legacy authentication requirements, which required incremental improvements to the Identity Baseline, described in the [previous article](identity-baseline-evolution.md). Since then, some things have changed that will affect governance: @@ -39,14 +39,14 @@ Since then, some things have changed that will affect governance: - The IT team is progressing on the CIO and CFO's plans to retire two datacenters. Almost 3,500 of the assets in the two datacenters have been retired or migrated. - The policies regarding sensitive personal and financial data have been modernized. However, the new corporate policies are contingent on the implementation of related security and governance policies. Teams are still stalled. -### Evolution of the future state +### Incrementally improve the future state - Early experiments from the application development and BI teams have shown potential improvements in customer experiences and data-driven decisions. Both teams would like to expand adoption of the cloud over the next 18 months by deploying those solutions to production. - IT has developed a business justification to migrate five more datacenters to Azure, which will further decrease IT costs and provide greater business agility. While smaller in scale, the retirement of those datacenters is expected to double the total cost savings. - Capital expense and operating expense budgets have approved to implement the required security and governance policies, tools, and processes. The expected cost savings from the datacenter retirement are more than enough to pay for this new initiative. IT and business leadership are confident this investment will accelerate the realization of returns in other areas. The grassroots cloud governance team became a recognized team with dedicated leadership and staffing. - Collectively, the cloud adoption teams, the cloud governance team, the IT security team, and the IT governance team will implement security and governance requirements to allow cloud adoption teams to migrate protected data into the cloud. -## Evolution of tangible risks +## Changes in tangible risks **Data breach:** There is an inherent increase in liabilities related to data breaches when adopting any new data platform. Technicians adopting cloud technologies have increased responsibilities to implement solutions that can decrease this risk. A robust security and governance strategy must be implemented to ensure those technicians fulfill those responsibilities. @@ -65,7 +65,7 @@ This business risk can be expanded into a few technical risks: - Disparate device configurations might lead to oversights in configuration and compromises in security. - The Cybersecurity team insists there is a risk of vendor lock-in from generating encryption keys on a single cloud provider's platform. While this claim is unsubstantiated, it was accepted by the team for the time being. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. The list looks long, but the adoption of these policies may be easier than it would appear. @@ -91,9 +91,11 @@ The following changes to policy will help remediate the new risks and guide impl 20. Deployment of any applications that require customer authentication must use an approved identity provider that is compatible with the primary identity provider for internal users. 21. Cloud Governance processes must include quarterly reviews with Identity Baseline teams to identify malicious actors or usage patterns that should be prevented by cloud asset configuration. -## Evolution of the best practices +## Incremental improvement of the best practices + + +This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Security Center. Together, these two design changes will fulfill the new corporate policy statements. The new best practices fall into two categories: Corporate IT (hub) and Cloud Adoption (spoke). @@ -121,18 +123,18 @@ The new best practices fall into two categories: Corporate IT (hub) and Cloud Ad 2. Deploy Azure Automation State Configuration to any instances of the Corporate IT subscription. Azure Automation can be used to apply DSC to VMs deployed in supported subscriptions within the management group. 3. The current roadmap plans to enable custom guest configuration policies. When that feature is released, the use of Azure Automation in this best practice will no longer be required. -**Applying additional governance to a Cloud Adoption Subscription (Spoke):** Building on the `Corporate IT Subscription`, minor changes to the governance MVP applied to each subscription dedicated to the support of application archetypes can produce rapid evolution. +**Applying additional governance to a Cloud Adoption Subscription (Spoke):** Building on the `Corporate IT Subscription`, minor changes to the governance MVP applied to each subscription dedicated to the support of application archetypes can produce rapid improvement. -In prior evolutions of the best practice, we defined network security groups to block public traffic and whitelisted internal traffic. Additionally, the Azure blueprint temporarily created DMZ and Active Directory capabilities. In this evolution, we will tweak those assets a bit, creating a new version of the Azure blueprint. +In prior iterative changes to the best practice, we defined network security groups to block public traffic and whitelisted internal traffic. Additionally, the Azure blueprint temporarily created DMZ and Active Directory capabilities. In this iteration, we will tweak those assets a bit, creating a new version of the Azure blueprint. 1. Network peering template. This template will peer the VNet in each subscription with the Hub VNet in the Corporate IT subscription. 1. The reference architecture from the prior section, [hub and spoke topology with shared services][shared-services], generated a Resource Manager template for enabling VNet peering. - 2. That template can be used as a guide to modify the DMZ template from the prior governance evolution. + 2. That template can be used as a guide to modify the DMZ template from the prior governance iteration. 3. Essentially, we are now adding VNet peering to the DMZ VNet that was previously connected to the local edge device over VPN. 4. *** It is also advised that the VPN should be removed from this template as well to ensure no traffic is routed directly to the on-premises datacenter, without passing through the corporate IT subscription and Firewall solution. 5. Additional [network configuration](/azure/automation/automation-dsc-overview#network-planning) will be required by Azure Automation to apply DSC to hosted VMs. 2. Modify the network security group. Block all public **and** direct on-premises traffic in the network security group. The only inbound traffic should be coming through the VNet peer in the corporate IT subscription. - 1. In the prior evolution, a network security group was created blocking all public traffic and whitelisting all internal traffic. Now we want to shift this network security group a bit. + 1. In the prior iteration, a network security group was created blocking all public traffic and whitelisting all internal traffic. Now we want to shift this network security group a bit. 2. The new network security group configuration should block all public traffic, along with all traffic from the local datacenter. 3. Traffic entering this VNet should only come from the VNet on the other side of the VNet peer. 3. Azure Security Center implementation: @@ -154,8 +156,8 @@ In prior evolutions of the best practice, we defined network security groups to 6. Azure blueprint: 1. Create an Azure blueprint named `protected-data`. 2. Add the VNet peer, network security group, and Azure Security Center templates to the blueprint. - 3. Ensure the template for Active Directory from the previous evolution is NOT included in the blueprint. Any dependencies on Active Directory will be provided by the corporate IT subscription. - 4. Terminate any existing Active Directory VMs deployed in the previous evolution. + 3. Ensure the template for Active Directory from the previous iteration is **not** included in the blueprint. Any dependencies on Active Directory will be provided by the corporate IT subscription. + 4. Terminate any existing Active Directory VMs deployed in the previous iteration. 5. Add the new policies for protected data subscriptions. 6. Publish the blueprint to any management group intended to host protected data. 7. Apply the new blueprint to each affected subscription along with existing blueprints. @@ -166,10 +168,10 @@ Adding these processes and changes to the governance MVP helps remediate many of ## Next steps -As cloud adoption continues to evolve and deliver additional business value, risks and cloud governance needs also evolve. For the fictional company in this journey, the next step is to support mission-critical workloads. This is the point when Resource Consistency controls are needed. +As cloud adoption continues and delivers additional business value, risks and cloud governance needs also change. For the fictional company in this guide, the next step is to support mission-critical workloads. This is the point when Resource Consistency controls are needed. > [!div class="nextstepaction"] -> [Resource Consistency evolution](./resource-consistency-evolution.md) +> [Improving Resource Consistency](./resource-consistency-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/best-practice-explained.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/best-practice-explained.md index 4bf62a0181c..f4bddd86734 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/best-practice-explained.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/best-practice-explained.md @@ -1,7 +1,7 @@ --- -title: "Small-to-medium enterprise: Best practice explained" +title: "Small-to-medium enterprise guide: Best practice explained" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Small-to-medium enterprise – Best practice explained +description: "Small-to-medium enterprise guide: Best practice explained" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -13,9 +13,9 @@ ms.custom: governance # Small-to-medium enterprise: Best practice explained -The governance journey starts with a set of initial [corporate policies](./initial-corporate-policy.md). These policies are used to establish a governance MVP that reflects [best practices](./index.md). +The governance guide starts with a set of initial [corporate policies](./initial-corporate-policy.md). These policies are used to establish a governance MVP that reflects [best practices](./index.md). -In this article, we discuss the high-level strategies that are required to create a governance MVP. The core of the governance MVP is the [Deployment Acceleration](../../deployment-acceleration/index.md) discipline. The tools and patterns applied at this stage will enable the incremental evolutions needed to expand governance in the future. +In this article, we discuss the high-level strategies that are required to create a governance MVP. The core of the governance MVP is the [Deployment Acceleration](../../deployment-acceleration/index.md) discipline. The tools and patterns applied at this stage will enable the incremental improvements needed to expand governance in the future. ## Governance MVP (initial governance foundation) @@ -74,7 +74,7 @@ Resource tagging decisions determine how metadata is applied to Azure resources - SLA - Environment - These four values will drive governance, operations, and security decisions. -- If this governance journey is being implemented for a business unit or team within a larger corporation, tagging should also include metadata for the billing unit. +- If this governance guide is being implemented for a business unit or team within a larger corporation, tagging should also include metadata for the billing unit. ### Logging and reporting @@ -83,9 +83,9 @@ Logging and reporting decisions determine how your store log data and how the mo - No governance requirements have been set regarding the data to be collected for logging or reporting purposes. - Additional analysis will be needed before releasing any protected data or mission-critical workloads. -## Evolution of governance processes +## Incremental improvement of governance processes -As governance evolves, some policy statements can’t or shouldn’t be controlled by automated tooling. Other policies will result in effort by the IT Security team and the on-premises Identity Management team over time. To help manage new risks as they arise, the cloud governance team will oversee the following processes. +As governance changes, some policy statements can’t or shouldn’t be controlled by automated tooling. Other policies will result in effort by the IT Security team and the on-premises Identity Management team over time. To help manage new risks as they arise, the cloud governance team will oversee the following processes. **Adoption acceleration:** The cloud governance team has been reviewing deployment scripts across multiple teams. They maintain a set of scripts that serve as deployment templates. Those templates are used by the cloud adoption and DevOps teams to define deployments more quickly. Each of those scripts contains the necessary requirements to enforce a set of governance policies with no additional effort from cloud adoption engineers. As the curators of these scripts, the cloud governance team can more quickly implement policy changes. As a result of script curation, the cloud governance team is seen as a source of adoption acceleration. This creates consistency among deployments, without strictly forcing adherence. @@ -99,7 +99,7 @@ As governance evolves, some policy statements can’t or shouldn’t be controll ## Alternative patterns -If any of the patterns selected in this governance journey don't align with the reader's requirements, alternatives to each pattern are available: +If any of the patterns selected in this governance guide don't align with the reader's requirements, alternatives to each pattern are available: - [Encryption patterns](../../../decision-guides/encryption/index.md) - [Identity patterns](../../../decision-guides/identity/index.md) @@ -114,7 +114,7 @@ If any of the patterns selected in this governance journey don't align with the Once this guide is implemented, each cloud adoption team can go forth with a sound governance foundation. The cloud governance team will work in parallel to continuously update the corporate policies and governance disciplines. -The two teams will use the tolerance indicators to identify the next evolution needed to continue supporting cloud adoption. For the fictional company in this journey, the next step is evolving the Security Baseline to support moving protected data to the cloud. +The two teams will use the tolerance indicators to identify the next set of improvements needed to continue supporting cloud adoption. For the fictional company in this guide, the next step is improving the Security Baseline to support moving protected data to the cloud. > [!div class="nextstepaction"] -> [Security Baseline evolution](./security-baseline-evolution.md) +> [Improving the Security Baseline](./security-baseline-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/cost-management-evolution.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/cost-management-evolution.md index 4857450fd33..4916e56e331 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/cost-management-evolution.