d
Contents
Design Decisions
Design Decision 1.5‑1 – Naming Standards. 9
Introduction
Overview
To achieve successful cloud adoption, it is vital to set in place a solid foundation to support both traditional Infrastructure as a Service (IaaS) and cloud native services (PaaS etc) in a secure, well governed, and manageable landing zone.
Aligned to Microsoft’s Cloud Adoption Framework, our solution is built upon Terraform, a multi-cloud ready base that sets any organisation up for the future.
BEDRRR Documents
This section details the various documents that are used within a BEDRRR Enterprise design phase:
- Solution Design
- Naming Standards
- Design Decision Register
- Micro-Design
- BEDRRR Pre-Requisites
While each document is a standalone document it is referenced throughout the Solution Design document to detail out the holistic Azure Foundations capability.
Solution Design
The purpose of the design document and the related micro-design is to capture and present decisions made during design workshops between LAB³ and ABCXX to provide a comprehensive guide for the design and deployment of BEDRRR Enterprise.
It will detail the platform design, constraints, and dependencies, as well as provide detailed descriptions of the components that comprise BEDRRR Enterprise in addition to any agreed exclusions or action items needing to be performed by ABCXX.
Acceptance of the design documents by ABCXX is a pre-requisite to commencing build.
Naming Standards (this document)
The naming standards document covers the default standards that will be used for Department of Climate Change, Energy, the Environment and Water’s BEDRRR Enterprise.
These naming standards are backed by code, whilst minor changes can be accommodated any variation will require review and agreement by [Company] prior to commencing build.
Design Decision Register
The purpose of the Design Decision Register is to facilitate easier management of design decisions and capture important information against each including who approved the decision and when. A separate design decision register is used to record the outcome of workshops and meetings during the design stage of the engagement and contextualise those decisions within the Solution Design document.
Micro-design
Whilst the solution design provides the contextual design of your BEDRRR Enterprise deployment, the micro-design records the specific parameters that will be used to deploy BEDRRR Enterprise for ABCXX.
BEDRRR Pre-Requisites
The BEDRRR Enterprise Pre-Requisites document outlines the required steps that need to be performed and services/technology that needs to be available for the successful deployment and build of BEDRRR Enterprise and the ABCXX Azure Foundations.
It is of utmost importance that the pre-requisites listed in this document are acknowledged and provided, otherwise the start of the build phase will stop until these are completed which will result in a delay in project deliverables.
Related Documents Register
Document | Document Name |
BEDRRR Pre-Requisites | LAYYY-DCC-4389 – D10 – BEDRRR Prerequisites |
Design Decisions Register | LAYYY-DCC-4389 – D10 – BEDRRR Design Register |
Micro-design | LAYYY-DCC-4389 – D10 – BEDRRR Micro Design |
Naming Standards | LAYYY-DCC-4389 – D10 – BEDRRR Naming Standards |
Table 1.2‑1 – Related Documents
Target Audience
The target audience includes:
- [Company] Solution Consultants
- ABCXXkey stakeholders
- ABCXXengineers and other technical resources
Document Conventions
Sections of the design document that relate to design decisions made by ABCXX during workshops and/or directly feed into the deployment of BEDRRR Enterprise as configuration items will have the following table completed to allow for easy cross-reference to the other design artefacts (design decision register and micro-design).
DDR | References to the detailed design register used to capture requirements during workshops. |
MD | References to worksheets within the micro-design that contain detailed information about the resources to be deployed. |
The following tables are used to highlight important information or activities above and beyond the general design document content.
Recommendation | |
These are recommendations made by LAYYY |
Action Required | |
This indicates ABCXX needs to take some action. |
Note | |
Notes are used to refer to other sections in the document or to draw attention to an important concept within the relevant section |
Example | |
An example is used to help illustrate a concept. |
Design Decision | |
This is a design decision that was made as a result of workshops that will be used as input into deployment. |
Terminology / Glossary
Term | Definition |
Landscape | A Landscape is a grouping of environments that share a set of common controls. It allows for a baseline to be applied to all environments at a broader scope and with less granularity than an Environment. For example, you can baseline access or alerting for production landscapes and further refine at the environment level. BEDRRR has a fixed Landscape Model comprising of: · Production · Non-production · Sandbox The number and naming of environments within a landscape is dynamic. |
Figure 1.5‑1 – Glossary
Naming Standards
DDR | MGT-GO-01: Are there any variations to the BEDRRR naming standards? |
MD | n/a |
Rationale | BEDRRR naming standards aligned to Microsoft CAF recommendations |
It is important to name resources within Azure with a consistent and predictable pattern.
