Everyone starts with Azure the same way: one subscription, everything thrown into a resource group called rg-teste, and the owner password circulating in the team chat. It works for a few months. Then the bill arrives, a security incident happens, or an auditor shows up—and the mess starts charging interest.
Azure governance is not enterprise bureaucracy. It is what separates the cloud you control from the cloud that controls you. Here are the practices worth the effort.
Get organized before inviting people in
A subscription is not a folder; it is a boundary. A boundary for billing, quotas, and policies. Before creating resources everywhere, design your management group hierarchy: one root group, with divisions underneath for environments (prod, non-prod) or business areas.
The real benefit comes from applying Azure Policy at the right level: prohibit regions outside your approved locations, require a tag on every resource, or block expensive SKUs once at the management group level, and have those rules inherited by everything below it. Fixing this resource by resource later is painful.
RBAC: less is more, always
Owner is the new root, and nobody should be walking around with root access. Azure RBAC is intentionally granular: use it.
Assign the weakest role that gets the job done. Someone who only reads metrics gets Reader. Someone who manages an app gets Contributor on that resource group, not on the entire subscription. Prefer Entra ID groups over assigning permissions to individuals; offboarding then means removing someone from a group instead of hunting down scattered permissions. For privileged access, enable PIM: instead of permanent Owner access, permissions are elevated on demand, for a limited period, with a justification. Fewer doors left open means fewer headaches.
A budget is not decoration: configure it before the surprise
Your Azure bill will not warn you that it is about to hurt. You have to ask.
Cost Management is free, and you are not using it. Create budgets per subscription or resource group, with alerts at 50%, 80%, and 100% of the forecast. Turn on anomaly alerts, which notify you when spending deviates from its usual pattern without requiring you to check a dashboard every day. Set aside thirty minutes each month to open Cost Analysis, group spending by tag, and find the VM that has been running unused since March. There is always one.
Managed services beat VMs almost every time
Every VM you provision is an operating system you have to patch, a disk you have to monitor, and a backup you hope was configured correctly. Scaling? That is your responsibility.
Before creating a Virtual Machine, ask whether a managed service would solve the problem. Use App Service or Container Apps instead of a VM running your backend. Use Azure SQL or PostgreSQL Flexible Server instead of a database you install and maintain yourself. You pay a little more per hour and save hours of operations work, while also getting patching, high availability, and one-click scaling. A VM is the last option, not the first.
Tags are the tax you pay with a smile
Tags seem like nitpicking until you open a five-figure bill and have no idea which project generated it.
Define a small set of required tags and treat them as a contract: owner, environment, costCenter, project. Do not rely on the team's goodwill: use Azure Policy to require the tag when a resource is created and even to inherit it from the resource group. With consistent tags, cost analysis, compliance reporting, and orphaned-resource cleanup become one-click filters instead of archaeology.
No clicking around in the portal: Bicep or Terraform
A resource created by clicking through the portal is a resource nobody knows how to recreate. It is a pet, not cattle.
Infrastructure is code. Use Bicep if you live in the Azure ecosystem and want something lightweight and native; use Terraform if you already have a multi-cloud setup or a team comfortable with HCL. The tool matters less than the rule: production changes go through a commit, a review, and a pipeline. That gives you a history of what changed, lets you replicate the entire environment in another region when needed, and prevents configuration surprises. The portal becomes a tool for reading, not writing.
Azure governance is not a six-month project. It is a handful of habits applied early. Do it now, with ten resources, and you will be grateful later when there are a thousand. Put it off, and it becomes debt with compound interest on your bill.