SAMPLE-AZ-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Azure Landing Zone and Cost Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
4 fictional Azure subscriptions: management structure, policy, access, networking, backup and cost, from administrator-supplied exports.
Executive summary
The environment works but has no management group structure, little policy enforcement and open management ports on a spoke network. Cost review found idle resources worth examining, though no saving is promised.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Management group and subscription tree | 4 subscriptions, 1 level | Provided |
| E-02 | Policy compliance export | 3 assignments | Provided |
| E-03 | Role assignment export | Subscription scope | Provided |
| E-04 | Network summary | 2 VNets, NSG rules | Provided |
| E-05 | Cost export, 3 months | All subscriptions | Provided |
| E-06 | Backup vault report | 1 vault | Provided |
What was not checked
- Workload application design
- Data plane access to storage and databases
- Defender for Cloud secure score detail
- Costs outside the 4 subscriptions
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | RDP and SSH reachable from the internet on 3 network security groups | E-04 | Remove direct exposure; use a managed access method such as a bastion service or just-in-time access. |
| F-02 | High | 11 users have Owner at subscription scope | E-03 | Microsoft recommends a maximum of three subscription owners. Reduce Owners, use groups and use narrower scopes or time-bound elevation. |
| F-03 | Medium | No management groups; policy assigned per subscription | E-01, E-02 | Introduce a simple hierarchy and assign policy at management group level. |
| F-04 | Medium | 9 unattached disks and 4 unused public IPs | E-05 | Confirm owners, snapshot if needed, then remove under change control. |
| F-05 | Medium | 2 VMs with no backup configured | E-06 | Protect them with the vault policy or document why not. |
| F-06 | Low | 38% of resources lack an owner tag | E-05 | Enforce the tag with policy in audit mode first. |
Fix first
- Remove internet exposure of management ports Effort: Medium.
- Reduce Owner assignments Effort: Low.
- Back up the 2 unprotected VMs Effort: Low.
- Confirm and clean up idle resources Effort: Low.
- Design management groups and policy Effort: High.
30/60/90-day plan
- First 30 days: Close management port exposure; reduce Owners; back up unprotected VMs.
- By 60 days: Confirm idle resources and remove under change control; start the tag standard in audit mode.
- By 90 days: Introduce management groups and move policy up; schedule a quarterly cost and access review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.