General Azure Subscription access best practices for development team

Question

Hi, We are moving more and more to Azure resources but are still in the beginning stages. We have a few architects and Devops folks that now Azure and how to setup resources, costs, etc

We are looking at setting up some of our developers to use a "Sandbox Subscription" where they can create resources that will evetually be used in some CI/CD pipelines (ADO). We are easily able to delete resources periodically (all resources groups or subsets) in this subscription.

We are wanting to prevent developers from spinning up large expensive resources that are costly.

What are some of the best practices related to this? I know we can setup a budget and alert on different thresholds and we can remove things nightly.

Are there any other things that might help constrain their resource selections? Can this be done as policy on the subscription?

thanks in advance.

Answer 1

@Lance Lyons - Thanks for reaching out to us.

There are several best practices that you can follow in order for you to prevent developers from spinning up expensive resources.

• You can try setting some resource quotas using azure policy where you can set limits on the number and types of resources that can be created by each developer.
• You can use azure tags to track the cost of resources by project or team, making it easier to identify the areas of excessive spending.
• Encourage developers to use cost-optimized instance types when creating resources.
• You can probably configure billing alerts in the portal when the cost of a particular resource exceeds a set threshold.
• Also provide developers with regular reports on their resource usage and cost, to help them make informed decisions about resource usage.

Hope this helps. and please feel free to reach out if you have any further questions.

---

If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.