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/cost-management-evolution.md @@ -1,7 +1,7 @@ --- -title: "Small-to-medium enterprise: Cost Management evolution" +title: "Small-to-medium enterprise: Improving Cost Management" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Small-to-medium enterprise – Cost Management evolution +description: "Small-to-medium enterprise guide: Improving Cost Management" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,15 +11,15 @@ ms.subservice: govern ms.custom: governance --- -# Small-to-medium enterprise: Cost Management evolution +# Small-to-medium enterprise guide: Improving Cost Management -This article evolves the narrative by adding cost controls to the governance MVP. +This article advances the narrative by adding cost controls to the governance MVP. -## Evolution of the narrative +## Advancing the narrative Adoption has grown beyond the cost tolerance indicator defined in the governance MVP. This is a good thing, as it corresponds with migrations from the "DR" datacenter. The increase in spending now justifies an investment of time from the cloud governance team. -### Evolution of the current state +### Changes in the current state In the previous phase of this narrative, IT had retired 100% of the DR datacenter. The application development and BI teams were ready for production traffic. @@ -30,13 +30,13 @@ Since then, some things have changed that will affect governance: - The business intelligence team within IT has delivered several predictive analytics tools in the cloud. The volumes of data aggregated in the cloud continues to grow. - All of this growth supports committed business outcomes. However, costs have begun to mushroom. Projected budgets are growing faster than expected. The CFO needs improved approaches to managing costs. -### Evolution of the future state +### Incrementally improve the future state Cost monitoring and reporting is to be added to the cloud solution. IT is still serving as a cost clearing house. This means that payment for cloud services continues to come from IT procurement. However, reporting should tie direct operating expenses to the functions that are consuming the cloud costs. This model is referred to as a "Show Back" cloud accounting model. The changes to current and future state expose new risks that will require new policy statements. -## Evolution of tangible risks +## Changes in tangible risks **Budget control:** There is an inherent risk that self-service capabilities will result in excessive and unexpected costs on the new platform. Governance processes for monitoring costs and mitigating ongoing cost risks must be in place to ensure continued alignment with the planned budget. @@ -46,7 +46,7 @@ This business risk can be expanded into a few technical risks: - Business conditions change. When they do, there will be cases when a business function needs to consume more cloud services than expected, leading to spending anomalies. There is a risk that this extra spending will be considered overages, as opposed to a necessary adjustment to the plan. - Systems could be overprovisioned, resulting in excess spending. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. @@ -57,9 +57,9 @@ The following changes to policy will help remediate the new risks and guide impl 5. During deployment planning, any required cloud resources associated with the hosting of production workloads should be documented. This documentation will help refine budgets and prepare additional automation to prevent the use of more expensive options. During this process consideration should be given to different discounting tools offered by the cloud provider, such as reserved instances or license cost reductions. 6. All application owners are required to attend trained on practices for optimizing workloads to better control cloud costs. -## Evolution of the best practices +## Incremental improvement of the best practices -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. +This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. 1. Implement Azure Cost Management 1. Establish the right scope of access to align with the subscription pattern and the Resource Consistency discipline. Assuming alignment with the governance MVP defined in prior articles, this requires **Enrollment Account Scope** access for the cloud governance team executing on high-level reporting. Additional teams outside of governance may require **Resource Group Scope** access. @@ -76,7 +76,7 @@ Adding these processes and changes to the governance MVP helps remediate many of ## Next steps -As cloud adoption continues to evolve and deliver additional business value, risks and cloud governance needs will also evolve. For the fictional company in this journey, the next step is using this governance investment to manage multiple clouds. +As cloud adoption continues and delivers additional business value, risks and cloud governance needs will also change. For the fictional company in this guide, the next step is using this governance investment to manage multiple clouds. > [!div class="nextstepaction"] -> [Multicloud evolution](./multi-cloud-evolution.md) +> [Multicloud evolution](./multicloud-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/index.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/index.md index 98808b54e28..4a8bb9f2e45 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/index.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/index.md @@ -1,7 +1,7 @@ --- -title: "Small-to-medium enterprise governance journey" +title: "Small-to-medium enterprise governance guide" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Small-to-medium enterprise governance journey +description: Small-to-medium enterprise governance guide author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,13 +11,13 @@ ms.subservice: govern ms.custom: governance --- -# Small-to-medium enterprise governance journey +# Small-to-medium enterprise governance guide ## Best practice overview -This governance journey follows the experiences of a fictional company through various stages of governance maturity. It is based on real customer journeys. The suggested best practices are based on the constraints and needs of the fictional company. +This governance guide follows the experiences of a fictional company through various stages of governance maturity. It is based on real customer experiences. The suggested best practices are based on the constraints and needs of the fictional company. -As a quick starting point, this overview defines a minimum viable product (MVP) for governance based on best practices. It also provides links to some governance evolutions that add further best practices as new business or technical risks emerge. +As a quick starting point, this overview defines a minimum viable product (MVP) for governance based on best practices. It also provides links to some governance improvements that add further best practices as new business or technical risks emerge. > [!WARNING] > This MVP is a baseline starting point, based on a set of assumptions. Even this minimal set of best practices is based on corporate policies driven by unique business risks and risk tolerances. To see if these assumptions apply to you, read the [longer narrative](./narrative.md) that follows this article. @@ -47,14 +47,14 @@ These patterns provide room for growth without complicating the hierarchy unnece [!INCLUDE [governance-of-resources](../../../../../includes/caf-governance-of-resources.md)] -## Governance evolutions +## Iterative governance improvements -Once this MVP has been deployed, additional layers of governance can be quickly incorporated into the environment. Here are some ways to evolve the MVP to meet specific business needs: +Once this MVP has been deployed, additional layers of governance can be incorporated into the environment quickly. Here are some ways to improve the MVP to meet specific business needs: - [Security Baseline for protected data](./security-baseline-evolution.md) - [Resource configurations for mission-critical applications](./resource-consistency-evolution.md) - [Controls for Cost Management](./cost-management-evolution.md) -- [Controls for multicloud evolution](./multi-cloud-evolution.md) +- [Controls for multicloud evolution](./multicloud-evolution.md) @@ -64,9 +64,9 @@ In the MVP, practices and tools from the [Deployment Acceleration](../../deploym ![Example of an incremental governance MVP](../../../_images/governance/governance-mvp.png) -## Evolving the best practice +## Incremental improvement of governance practices -Over time, this governance MVP will be used to evolve the governance practices. As adoption advances, business risk grows. Various disciplines within the Cloud Adoption Framework governance model will evolve to manage those risks. Later articles in this series discuss the evolution of corporate policy affecting the fictional company. These evolutions happen across three disciplines: +Over time, this governance MVP will be used to improve governance practices. As adoption advances, business risk grows. Various disciplines within the Cloud Adoption Framework governance model will change to manage those risks. Later articles in this series discuss the incremental improvement of corporate policy affecting the fictional company. These improvements happen across three disciplines: - Cost Management, as adoption scales. - Security Baseline, as protected data is deployed. @@ -76,7 +76,7 @@ Over time, this governance MVP will be used to evolve the governance practices. ## Next steps -Now that you’re familiar with the governance MVP and have an idea of the governance evolutions to follow, read the supporting narrative for additional context. +Now that you’re familiar with the governance MVP and have an idea of the governance improvements to follow, read the supporting narrative for additional context. > [!div class="nextstepaction"] > [Read the supporting narrative](./narrative.md) diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/initial-corporate-policy.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/initial-corporate-policy.md index 3ce79e62d67..15e32909e37 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/initial-corporate-policy.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/initial-corporate-policy.md @@ -13,20 +13,20 @@ ms.custom: governance # Small-to-medium enterprise: Initial corporate policy behind the governance strategy -The following corporate policy defines an initial governance position, which is the starting point for this journey. This article defines early-stage risks, initial policy statements, and early processes to enforce policy statements. +The following corporate policy defines an initial governance position, which is the starting point for this guide. This article defines early-stage risks, initial policy statements, and early processes to enforce policy statements. > [!NOTE] >The corporate policy is not a technical document, but it drives many technical decisions. The governance MVP described in the [overview](./index.md) ultimately derives from this policy. Before implementing a governance MVP, your organization should develop a corporate policy based on your own objectives and business risks. ## Cloud governance team -In this narrative, the cloud governance team is comprised of two systems administrators who have recognized the need for governance. Over the next several months, they will inherit the job of cleaning up the governance of the company’s cloud presence, earning them the title of _cloud custodians_. In subsequent evolutions, this title will likely change. +In this narrative, the cloud governance team is comprised of two systems administrators who have recognized the need for governance. Over the next several months, they will inherit the job of cleaning up the governance of the company’s cloud presence, earning them the title of _cloud custodians_. In subsequent iterations, this title will likely change. [!INCLUDE [business-risk](../../../includes/governance/business-risks.md)] ## Tolerance indicators -The current tolerance for risk is high and the appetite for investing in cloud governance is low. As such, the tolerance indicators act as an early warning system to trigger more investment of time and energy. If and when the following indicators are observed, you should evolve the governance strategy. +The current tolerance for risk is high and the appetite for investing in cloud governance is low. As such, the tolerance indicators act as an early warning system to trigger more investment of time and energy. If and when the following indicators are observed, you should iteratively improve the governance strategy. - **Cost Management:** The scale of deployment exceeds 100 assets to the cloud, or monthly spending exceeds $1,000 USD per month. - **Security Baseline:** Inclusion of protected data in defined cloud adoption plans. diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/multicloud-evolution.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/multicloud-evolution.md index 874e9ff00b2..2e89aea8449 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/multicloud-evolution.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/multicloud-evolution.md @@ -13,15 +13,15 @@ ms.custom: governance # Small-to-medium enterprise: Multicloud evolution -This article evolves the narrative by adding controls for multicloud adoption. +This article advances the narrative by adding controls for multicloud adoption. -## Evolution of the narrative +## Advancing the narrative -Microsoft recognizes that customers are adopting multiple clouds for specific purposes. The fictional customer in this journey is no exception. In parallel to the Azure adoption journey, the business success has led to the acquisition of a small, but complementary business. That business is running all of their IT operations on a different cloud provider. +Microsoft recognizes that customers are adopting multiple clouds for specific purposes. The fictional customer in this guide is no exception. In parallel to the Azure adoption journey, the business success has led to the acquisition of a small, but complementary business. That business is running all of their IT operations on a different cloud provider. -This article describes how things change when integrating the new organization. For purposes of the narrative, we assume this company has completed each of the governance evolutions outlined in this customer journey. +This article describes how things change when integrating the new organization. For purposes of the narrative, we assume this company has completed each of the governance iterations outlined in this governance guide. -### Evolution of the current state +### Changes in the current state In the previous phase of this narrative, the company had begun actively pushing production applications to the cloud through CI/CD pipelines. @@ -34,11 +34,11 @@ Since then, some things have changed that will affect governance: - Azure Security Center and Azure Monitor are both used to monitor governance of the cloud. - Azure Blueprints, Azure Policy, and Azure management groups are used to automate compliance with policy. -### Evolution of the future state +### Incrementally improve the future state The goal is to integrate the acquisition company into existing operations wherever possible. -## Evolution of tangible risks +## Changes in tangible risks **Business acquisition cost:** Acquisition of the new business is estimated to be profitable in approximately five years. Because of the slow rate of return, the board wants to control acquisition costs, as much as possible. There is a risk of cost control and technical integration conflicting with one another. @@ -47,7 +47,7 @@ This business risk can be expanded into a few technical risks: - Cloud migration might produce additional acquisition costs. - The new environment might not be properly governed, which could result in policy violations. