search

Azure / Enterprise-Scale

The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture
https://aka.ms/alz
MIT License
1.72k stars 980 forks source link

Possibility of deploying Trey Research reference twice in the same tenant #1763

Closed EstebanZ closed 2 months ago

EstebanZ commented 2 months ago

Hi,

I have a question about the possibility of deploying the Trey Research reference (https://github.com/Azure/Enterprise-Scale/blob/main/docs/reference/treyresearch/README.md) twice in the same Azure tenant.

Currently, I have one Trey Research implementation with specific customizations (three subscriptions: mgmt, connectivity, and identity). I would like to know if it is possible to perform a second deployment of this same reference in the same tenant without affecting tenant-level components.

Additionally, I have attached a diagram where the crossed-out components were not deployed

image

I would appreciate any guidance or additional documentation you can provide on this topic.

Thanks in advance.

mundayn commented 2 months ago

To the best of my knowledge, nothing is Tenant Level, or "Tenant Root Group" level, everything is that the "Intermediate root management group", in your scenario "Contoso".

So if you built "Contoso-New" under "Tenant Root Group", applied the new ESLZ to this, nothing would be impacted at the "Contoso" level.

EstebanZ commented 2 months ago

Thank you very much for your response. I understand that everything is managed at the intermediate root management group level, in this case, “Contoso”.

EstebanZ commented 2 months ago

Given that everything is managed at the intermediate root management group level (in this case, “Contoso”), I would like to understand at a high level how roles might be affected when deploying ESLZ. Specifically:

Roles: Are there any predefined roles that ESLZ deploys, and how do they interact with existing roles in the tenant? Could there be any potential conflicts or overlaps?

jtracey93 commented 2 months ago

As long as you chose a different root ID prefix, which im sure you will, you can deploy multiple times in the same tenant.

Everything from an ALZ perspective is stored at the intermediate root management group level, even our custom roles.