India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Azure Monitor, Policy & Cost Governance Services
Azure monitoring and governance is the combination of Azure Monitor, Log Analytics and Application Insights for observability, with Management Groups, Azure Policy and Cost Management for control over how subscriptions are structured, configured and paid for. NTSPL designs these for Indian enterprises whose Azure estate has grown faster than their ability to see who owns what, what it costs and when it breaks.
Microsoft Azure services in scope
The Problem Management Groups and Azure Policy Solve
An Azure estate that started with one subscription for a pilot tends to reach 30 or 40 within three years, each created by a different project, with Owner rights given to vendors, no tags, diagnostics switched off and cost reports that finance cannot map to any business unit. Monitoring follows the same pattern: some teams use classic alerts, others export to a third-party tool, and nobody gets paged when an API's p95 latency doubles. The result is unexplained cost growth of 25 to 40 percent a year and incidents found by customers first.
NTSPL fixes the structure before the dashboards. We design a management group hierarchy aligned to how the business is governed, assign Azure Policy initiatives that enforce tagging, allowed regions and diagnostic settings at that scope, and rebuild Cost Management around budgets and allocation rules per cost owner. Observability is then standardized: Azure Monitor Agent with data collection rules, a small number of Log Analytics workspaces with deliberate table plans, and Application Insights on every customer-facing application.
When Your Azure Estate Needs Management Groups, Policy and Azure Monitor (and When It Does Not)
Signals that point to monitoring & governance on Microsoft Azure
- You have more than 15 subscriptions and no management group hierarchy beyond the tenant root.
- Over 30 percent of monthly Azure spend cannot be attributed to a cost owner by tag or subscription.
- Azure spend has grown more than 25 percent year on year without a matching growth in workloads.
- Incidents are reported by customers or business users before any alert fires.
- Log Analytics ingestion costs have overtaken the cost of the VMs being monitored for some workloads.
- An audit asked for evidence that resources are restricted to Indian regions and that diagnostic logging is enabled.
When a different approach is better
- If you run a single subscription with fewer than 50 resources, a full management group and policy framework is overhead; use resource groups, a handful of built-in policies and one budget.
- If your organization has already standardized on Datadog, Dynatrace or New Relic across clouds with mature dashboards, do not rebuild in Azure Monitor; forward Azure metrics and logs to that tool and keep Azure Monitor for platform alerts and activity logs.
- For multi-cloud cost reporting across AWS, Google Cloud and Azure with unit economics, Cost Management alone is limited; pair FOCUS-format exports with a dedicated FinOps platform or Microsoft Fabric reporting.
Azure Governance and Observability Stack: Management Groups, Azure Policy, Cost Management, Azure Monitor and Application Insights
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Management Groups | Organize subscriptions into a hierarchy up to six levels deep below the root, so RBAC, Azure Policy and budgets are inherited by every subscription beneath a node. | You have more than 5 subscriptions or need different guardrails for production, non-production, sandbox and regulated workloads. |
| Azure Policy | Evaluates resources against rules with audit, deny, append, modify and deployIfNotExists effects, and remediates existing resources through managed-identity remediation tasks. | Teams keep deploying untagged, public or out-of-region resources after being told not to. |
| Microsoft Cost Management and Budgets | Analyses consumption by subscription, resource group and tag, applies cost allocation rules and tag inheritance, and fires budget and anomaly alerts at set thresholds. | Finance cannot map the monthly Azure invoice to business units, or overspend is discovered only when the invoice arrives. |
| Azure Monitor and Log Analytics | Collects platform metrics, activity and resource logs and guest telemetry through Azure Monitor Agent and data collection rules into Log Analytics workspaces for KQL queries, alerts and workbooks. | Alerts are inconsistent across teams, or you still rely on the retired Log Analytics agent or ad-hoc scripts. |
| Application Insights | Workspace-based APM that captures requests, dependencies, exceptions and distributed traces via OpenTelemetry-based instrumentation for .NET, Java, Node.js and Python apps. | You cannot tell whether a slow page is caused by code, the database, a third-party API or the network. |
| Azure Advisor | Produces cost, reliability, security, performance and operational excellence recommendations with an Advisor score, including right-sizing and reservation purchase suggestions. | You want a prioritized, continuously updated list of idle and oversized resources without building your own analysis. |
Management-group-scoped governance with central observability
Management-group-scoped governance with central observability
Subscriptions sit under platform, landing-zone and sandbox management groups, where inherited Azure Policy assignments enforce tags, regions and diagnostic settings and Cost Management budgets alert each cost owner. Telemetry from resources and applications flows through data collection rules and Application Insights into regional Log Analytics workspaces, which drive alert rules, action groups and workbooks for operations and finance.