Management of resources within the Azure platform is greatly simplified when key pieces of information that describe the resource are listed in the name of the resource itself. A comprehensive naming standard will allow administrators to identify a resources’ location, classification, purpose, and system it belongs to all by glancing at the name of the resource.
Additionally, resource names in most cloud systems are often consumed by external tool sets (such as command line utilities, or cloud management tools like DataDog etc.), and a well-defined naming standard ensures that the resources are also identifiable when viewed from outside the context of Azure’s native platform.
There are some special cases within Azure where there are restrictions on the naming of resources, such as disallowed special characters or a maximum character length. In these circumstances, the name of the resource may not fit exactly within the parameters of the convention.
Some Azure resources such as key vaults or storage accounts require the name to be globally unique across all of Azure. The naming convention should also accommodate this restriction to ensure that a duplicate resource in another subscription or region will not clash with an existing globally unique resource name.
The key characteristics of a mature naming standard are:
- It allows resources to be easily identifiable by human eyes.
- It accommodates naming restrictions enforced by the platform.
- It is programmatically accessible.
- It is predictable and follows a logical pattern.
- It is repeatable.
- It is searchable.
- It is scalable.
Design Decision | |
ABCXX to align to the LAB³ naming standards with no variation. |
Design Decision 1.5‑1 – Naming Standards
Action Required | |
ABCXX must review the naming standards as defined in this document as sign-off is required prior to build. The naming standard and conventions detailed in this document act as a set of guiding principles for the naming of Azure resources. LAB³ will adopt these principals for the names of resource during the BEDRRR Enterprise deployment, however this is not to be considered a comprehensive or definitive naming standard policy. ABCXX will need to create, maintain, and enforce their own internal naming standard policy that caters for the unique requirements of the organisation and Azure platform consumers. |
Action Required 1.5‑1 – Naming Standards
Naming Conventions
A naming convention defines the repeatable pattern used to generate the names of management groups, subscriptions, resource groups and resources, and is specifically crafted to achieve the objectives outlined in the naming standard.
The following rules are shared across all Azure objects:
- Names must be lower case
- Spaces and special characters are not allowed – except for hyphens
- Where possible, kebab-case should be used. Hyphens can be removed for services where only alphanumeric characters are allowed (such as storage accounts)
- Each segment should be a recognisable name or abbreviation in your organisation.
This convention simplifies management from command line or automation tool chains and makes it easier to visually identify ambiguous characters that are placed next to each other, such as “i” (Indigo) and “l” (Lima), “o” (Oscar) and zero etc.
The names of resources are comprised of multiple sections of metadata that provide key pieces of information to assist in the unique identification of the resource, it is type, location, and purpose.
This is an example of the name of a regional resource (a resource group) that has been created using the naming convention.
Resource Identifier | Region identifier | Landscape Identifier | Environment Identifier | Classification Identifier | Operating Zone | Descriptor | Sequence Number | Generated Name |
RG | AUE | PR | R | S | I | mktg-appn | 01 | rg-aue-prrsi-mktg-appn-01 |
Table 1.5‑1 – Naming Conventions
Information about a resource may vary depending on the resource type, therefor there are variations on the sections of metadata that make up the resource name across different resource types, however there is consistency between all resources of the same type.
For example, there is no need to incorporate the metadata of a resource’s region, if it is a global resource such as an Azure subscription or a resource such as Traffic Manager.
Globally deployed resources often have additional restrictions over regionally deployed resources, such as their names may need to be unique across all of Azure, not just a region or subscription. The unique requirements of global resources are explained in the Restrictions and Constraints section of this document.
Resource Identifiers
Resource identifiers are a 1-4-character prefix prepended to every resource to allow resources to be easily grouped, filtered, and identified within a large list of mixed resources. Each resource type has its own unique prefix.
A list of suggested example resource identifiers is provided in the Regional Resource Examples section of this document.
Example | |
Consider the following resource: · vnet-aue-prrsi-mktg-appn-01 The prefixed characters VNET represent that this is a virtual network resource. |
Example 1.5‑1 – Resource Identifiers
Region Identifiers
Region identifiers are a 3-character short code that represents the region in which the resource is deployed. Each region has its own unique short code.
The following table demonstrates an example list of suggested region identifiers:
Term | Definition |
Australia East | aue |
Australia Southeast | aus |
Table 1.5‑2 – Region Identifiers
Example | |
Consider the following resource: · agw-aue-prrsi-mktg-appn-01 The characters aue represent that this resource is deployed within the Australia East region |
Example 1.5‑2 – Region Identifiers
Landscape Identifiers
Landscape identifiers are a 2-character short code that represents the landscape in which the resource resides. Each landscape has its own unique short code.
The following table lists the supported landscape identifiers.
