How would you govern a large Azure estate across many subscriptions?

Question

Accepted Answer

I govern it structurally rather than resource by resource. First, structure: organize all the subscriptions under a management group hierarchy, typically by environment and business unit, so policy and RBAC set high up inherit down consistently, and Azure supports up to 6 levels of management groups below the root, which is plenty. Second, guardrails with Azure Policy. Instead of hoping teams comply, I apply policies at the management group level that audit or outright deny non-compliant resources: 2 or 3 allowed regions only, required tags like cost centre and owner, no public IP addresses, encryption required, enforced automatically across every subscription. Third, standardize provisioning with Azure Landing Zones, the Cloud Adoption Framework blueprint, so every new subscription is created from a consistent, secure baseline with networking, identity, logging and policy already wired in, rather than each team building from scratch and drifting. Fourth, identity: RBAC with least privilege assigned to groups, and crucially Privileged Identity Management for admin access, so high-privilege roles are not standing grants but just-in-time, time-bound, typically 8 hours with approval and MFA, which shrinks the standing-admin attack surface dramatically. I would also centralize logging and turn on Microsoft Defender for Cloud for posture management. The theme is the same as any large-cloud governance: hierarchy, automated guardrails, standardized baselines, and least-privilege just-in-time identity, not manual per-resource control.

Answer

What does Azure Policy give you that RBAC does not?

RBAC controls who can do actions; Azure Policy controls what configurations are allowed (deny/audit non-compliant resources, like disallowed regions or missing encryption), regardless of who has access. They are complementary guardrails.

Answer

What problem does PIM (Privileged Identity Management) solve?

Standing admin access is a large attack surface. PIM makes privileged roles just-in-time, time-bound, and approval-gated, so admins elevate only when needed and access expires, reducing risk and improving auditability.

How would you govern a large Azure estate across many subscriptions?

How would you govern a large Azure estate across many subscriptions?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with azure

Knowing the answer is not the same as recalling it under pressure