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. @@ -55,9 +55,9 @@ The following changes to policy will help remediate the new risks and guide impl 2. All Organization Units must be integrated into the existing identity provider. 3. The primary identity provider should govern authentication to assets in the secondary cloud. -## Evolution of the best practices +## Incremental improvement of governance practices -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. +This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. 1. Connect the networks. This step is executed by the Networking and IT Security teams, and supported by the cloud governance team. Adding a connection from the MPLS/leased-line provider to the new cloud will integrate networks. Adding routing tables and firewall configurations will control access and traffic between the environments. 2. Consolidate identity providers. Depending on the workloads being hosted in the secondary cloud, there are a variety of options to identity provider consolidation. The following are a few examples: @@ -74,9 +74,9 @@ This section of the article will evolve the governance MVP design to include new 2. Virtual machines in the secondary cloud may be compatible with Azure Monitor agents, allowing them to be included in Azure Monitor for operational monitoring. 6. Governance enforcement tools: 1. Governance enforcement is cloud-specific. - 2. The corporate policies established in the governance journey are not cloud-specific. While the implementation may vary from cloud to cloud, the policies can be applied to the secondary provider. + 2. The corporate policies established in the governance guide are not cloud-specific. While the implementation may vary from cloud to cloud, the policies can be applied to the secondary provider. -As multicloud adoption grows, the design evolution above will continue to mature. +As multicloud adoption grows, the design changes above will continue to mature. ## Conclusion diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/narrative.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/narrative.md index 65b123d79f4..7eaad323d89 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/narrative.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/narrative.md @@ -1,7 +1,7 @@ --- title: "Small-to-medium enterprise: The narrative behind the governance strategy" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: This narrative establishes a use case for a small-to-medium enterprise governance journey. +description: This narrative establishes a use case for governance during a small-to-medium enterprise's cloud adoption journey. author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -13,7 +13,7 @@ ms.custom: governance # Small-to-medium enterprise: The narrative behind the governance strategy -The following narrative describes the use case for the [small-to-medium enterprise governance journey](./index.md). Before implementing the journey, it’s important to understand the assumptions and rationale that are reflected in this narrative. Then you can better align the governance strategy to your own organization’s journey. +The following narrative describes the use case for governance during a [small-to-medium enterprise's cloud adoption journey](./index.md). Before implementing the journey, it’s important to understand the assumptions and rationale that are reflected in this narrative. Then you can better align the governance strategy to your own organization’s journey. ## Back story diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/resource-consistency-evolution.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/resource-consistency-evolution.md index 99baa0032a3..80e6dd7af9e 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/resource-consistency-evolution.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/resource-consistency-evolution.md @@ -1,7 +1,7 @@ --- -title: "Small-to-medium enterprise: Resource Consistency evolution" +title: "Small-to-medium enterprise guide: Improving Resource Consistency" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Small-to-medium enterprise – Resource Consistency evolution +description: "Small-to-medium enterprise guide: Improving Resource Consistency" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,15 +11,15 @@ ms.subservice: govern ms.custom: governance --- -# Small-to-medium enterprise: Resource Consistency evolution +# Small-to-medium enterprise guide: Improving Resource Consistency -This article evolves the narrative by adding Resource Consistency controls to support mission-critical apps. +This article advances the narrative by adding Resource Consistency controls to support mission-critical apps. -## Evolution of the narrative +## Advancing the narrative New customer experiences, new prediction tools, and migrated infrastructure continue to progress. The business is now ready to begin using those assets in a production capacity. -### Evolution of the current state +### Changes in the current state In the previous phase of this narrative, the application development and BI teams were nearly ready to integrate customer and financial data into production workloads. The IT team was in the process of retiring the DR datacenter. @@ -29,13 +29,13 @@ Since then, some things have changed that will affect governance: - The application development teams are now ready for production traffic. - The BI team is ready to feed predictions and insights back into operation systems in the Production datacenter. -### Evolution of the future state +### Incrementally improve the future state -Before using Azure deployments in production business processes, cloud operations must mature. In conjunction, an additional governance evolution is required to ensure assets can be operated properly. +Before using Azure deployments in production business processes, cloud operations must mature. In conjunction, additional governance changes is required to ensure assets can be operated properly. The changes to current and future state expose new risks that will require new policy statements. -## Evolution of tangible risks +## Changes in tangible risks **Business interruption:** There is an inherent risk of any new platform causing interruptions to mission-critical business processes. The IT Operations team and the teams executing on various cloud adoptions are relatively inexperienced with cloud operations. This increases the risk of interruption and must be remediated and governed. @@ -53,7 +53,7 @@ This business risk can be expanded into several technical risks: - Deployed operating systems or applications might fail to meet hardening requirements. - With so many teams working in the cloud, there is a risk of inconsistency. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. The list looks long, but adopting these policies may be easier than it appears. @@ -74,9 +74,11 @@ The following changes to policy will help remediate the new risks and guide impl 15. Deployment scripts must be maintained in a central repository accessible by the cloud governance team for periodic review and auditing. 16. Governance review processes must validate that deployed assets are properly configured in alignment with SLA and recovery requirements. -## Evolution of the best practices +## Incremental improvement of governance practices + + +This section of the article will change the governance MVP design to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. -This section of the article will evolve the governance MVP design to include new Azure policies and an implementation of Azure Vault and Azure Monitor. These design changes will fulfill the new corporate policy statements. 1. The cloud operations team will define operational monitoring tooling and automated remediation tooling. The cloud governance team will support those discovery processes. In this use case, the cloud operations team chose Azure Monitor as the primary tool for monitoring mission-critical applications. 2. Create a repository in Azure DevOps to store and version all relevant Resource Manager templates and scripted configurations. @@ -111,7 +113,7 @@ These additional processes and changes to the governance MVP help remediate many ## Next steps -As cloud adoption continues to evolve and deliver additional business value, risks and cloud governance needs will also evolve. For the fictional company in this journey, the next trigger is when the scale of deployment exceeds 100 assets to the cloud or monthly spending exceeds $1,000 per month. At this point, the cloud governance team adds Cost Management controls. +As cloud adoption continues and delivers additional business value, risks and cloud governance needs will also change. For the fictional company in this guide, the next trigger is when the scale of deployment exceeds 100 assets to the cloud or monthly spending exceeds $1,000 per month. At this point, the cloud governance team adds Cost Management controls. > [!div class="nextstepaction"] -> [Cost Management evolution](./cost-management-evolution.md) +> [Improving Cost Management](./cost-management-evolution.md) diff --git a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/security-baseline-evolution.md b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/security-baseline-evolution.md index e9a3d1f6d9e..8570ff24c08 100644 --- a/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/security-baseline-evolution.md +++ b/docs/cloud-adoption/governance/journeys/small-to-medium-enterprise/security-baseline-evolution.md @@ -1,7 +1,7 @@ --- -title: "Small-to-medium enterprise: Security Baseline evolution" +title: "Small-to-medium enterprise guide: Improving the Security Baseline" titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: "Small-to-medium enterprise: Security Baseline evolution" +description: "Small-to-medium enterprise guide: Improving the Security Baseline" author: BrianBlanchard ms.author: brblanch ms.date: 02/11/2019 @@ -11,21 +11,21 @@ ms.subservice: govern ms.custom: governance --- -# Small-to-medium enterprise: Security Baseline evolution +# Small-to-medium enterprise guide: Improving the Security Baseline -This article evolves the narrative by adding security controls that support moving protected data to the cloud. +This article advances the narrative by adding security controls that support moving protected data to the cloud. -## Evolution of the narrative +## Advancing the narrative -IT and business leadership have been happy with results from early stage experimentation by the IT, App Development, and BI teams. To realize tangible business values from these experiments, those teams must be allowed to integrate protected data into solutions. This triggers changes to corporate policy, but also requires an evolution of the cloud governance implementations before protected data can land in the cloud. +IT and business leadership have been happy with results from early stage experimentation by the IT, App Development, and BI teams. To realize tangible business values from these experiments, those teams must be allowed to integrate protected data into solutions. This triggers changes to corporate policy, but also requires incremental improvement of the cloud governance implementations before protected data can land in the cloud. -### Evolution of the cloud governance team +### Changes to the cloud governance team Given the effect of the changing narrative and support provided so far, the cloud governance team is now viewed differently. The two system administrators who started the team are now viewed as experienced cloud architects. As this narrative develops, the perception of them will shift from being Cloud Custodians to more of a Cloud Guardian role. While the difference is subtle, it’s an important distinction when building a governance- focused IT culture. A Cloud Custodian cleans up the messes made by innovative cloud architects. The two roles have natural friction and opposing objectives. On the other hand, a Cloud Guardian helps keep the cloud safe, so other cloud architects can move more quickly, with less messes. Additionally, a Cloud Guardian is involved in creating templates that accelerate deployment and adoption, making them an innovation accelerator as well as a defender of the Five Disciplines of Cloud Governance. -### Evolution of the current state +### Changes in the current state At the start of this narrative, the application development teams were still working in a dev/test capacity, and the BI team was still in the experimental phase. IT operated two hosted infrastructure environments, named Prod and DR. @@ -36,7 +36,7 @@ Since then, some things have changed that will affect governance: - The IT team is progressing on the CIO and CFO's plans to retire the DR datacenter. More than 1,000 of the 2,000 assets in the DR datacenter have been retired or migrated. - The loosely defined policies regarding PII and financial data have been modernized. However, the new corporate policies are contingent on the implementation of related security and governance policies. Teams are still stalled. -### Evolution of the future state +### Incrementally improve the future state Early experiments by the App Dev and BI teams show potential improvements in customer experiences and data-driven decisions. Both teams want to expand adoption of the cloud over the next 18 months by deploying those solutions to production. @@ -44,7 +44,7 @@ During the remaining six months, the cloud governance team will implement securi The changes to current and future state expose new risks that require new policy statements. -## Evolution of tangible risks +## Changes in tangible risks **Data breach:** When adopting any new data platform, there is an inherent increase in liabilities related to potential data breaches. Technicians adopting cloud technologies have increased responsibilities to implement solutions that can decrease this risk. A robust security and governance strategy must be implemented to ensure those technicians fulfill those responsibilities. @@ -60,7 +60,7 @@ This business risk can be expanded into a few technical risks: - Inconsistent deployment processes might result in security gaps, which could lead to data leaks or interruptions. - Configuration drift or missed patches might result in unintended security gaps, which could lead to data leaks or interruptions. -## Evolution of the policy statements +## Incremental improvement of the policy statements The following changes to policy will help remediate the new risks and guide implementation. The list looks long, but adopting these policies may be easier than it appears. @@ -83,9 +83,11 @@ The following changes to policy will help remediate the new risks and guide impl 17. Deployment of any applications that require customer authentication must use an approved identity provider that is compatible with the primary identity provider for internal users. 