Term | Definition |
Production | pr |
Non-Production | np |
Sandbox | sb |
Table 1.5‑3 – Landscape Identifiers
Example | |
Consider the following resource: · agw-aue-prrsi-mktg-appn-01 The characters pr indicate that this resource is deployed within the production environment |
Example 1.5‑3 – Landscape Identifiers
Environment Identifiers
Environment identifiers are a 1-character short code that represents the environment in which the resource resides. Each environment has its own unique short code.
Note | |
The letter “l” is reserved to represent a landscape-level resource and cannot be used to represent an environment. An example of a landscape-level resource in BEDRRR is a Key Vault deployed by the platform into a non-production application subscription, and shared between all application environments within the non-production landscape. |
The following table demonstrates an example list of suggested environment identifiers.
Term | Definition |
Production | p |
Pre-Production | r |
Quality Assurance | q |
User Acceptance Testing | u |
Testing | t |
Development | d |
Innovation | x |
Proof of Concept | c |
Table 1.5‑4 – Environment Identifiers
Example | |
Consider the following resource: · agw-aue-prpsi-mktg-appn-01 The character p indicates that this resource is deployed within the production environment. |
Example 1.5‑4 – Environment Identifiers
Classification Identifiers
Classification identifiers are a 1-character short code that represents the classification regarding the hub and spoke model. Each classification has its own unique short code.
The following table demonstrates an example list of suggested classification identifiers.
Classification | Identifier |
Core | c |
Spoke | s |
Table 1.5‑5 – Classification Identifiers
Example | |
Consider the following resource: · agw-aue-prpsi-mktg-appn-01 The character s indicates that this resource is deployed with the spoke resource classification |
Example 1.5‑5 – Classification Identifiers
Operating Zone Identifiers
Operating zone identifiers are a 1-character short code that represents the operating zone with reference to the resources network exposure. Each operating zone has its own unique short code.
Note | |
BEDRRR support of any other operating zone other than “internal” is depreciated. All new deployments of BEDRRR are limited to “internal” operating zone only. |
The following table demonstrates the available operating zone identifiers.
Operating Zone | Identifier |
Internal | i |
Table 1.5‑6 – Operating Zone Identifiers
Example | |
Consider the following resource: · agw-aue-prpsi-mktg-appn-01 The character i indicates that this resource is deployed with internal network exposure |
Example 1.5‑6 – Operating Zone Identifiers
Resource Descriptors
The descriptor segment is freeform text and does not need to consist of a selection of predefined values. The descriptor also serves to provide a short description about the resource that can help locate a specific resource amongst a large grouping of similar resources.
Information commonly included within the unique identifier are ownership information, application names, service names or purpose. These suggestions are entirely optional, and the values should be selected based on what resonates with the resource owner.
The length of the unique identifier is dependent on the maximum length restrictions imposed by the platform for each resource type.
Example | |
Consider the following resource: · agw-aue-prpsi-mktg-appn-01 The characters mktg-appn indicates that this resource is owned by the marketing team and relates to “appn” |
Example 1.5‑7 – Resource Descriptors
Sequence Numbers
Sequence numbers are a 2-digit suffix appended to every resource used to provide uniqueness to resources that share the same preceding identifiers.
Example | |
Consider the following resource: · agw-aue-prpsi-accounts-appn-01 The digits 01 represent the resources sequence number. If a resource of the same name exists, the sequence number can be incremented until the resource name is completely unique |
Example 1.5‑8 – Sequence Numbers
Organisation Identifiers
When creating resources that have a global uniqueness requirement, the naming convention is altered slightly in the following ways:
- Regional identifiers are removed as they are redundant on global resources.
- An organisation identifier is added to ensure global uniqueness compared to other Microsoft customers that may implement the same naming standard.
An organisation identifier is a 3-character short code that represents the name of the organisation that owns the resource and is necessary to add uniqueness to globally deployed resources.
Example | |
Consider the following Azure Front Door resource. · afd-dcc-prpsi-mktg-appn-01 The characters dcc represent the organisation identifier |
Example 1.5‑9 – Organisation Identifiers
Unique Identifiers
To prevent naming collisions with other resources within the same environment, the name of each resource must be unique when compared to other resources of the same type. The naming convention achieves this with the combination of multiple naming segments, which we refer to as the unique identifier.
The combination of the landscape, environment, classification, operating zone, descriptor, and sequence number provides confidence that the name of the resource will be unique across all environments and regions.
Example | |
Consider the following regional resource: · agw-aue-prpsi-mktg-appn-01 The characters prpsi-mkgtg-appn-01 represent the unique identifier of this resource |
Example 1.5‑10 – Unique Identifiers
Restrictions and Constraints
There are some resources within Azure that have more restrictive naming requirements imposed upon them.
