Question

A global manufacturing company is building out its Azure environment following the Cloud Adoption Framework enterprise-scale landing zone architecture. Multiple application teams need to provision their own subscriptions rapidly, but the security architect must ensure every new subscription automatically inherits network topology, Microsoft Defender for Cloud plans, diagnostic logging to a central Log Analytics workspace, and required policy guardrails without manual configuration by the platform team. Which approach best satisfies these requirements while enabling team autonomy?

Accepted Answer

Implement a subscription vending process that places new subscriptions into the appropriate management group hierarchy where Azure Policy assignments and policy initiatives enforce security baselines, Defender plans, and diagnostic settings through deployIfNotExists and modify effects

Answer

Grant each application team Owner rights at the tenant root management group so they can configure their own logging, Defender plans, and network peering as needed

Answer

Require each team to submit a service ticket to the platform team, who manually configures networking, Defender for Cloud, and diagnostic settings on every new subscription before handover

Answer

Deploy all workloads into a single shared subscription with resource groups per team, applying RBAC at the resource group level to isolate them