18. Cloud governance processes must include quarterly reviews with identity management teams. These reviews can help identify malicious actors or usage patterns that should be prevented by cloud asset configuration. -## Evolution of the best practices +## Incremental improvement of governance practices + + +The governance MVP design will change to include new Azure policies and an implementation of Azure Cost Management. Together, these two design changes will fulfill the new corporate policy statements. -The governance MVP design will evolve to include new Azure policies and an implementation of Azure Security Center. Together, these two design changes will fulfill the new corporate policy statements. 1. The Networking and IT Security teams will define network requirements. The cloud governance team will support the conversation. 2. The Identity and IT Security teams will define identity requirements and make any necessary changes to local Active Directory implementation. The cloud governance team will review changes. @@ -124,7 +126,7 @@ Adding the above processes and changes to the governance MVP will help to remedi ## Next steps -As cloud adoption continues to evolve and deliver additional business value, risks and cloud governance needs also evolve. For the fictional company in this journey, the next step is to support mission-critical workloads. This is the point when Resource Consistency controls are needed. +As cloud adoption continues and delivers additional business value, risks and cloud governance needs also change. For the fictional company in this guide, the next step is to support mission-critical workloads. This is the point when Resource Consistency controls are needed. > [!div class="nextstepaction"] -> [Resource Consistency evolution](./resource-consistency-evolution.md) +> [Improving Resource Consistency](./resource-consistency-evolution.md) diff --git a/docs/cloud-adoption/governance/policy-compliance/align-governance-journeys.md b/docs/cloud-adoption/governance/policy-compliance/align-governance-journeys.md index e7516bfa9d3..471b7be2afc 100644 --- a/docs/cloud-adoption/governance/policy-compliance/align-governance-journeys.md +++ b/docs/cloud-adoption/governance/policy-compliance/align-governance-journeys.md @@ -30,9 +30,9 @@ While cloud design guides should take into account some of the technical details -## Using the actionable governance journeys +## Using the actionable governance guides -If you're planning to use the Azure platform for your cloud adoption, the Cloud Adoption Framework provides [governance journeys](../journeys/index.md) illustrating the incremental approach of the Cloud Adoption Framework governance model. These narrative journeys cover a range of common adoption scenarios, including the business risks, tolerance requirements, and policy statements that went into creating a governance minimum viable product (MVP). These journeys represent a synthesis of real-world customer experience of the cloud adoption process in Azure. +If you're planning to use the Azure platform for your cloud adoption, the Cloud Adoption Framework provides [actionable governance guides](../journeys/index.md) illustrating the incremental approach of the Cloud Adoption Framework governance model. These narrative guides cover a range of common adoption scenarios, including the business risks, tolerance requirements, and policy statements that went into creating a governance minimum viable product (MVP). These guides represent a synthesis of real-world customer experience of the cloud adoption process in Azure. While every cloud adoption has unique goals, priorities, and challenges, these samples should provide a good template for converting your policy into guidance. Pick the closest scenario to your situation as a starting point, and mold it to fit your specific policy needs. diff --git a/docs/cloud-adoption/governance/policy-compliance/processes.md b/docs/cloud-adoption/governance/policy-compliance/processes.md index 1eec0d884cb..a6a59ca2cc4 100644 --- a/docs/cloud-adoption/governance/policy-compliance/processes.md +++ b/docs/cloud-adoption/governance/policy-compliance/processes.md @@ -21,7 +21,7 @@ I've defined policies, I've provided an architecture guide. Now how do I monitor After establishing your cloud policy statements and drafting a design guide, you'll need to create a strategy for ensuring your cloud deployment stays in compliance with your policy requirements. This strategy will need to encompass your cloud governance team's ongoing review and communication processes, establish criteria for when policy violations require action, and defining the requirements for automated monitoring and compliance systems that will detect violations and trigger remediation actions. -See the corporate policy sections of the [actionable governance journeys](../journeys/index.md) for examples of how policy adherence process fit into a cloud governance plan. +See the corporate policy sections of the [actionable governance guides](../journeys/index.md) for examples of how policy adherence process fit into a cloud governance plan. ## Prioritize policy adherence processes diff --git a/docs/cloud-adoption/governance/policy-compliance/what-is-data-classification.md b/docs/cloud-adoption/governance/policy-compliance/what-is-data-classification.md index 004a8d67bcc..898f4ba25d8 100644 --- a/docs/cloud-adoption/governance/policy-compliance/what-is-data-classification.md +++ b/docs/cloud-adoption/governance/policy-compliance/what-is-data-classification.md @@ -41,7 +41,7 @@ For additional information on resource tagging in Azure, see the article on [Usi ## Next steps -Apply data classifications during one of the actionable governance journeys. +Apply data classifications during one of the actionable governance guides. > [!div class="nextstepaction"] -> [Begin an actionable governance journey](../journeys/index.md) +> [Choose an actionable governance guide](../journeys/index.md) diff --git a/docs/cloud-adoption/governance/policy-compliance/what-is-regulatory-compliance.md b/docs/cloud-adoption/governance/policy-compliance/what-is-regulatory-compliance.md index 256bfd9b54e..3d29fb959f7 100644 --- a/docs/cloud-adoption/governance/policy-compliance/what-is-regulatory-compliance.md +++ b/docs/cloud-adoption/governance/policy-compliance/what-is-regulatory-compliance.md @@ -17,7 +17,7 @@ This is an introductory article about regulatory compliance, therefore it's not Regulatory compliance refers to the discipline and process of ensuring that a company follows the laws enforced by governing bodies in their geography or rules required by voluntarily adopted industry standards. For IT regulatory compliance, people and processes monitor corporate systems in an effort to detect and prevent violations of policies and procedures established by these governing laws, regulations, and standards. This in turn applies to a wide array of monitoring and enforcement processes. Depending on the industry and geography, these processes can become quite lengthy and complex. -For multinational organizations (particularly those in heavily regulated industries, such as healthcare and financial services), compliance can be challenging. Standards and regulations abound, and in certain cases can change frequently. This can make it difficult for businesses to keep abreast of evolving international electronic data handling laws. +For multinational organizations (particularly those in heavily regulated industries, such as healthcare and financial services), compliance can be challenging. Standards and regulations abound, and in certain cases can change frequently. This can make it difficult for businesses to keep abreast of changing international electronic data handling laws. As with security controls, organizations should understand the division of responsibilities regarding regulatory compliance in the cloud. Cloud providers strive to ensure that their platforms and services are compliant. But organizations also need to confirm that their applications, the infrastructure those applications depend on, and services supplied by third parties are also certified as compliant. diff --git a/docs/cloud-adoption/governance/resource-consistency/compliance-processes.md b/docs/cloud-adoption/governance/resource-consistency/compliance-processes.md index a3c8ca93a29..eb7e2c3b581 100644 --- a/docs/cloud-adoption/governance/resource-consistency/compliance-processes.md +++ b/docs/cloud-adoption/governance/resource-consistency/compliance-processes.md @@ -31,7 +31,7 @@ The following is a set of example processes commonly involved in the Resource Co **Quarterly review and planning:** On a quarterly basis perform a review of operational data and incident reports to identify any changes required in Resource Consistency policy. As part of this process, review changes in resource usage and performance to identify assets that require increases or decreases in resource allocation, and identify any workloads or assets that are candidates for retirement. -This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or evolving policy and risks related to Resource Consistency as a discipline. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. +This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or changing policy and risks related to Resource Consistency as a discipline. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. **Education and training:** On a bimonthly basis, offer training sessions to make sure IT staff and developers are up-to-date on the latest Resource Consistency policy requirements and guidance. As part of this process review and update any documentation or other training assets to ensure they are in sync with the latest corporate policy statements. diff --git a/docs/cloud-adoption/governance/resource-consistency/discipline-improvement.md b/docs/cloud-adoption/governance/resource-consistency/discipline-improvement.md index 7ee6ad27a18..058c66266e0 100644 --- a/docs/cloud-adoption/governance/resource-consistency/discipline-improvement.md +++ b/docs/cloud-adoption/governance/resource-consistency/discipline-improvement.md @@ -21,7 +21,7 @@ This article outlines some potential tasks your company can engage in to better *Figure 1 - Adoption phases of the incremental approach to cloud governance.* -It's impossible for any one document to account for the requirements of all businesses. As such, this article outlines suggested minimum and potential example activities for each phase of the governance maturation process. The initial objective of these activities is to help you build a [Policy MVP](../journeys/index.md#an-incremental-approach-to-cloud-governance) and establish a framework for incremental policy evolution. Your cloud governance team will need to decide how much to invest in these activities to improve your Resource Consistency governance capabilities. +It's impossible for any one document to account for the requirements of all businesses. As such, this article outlines suggested minimum and potential example activities for each phase of the governance maturation process. The initial objective of these activities is to help you build a [Policy MVP](../journeys/index.md#an-incremental-approach-to-cloud-governance) and establish a framework for incremental policy improvement. Your cloud governance team will need to decide how much to invest in these activities to improve your Resource Consistency governance capabilities. > [!CAUTION] > Neither the minimum or potential activities outlined in this article are aligned to specific corporate policies or third-party compliance requirements. This guidance is designed to help facilitate the conversations that will lead to alignment of both requirements with a cloud governance model. diff --git a/docs/cloud-adoption/governance/resource-consistency/policy-statements.md b/docs/cloud-adoption/governance/resource-consistency/policy-statements.md index 192475520c9..966e10e3fc7 100644 --- a/docs/cloud-adoption/governance/resource-consistency/policy-statements.md +++ b/docs/cloud-adoption/governance/resource-consistency/policy-statements.md @@ -88,7 +88,7 @@ Use the samples mentioned in this article as a starting point to develop policie To begin developing your own custom policy statements related to Resource Consistency, download the [Resource Consistency template](./template.md). -To accelerate adoption of this discipline, choose the [actionable governance journey](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. +To accelerate adoption of this discipline, choose the [actionable governance guide](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. > [!div class="nextstepaction"] -> [Actionable governance journeys](../journeys/index.md) +> [Actionable governance guides](../journeys/index.md) diff --git a/docs/cloud-adoption/governance/security-baseline/cloud-native-policy.md b/docs/cloud-adoption/governance/security-baseline/cloud-native-policy.md index 7eb88ef4dd1..c8c43590642 100644 --- a/docs/cloud-adoption/governance/security-baseline/cloud-native-policy.md +++ b/docs/cloud-adoption/governance/security-baseline/cloud-native-policy.md @@ -32,7 +32,7 @@ It’s hard to maintain a strong security infrastructure when security controls ### Cloud-native identity policies -Identity is becoming the new boundary control plane for security, taking over that role from the traditional network-centric perspective. Network perimeters have become increasingly porous and that perimeter defense cannot be as effective as it was before the evolution of bring your own device (BYOD) and cloud applications. Azure identity management and access control enable seamless, secure access to all your applications. +Identity is becoming the new boundary control plane for security, taking over that role from the traditional network-centric perspective. Network perimeters have become increasingly porous and that perimeter defense cannot be as effective as it was before the advent of bring your own device (BYOD) and cloud applications. Azure identity management and access control enable seamless, secure access to all your applications. A sample cloud-native policy for identity across cloud and on-premises directories, could include requirements like the following: diff --git a/docs/cloud-adoption/governance/security-baseline/compliance-processes.md b/docs/cloud-adoption/governance/security-baseline/compliance-processes.md index 309f524990e..14ff761f333 100644 --- a/docs/cloud-adoption/governance/security-baseline/compliance-processes.md +++ b/docs/cloud-adoption/governance/security-baseline/compliance-processes.md @@ -29,7 +29,7 @@ The best Security Baseline tools in the cloud are only as good as the processes **Quarterly review and planning:** On a quarterly basis perform a review of security audit data and incident reports to identify any changes required in security policy. As part of this process, review the current cybersecurity landscape to proactively anticipate emerging threats, and update policy as appropriate. After the review is complete, align design guidance with updated policy. -This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or evolving policy and risks related to security. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. +This planning process is also a good time to evaluate the current membership of your cloud governance team for knowledge gaps related to new or changing policy and risks related to security. Invite relevant IT staff to participate in reviews and planning as either temporary technical advisors or permanent members of your team. **Education and training:** On a bimonthly basis, offer training sessions to make sure IT staff and developers are up-to-date on the latest security policy requirements. As part of this process review and update any documentation, guidance, or other training assets to ensure they are in sync with the latest corporate policy statements. diff --git a/docs/cloud-adoption/governance/security-baseline/discipline-improvement.md b/docs/cloud-adoption/governance/security-baseline/discipline-improvement.md index 839bd4a093d..c0b19e306f4 100644 --- a/docs/cloud-adoption/governance/security-baseline/discipline-improvement.md +++ b/docs/cloud-adoption/governance/security-baseline/discipline-improvement.md @@ -21,7 +21,7 @@ This article outlines some potential tasks your company can engage in to better *Figure 1 - Adoption phases of the incremental approach to cloud governance.* -It's impossible for any one document to account for the requirements of all businesses. As such, this article outlines suggested minimum and potential example activities for each phase of the governance maturation process. The initial objective of these activities is to help you build a [Policy MVP](../journeys/index.md#an-incremental-approach-to-cloud-governance) and establish a framework for incremental policy evolution. Your cloud governance team will need to decide how much to invest in these activities to improve your Security Baseline governance capabilities. +It's impossible for any one document to account for the requirements of all businesses. As such, this article outlines suggested minimum and potential example activities for each phase of the governance maturation process. The initial objective of these activities is to help you build a [Policy MVP](../journeys/index.md#an-incremental-approach-to-cloud-governance) and establish a framework for incremental policy improvement. Your cloud governance team will need to decide how much to invest in these activities to improve your Security Baseline governance capabilities. > [!CAUTION] > Neither the minimum or potential activities outlined in this article are aligned to specific corporate policies or third-party compliance requirements. This guidance is designed to help facilitate the conversations that will lead to alignment of both requirements with a cloud governance model. diff --git a/docs/cloud-adoption/governance/security-baseline/policy-statements.md b/docs/cloud-adoption/governance/security-baseline/policy-statements.md index 66cb93e5979..c4022585892 100644 --- a/docs/cloud-adoption/governance/security-baseline/policy-statements.md +++ b/docs/cloud-adoption/governance/security-baseline/policy-statements.md @@ -91,7 +91,7 @@ Use the samples mentioned in this article as a starting point to develop policie To begin developing your own custom policy statements related to Security Baseline, download the [Security Baseline template](./template.md). -To accelerate adoption of this discipline, choose the [actionable governance journey](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. +To accelerate adoption of this discipline, choose the [actionable governance guide](../journeys/index.md) that most closely aligns with your environment. Then modify the design to incorporate your specific corporate policy decisions. > [!div class="nextstepaction"] -> [Actionable governance journeys](../journeys/index.md) +> [Actionable governance guides](../journeys/index.md) diff --git a/docs/cloud-adoption/includes/governance/business-risks.md b/docs/cloud-adoption/includes/governance/business-risks.md index 0c1dc6f6315..f95181486fd 100644 --- a/docs/cloud-adoption/includes/governance/business-risks.md +++ b/docs/cloud-adoption/includes/governance/business-risks.md @@ -3,7 +3,7 @@ ## Objective -The initial objective is to establish a foundation for governance agility. An effective Governance MVP allows the governance team to stay ahead of cloud adoption and implement guardrails as the adoption plan evolves. +The initial objective is to establish a foundation for governance agility. An effective Governance MVP allows the governance team to stay ahead of cloud adoption and implement guardrails as the adoption plan changes. ## Business risks diff --git a/docs/cloud-adoption/includes/governance/implementation-process.md b/docs/cloud-adoption/includes/governance/implementation-process.md index d6467775dcb..7afa0e41a37 100644 --- a/docs/cloud-adoption/includes/governance/implementation-process.md +++ b/docs/cloud-adoption/includes/governance/implementation-process.md @@ -8,12 +8,12 @@ The following decisions come from teams outside of the cloud governance team. Th ### Identity Baseline Identity Baseline is the fundamental starting point for all governance. Before attempting to apply governance, identity must be established. The established identity strategy will then be enforced by the governance solutions. -In this governance journey, the Identity Management team implements the **[Directory Synchronization](/azure/architecture/cloud-adoption/decision-guides/identity/overview#directory-synchronization)** pattern: +In this governance guide, the Identity Management team implements the **[Directory Synchronization](/azure/architecture/cloud-adoption/decision-guides/identity/overview#directory-synchronization)** pattern: - RBAC will be provided by Azure Active Directory (Azure AD), using the directory synchronization or "Same Sign-On" that was implemented during company’s migration to Office 365. For implementation guidance, see [Reference Architecture for Azure AD Integration](/azure/architecture/reference-architectures/identity/azure-ad). - The Azure AD tenant will also govern authentication and access for assets deployed to Azure. -In the governance MVP, the governance team will enforce application of the replicated tenant through subscription governance tooling, discussed later in this article. In future evolutions, the governance team could also enforce rich tooling in Azure AD to extend this capability. +In the governance MVP, the governance team will enforce application of the replicated tenant through subscription governance tooling, discussed later in this article. In future iterations, the governance team could also enforce rich tooling in Azure AD to extend this capability. ### Security Baseline: Networking @@ -41,7 +41,7 @@ At this point, a **[cloud-native pattern for encryption](/azure/architecture/clo The first decision to make regarding Deployment Acceleration is the pattern for enforcement. In this narrative, the governance team decided to implement the **[Automated Enforcement](/azure/architecture/cloud-adoption/decision-guides/policy-enforcement/overview#automated-enforcement)** pattern. -- Azure Security Center will be made available to the security and identity teams to monitor security risks. Both teams are also likely to use Security Center to identify new risks and evolve corporate policy. +- Azure Security Center will be made available to the security and identity teams to monitor security risks. Both teams are also likely to use Security Center to identify new risks and improve corporate policy. - RBAC is required in all subscriptions to govern authentication enforcement. - Azure Policy will be published to each management group and applied to all subscriptions. However, the level of policies being enforced will be very limited in this initial Governance MVP. - Although Azure management groups are being used, a relatively simple hierarchy is expected. @@ -51,8 +51,8 @@ The first decision to make regarding Deployment Acceleration is the pattern for The following decisions represent the patterns to be enforced through the policy enforcement strategy above: -**Identity Baseline**. Azure Blueprints will set RBAC requirements at a subscription level to ensure that consistent identity is configured for all subscriptions. +**Identity Baseline.** Azure Blueprints will set RBAC requirements at a subscription level to ensure that consistent identity is configured for all subscriptions. -**Security Baseline: Networking**. The cloud governance team maintains a Resource Manager template for establishing a VPN gateway between Azure and the on-premises VPN device. When an application team requires a VPN connection, the cloud governance team will apply the gateway Resource Manager template via Azure Blueprints. +**Security Baseline: Networking.** The cloud governance team maintains a Resource Manager template for establishing a VPN gateway between Azure and the on-premises VPN device. When an application team requires a VPN connection, the cloud governance team will apply the gateway Resource Manager template via Azure Blueprints. -**Security Baseline: Encryption**. At this point in the journey, no policy enforcement is required in this area. This will be revisited during later evolutions. \ No newline at end of file +**Security Baseline: Encryption.** At this point, no policy enforcement is required in this area. This will be revisited during later iterations. diff --git a/docs/cloud-adoption/includes/governance/policy-statements.md b/docs/cloud-adoption/includes/governance/policy-statements.md index f1edec7d9b5..f228e4221dc 100644 --- a/docs/cloud-adoption/includes/governance/policy-statements.md +++ b/docs/cloud-adoption/includes/governance/policy-statements.md @@ -36,5 +36,5 @@ Deployment Acceleration: No budget has been allocated for ongoing monitoring and enforcement of these governance policies. Because of that, the cloud governance team has some ad hoc ways to monitor adherence to policy statements. -- **Education:** The cloud governance team is investing time to educate the cloud adoption teams on the governance journeys that support these policies. -- **Deployment reviews:** Before deploying any asset, the cloud governance team will review the governance journey with the cloud adoption teams. +- **Education:** The cloud governance team is investing time to educate the cloud adoption teams on the governance guides that support these policies. +- **Deployment reviews:** Before deploying any asset, the cloud governance team will review the governance guide with the cloud adoption teams. diff --git a/docs/cloud-adoption/migrate/about.md b/docs/cloud-adoption/migrate/about.md index 79c379129b4..2b27b83aacd 100644 --- a/docs/cloud-adoption/migrate/about.md +++ b/docs/cloud-adoption/migrate/about.md @@ -18,7 +18,7 @@ Cloud migration is the process of moving existing digital assets into a cloud pl The guidance in this section of the Cloud Adoption Framework is designed for two purposes: -- Provide actionable migration guides that represent common experiences that customers often encounter. Each guide encapsulates the process and tools needed to be successful in a cloud migration effort. By necessity, the design guidance is specific to Azure. All other guidance in these journeys could be applied as part of a cloud-agnostic or multicloud approach. +- Provide actionable migration guides that represent common experiences that customers often encounter. Each guide encapsulates the process and tools needed to be successful in a cloud migration effort. By necessity, the design guidance is specific to Azure. All other recommendations in these guides could be applied as part of a cloud-agnostic or multicloud approach. - Help readers create personalized migration plans that can meet a variety of business needs, including migration to multiple public clouds, through detailed guidance on the development of processes, role and responsibilities, and change management controls. This content is intended for the cloud adoption team. It is also relevant to cloud architects that need to develop a strong foundation in cloud migration. diff --git a/docs/cloud-adoption/migrate/azure-best-practices/migrate-best-practices-costs.md b/docs/cloud-adoption/migrate/azure-best-practices/migrate-best-practices-costs.md index 5c8cc638822..635c9cba9fc 100644 --- a/docs/cloud-adoption/migrate/azure-best-practices/migrate-best-practices-costs.md +++ b/docs/cloud-adoption/migrate/azure-best-practices/migrate-best-practices-costs.md @@ -15,7 +15,7 @@ ms.subservice: migrate As you plan and design for migration, focusing on costs ensures the long-term success of your Azure migration. During a migration project, it's critical that all teams (such as finance, management, and application development teams) understand associated costs. - Before migration, estimating your migration spend, with a baseline for monthly, quarterly, and yearly budget targets is critical to success. -- After migration, you should optimize costs, continually monitor workloads, and plan for future usage patterns. Migrated resources might start out as one type of workload, but evolve into another type over time, based on usage, costs, and shifting business requirements. +- After migration, you should optimize costs, continually monitor workloads, and plan for future usage patterns. Migrated resources might start out as one type of workload, but shift to another type over time, based on usage, costs, and shifting business requirements. This article describes best practices for costing and sizing before and after migration. diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/assess.md b/docs/cloud-adoption/migrate/azure-migration-guide/assess.md index f1d5d1a68a8..e9b59beb50b 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/assess.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/assess.md @@ -8,7 +8,8 @@ ms.date: 08/08/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- # Assess the digital estate diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/assistance.md b/docs/cloud-adoption/migrate/azure-migration-guide/assistance.md index 73639c3ff0f..6408ff9753e 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/assistance.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/assistance.md @@ -8,7 +8,8 @@ ms.date: 04/04/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- ::: zone target="chromeless" diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/index.md b/docs/cloud-adoption/migrate/azure-migration-guide/index.md index 50c2711595c..c1ba6836a11 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/index.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/index.md @@ -8,7 +8,8 @@ ms.date: 04/04/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- ::: zone target="chromeless" diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/manage-costs.md b/docs/cloud-adoption/migrate/azure-migration-guide/manage-costs.md index b243ac03ffa..767861346b2 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/manage-costs.