One example is Storage Accounts, which must be globally unique, all lower case, contain no special characters and is restricted to a maximum length of 24 characters.
The outcome of the restrictions is that the names of the resources may not directly conform to the pattern of the naming convention, it is important to have consistency in the way that these restrictions are handled. They must still follow a pattern and meet the outcomes set forth by the naming standard.
Global Resource Namespaces
Microsoft Azure has multiple services that may be deployed either regionally or globally that provide an endpoint in a Microsoft provided domain namespace. Some examples of these services are Azure Function Apps, Azure Storage Accounts, Azure Front Door or Azure CDN.
All Azure services that consume these endpoints must be globally unique across all other Microsoft customers consuming the same resource type.
The namespace of a global resource is often derived from the name of the resource instance, and therefore the global resource naming limitations are inherited on the name of the resource itself.
When deployed, this global namespace must not already exist.
Example | |
Consider the following Azure Function App: · fa-aue-dcc-npdse-mktg-appn-01 Azure Function Apps are provisioned with an endpoint on the azurewebsites.net domain hosted by Microsoft. The resultant global namespace would be: · fa-aue-dcc-npdse-mktg-appn-01.azurewebsites.net |
Example 1.5‑11 – Global Resource Namespaces
Storage Accounts
Azure storage accounts are another type of global resource. Storage accounts are deployed with an endpoint in the core.windows.net global namespace. All global resources restrictions apply to storage accounts, in addition to the following resource name restrictions:
- must be all lower case.
- contain only numbers (0-9), letters (a-z, A-Z).
- must be less than 24 characters in length.
With all restrictions on storage accounts are considered, it is not possible for this resource type to adhere to the naming convention of other resource types and is considered a special case.
If the limitations on resource names result in the name needing to deviate from the convention, it is important that that it deviates consistently.
The name of storage accounts uses the same identifiers as other resource types to aligns with the standardised convention as closely as possible.
Region Identifier (3) | Organisation Identifier (3) | Unique Identifier (3) | Class/Zone Identifier (2) | Descriptor (<=9) | Sequence (2) | Resultant Name (<=24) |
AUE | DCC | PRP | SI | APPNDIAG | 01 | auedccprpsiappndiag01 |
Table 1.5‑7 – Storage Accounts
Key Vaults
Azure key vaults are also a global resource type. Key vaults are deployed with an endpoint in the vault.azure.net global namespace.
All global resources restrictions apply to key vaults, in addition to the following resource name restrictions:
- contain only numbers (0-9), letters (a-z, A-Z), and hyphens (-).
- must be less than 24 characters in length.
Just like storage accounts, it is not possible for this resource type to adhere to the naming convention of all other resource types.
The name of the key vaults uses the same identifiers as other resource types to align with the standardised convention as closely as possible.
To maximize the available key space to describe the resource, the resource identifier, and hyphens have been removed from the naming structure.
Region Identifier (3) | Organisation Identifier (3) | Unique Identifier (3) | Class/Zone Identifier (2) | Descriptor (<=9) | Sequence (2) | Resultant Name (<=24) |
AUE | DCC | PRP | SI | MKTGAPPN | 01 | auedccprpsimktgappn01 |
Table 1.5‑8 – Key Vaults
Virtual Machines
The character limit on virtual machine resources is 64 characters, however the hostname of the operating system being deployed on the virtual machine will inherit the resources name. On Microsoft Windows, the hostname is restricted to 15 characters.
To preserve consistency between operating system hostnames and virtual machine resource name, the hostname length limitation is also applied name of the virtual machine resource.
The following table demonstrates an example list of suggested resource operating system prefixes:
Operating System | Prefix |
Windows | w |
Linux | l |
Table 1.5‑9 – Virtual Machines
Example | |
Consider the following virtual machine: · wauemktgappn01 The character w represents the operating system type. The characters aue represent the region in which this resource is deployed. The characters mktgappn01 represent the resource’s unique identifier. |
Example 1.5‑12 – Virtual Machines
Network Interfaces
Network interfaces are tightly coupled with virtual machine resources. and inherit the virtual machine’s name within the name of the network interface.
Example | |
Consider the following network interface. · ni-aue-mktgappn01-01 The characters mktgappn01 indicates the network interface belonging to the mktgappn01 virtual machine. |
Example 1.5‑13 – Network Interfaces
Management Containers
Management groups and subscriptions are not considered Azure resources themselves, but instead are containers that are used for the grouping and management of resources.
These management containers are prefixed with a resource identifier to assist in the recognition of these objects when used as part of the names for other resource types, such as Entra ID groups.