Select any component
Management-group-scoped governance with central observability: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Governance Engineering Decisions: Hierarchy Depth, Policy Effects, Workspace Topology and Cost Allocation
Management group depth and shape
Model management groups on how policy differs, not on the org chart. Production versus non-production, regulated versus general, and sandbox are real policy boundaries; business units usually are not, so represent them with tags and subscriptions. Keep the hierarchy to three or four levels even though six are allowed, because deep trees make policy inheritance and exemptions hard to reason about. Create a Decommissioned group with deny-all policy for subscriptions being retired.
Policy effect rollout
Assign every new initiative in audit mode first and review compliance for 2 to 3 weeks; a deny policy that blocks a pipeline at month-end is how governance programmes lose sponsorship. Then switch to deny for preventive rules such as allowed locations and public network access, and use modify or deployIfNotExists with remediation tasks for tags and diagnostic settings. Track exemptions with an expiry date and owner, and review them monthly.
Log Analytics workspace topology
Fewer workspaces are easier to query and cheaper with commitment tiers. A practical pattern is one workspace per region for production and one for non-production, with resource-context RBAC so application teams see only their resources. Separate workspaces are justified for Sentinel when security wants different retention, or for data that regulators require kept apart. Avoid per-application workspaces; they fragment cross-service queries and prevent commitment-tier discounts.
Table plans and retention
Ingestion is the main monitoring cost. Keep tables used by alerts and frequent troubleshooting, such as AppRequests, Perf and Heartbeat, on the Analytics plan with 30 to 90 days interactive retention. Move verbose diagnostic tables such as storage, firewall and container logs to Basic or Auxiliary plans with longer long-term retention. Filter at the DCR with transformations so unused columns and noise never land. Set a daily cap alert at 120 percent of the 30-day average.
Cost allocation model
Decide early between showback and chargeback. Showback is enough until business units have budgets they own. For chargeback, tag every resource with CostCentre, use tag inheritance to fill gaps, and allocate shared platform costs (hub firewall, ExpressRoute, monitoring, backup) using cost allocation rules proportional to each unit's direct spend. Publish a monthly report from Cost Management exports in FOCUS format so finance can reconcile against the invoice.
How NTSPL Brings 40 Ungoverned Azure Subscriptions Under Management Groups and Policy
Estate inventory and ownership mapping
Export all subscriptions, role assignments, tags and 6 months of cost data, then assign a business owner and cost centre to each subscription with finance.
Management group build and subscription move
Create the hierarchy, move subscriptions into place in batches, and replace subscription-level Owner assignments with group-based RBAC at management-group scope.
Policy in audit, then enforce
Assign tagging, location, diagnostic and security initiatives in audit mode, review compliance for 2 to 3 weeks, then switch to deny or remediate with tracked exemptions.
Cost allocation and budgets
Enable tag inheritance, configure allocation rules for shared platform costs, create budgets per cost owner and schedule FOCUS exports for finance.
Telemetry standardization
Deploy Azure Monitor Agent and data collection rules through policy, consolidate workspaces, set table plans and enable Application Insights on customer-facing apps.
Alert baseline and monthly review cadence
Apply recommended alert rules and dynamic thresholds, wire action groups to the ITSM tool, and start a monthly Advisor and budget review with owners.
What you receive
Guardrails That Stick: Policy Exemptions, RBAC at Management-Group Scope and Monitoring Data Access
Governance is itself a security control, so its own weak points matter: excessive Owner rights at management-group scope, policy exemptions that never expire, and monitoring data that exposes sensitive fields to too many readers. NTSPL limits who can change policy and hierarchy, logs every exemption with an owner and expiry, and applies resource-context and table-level RBAC in Log Analytics so application teams cannot read security or other units' data.
- Management-group Owner and Resource Policy Contributor restricted to a platform team via PIM
- Policy exemptions with mandatory expiry date and justification, reviewed monthly
- Resource-context RBAC and table-level access in Log Analytics to separate team and security data
- DCR transformations that drop or mask personal data fields before ingestion, supporting DPDP Act minimization
- Activity log alerts on policy assignment deletion and management group changes
Paying for Visibility: Log Analytics Ingestion, Table Plans, Budgets and Advisor Savings
Monitoring cost is driven mainly by Log Analytics ingestion per GB and retention beyond included periods, plus Application Insights data volume, alert rule evaluations and availability tests. Governance tools such as Azure Policy, management groups, Cost Management and Advisor carry no direct charge for Azure resources. The savings come from what governance enables: right-sizing, shutdown schedules, reservations and removing orphaned disks and IPs.