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/manage-costs.md @@ -2,13 +2,14 @@ title: Migration-focused cost control mechanisms titleSuffix: Microsoft Cloud Adoption Framework for Azure description: Learn how to set up budgets, payments, and understand invoices for your Azure resources. -author: dchimes -ms.author: kfollis +author: bandersmsft +ms.author: banders ms.date: 08/08/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Migration-focused cost control mechanisms @@ -65,7 +66,7 @@ The resulting estimate, pictured below, identifies the monthly costs of compute ## Additional resources - [Set up and review an assessment with Azure Migrate](/azure/migrate/tutorial-assess-vmware#set-up-an-assessment) -- For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management discipline](../../governance/cost-management/index.md) and the [Cost Management evolution in the large enterprise guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). +- For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management discipline](../../governance/cost-management/index.md) and the [Cost Management improvement in the large enterprise guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). # [Estimate and optimize VM costs during and after migration](#tab/EstimateOptimize) @@ -98,7 +99,7 @@ This analysis will allow you to review total costs, budget (if available), and a ## Additional resources -- For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management discipline](../../governance/cost-management/index.md) and the [Cost Management evolution in the large enterprise guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). +- For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management discipline](../../governance/cost-management/index.md) and the [incremental Cost Management improvement in the large enterprise guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). - For more information about Azure Advisor, see [Reducing service costs using Azure Advisor](/azure/advisor/advisor-cost-recommendations). - For more information about Azure Cost Management, see [Understand and work with scopes](/azure/cost-management/understand-work-scopes) and [Explore and analyze costs with Cost Analysis](/azure/cost-management/quick-acm-cost-analysis). @@ -136,4 +137,4 @@ For lower priority background processes, Batch offers a means of managing the ba ## Additional resources -For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management Discipline](../../governance/cost-management/index.md) and the [Cost Management evolution in the large enterprise Guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). +For a more comprehensive plan on cost management across larger numbers of assets (infrastructure, apps, and data), see the [Cloud Adoption Framework governance model](../../governance/journeys/index.md). In particular, guidance on the [Cost Management discipline](../../governance/cost-management/index.md) and the [incremental Cost Management improvements in the large enterprise governance guide](../../governance/journeys/large-enterprise/cost-management-evolution.md). diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/migrate.md b/docs/cloud-adoption/migrate/azure-migration-guide/migrate.md index f0991e5c132..d431a4ca0b8 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/migrate.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/migrate.md @@ -8,7 +8,8 @@ ms.date: 08/08/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- # Migrate assets (infrastructure, apps, and data) diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/optimize-and-transform.md b/docs/cloud-adoption/migrate/azure-migration-guide/optimize-and-transform.md index ea9d92944eb..e6033192260 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/optimize-and-transform.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/optimize-and-transform.md @@ -8,7 +8,8 @@ ms.date: 04/04/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- # Optimize and transform diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/organize-resources.md b/docs/cloud-adoption/migrate/azure-migration-guide/organize-resources.md index 82debd6f093..ccbef4dd8e9 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/organize-resources.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/organize-resources.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Organize your Azure resources diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/prerequisites.md b/docs/cloud-adoption/migrate/azure-migration-guide/prerequisites.md index e3634a4bfc1..959f401a106 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/prerequisites.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/prerequisites.md @@ -8,7 +8,8 @@ ms.date: 04/04/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- ::: zone target="chromeless" diff --git a/docs/cloud-adoption/migrate/azure-migration-guide/secure-and-manage.md b/docs/cloud-adoption/migrate/azure-migration-guide/secure-and-manage.md index b99f3926f1f..e42281e245d 100644 --- a/docs/cloud-adoption/migrate/azure-migration-guide/secure-and-manage.md +++ b/docs/cloud-adoption/migrate/azure-migration-guide/secure-and-manage.md @@ -8,7 +8,8 @@ ms.date: 04/04/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: migrate -ms.custom: fasttrack-new +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- # Secure and manage diff --git a/docs/cloud-adoption/migrate/migration-considerations/assess/release-iteration-backlog.md b/docs/cloud-adoption/migrate/migration-considerations/assess/release-iteration-backlog.md index cc85076104d..eee2403783f 100644 --- a/docs/cloud-adoption/migrate/migration-considerations/assess/release-iteration-backlog.md +++ b/docs/cloud-adoption/migrate/migration-considerations/assess/release-iteration-backlog.md @@ -22,7 +22,7 @@ A *release backlog* consists of a series of assets (VMs, databases, files, and a An *iteration backlog* is a list of the detailed work required to migrate a specific number of assets from the existing digital estate to the cloud. The entries on this list are often stored in an agile management tool, like Azure DevOps, as work items. -Prior to starting the first iteration, the cloud adoption team specifies an iteration duration, usually two to four weeks. This time box is important to create a start and finish time period for each set of committed activities. Maintaining consistent execution windows makes it easy to gauge velocity (pace of migration) and alignment to evolving business needs. +Prior to starting the first iteration, the cloud adoption team specifies an iteration duration, usually two to four weeks. This time box is important to create a start and finish time period for each set of committed activities. Maintaining consistent execution windows makes it easy to gauge velocity (pace of migration) and alignment to changing business needs. Prior to each iteration, the team reviews the release backlog, estimating the effort and priorities of assets to be migrated. It then commits to deliver a specific number of agreed-on migrations. After this is agreed to by the cloud adoption team, the list of activities becomes the *current iteration backlog*. diff --git a/docs/cloud-adoption/migrate/migration-considerations/index.md b/docs/cloud-adoption/migrate/migration-considerations/index.md index 6a1d8d97365..7adbadd3fd8 100644 --- a/docs/cloud-adoption/migrate/migration-considerations/index.md +++ b/docs/cloud-adoption/migrate/migration-considerations/index.md @@ -36,7 +36,7 @@ Cloud-native strategies and platform as a service (PaaS) strategies *rebuild* on > [!NOTE] > During the public preview of the Cloud Adoption Framework, this section of the framework emphasizes a rehost migration strategy. Although PaaS and SaaS solutions are discussed as alternatives when appropriate, the migration of virtual machine-based workloads using IaaS capabilities is the primary focus. > -> Other sections and future evolutions of this content will expand on other approaches. For a high-level discussion on expanding the scope of your migration to include more complicated migration strategies, see the article balancing the portfolio. +> Other sections and future iterations of this content will expand on other approaches. For a high-level discussion on expanding the scope of your migration to include more complicated migration strategies, see the article balancing the portfolio. ## Incremental migration diff --git a/docs/cloud-adoption/migrate/migration-considerations/optimize/business-change-plan.md b/docs/cloud-adoption/migrate/migration-considerations/optimize/business-change-plan.md index 8c6db585e2c..65cb599c9d1 100644 --- a/docs/cloud-adoption/migrate/migration-considerations/optimize/business-change-plan.md +++ b/docs/cloud-adoption/migrate/migration-considerations/optimize/business-change-plan.md @@ -18,7 +18,7 @@ Traditionally, IT has overseen the release of new workloads. During a major tran User adoption plans focus on how users will adopt a new technology or change to a given technology. This approach is time tested for introducing users to new tools. In a typical user adoption plan, IT focuses on the installation, configuration, maintenance, and training associated with the technical changes being introduced to the business environment. -Although approaches may vary, general themes are present in most user adoption plans. These themes are typically based on a risk control and facilitation approach that aligns to evolutionary change. The Eason Matrix, illustrated in the figure below, represents the drivers behind those themes across a spectrum of adoption types. +Although approaches may vary, general themes are present in most user adoption plans. These themes are typically based on a risk control and facilitation approach that aligns to incremental improvement. The Eason Matrix, illustrated in the figure below, represents the drivers behind those themes across a spectrum of adoption types. ![Eason Matrix of user adoption concerns](../../../_images/eason-matrix.gif) diff --git a/docs/cloud-adoption/migrate/migration-considerations/optimize/business-test.md b/docs/cloud-adoption/migrate/migration-considerations/optimize/business-test.md index f640f576163..d49a9be9483 100644 --- a/docs/cloud-adoption/migrate/migration-considerations/optimize/business-test.md +++ b/docs/cloud-adoption/migrate/migration-considerations/optimize/business-test.md @@ -23,7 +23,7 @@ The goal of business testing is to solicit validation from power users to certif ## Business activities during business testing -During business testing, the first evolution is manually driven directly with customers. This is the purest but most time-consuming form of feedback loop. +During business testing, the first iteration is manually driven directly with customers. This is the purest but most time-consuming form of feedback loop. - **Identify power users.** The business generally has a better understanding of the power users who are most affected by a technical change. - **Align and prepare power users.** Ensure that power users understand the business objectives, desired outcomes, and expected changes to business processes. Prepare them and their management structure for the testing process. diff --git a/docs/cloud-adoption/migrate/migration-considerations/prerequisites/culture-complexity.md b/docs/cloud-adoption/migrate/migration-considerations/prerequisites/culture-complexity.md index 5201cda2c40..e87b192b84b 100644 --- a/docs/cloud-adoption/migrate/migration-considerations/prerequisites/culture-complexity.md +++ b/docs/cloud-adoption/migrate/migration-considerations/prerequisites/culture-complexity.md @@ -24,7 +24,7 @@ In any migration, there are a few key functions that are best executed by the bu |---------|---------|---------| | Assess | Business goals | Define the desired business outcomes of the migration effort. | | Assess | Priorities | Ensure alignment with changing business priorities and market conditions. | -| Assess | Justification | Validate assumptions that drive evolving business justifications. | +| Assess | Justification | Validate assumptions that drive changing business justifications. | | Assess | Risk | Help the cloud adoption team understand the impact of tangible business risks. | | Assess | Approve | Review and approve the business impact of proposed architecture changes. | | Optimize | Change plan | Define a plan for consumption of change within the business, including periods of low activities and change freezes. | diff --git a/docs/cloud-adoption/operations/monitor/platform-overview.md b/docs/cloud-adoption/operations/monitor/platform-overview.md index 0c53384d459..c04f321ea11 100644 --- a/docs/cloud-adoption/operations/monitor/platform-overview.md +++ b/docs/cloud-adoption/operations/monitor/platform-overview.md @@ -2,7 +2,7 @@ title: Cloud monitoring guide – monitoring platforms overview titleSuffix: Microsoft Cloud Adoption Framework for Azure description: Choose when to use Azure Monitor or System Center Operations Manager in Microsoft Azure -author: MGoedtel +author: mgoedtel ms.author: magoedte ms.date: 07/31/2019 ms.topic: guide @@ -21,13 +21,13 @@ This article provides a high-level overview of our monitoring platforms to help ## Story of System Center Operations Manager -In 2000, we entered the operations management field with Microsoft Operations Manager (MOM) 2000. In 2007, we introduced a re-engineered version of the product named System Center Operations Manager. It moved beyond simple monitoring of a Windows server and concentrated on robust, end-to-end service and application monitoring, including heterogenous platforms, network devices, and other application or service dependencies. It's an established, enterprise-grade monitoring platform for on-premises environments, in the same class as IBM Tivoli or HP Operations Manager in the industry. It has evolved to support monitoring compute and platform resources running in Azure, Amazon Web Services (AWS), and other cloud providers. +In 2000, we entered the operations management field with Microsoft Operations Manager (MOM) 2000. In 2007, we introduced a re-engineered version of the product named System Center Operations Manager. It moved beyond simple monitoring of a Windows server and concentrated on robust, end-to-end service and application monitoring, including heterogenous platforms, network devices, and other application or service dependencies. It's an established, enterprise-grade monitoring platform for on-premises environments, in the same class as IBM Tivoli or HP Operations Manager in the industry. It has grown to support monitoring compute and platform resources running in Azure, Amazon Web Services (AWS), and other cloud providers. ## Story of Azure Monitor When Azure was released in 2010, monitoring of cloud services was provided with the Azure Diagnostics agent, which delivered a way to collect diagnostic data from Azure resources. This capability was considered a general monitoring tool vs an enterprise-class monitoring platform. -Application Insights was introduced to shift with changes in the industry where proliferation of cloud, mobile and IoT devices was growing and the introduction of DevOps practices. It evolved from Application Performance Monitoring in Operations Manager to a service in Azure, where it delivers rich monitoring of web applications written in a variety of languages. In 2015, the preview of Application Insights for Visual Studio was announced and later, it became known just as Application Insights. It collects details on application performance, requests and exceptions, and traces. +Application Insights was introduced to shift with changes in the industry where proliferation of cloud, mobile and IoT devices was growing and the introduction of DevOps practices. It grew from Application Performance Monitoring in Operations Manager to a service in Azure, where it delivers rich monitoring of web applications written in a variety of languages. In 2015, the preview of Application Insights for Visual Studio was announced and later, it became known just as Application Insights. It collects details on application performance, requests and exceptions, and traces. In 2015, Azure Operational Insights was made generally available. It delivered the Log Analytics analysis service that collected and searched data from machines in Azure, on-prem or other cloud environments, and connected to System Center Operations Manager. Intelligence packs were offered that delivered different pre-packaged management and monitoring configurations that contained a collection of query and analytic logic, visualizations, and