The following table demonstrates an example list of suggested resource identifier prefixes:
Resource | Prefix |
Management Groups | mg |
Subscriptions | sub |
Table 1.5‑10 – Management Containers
Considering that management groups and subscriptions are not directly tied to any resources, the names of these management containers carry the least amount of restriction. They are not constrained by regions or environments. This means that there may be cases where certain segments of the name are omitted depending on where it sits within the management hierarchy.
The descriptor segment is used to describe the objects that reside within the management group.
Example | |
Consider the following management group: · mg-dcc-production The characters mg indicates the management container is a management group. |
Example 1.5‑14 – Management Groups
Example | |
Consider the following subscription group:
The characters sub indicates the management container is a subscription. |
Example 1.5‑15 – Subscriptions
Entra ID Identities and Groups
Entra ID identities and groups are not considered Azure resources, but instead objects that reside within the Entra ID identity plane. The naming convention still applies to identities and groups, however since these objects are not resources themselves, the resource identifier segment represents the resource, service, or application in which the identity or group has been granted permissions.
The following table demonstrates an example list of suggested resource identifier prefixes:
Resource | Prefix |
Entra ID | aad |
Azure Resources | az |
Azure Management Groups | mg |
Azure Subscriptions | sub |
Azure DevOps | azdo |
Terraform Cloud | tfc |
Microsoft SharePoint | mssp |
Microsoft Teams | mstm |
Microsoft Exchange | msex |
ServiceNOW | snow |
Table 1.5‑11 – Entra ID Identities and Groups
Example | |
Consider the following service principal: · aad-spn-dcc-aad-api-spn-generator The characters aad represents the service principal is granted permissions to, and interacts with, AzureAD. |
Example 1.5‑16 – Entra ID Identities and Groups
Entra ID Security Groups
Entra ID security groups are used to provide access to resources via Role Based Access Control (RBAC) and are represented by the characters sec.
Entra ID Groups that are created to apply permissions directly to Azure resources (such as resource groups), have a one-to-one relationship with that resource. In this instance, the scope in which the permissions will be applied is included within the unique identifier segment.
However, Entra ID Groups that are created for personas (such as Cost Management Reader) have a one-to-many relationship with multiple Azure resources. In this instance, the name of the persona is included within the unique identifier segment.
Security groups are further identified by a suffix that indicates the role that defines the permissions that is granted by the group.
The following table demonstrates an example list of suggested role suffixes:
Role | Suffix |
Reader | reader |
Contributor | contributor |
Owner | owner |
Cost Management Reader | costmanagementreader |
Cost Management Contributor | costmanagementcontributor |
Security Reader | securityreader |
Security Administrator | securityadmin |
Table 1.5‑12 – Entra ID Security Groups
Example | |
Consider the following Entra ID security group: · az-sec-arg-aue-prpsi-mktg-appn-01-contributor The characters sec represents the Entra ID security group indicator. The characters arg-aue-prpsi-mktg-appn-01 represent the permission scope. The characters contributor represents members of this group will inherit contributor role permissions to the arg-aue-prpsi-mktg-appn-01 application resource group. |
Example 1.5‑17 – Entra ID Security Groups – Direct Role Assignment (One to One)
Example | |
Consider the following Entra ID security group: · az-sec-financeoperations-costmanagementreader The characters sec represents the Entra ID security group indicator. The characters financeoperations represents the persona is granted access across multiple resources. The characters costmanagementreader represents members of this group will inherit permissions defined in the Cost Management Reader role. |
Example 1.5‑18 – Entra ID Security Groups – Direct Role Assignment (One-to-Many)
Service Principals
Service principals are used to provide programmatic access to Entra ID or resources on the Azure platform and have a close relationship with application registrations and enterprise applications. These identity types should be clearly identifiable and distinct from regular user identities.
The characters spn are added to the name of the identity to clearly distinguish this identity type.
Example | |
Consider the following service principal: · az-spn-lab-nrg-prpci-cloudability-01-networkoperator The characters spn indicates the identity object is a service principal. |
Example 1.5‑19 – Service Principals
The organisation identifier is used to help identify accounts that exist inside a tenancy and are exclusively used by an external party or third-party application.
Example | |
Consider the following service principal: · az-spn-lab-nrg-prpci-cloudability-01-networkoperator The characters lab indicates the resource is owned by the LAB³ service provider. |
Example 1.5‑20 – Service Principals
Service principals always have their permissions tightly scoped to resources and will have the name of the resource scope included as part of the unique identifier.