- Basic or Auxiliary table plans for verbose diagnostics, Analytics plan only for alerting tables
- Log Analytics commitment tier once average daily ingestion is consistently above the first tier
- Adaptive sampling in Application Insights for high-volume APIs, keeping full capture for errors
- Advisor right-sizing and reservation recommendations reviewed monthly with owners
- Policy-driven auto-shutdown and deletion of orphaned disks and public IPs in non-production
Azure Monitor vs Datadog or Grafana: what should monitor an Azure-first estate?
Use four criteria. Estate mix: if 80 percent or more of workloads are on Azure, Azure Monitor and Application Insights collect platform metrics and logs natively without agents or API polling, and integrate with Azure Policy for coverage enforcement. Multi-cloud: if AWS or Google Cloud carry significant load, a cross-cloud tool such as Datadog gives one view, while Azure Monitor remains the source for activity logs and service health. Cost model: Azure Monitor bills on ingestion and retention, Datadog per host and per feature, so large VM fleets with low log volumes often cost less on Azure Monitor. Dashboards: Azure Managed Grafana can sit on top of Azure Monitor if teams prefer Grafana visuals. For most Azure-first Indian enterprises, Azure Monitor plus Managed Grafana is the sensible default.
Key facts about monitoring & governance on Microsoft Azure
Monitoring & Governance on Microsoft Azure in Practice
3 monitoring & governance scenarios from IT services, Multi-specialty hospital group, Publishing and digital media: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
IT services firm brings 43 Azure subscriptions under one policy hierarchy
Hospital group gives each unit ownership of its Azure bill with chargeback
Publishing house traces slow page loads to one dependency with Application Insights
Three directories become one: identity consolidation after two acquisitions
Asset manager evidences SEBI CSCRF controls from one Azure security stack
3PL operator cuts warehouse system recovery time from 2 days to 45 minutes
Ground-handling firm moves 14 .NET apps from IIS servers to App Service
FMCG manufacturer moves 180 Hyper-V VMs to Azure ahead of a host refresh
Monitoring & Governance on Microsoft Azure: Frequently Asked Questions
Do Azure Policy, management groups and Cost Management cost extra?
No direct charge applies for Azure Policy on Azure resources, management groups, Cost Management analysis and budgets, or Azure Advisor. Costs arise from what policies deploy, such as diagnostic settings sending logs to Log Analytics, and from Azure Policy guest configuration on Arc-enabled servers. NTSPL estimates the ingestion cost created by diagnostic policies before assigning them.
Why is our Log Analytics bill so high, and how do we reduce it?
Usually because verbose diagnostic tables, such as storage, firewall, AKS container logs or SQL audit, land on the Analytics plan with no filtering. Run the workspace usage workbook to find the top tables, move those not used for alerting to Basic or Auxiliary plans, filter with DCR transformations, and adopt a commitment tier. Reductions of 30 to 50 percent are typical without losing alerting coverage.
How do we move existing subscriptions under management groups without breaking things?
Moving a subscription between management groups does not move or restart resources, but it changes inherited RBAC and policy. Before moving, compare the policy assignments at the source and target, run new policies in audit mode, and check that no pipeline service principal loses rights inherited from the old scope. NTSPL moves subscriptions in batches of 5 to 10 with a rollback plan.
Can we restrict all deployments to Indian Azure regions?
Yes. Assign the built-in Allowed locations and Allowed locations for resource groups policies at the root or landing-zone management group, listing Central India, South India and West India plus global, for services such as Front Door and DNS that are not regional. This gives auditable evidence for data residency commitments under the DPDP Act and sector regulators such as RBI, SEBI and IRDAI.
We still use the old Log Analytics agent. What should we do?
Migrate to Azure Monitor Agent with data collection rules. The legacy Log Analytics agent was retired in August 2024 and no longer receives support. Use the AMA migration helper workbook to inventory agents, create DCRs that replicate your current collection, deploy AMA via Azure Policy, validate data parity for a week, then remove the old agent and workspace configuration.
How do we give each business unit ownership of its Azure costs?
Map every subscription or resource group to a cost centre, enforce a CostCentre tag with Azure Policy and tag inheritance, and allocate shared platform costs with Cost Management allocation rules. Then create budgets per cost owner with forecast alerts and give each owner Cost Management Reader on their scope. Monthly FOCUS exports let finance reconcile chargeback against the invoice.