Azure governance enterprise at scale is a four-layer stack: identity and RBAC at the tenant level, management-group hierarchy for policy inheritance, Azure Policy and Blueprints for guardrails, and Azure Cost Management with budgets, tag policy, and showback / chargeback at the subscription level. Most enterprises have at least one layer correctly configured. Few have all four. The cost consequence: 12–22% of Azure spend on most tenants is governance-leakage — orphaned resources, unsized VMs, dev/test workloads running 24x7, untagged subscriptions that bypass chargeback, and Azure policies that fire after the resource is provisioned rather than blocking it at creation. Done together, the four-layer stack puts the controls in place to make every Azure optimisation lever — Savings Plans, AHB, lifecycle policies, networking rationalisation — sustainable rather than one-off.
Why azure governance enterprise spend goes sideways without it
Azure cost optimisation is two distinct disciplines. The first — the FinOps savings lever stack — gets the headlines: Reserved Instances, AHB, storage tiering, networking architecture. The second — governance — gets none, but determines whether the first compounds or evaporates. Without governance, every monthly savings initiative is fighting last month's untracked sprawl. We routinely audit tenants where the FinOps team has cut $4M of annual run rate in the last twelve months, while engineering teams have provisioned $3.2M of new untracked workloads in the same period. Net saving: $800K, on a budget that targeted $4M.
Layer 1 — identity and RBAC at the tenant
Every Azure governance posture starts with Azure RBAC and least-privilege role assignment. The two structural mistakes: subscription Owner rights granted to engineering teams (they can change everything, including policy), and global admin rights granted to procurement (they need read access, not write). The correct posture:
- Tenant root and management group roots: locked to a small Cloud CoE team with break-glass procedures.
- Subscription Owner: removed from all engineering teams; replaced with Contributor + Network Contributor scoped to the resource groups they own.
- Cost Management Reader: granted to finance, procurement, and FinOps roles.
- Reservation Purchaser: scoped to the FinOps team only, never engineering.
Layer 2 — management group hierarchy
Management groups are the inheritance plane for Azure Policy, RBAC, and tag rules. The enterprise pattern: a root management group, three or four production tiers below (Production, Pre-Production, Dev/Test, Sandbox), and subscriptions assigned by function within each tier. Policies attached at the root cascade to every subscription. The mistake: a flat subscription list with no management groups, which forces policy attachment per-subscription and creates drift the moment a new subscription is provisioned.
Layer 3 — Azure Policy and Blueprints
Azure Policy enforces guardrails at resource creation. The high-leverage policy set for cost governance:
- Allowed VM SKUs: deny B-series in Production, deny D and E v3 in any environment, force v5 generation defaults.
- Required tags: deny resource creation without CostCenter, Owner, Environment, and Application tags.
- Allowed regions: deny provisioning outside approved regions (stops the partner-team subscription that fires up Sweden Central by accident and incurs cross-region egress forever).
- Auto-shutdown for dev/test: enforce 7pm shutdown and 7am start on Dev/Test VMs.
- Public IP restrictions: deny public IPs on storage accounts, deny public network access on PaaS resources.
Each policy fires at create, not after the fact. A "audit-only" policy mode finds drift but does not prevent it. Switch to "deny" mode the moment the tenant is stable enough.
Azure Policy is free, but Microsoft does not market it heavily. The Azure portal default for a new policy is "audit", not "deny". The Cost Management dashboard does not show the dollar impact of policy violations. Microsoft would rather see your sprawl than your guardrails — sprawl drives consumption, guardrails reduce it. Every customer we audit who has not flipped policies to deny is paying for that bias.
Layer 4 — Cost Management, budgets, and chargeback
Cost Management is the visibility plane. The structural pattern:
- Budgets per subscription: alert at 50%, 80%, 100%; auto-scale-down or quarantine workloads at 110%.
- Showback dashboards per business unit, refreshed daily, attached to the cost-centre tag.
- Chargeback policy: business units pay for their consumption; finance gets the totals from the tag-based view.
- Anomaly detection: Cost Management's machine-learning detector finds the orphaned $80K Cosmos DB that nobody is using.
Without budgets and chargeback, engineering teams have no consumption discipline. The dollar always lands somewhere else — usually IT central — so the team that provisioned the resource has no incentive to right-size or tear down. The single most effective intervention we recommend: implement subscription-level chargeback within 90 days. We typically see 12–18% consumption reduction in the following quarter, with no other change.
Anonymised case study: $3.8M governance recovery
A retail enterprise on $26M annual Azure spend had FinOps mature on the savings-lever side (good RI portfolio, AHB applied, lifecycle policies) but no governance baseline. The audit found: 23% of resources untagged (so no chargeback possible), 14 production subscriptions with engineering Owner rights, 4,200 dev/test VMs running 24x7 with no auto-shutdown, no Allowed VM SKU policy (so partner teams were provisioning Premium SSD on every disk). Remediation: deployed the four-layer governance baseline over 14 weeks, enforced deny-mode policies after a 4-week audit-only soak, attached budgets to every subscription, stood up subscription-level chargeback. Annual run-rate cut: $3.8M, of which $2.1M was net-new from governance enforcement and $1.7M was from disciplined right-sizing that engineering teams now had a chargeback incentive to do.
The Microsoft Licensing Briefing — 3 minutes, every Friday
Independent analysis of Microsoft commercial moves, with implications for your EA and Azure commit. No vendor spin.
No spam. Unsubscribe any time.
Where to take this from here
Governance is the substrate every other Azure cost discipline rides on. Sequence the work: RBAC and management group cleanup first, then the policy set, then budgets and chargeback. Once the substrate is in place, every Azure optimisation programme — commitment design, networking rationalisation, storage cost optimisation — compounds rather than evaporates. For the broader picture, the complete Azure cost optimisation guide sequences governance with the savings-lever stack. For renewal leverage, the EA tier collapse playbook shows how a governed Azure footprint changes EA negotiation position. For end-to-end advisory including governance design, our Azure & MACC Advisory covers it. Request a discovery call to benchmark your governance maturity.