data collection rules for such scenarios as security auditing, health assessments, and alert management. Later Azure Operational Insights became known as Log Analytics. @@ -35,23 +35,23 @@ In 2016, the preview of Azure Monitor was announced Ignite. It provided a common At Microsoft Ignite conference in 2018, we announced that the Azure Monitor brand expanded to include several different services originally developed with independent functionality: -* The original **Azure Monitor** functionality of collecting platform metrics, resource diagnostics logs, and activity logs for only Azure platform resources. -* **Application Insights** for application monitoring. -* **Log Analytics** as the primary location for collection and analysis of log data. -* A new **unified alerting service** that brought together alert mechanisms from each of the other services mentioned earlier. -* **Azure Network Watcher** to monitor, diagnose, and view metrics for resources in an Azure virtual network. +- The original **Azure Monitor** functionality of collecting platform metrics, resource diagnostics logs, and activity logs for only Azure platform resources. +- **Application Insights** for application monitoring. +- **Log Analytics** as the primary location for collection and analysis of log data. +- A new **unified alerting service** that brought together alert mechanisms from each of the other services mentioned earlier. +- **Azure Network Watcher** to monitor, diagnose, and view metrics for resources in an Azure virtual network. -## Story of Operations Management Suite (OMS) +## The story of Operations Management Suite (OMS) From 2015 until April 2018, Operations Management Suite (OMS) was a bundling of the following Azure management services for licensing purposes: -* Application Insights -* Azure Automation -* Azure Backup -* Operational Insights (later the rebranded Log Analytics) -* Site Recovery +- Application Insights +- Azure Automation +- Azure Backup +- Operational Insights (later the rebranded Log Analytics) +- Site Recovery -The functionality of the services that were part of OMS did not change when OMS was discontinued, they were realigned under Azure Monitor. +The functionality of the services that were part of OMS did not change when OMS was discontinued, they were realigned under Azure Monitor. ## Infrastructure requirements @@ -145,7 +145,7 @@ Operations Manager provides four basic ways to analyze data after it’s collect ### Azure Monitor -Azure Monitor has a powerful analytics engine that allows you to interactively work with log data and combine them with other monitoring data for trending and other data analysis. Views and dashboards allow you to visualize query data in different ways from the Azure portal, and import into Power BI. Monitoring solutions include queries and views to present the data they collect. Insights such as Application Insights, Azure Monitor for VMs, and Azure Monitor for containers include customized visualizations to support interactive monitoring scenarios. +Azure Monitor has a powerful analytics engine that allows you to interactively work with log data and combine them with other monitoring data for trending and other data analysis. Views and dashboards allow you to visualize query data in different ways from the Azure portal, and import into Power BI. Monitoring solutions include queries and views to present the data they collect. Insights such as Application Insights, Azure Monitor for VMs, and Azure Monitor for containers include customized visualizations to support interactive monitoring scenarios. ## Alerting @@ -179,7 +179,7 @@ Azure Monitor separates data collection from actions and analysis taken from tha Operations Manager implements all monitoring logic in a management pack, which you either create yourself or obtain from us or a partner. When you install a management pack, it automatically discovers components of the application or service on different agents, and deploys appropriate rules and monitors. The management pack contains health definitions, alert rules, performance and event collection rules, and views, to provide complete monitoring supporting the infrastructure service or application. -The Operations Manager SDK enables Operations Manager to integrate with third-party monitoring platforms or ITSM software. The SDK is also used by some partner management packs to support monitoring network devices, and deliver custom presentation experiences like the Squared Up HTML5 dashboard or integration with Office Visio. +The Operations Manager SDK enables Operations Manager to integrate with third-party monitoring platforms or ITSM software. The SDK is also used by some partner management packs to support monitoring network devices, and deliver custom presentation experiences like the Squared Up HTML5 dashboard or integration with Microsoft Office Visio. ### Azure Monitor diff --git a/docs/cloud-adoption/operations/operational-fitness-review.md b/docs/cloud-adoption/operations/operational-fitness-review.md index ae735f9b952..929c08e1762 100644 --- a/docs/cloud-adoption/operations/operational-fitness-review.md +++ b/docs/cloud-adoption/operations/operational-fitness-review.md @@ -40,7 +40,7 @@ During this process, the focus is often on the features of the service: the set The _nonfunctional_ requirements, in contrast, relate to properties such as the service's [availability](../../checklist/availability.md), [resiliency](../../resiliency/index.md), and [scalability](../../checklist/scalability.md). These properties differ from the functional requirements because they don't directly affect the final function of any particular feature in the service. However, nonfunctional requirements do relate to the performance and continuity of the service. -Some nonfunctional requirements can be specified in terms of a service-level agreement (SLA). For service continuity, as an example, an availability requirement for the service can be expressed as a percentage: "Available 99.99% of the time". Other nonfunctional requirements might be more difficult to define and might change as production needs evolve. For example, a consumer-oriented service might face unanticipated throughput requirements after a surge of popularity. +Some nonfunctional requirements can be specified in terms of a service-level agreement (SLA). For service continuity, as an example, an availability requirement for the service can be expressed as a percentage: "Available 99.99% of the time". Other nonfunctional requirements might be more difficult to define and might change as production needs change. For example, a consumer-oriented service might face unanticipated throughput requirements after a surge of popularity. > [!NOTE] > Requirements for resiliency are explored in more depth in [Designing reliable Azure applications](../../reliability/index.md#define-requirements). That article includes explanations of concepts like recovery-point objective (RPO), recovery-time objective (RTO), SLA, and others. diff --git a/docs/cloud-adoption/organization/cloud-governance.md b/docs/cloud-adoption/organization/cloud-governance.md index 9f60333a711..5449ea6bfc8 100644 --- a/docs/cloud-adoption/organization/cloud-governance.md +++ b/docs/cloud-adoption/organization/cloud-governance.md @@ -47,7 +47,7 @@ These tasks are usually executed by the cloud governance capability on a monthly - Understand [business risks](../governance/policy-compliance/risk-tolerance.md) introduced during each release - Represent the [business' tolerance for risk](../governance/policy-compliance/risk-tolerance.md) -- Aid in the evolution of [Policy and Compliance requirements](../governance/policy-compliance/overview.md) +- Aid in the incremental improvement of [Policy and Compliance requirements](../governance/policy-compliance/overview.md) ## Meeting cadence diff --git a/docs/cloud-adoption/organization/cloud-operations.md b/docs/cloud-adoption/organization/cloud-operations.md index a332f61742f..61d2109ca64 100644 --- a/docs/cloud-adoption/organization/cloud-operations.md +++ b/docs/cloud-adoption/organization/cloud-operations.md @@ -17,7 +17,7 @@ Business transformation may be enabled by cloud adoption. However, returns are o Traditional IT operations were required to focus on maintaining current-state operations for a wide variety of low-level technical assets. Things like storage, cpu, memory, network equipment, servers, and virtual machine hosts require continuous maintenance to maintain peek operations. Capital budgets often include large expenses related to annual or periodic updates to these low-level assets. - Human capital within operations would also focus heavily on the monitoring, repair, and remediation of issues related to these assets. In the cloud, many of these capital costs and operations activities are transferred to the cloud provider. This provides an opportunity for IT operations to evolve and provide significant additional value. + Human capital within operations would also focus heavily on the monitoring, repair, and remediation of issues related to these assets. In the cloud, many of these capital costs and operations activities are transferred to the cloud provider. This provides an opportunity for IT operations to improve and provide significant additional value. ## Possible sources for this capability @@ -37,21 +37,21 @@ The duties of the people providing cloud operations capability is to deliver max ### Strategic tasks -- Review [business outcomes](../business-strategy/business-outcomes/index.md), [financial models](../business-strategy/financial-models.md), [motivations for cloud adoption](../business-strategy/motivations-why-are-we-moving-to-the-cloud.md), [business risks](../governance/policy-compliance/risk-tolerance.md), and [rationalization of the digital estate](../digital-estate/overview.md) -- Determine workload criticality, impact of disruptions or performance degradation -- Establish business approved cost/performance commitments -- Monitor and operate cloud workloads +- Review [business outcomes](../business-strategy/business-outcomes/index.md), [financial models](../business-strategy/financial-models.md), [motivations for cloud adoption](../business-strategy/motivations-why-are-we-moving-to-the-cloud.md), [business risks](../governance/policy-compliance/risk-tolerance.md), and [rationalization of the digital estate](../digital-estate/overview.md). +- Determine workload criticality, impact of disruptions or performance degradation. +- Establish business approved cost/performance commitments. +- Monitor and operate cloud workloads. ### Technical tasks -- Maintain asset and workload inventory -- Monitor performance of workloads -- Maintain operational compliance -- Protect workloads and associated assets -- Recover assets in the case of performance degradation or business interruption -- Mature capabilities of core platforms -- Continuously improve workload performance -- Evolve budgetary and design requirements of workloads to fit commitments to the business +- Maintain asset and workload inventory. +- Monitor performance of workloads. +- Maintain operational compliance. +- Protect workloads and associated assets. +- Recover assets in the case of performance degradation or business interruption. +- Mature capabilities of core platforms. +- Continuously improve workload performance. +- Improve budgetary and design requirements of workloads to fit commitments to the business. ## Meeting cadence diff --git a/docs/cloud-adoption/organization/cloud-platform.md b/docs/cloud-adoption/organization/cloud-platform.md index 17de4c6cc5d..b2724539981 100644 --- a/docs/cloud-adoption/organization/cloud-platform.md +++ b/docs/cloud-adoption/organization/cloud-platform.md @@ -53,7 +53,7 @@ The following tasks are typically executed on a regular basis: - Build and maintain the cloud platform to support solutions. - Define and implement the platform architecture. - Operate and manage the cloud platform. -- Continuously evolve the platform. +- Continuously improve the platform. - Keep up with new innovations in the cloud platform. - Bring new cloud capabilities to support business value creation. - Suggest self-service solutions. diff --git a/docs/cloud-adoption/plan/adapt-roles-skills-processes.md b/docs/cloud-adoption/plan/adapt-roles-skills-processes.md index 6b795c3eef4..1d3a5bd3060 100644 --- a/docs/cloud-adoption/plan/adapt-roles-skills-processes.md +++ b/docs/cloud-adoption/plan/adapt-roles-skills-processes.md @@ -14,7 +14,7 @@ ms.subservice: plan At each phase of the IT industry's history, the most notable changes have often been marked by changes in staff roles. One example is the transition from mainframe computing to client/server computing. The role of the computer operator during this transition has largely disappeared, replaced by the system administrator role. When virtualization arrived, the requirement for individuals working with physical servers was replaced with a need for virtualization specialists. -Roles will likely change as institutions similarly shift to cloud computing. For example, datacenter specialists might be replaced with cloud administrators or cloud architects. In some cases, though IT job titles haven't changed, the daily work of these roles has evolved significantly. +Roles will likely change as institutions similarly shift to cloud computing. For example, datacenter specialists might be replaced with cloud administrators or cloud architects. In some cases, though IT job titles haven't changed, the daily work of these roles has changed significantly. IT staff members might feel anxious about their roles and positions because they realize that they need a different set of skills to support cloud solutions. But agile employees who explore and learn new cloud technologies shouldn't fear. They can lead the adoption of cloud services and help the organization learn and embrace the associated changes. diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/govern-org-compliance.md b/docs/cloud-adoption/ready/azure-readiness-guide/govern-org-compliance.md index ea9d568e802..e3478ff28ec 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/govern-org-compliance.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/govern-org-compliance.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Governance, security, and compliance in Azure diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/index.md b/docs/cloud-adoption/ready/azure-readiness-guide/index.md index 3faa418d521..c5c2143e00a 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/index.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/index.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Before you start diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/manage-access.md b/docs/cloud-adoption/ready/azure-readiness-guide/manage-access.md index 1890ab24d1f..f9cab4d9f4b 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/manage-access.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/manage-access.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Manage access to your Azure environment with role-based access controls diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/manage-costs.md b/docs/cloud-adoption/ready/azure-readiness-guide/manage-costs.md index 1f13ef13948..fca4fb19189 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/manage-costs.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/manage-costs.