Automated issuing of subscriptions for workload landing zones: each arrives already in its management group, with policy, networking and cost tracking set up. A request pipeline running IaC modules usually drives it.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Subscription vending in context, with comparison tables and the common traps.
Terms in this definition
- Workload
Also called an experience: a Fabric toolset aimed at one job role, e.g. Data Factory, Data Engineering, Data Warehouse, Real-Time Intelligence or Power BI. Each keeps its data in OneLake.
- Management group
An Azure scope that sits over subscriptions. Policies and role assignments set there flow down to every subscription, resource group and resource it contains.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
- Set
Secret permission in Key Vault for writing secrets; some older material refers to it as Create.
- Pipeline
Groups activities logically so that, together, they move and transform data, either one after another or side by side; found in both Azure Data Factory and Microsoft Fabric.
- IaC
Infrastructure as code means deploying resources from declarative files, for example Bicep or ARM templates.
Related terms
- Gitflow
The branch-and-pull-request workflow used in Microsoft's subscription vending example: each request gets its own branch and a single parameter file for the new subscription. Merging the pull request into main starts the deployment pipeline.
- Platform team
Owns the build and day-to-day running of the platform landing zone. Workload teams rely on it for common services, guardrails and self-service tools like subscription vending.
- Product line
Subscription vending may offer several kinds of subscription, for example Corp connected, Online, Tech platform, Shared application portfolio and Sandbox. Each of these is a product line, with a distinct approach to networking and governance.
- Subscription alias
Microsoft.Subscription/aliases: deploying one at tenant level against a billing scope makes a brand-new subscription. Existing subscriptions can't be changed this way. Subscription vending modules call this method alias mode.