Example | |
Consider the following service principal: · az-spn-lab-nrg-prpci-cloudability-01-networkoperator The characters nrg-prpci-cloudability-01 indicates the service principal permissions are scoped to the nrg-prpci-cloudability-01 network resource group. |
Example 1.5‑21 – Service Principals
Personas are a grouping of minimum permissions needed for an identity to perform a particular task or function within a service or system. The resource descriptor segment is used to provide information on the persona that used for the service principal.
Example | |
Consider the following service principal: · az-spn-lab-nrg-prpci-cloudability-01-networkoperator The characters networkoperator indicates the service principal is assigned the network operator persona on the nrg-prpci-cloudability-01 network resource group. |
Example 1.5‑22 – Service Principals
Service Accounts
Service accounts are sometimes needed in circumstances where service principals or application registrations are unable to perform a required task. Service accounts can be either synchronised from Active Directory or created directly within Entra ID (cloud native).
Accounts that are synchronised will create an object in Entra ID with the same name as the object being synchronised. In contrast, cloud native accounts are created in accordance with the naming standard.
Example | |
Consider the following service account: · azdo-svc-dcc-prpc-org-contosoorg-pipelinemanager The characters svc indicate that this is a service account identity object. The characters pipelinemanager indicates the service account is assigned the pipeline manager persona within the Azure DevOps organisation. |
Example 1.5‑23 – Service Accoun
Naming Examples
The Azure platform is constantly evolving as Microsoft releases new services to customers. Due to the ever-changing nature of the platform, these examples are not to be considered as a point-in-time source of truth for resource names, but instead a demonstration of a flexible framework that can be adapted to all resources, both present and future.
Regional Resource Examples
The table below demonstrates the naming conventions applied to regional resources.
Identifier | Azure Resource Type | Convention | Resultant Name Examples |
MG | Management Group | <ResourceIdentifier>-<CompanyIdentifier>-<UniqueIdentifier> | mg-dcc-production |
SUB | Subscription | <ResourceIdentifier>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | sub-dcc-prpci-corporate-appn-01 |
ARG (Application RG) | Resource Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | arg-aue-prpsi-mktg-appn-01 |
PRG (Platform RG) | Resource Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | prg-aue-prpsi-mktg-appn-01 |
SRD (Shared RG) | Resource Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | srg-aue-prpsi-mktg-appn-01 |
RRG (Recovery RG) | Resource Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | rrg-aue-prpsi-mktg-appn-01 |
NRG (Network) | Resource Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | nrg-aue-prpsi-mktg-appn-01 |
PPG | Proximity Placement Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | ppg-aue-prpsi-mktg-appn-01 |
– | Subnet | <Owner>/<Purpose> | DevOpsAgents |
VNET | VNET | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | vnet-aue-prpsi-mktg-appn-01 |
XRC | ExpressRoute Circuit | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | xrc-aue-prpsi-mktg-appn-01 |
XCN | ExpressRoute Connection | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | xcn-aue-prpsi-mktg-appn-01 |
NI | Network Interface | <ResourceIdentifier>-<ResourceName>-<Sequence Number> | ni-lauemktgsap1-01 |
PE | Private endpoint
Private endpoint network interface | <ResourceIdentifier>-<ExistingResourceName>-<SubResource>
<ExistingPrivateEndpointName><AzureAutoGeneratedID> | pe-aa-aue-prpsi-mktg-appn-01-webhook
pe-aa-aue-prpsi-mktg-appn-01-webhook .nic.00000002-0000-0000-c000-000000000000 |
RT | Route Table | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence>-subnet-<Subnet> | rt-aue-prpsi-mktg-appn-01-subnet-Frontend |
NWA | Network watcher | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | nwa-aue-prpsi-mktg-appn-01 |
LAW | Log analytics workspace | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | law-aue-prpsi-mktg-appn-01 |
PLS | Azure monitor private link scope | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | pls-aue-prpsi-mktg-appn-01 |
AG | Action group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence>-<Severity> | ag-aue-prpsi-mktg-appn-01-sev2 |
– | Metric alert rule | <AlertRuleName>-<ExistingResourceName> | LAYYYALSTG001-agw-aue-prpsi-mktg-appn-01 |
– | Activity log alert rule | <AlertRuleName>-<SubscriptionId> | LAYYYALSTG001-00000002-0000-0000-c000-000000000000 |
– | Log search alert rule | <AlertRuleName>-<SubscriptionId> | LAYYYQALAW001-00000002-0000-0000-c000-000000000000 |
SESP | Service endpoint policy | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sesp-aue-prpsi-mktg-appn-01 |
LBI | Load Balancer Internal | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | lbi-aue-prpsi-mktg-appn-01 |
LBE | Load Balancer External | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | lbe-aue-prpsi-mktg-appn-01 |
VGW | Virtual Network Gateway | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | vgw-aue-prpsi-mktg-appn-01 |
LGW | Local Network Gateway | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | lgw-aue-prpsi-mktg-appn-01 |
AGW | Application Gateway | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | agw-aue-prpsi-mktg-appn-01 |
NSG | Network Security Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence>-subnet-<Subnet> | nsg-aue-prpsi-mktg-appn-01-subnet-Frontend |
