Partner Quick Reference

Prerequisites

Requirement	Minimum
Azure subscription	Owner role
Azure CLI	2.60+
Azure Developer CLI (azd)	1.9+
PowerShell	7.4+
Management group	Create `smb-rf` under tenant root

Quick Deploy

cd infra/bicep/smb-ready-foundation

# One-time: create management group
az account management-group create --name smb-rf \
  --display-name "SMB Ready Foundation"
az account management-group subscription add --name smb-rf \
  --subscription $(az account show --query id -o tsv)

# Configure
azd env new customer-prod
azd env set SCENARIO baseline
azd env set OWNER "partner@contoso.com"
azd env set AZURE_LOCATION swedencentral
azd env set ENVIRONMENT prod
azd env set HUB_VNET_ADDRESS_SPACE "10.0.0.0/23"
azd env set SPOKE_VNET_ADDRESS_SPACE "10.0.2.0/23"
azd env set LOG_ANALYTICS_DAILY_CAP_GB "0.5"
azd env set MANAGEMENT_GROUP_ID smb-rf

# For vpn or full scenarios:
azd env set ON_PREMISES_ADDRESS_SPACE "192.168.0.0/16"

# Deploy
azd up

Scenarios

Scenario	Cost/month	NAT GW	Firewall	VPN GW	Peering
baseline	~$48	✅	—	—	—
firewall	~$336	—	✅	—	✅
vpn	~$187	✅	—	✅	✅
full	~$476	—	✅	✅	✅

What Gets Deployed

Resource Group	Key Resources
`rg-hub-smb-swc`	Hub VNet, NSG, Private DNS, Bastion Developer
`rg-spoke-prod-swc`	Spoke VNet, NSG, NAT GW or Route Table
`rg-monitor-smb-swc`	Log Analytics (500 MB cap), Automation Account
`rg-backup-smb-swc`	Recovery Services Vault
`rg-security-smb-swc`	Key Vault + Private Endpoint
`rg-migrate-smb-swc`	Azure Migrate Project

Plus: Governance policies (MG + subscription scoped), monthly budget ($500), Defender for Cloud (free CSPM).

Verification

# 6 resource groups
az group list \
  --query "[?starts_with(name,'rg-')].{Name:name, State:properties.provisioningState}" \
  -o table

# Check MG policies
az policy assignment list \
  --scope "/providers/Microsoft.Management/managementGroups/smb-rf" \
  --query "length(@)"

# Budget
az consumption budget list \
  --query "[?name=='budget-smb-monthly'].amount" -o tsv

Cleanup

cd infra/bicep/smb-ready-foundation

# Preview (dry run)
pwsh scripts/Remove-SmbReadyFoundation.ps1 -WhatIf

# Remove RGs + policies (keep MG)
pwsh scripts/Remove-SmbReadyFoundation.ps1 -Force

# Remove everything including MG
pwsh scripts/Remove-SmbReadyFoundation.ps1 -Force -RemoveManagementGroup