Azure Discount Voucher Professional Azure Multi Subscription Setup

Why Your Azure Setup Looks Like a Toddler’s LEGO Bin

Let’s be honest: your current Azure environment probably resembles a shared Google Doc edited by seven people during a caffeine crash—subscriptions named dev-test-prod-legacy-2, resource groups titled "maybe-delete-later", and a single Global Admin who hasn’t slept since March 2023. You’re not alone. Most Azure deployments start with one subscription, then spiral into five, then twelve, then existential dread when Finance emails you asking why Subscription-Alpha-Phoenix-Backup-2 just burned $8,432 on idle VMs.

The Multi-Subscription Mindset Shift

Forget ‘multi-subscription’ as a technical checkbox. It’s a governance philosophy—like choosing between living in one sprawling, unzoned city versus building three distinct, code-compliant towns with separate mayors, budgets, and fire departments. Each subscription is a trust boundary, a billing container, and a policy enforcement zone. Not a folder. Not a tag. A hard boundary.

When You *Actually* Need More Than One

Here’s the litmus test: if you can’t answer “Yes” to all three, stop creating subscriptions:

• Do you need separate billing, forecasting, or chargeback? (e.g., Marketing owns its own spend; Engineering doesn’t subsidize HR’s Power BI workspaces)
• Do you require strict isolation for compliance or risk? (e.g., PCI workloads must never share a subscription with dev/test)
• Do you have distinct teams with zero operational overlap and zero need to share resources? (Spoiler: most don’t. Shared services? Use resource groups + RBAC + private endpoints—not new subs)

Creating a subscription for every microservice? That’s not architecture—that’s tax fraud against your own sanity.

The Goldilocks Subscription Model (Not Too Few, Not Too Many)

Based on 17 real Azure migrations (and 3 post-mortems involving coffee-stained war rooms), here’s what works:

🌱 The Foundation Tier (Mandatory)

• Management Subscription: Houses Azure AD, Entra ID, Policy definitions, Management Groups, and Log Analytics workspaces for cross-subscription telemetry. No apps. No VMs. Just governance plumbing.
• Connectivity Subscription: Virtual WAN, ExpressRoute circuits, DNS Private Zones, and Azure Firewall policies. Zero app resources. Firewalls don’t host web apps—they protect them.

🏢 The Workload Tiers (Context-Driven)

• Production: One per major business unit (e.g., prod-finance, prod-crm). Tagged, budgeted, with auto-shutdown for non-business hours.
• Non-Production: One per environment (dev, test, staging)—but not one per team. Devs share dev-core; QA owns test-integration. Why? Because policy inheritance scales better than permission sprawl.
• Shared Services: Dedicated sub for Key Vault, API Management, and centralized monitoring tools. Access via private endpoints + RBAC—not cross-subscription resource linking.

Azure Discount Voucher Total? Usually 5–9 subscriptions. Not 27. If you’re at 15+, audit ruthlessly. Chances are, 60% are ghosts haunting your Cost Analysis report.

The Three Pillars of Multi-Sub Sanity

Azure Discount Voucher 🔑 Identity & Access: RBAC Is Your First Line of Defense (Not Your Last)

Assign roles at the subscription level only for true platform-wide needs (e.g., Owner on Management sub for Cloud Architects). Everything else? Use resource group scope. Why? Because Contributor on a subscription lets someone delete your entire prod-finance network. Contributor on rg-prod-finance-app? They can deploy—but not nuke DNS or jump to another RG.

Pro tip: Create custom roles. Instead of giving Network Contributor, build Network DNS Manager with Microsoft.Network/dnsZones/* but no Microsoft.Network/virtualNetworks/*. Precision beats blanket permissions every time.

💰 Cost Control: Budgets That Actually Scream When You’re About to Blow It

Azure Budgets aren’t optional—they’re your financial seatbelt. But default alerts? Useless. Set three tiers:

• Soft Alert (75%): Slack message to team lead + weekly digest email
• Hard Alert (95%): SMS to on-call engineer + auto-suspend non-critical VMs (via Logic App + Runbook)
• Red Alert (100%): Block all Microsoft.Compute/virtualMachines/write operations until finance approves exception

And tag everything—even your tags need tags. Use CostCenter, Environment, Team, and BusinessImpact. Then run this weekly:

az costmanagement query create --timeframe MonthToDate \
  --dataset 'columns=["tags","cost"]' \
  --filters '{"tags":{"CostCenter":"FIN-202"}}'

If your finance team can’t map spend to org charts, you’ve failed governance.

🛡️ Policy & Compliance: Automate the Boring, Brutal Stuff

Manual compliance checks are like hand-washing every car in a dealership. Use Azure Policy:

• Enforce encryption-at-rest on all Storage Accounts (built-in policy Storage accounts should use customer-managed keys)
• Block public blob access with Storage accounts should restrict network access
• Mandate naming conventions using RegEx (e.g., ^rg-[a-z]+-[a-z0-9]{3}-[dev|test|prod]$)

Deploy policies at the Management Group level—not per subscription. One policy definition, infinite inheritance. Bonus: assign Deny mode for critical rules (no exceptions!), and Modify for auto-tagging (so that rogue dev’s my-first-vm becomes vm-devops-tools-001).

Terraform? Yes. But Don’t Let It Become Your Single Point of Failure

You’ll use Terraform. You’ll love it. Then you’ll accidentally terraform destroy the wrong state file and weep softly into your laptop fan. Mitigate:

• Separate state files per subscription (never one monorepo state)
• Remote backend with locking (Azure Storage + SAS token)
• Pre-apply plan diffs posted to Slack channel #infra-changes—with human approval required for prod changes

Sample snippet for subscription-level tagging (yes, subscriptions can be tagged):

resource "azurerm_subscription_policy_assignment" "tagging" {
  name                 = "enforce-subscription-tags"
  policy_definition_id = data.azurerm_policy_definition.tag_enforcement.id
  subscription_id      = azurerm_subscription.prod_finance.id
  parameters           = jsonencode({
    tagName = { value = "CostCenter" }
    tagValue = { value = "FIN-202" }
  })
}

The Pitfalls That Will Haunt Your Dreams

• The Cross-Subscription Resource Trap: Don’t let a VM in dev reach a Key Vault in shared-services via public endpoint. Use private endpoints + VNet peering. Public = vulnerable + slow + billed.
• The “I’ll Clean This Up Later” Subscription: That subscription-temp-migration-2023? It’s still there. Still running. Still costing $147/month in idle SQL databases. Schedule quarterly “subscription archaeology” sprints.
• The Over-Permissioned Service Principal: A CI/CD pipeline with Owner on prod? That’s not DevOps—it’s Russian roulette with your production DB.

Final Thought: Subscriptions Aren’t Legos. They’re Load-Bearing Walls.

You wouldn’t frame a house with duct tape and hope. Don’t treat subscriptions as disposable scaffolding. Design them once—with input from Finance, Security, and Legal—not as an afterthought during sprint planning. Audit quarterly. Prune ruthlessly. And when someone asks, “Can we just spin up another sub for this POC?”—reply with: “Show me the billing owner, the compliance waiver, and the sunset date.” Then watch them walk away slowly, muttering about Kubernetes.

Your future self—calm, caffeinated, and un-billed—will thank you.