ASG | Application Security Group | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | asg-aue-prpsi-mktg-appn-01 |
PIP | Public IP address | <ResourceIdentifier>-<ResourceName> | pip-azfw-aue-prpsi-mktg-appn-01 |
AZFW | Azure Firewall | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | azfw-aue-prpsi-mktg-appn-01 |
AZFWP | Azure Firewall Policy | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | azfwp-aue-prpsi-mktg-appn-01 |
NG | NAT gateway | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | azfwp-aue-prpsi-mktg-appn-01 |
VWAN | Virtual WAN | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | vwan-aue-prpci-core-01 |
VM | Virtual machine | <OSType><region><Owner><Purpose><Sequence Number> (unless adopting existing naming standard) | waueitnav1 lauemktgsap1 |
VMSS | Virtual machine scale set | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | vmss-aue-prpsi-mktg-appn-01 |
AS | Availability set | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | as-aue-prpsi-mktg-appn-01 |
VMSA | VM storage account | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | vmsa-aue-prpsi-mktg-appn-01 |
ARCM | Azure Arc connected machine | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | arcm-aue-prpsi-mktg-appn-01 |
AA | Automation Account | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | aa-aue-prpsi-mktg-appn-01 |
– | Automation Runbook | <Owner>/<Purpose> | VMPowerManagement |
DNSPR | DNS private resolver | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | dnspr-aue-prpsi-dnsr-01 |
RS | DNS forwarding ruleset | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | rs-aue-prpsi-dnsr-01 |
ACI | Container instance | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | aci-aue-prpsi-mktg-appn-01 |
AKS | AKS cluster | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | aks-aue-prpsi-mktg-appn-01 |
SF | Service Fabric cluster | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sf-aue-prpsi-mktg-appn-01 |
ASE | App service environment | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | ase-aue-prpsi-mktg-appn-01 |
ASP | App Service plan | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | asp-aue-prpsi-mktg-appn-01 |
CS | Cloud service | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | cs-aue-prpsi-mktg-appn-01 |
NH | Notification Hubs | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | nh-aue-prpsi-mktg-appn-01 |
NHNS | Notification Hubs namespace | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | nhns-aue-prpsi-mktg-appn-01 |
SQL | Azure SQL Database server | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sql-aue-prpsi-mktg-appn-01 |
SQLDB | Azure SQL database | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sqldb-aue-prpsi-mktg-appn-01 |
CSDB | Cosmos DB database | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | csdb-aue-prpsi-mktg-appn-01 |
SSMP | Azure Store Simple | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | ssmp-aue-prpsi-mktg-appn-01 |
SRCH | Azure Cognitive Search | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | srch-aue-prpsi-mktg-appn-01 |
ACS | Azure Cognitive Services | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | acs-aue-prpsi-mktg-appn-01 |
MLW | Azure Machine Learning workspace | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | mlw-aue-prpsi-mktg-appn-01 |
AAS | Azure Analysis Services server | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | aas-aue-prpsi-mktg-appn-01 |
DBW | Azure Databricks workspace | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | dbw-aue-prpsi-mktg-appn-01 |
DLS | Data Lake Store account | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | dls-aue-prpsi-mktg-appn-01 |
DLA | Data Lake Analytics account | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | dla-aue-prpsi-mktg-appn-01 |
EH | Event hub | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | eh-aue-prpsi-mktg-appn-01 |
HIHC | HDInsight – Hadoop cluster | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | hihc-aue-prpsi-mktg-appn-01 |
HIBC | HDInsight – HBase cluster | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | hibc-aue-prpsi-mktg-appn-01 |
IOT | IoT Hub | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | iot-aue-prpsi-mktg-appn-01 |
PBI | Power BI Embedded | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | pbi-aue-prpsi-mktg-appn-01 |
LA | Logic App | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | la-aue-prpsi-mktg-appn-01 |
EG | Event Grid | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | eg-aue-prpsi-mktg-appn-01 |
SB | Service Bus | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sb-aue-prpsi-mktg-appn-01 |
SBQ | Service Bus Queue | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sbq-aue-prpsi-mktg-appn-01 |
SBT | Service Bus Topic | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | sbt-aue-prpsi-mktg-appn-01 |
BP | BluePrint | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | bp-aue-prpsi-mktg-appn-01 |
APS | Application Insights | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | aps-aue-prpsi-mktg-appn-01 |
RSV | Recovery Services Vault | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence>-<StorageReplicationType> | rsv-aue-prpsi-mktg-appn-01-GRS |
AMGR | Azure Migration Project | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | amgr-aue-prpsi-mktg-appn-01 |
NWAFL | Network Watcher Flow Log | <ResourceIdentifier>-<Region>-<UniqueIdentifier>-<Sequence> | nwafl-aue-prpsi-mktg-appn-01 |
Table 1.5‑13 – Regional Resource Examples
Global Resource Examples
The table below demonstrates the naming conventions applied to global resources.
