The Scenario
Contoso Holdings — Enterprise Overview
- 3 Business Units: Retail, Finance, Healthcare
- 5,000 employees across USA, UK, and Germany
- Acquisition: Fabrikam Corp (500 employees, separate Entra ID tenant) — must integrate within 6 months
- Compliance: PCI-DSS for Finance BU, HIPAA for Healthcare BU, GDPR for all EU data
- Current state: Flat subscription model (one sub per team), no management groups, no PIM, basic Conditional Access
- Goals: Unified identity, per-BU governance guardrails, least-privilege access, centralized audit
Decision 1 — Management Group Hierarchy
Rationale
- Each BU gets its own MG for scoped policy assignment (PCI initiative on Finance, HIPAA on Healthcare).
- Shared Services MG hosts networking hub, DNS, monitoring — policies inherited from parent but no BU-specific compliance.
- Sandbox MG with relaxed policies for dev/test; deny production data via policy.
- Acquisition MG isolates Fabrikam resources during integration; move subscriptions to BU MGs post-migration.
- Max depth = 3 levels (root → Contoso → BU) — keeps inheritance simple.
Decision 2 — Subscription Topology
| Management Group | Subscriptions | Purpose |
|---|---|---|
| Shared Services | sub-connectivity, sub-management | Hub VNet, Firewall, Log Analytics, Defender for Cloud |
| Retail | sub-retail-prod, sub-retail-dev | E-commerce workloads |
| Finance | sub-finance-prod, sub-finance-dev | PCI-scoped workloads only |
| Healthcare | sub-health-prod, sub-health-dev | PHI workloads, HIPAA controls |
| Acquisition | sub-fabrikam-landing | Temporary home for migrated Fabrikam resources |
| Sandbox | sub-sandbox | Experimentation, budget-capped |
Key rule: Prod & dev separated per BU so dev never inherits production compliance overhead unnecessarily — but still inherits BU-level tagging policies.
Decision 3 — Identity & Cross-Tenant Access
Design Choices
- Cross-Tenant Access Settings — configure inbound trust so Fabrikam users access Contoso resources without re-creating accounts (B2B direct connect).
- Entra ID PIM — all Global Admin, Subscription Owner, and Key Vault Admin roles require activation with justification + 4-hour max window.
- Conditional Access per BU:
- Finance — require compliant device + phishing-resistant MFA + block non-US locations.
- Healthcare — require managed device + session sign-in frequency 1 hour for PHI apps.
- Retail — standard MFA + risk-based sign-in policy.
- Long-term plan: Migrate Fabrikam identities into Contoso tenant (cross-tenant sync → full migration) within 6 months; retire Fabrikam tenant.
Decision 4 — Policy & Tagging
| Scope | Policy Initiative | Key Policies |
|---|---|---|
| Contoso MG (all) | Baseline Security | Require tags (BU, Environment, CostCenter), deny public IP on VMs, enable Defender |
| Finance MG | PCI-DSS v4 | Encrypt at rest (CMK), enable NSG flow logs, deny storage without private endpoint |
| Healthcare MG | HIPAA/HITRUST | Audit diagnostic settings, enforce TLS 1.2, deny non-encrypted SQL |
| Sandbox MG | Cost Control | Allowed VM SKUs (B-series only), deny premium storage, budget alert |
Tagging Taxonomy
BU— Retail | Finance | Healthcare | SharedEnvironment— prod | dev | sandboxCostCenter— mapped to internal finance codesDataClassification— Public | Internal | Confidential | RestrictedComplianceScope— PCI | HIPAA | GDPR | None
Decision 5 — Monitoring Architecture
- Centralized Log Analytics workspace in Shared Services subscription for security logs, Azure AD sign-in/audit, and Defender for Cloud.
- Per-BU workspaces for application-level diagnostics — keeps HIPAA/PCI data within compliance boundary and controls access via workspace-level RBAC.
- Azure Monitor Data Collection Rules route VM/platform metrics to the correct workspace based on subscription tags.
- Sentinel connected to the central workspace for unified SIEM; BU workspaces linked as additional data sources.
Why hybrid? A single workspace simplifies correlation but creates compliance risk (PCI auditors can see HIPAA data). Workspace-level RBAC + resource-context access gives the best balance.
Architecture Summary
| Area | Decision | Rationale |
|---|---|---|
| MG Hierarchy | 3-level: Root → Contoso → BU/Shared/Sandbox/Acquisition | Scoped policy, simple inheritance |
| Subscriptions | Prod + Dev per BU, shared connectivity/management, landing zone for acquisition | Blast-radius isolation, compliance scoping |
| Identity | Cross-tenant access + B2B → eventual full migration; PIM for all privileged roles | Least privilege, smooth acquisition path |
| Policy | Baseline at top MG, compliance initiatives at BU MGs | Enforce guardrails without over-constraining dev |
| Monitoring | Central security workspace + per-BU app workspaces + Sentinel | Unified SIEM, compliance data separation |
Practice Questions — Contoso Scenario
Q1: Where should the PCI-DSS policy initiative be assigned?
Assign at the Finance MG to cover both prod and dev subscriptions. Tenant Root is too broad; subscription-only misses dev resources that still need compliance; RG-level is unmanageable.
Q2: What is the recommended approach for Fabrikam users to access Contoso resources during integration?
Cross-Tenant Access Settings allow Fabrikam users to authenticate with their home tenant and access Contoso resources — no account duplication or third-party IdP needed.
Q3: Why use separate Log Analytics workspaces for Healthcare and Finance instead of one central workspace?
Separate workspaces enforce data isolation so PCI auditors cannot see HIPAA-protected data and vice versa. Sentinel CAN ingest from multiple workspaces.
Q4: Which PIM configuration best fits the Contoso scenario for Global Admin?
Global Admin is the highest-risk role — JIT activation with justification, approval, and short duration (4 hours) applies least-privilege principles.
Q5: After full migration, what happens to the Fabrikam MG and tenant?
Post-migration, Fabrikam subscriptions move under the correct BU management groups. The separate tenant is decommissioned — Azure does not support "merging" tenants natively.