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Manage costs and billing for your Azure resources diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/migration-landing-zone.md b/docs/cloud-adoption/ready/azure-readiness-guide/migration-landing-zone.md index efbf145b058..6ad7d8f330a 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/migration-landing-zone.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/migration-landing-zone.md @@ -8,7 +8,7 @@ ms.date: 5/19/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit --- # Deploy a migration landing zone diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/monitoring-reporting.md b/docs/cloud-adoption/ready/azure-readiness-guide/monitoring-reporting.md index 8795bebf428..b787a1affd3 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/monitoring-reporting.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/monitoring-reporting.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Monitoring and reporting in Azure diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/organize-resources.md b/docs/cloud-adoption/ready/azure-readiness-guide/organize-resources.md index 0e78cf34f25..e27cebabdc1 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/organize-resources.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/organize-resources.md @@ -8,7 +8,8 @@ ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack-edit" +ms.custom: fasttrack-edit, AQC +ms.localizationpriority: high --- # Organize your Azure resources diff --git a/docs/cloud-adoption/ready/azure-readiness-guide/staying-current.md b/docs/cloud-adoption/ready/azure-readiness-guide/staying-current.md index 5cb8a8feb94..43f1b7fcf9a 100644 --- a/docs/cloud-adoption/ready/azure-readiness-guide/staying-current.md +++ b/docs/cloud-adoption/ready/azure-readiness-guide/staying-current.md @@ -1,19 +1,20 @@ --- title: Stay current with Azure in today's cloud cadence titleSuffix: Microsoft Cloud Adoption Framework for Azure -description: Learn how to stay current with Azure in today's cloud cadence. +description: Learn how to stay current and manage change with Azure in today's cloud cadence. author: jelledruyts ms.author: andym ms.date: 04/09/2019 ms.topic: conceptual ms.service: cloud-adoption-framework ms.subservice: ready -ms.custom: "fasttrack - new" +ms.custom: fasttrack-new, AQC +ms.localizationpriority: high --- -# Stay current with Azure +# Stay current with Microsoft Azure -Cloud services like Azure evolve at a faster pace than many organizations are used to. This pace of change means that organizations have to adapt people and processes to a new cadence. If you're responsible for helping your organization keep up with change, you might feel overwhelmed at times. The resources listed in this section can help you stay up to date. +Cloud platforms like Microsoft Azure change faster than many organizations are accustomed to. This pace of change means that organizations have to adapt people and processes to a new cadence. If you're responsible for helping your organization keep up with change, you might feel overwhelmed at times. The resources listed in this section can help you stay up to date. # [Top resources](#tab/TopResources) diff --git a/docs/cloud-adoption/ready/initial-org-alignment.md b/docs/cloud-adoption/ready/initial-org-alignment.md index e77b4cf2f37..74d7ee59507 100644 --- a/docs/cloud-adoption/ready/initial-org-alignment.md +++ b/docs/cloud-adoption/ready/initial-org-alignment.md @@ -96,7 +96,7 @@ Once the design of the solution is complete, the team moves on to the implementa ## Step 5: Adapt existing roles, skills, and process for the cloud -At each phase of the history of the IT industry, the most notable industry changes are often marked by changes in staff roles. During the transition from mainframes to the client/server model, the role of the computer operator largely disappeared, replaced by the system administrator. When the age of virtualization arrived, the requirement for individuals working with physical servers diminished, replaced with a need for virtualization specialists. Similarly, as institutions shift to cloud computing, roles will likely change again. For example, datacenter specialists might be replaced with cloud financial analysts. Even in cases where IT job titles have not changed, the daily work roles have evolved significantly. +At each phase of the history of the IT industry, the most notable industry changes are often marked by changes in staff roles. During the transition from mainframes to the client/server model, the role of the computer operator largely disappeared, replaced by the system administrator. When the age of virtualization arrived, the requirement for individuals working with physical servers diminished, replaced with a need for virtualization specialists. Similarly, as institutions shift to cloud computing, roles will likely change again. For example, datacenter specialists might be replaced with cloud financial analysts. Even in cases where IT job titles have not changed, the daily work roles have changed significantly. IT staff members may feel anxious about their roles and positions as they realize that a different set of skills is needed for the support of cloud solutions. But agile employees who explore and learn new cloud technologies don’t need to have that fear. They can lead the adoption of cloud services and help the organization understand and embrace the associated changes. diff --git a/docs/guide/technology-choices/compute-comparison.md b/docs/guide/technology-choices/compute-comparison.md index 8ff1cd0bc99..839bed48b10 100644 --- a/docs/guide/technology-choices/compute-comparison.md +++ b/docs/guide/technology-choices/compute-comparison.md @@ -56,8 +56,8 @@ Notes | Criteria | Virtual Machines | App Service | Service Fabric | Azure Functions | Azure Kubernetes Service | Container Instances | Azure Batch | |----------|-----------------|-------------|----------------|-----------------|-------------------------|----------------|-------------| | Autoscaling | Virtual machine scale sets | Built-in service | Virtual machine scale sets | Built-in service | Not supported | Not supported | N/A | -| Load balancer | Azure Load Balancer | Integrated | Azure Load Balancer | Integrated | Integrated | No built-in support | Azure Load Balancer | -| Scale limit1 | Platform image: 1000 nodes per VMSS, Custom image: 100 nodes per VMSS | 20 instances, 100 with App Service Environment | 100 nodes per VMSS | 200 instances per Function app | 100 nodes per cluster (default limit) |20 container groups per subscription (default limit). | 20 core limit (default limit). | +| Load balancer | Azure Load Balancer | Integrated | Azure Load Balancer | Integrated | Azure Load Balancer or Application Gateway | No built-in support | Azure Load Balancer | +| Scale limit1 | Platform image: 1000 nodes per scale set, Custom image: 100 nodes per scale set | 20 instances, 100 with App Service Environment | 100 nodes per scale set | 200 instances per Function app | 100 nodes per cluster (default limit) |20 container groups per subscription (default limit). | 20 core limit (default limit). | Notes diff --git a/docs/guide/technology-choices/images/load-balancing-decision-tree.png b/docs/guide/technology-choices/images/load-balancing-decision-tree.png new file mode 100644 index 00000000000..593b8271aea Binary files /dev/null and b/docs/guide/technology-choices/images/load-balancing-decision-tree.png differ diff --git a/docs/guide/technology-choices/load-balancing-overview.md b/docs/guide/technology-choices/load-balancing-overview.md new file mode 100644 index 00000000000..078cf19385c --- /dev/null +++ b/docs/guide/technology-choices/load-balancing-overview.md @@ -0,0 +1,82 @@ +--- +title: Overview of Azure load-balancing options +titleSuffix: Azure Application Architecture Guide +description: An overview of Azure load-balancing options. +author: sharad4u +ms.date: 08/23/2019 +ms.topic: guide +ms.service: architecture-center +ms.subservice: reference-architecture +ms.custom: seojan19 +--- + +# Overview of load-balancing options in Azure + +The term *load balancing* refers to the distribution of workloads across multiple computing resources. Load balancing aims to optimize resource use, maximize throughput, minimize response time, and avoid overloading any single resource. It can also improve availability by sharing a workload across redundant computing resources. + +## Overview + +Azure load balancing services can be categorized along two dimensions: global versus regional, and HTTP(S) versus non-HTTP(S). + +### Global versus regional + +- **Global** load-balancing services distribute traffic across regional backends, clouds, or hybrid on-premises services. These services route end-user traffic to the closest available backend. They also react to changes in service reliability or performance, in order to maximize availability and performance. You can think of them as systems that load balance between application stamps, endpoints, or scale-units hosted across different regions/geographies. + +- **Regional** load-balancing services distribute traffic within virtual networks across virtual machines (VMs) or zonal and zone-redundant service endpoints within a region. You can think of them as systems that load balance between VMs, containers, or clusters within a region in a virtual network. + +### HTTP(S) versus non-HTTP(S) + +- **HTTP(S)** load-balancing services are Layer 7 load balancers that only accept HTTP(S) traffic. They are intended for web applications or other HTTP(S) endpoints. They include features such as SSL offload, web application firewall, path-based load balancing, and session affinity. + +- **Non-HTTP/S** load-balancing services can handle non-HTTP(S) traffic and are recommended for non-web workloads. + +The following table summarizes the Azure load balancing services by these categories: + +| Service | Global/regional | Recommended traffic | +| ------- | --------------- | ------- | +| Azure Front Door | Global | HTTP(S) | +| Traffic Manager | Global | non-HTTP(S) | +| Application Gateway | Regional | HTTP(S) | +| Azure Load Balancer | Regional | non-HTTP(S) | + +## Azure load balancing services + +Here are the main load-balancing services currently available in Azure: + +[Front Door](/azure/frontdoor/front-door-overview) is an application delivery network that provides global load balancing and site acceleration service for web applications. It offers Layer 7 capabilities for your application like SSL offload, path-based routing, fast failover, caching, etc. to improve performance and high-availability of your applications. + +[Traffic Manager](/azure/traffic-manager/traffic-manager-overview) is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions, while providing high availability and responsiveness. Because Traffic Manager is a DNS-based load-balancing service, it load balances only at the domain level. For that reason, it can't fail over as quickly as Front Door, because of common challenges around DNS caching and systems not honoring DNS TTLs. + +[Application Gateway](/azure/application-gateway/overview) provides application delivery controller (ADC) as a service, offering various Layer 7 load-balancing capabilities. Use it to optimize web farm productivity by offloading CPU-intensive SSL termination to the gateway. + +[Azure Load Balancer](/azure/load-balancer/load-balancer-overview) is an integral part of the Azure SDN stack, providing high-performance, low-latency Layer 4 load-balancing services (inbound and outbound) for all UDP and TCP protocols. + +## Decision tree for load balancing in Azure + +When selecting the load-balancing options, here are some factors to consider: + +- **Traffic type**. Is it a web (HTTP/HTTPS) application? Is it public facing or a private application? +- **Global versus. regional**. Do you need to load balance VMs or containers within a virtual network, or load balance scale unit/deployments across regions, or both? +- **Availability**. What is the service [SLA](https://azure.microsoft.com/support/legal/sla/)? +- **Cost**. See [Azure pricing](https://azure.microsoft.com/pricing/). In addition to the cost of the service itself, consider the operations cost for managing a solution built on that service. +- **Features and limits**. What are the overall limitations of each service? See [Service limits](/azure/azure-subscription-service-limits). + +The following flowchart will help you to choose a load-balancing solution for your application. The flowchart guides you through a set of key decision criteria to reach a recommendation. + +**Treat this flowchart as a starting point.** Every application has unique requirements, so use the recommendation as a starting point. Then perform a more detailed evaluation. + +If your application consists of multiple workloads, evaluate each workload separately. A complete solution may incorporate two or more load-balancing solutions. + +![Decision tree for load balancing in Azure](./images/load-balancing-decision-tree.png) + +### Definitions + +- **Internet facing**. Applications that are publicly accessible from the internet. As a best practice, application owners apply restrictive access policies or protect the application by setting up offerings like web application firewall and DDoS protection. + +- **Global**. End users or clients are located beyond a small geographical area. For example, users across multiple continents, across countries within a continent, or even across multiple metropolitan areas within a larger country. + +- **PaaS**. Platform as a service (PaaS) services provide a managed hosting environment, where you can deploy your application without needing to manage VMs or networking resources. In this case, PaaS refers to services that provide integrated load balancing within a region. See [Choosing a compute service – Scalability](./compute-comparison.md#scalability). + +- **IaaS**. Infrastructure as a service (IaaS) is a computing option where you provision the VMs that you need, along with associated network and storage components. IaaS applications require internal load balancing within a virtual network, using Azure Load Balancer. + +- **Application-layer processing** refers to special routing within a virtual network. For example, path-based routing within the virtual network across VMs or virtual machine scale sets. For more information, see [When should we deploy an Application Gateway behind Front Door?](/azure/frontdoor/front-door-faq#when-should-we-deploy-an-application-gateway-behind-front-door). \ No newline at end of file diff --git a/docs/toc.yml b/docs/toc.yml index 65f9e61193f..db8ab5d13ea 100644 --- a/docs/toc.yml +++ b/docs/toc.yml @@ -46,14 +46,18 @@ items: href: guide/design-principles/design-for-evolution.md - name: Build for the needs of business href: guide/design-principles/build-for-business.md - - name: Choosing a compute service + - name: Technology choices items: - - name: Overview - href: guide/technology-choices/compute-overview.md - - name: Decision tree - href: guide/technology-choices/compute-decision-tree.md - - name: Compute comparison - href: guide/technology-choices/compute-comparison.md + - name: Choosing a compute service + items: + - name: Overview + href: guide/technology-choices/compute-overview.md + - name: Decision tree + href: guide/technology-choices/compute-decision-tree.md + - name: Compute comparison + href: guide/technology-choices/compute-comparison.md + - name: Choosing a load balancing service + href: guide/technology-choices/load-balancing-overview.md - name: Best Practices items: - name: API design