Identifier | Azure Resource Type | Location | Convention | Resultant Name Examples |
TMP | Traffic Manager Profile | Global | <ResourceIdentifier>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | tmp-dcc-prrsi-mktg-appn-01 |
AFD | Front Door | Global | <ResourceIdentifier>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | afd-dcc-prrsi-mktg-appn-01 |
CDN | Content Delivery Network | Global | <ResourceIdentifier>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | cdn-dcc-prrsi-mktg-appn-01 |
APIM | API Management Service | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | apim-aue-dcc-prrsi-mktg-appn-01 |
cr | Container Registry | Regional | <ResourceIdentifier><Region(3)><CompanyIdentifier(3)><Uniqueidentifer(<=5)> <Purpose(<=4)><sequence(2)> | crauedccprpcidevops01 |
WA | Web app | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | wa-aue-dcc-prrsi-mktg-appn-01 |
FA | Function app | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | fa-aue-dcc-prrsi-mktg-appn-01 |
EHN | Event Hub Namespace | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | ehn-aue-dcc-prrsi-mktg-appn-01 |
REDIS | Azure Cache for Redis instance | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | redis-aue-dcc-prrsi-mktg-appn-01 |
MYSQL | MySQL database | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | mysql-aue-dcc-prrsi-mktg-appn-01 |
PSQL | PostgreSQL database | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | psql-aue-dcc-prrsi-mktg-appn-01 |
SQLDW | Azure SQL Data Warehouse | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | sqldw-aue-dcc-prrsi-mktg-appn-01 |
SAA | Azure Synapse Analytics | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | saa-aue-dcc-prrsi-mktg-appn-01 |
| Storage Account | Regional | <Region(3)><CompanyIdentifier(3)><Uniqueidentifer(<=5)><Purpose(<=4)> <sequence(2)> | auedccprrsiappndiag01 auedccprrsiappnmedi01 |
ASA | Azure Stream Analytics | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | asa-aue-dcc-prrsi-mktg-appn-01 |
ADF | Azure Data Factory | Regional | <ResourceIdentifier>-<Region>-<CompanyIdentifier>-<UniqueIdentifier>-<Sequence> | adf-aue-dcc-prrsi-mktg-appn-01 |
– | KeyVault | Regional | <Region(3)><CompanyIdentifier(3)><UniqueIdentifier(6)><Descriptor(<=9)> <sequence(2)> | auedccprrsimktgappn01 |
Table 1.5‑14 – Global Resource Examples
Entra ID Security Group Examples
Identifier | Resource Type | Convention | Generated Name |
AZ | Azure Role Based Access Control | <ResourceIdentifier>-sec-<PemissionScope/Persona>-<Role> | az-sec-rg-aue-prpsi-mktg-appn-01-contributor |
AZ | Azure Persona Based Access Control | <ResourceIdentifier>-sec-<PemissionScope/Persona>-<Role> | az-sec-financeoperations-costmanagementreader |
AZDO | Azure DevOps | <ResourceIdentifier>-sec-<PemissionScope/Persona>-<Role> | azdo-sec-prj-platformresources-admins |
MSEX | Microsoft Exchange | <ResourceIdentifier>-sec-<PemissionScope/Persona>-<Role> | msex-sec-mailbox-administrators |
SNOW | Service Now | <ResourceIdentifier>-sec-<PemissionScope/Persona>-<role> | snow-sec-ticket-administrators |
Table 1.5‑15 – Security Group Examples
Service Principal Examples
The table below demonstrates the naming conventions applied to service principals.
Identifier | Resource Type | Convention | Generated Name |
AAD | Entra ID | <ResourceIdentifier>-spn-<CompanyIdentifier>-<PermissionScope>-<Persona> | aad-spn-dcc-aadapi-scaffoldbuilder |
AZ | Azure Role Based Access Control | <ResourceIdentifier>-spn-<CompanyIdentifier>-<PermissionScope>-<Persona> | az-spn-dcc-nrg-prpci-cloudability-01-networkoperator |
Appendix
References
Table 3.1‑1 – Reference