Skip to content

Common Requests (Standard Changes)

A standard change is a pre-approved, low-risk change with a known procedure. Each runbook below gives:

  • the request fields to collect
  • the files to edit and what each edit does in Azure
  • the pipeline to run
  • verification steps
  • rollback steps

Every runbook builds on the generic procedure in Making a change safely. Reviewers use the checklist in Pull request review and the reviewer and operator runbooks. For firewall rules, naming, priorities and IP groups, see the Firewall rule and IP group guidelines. The process around a request (intake, states, who does what, categories) is described in The standard change process. To edit the JSON files with suggestions and validation in your editor, see Edit the JSON files with schema support.

The two requests that come in most often are standard changes on the hub (firewall rules, App Gateway, policies, tags) and adding a region. Consumer teams request these through the consumer request process.

# Standard change Runbook Files you edit Pipeline Hub layer
1 New workload / spoke / application landing zone (spoke canvas) New spoke <env-folder>/spokes/**/<file>.json (new) spoke –
2 Deletion of workload / spoke / application landing zone Delete spoke spoke JSON (removed afterwards) spoke-destroy –
3 Changes to spoke canvas (RBAC owner, service principal, networking, …) Change spoke existing spoke JSON spoke –
4 Creation and changing of tags (hub) Hub tags <region>/<layer>.auto.tfvars (*_tags variables) hub layer of the tagged resource
5 Deletion of tags (hub) Hub tags same hub same
6 Add new firewall rules Firewall rules firewall_rule_configuration/*.json, ip_groups/*.json hub firewall
7 Change firewall rules Firewall rules same hub firewall
8 Add workload to Application Gateway Application Gateway application_gateways/*.json, web_application_firewall_policies/*.json hub connectivity
9 Changes to workload configuration within Application Gateway Application Gateway same hub connectivity
10 New Azure sandbox subscription Sandbox subscription (work in progress) foundation.auto.tfvars hub foundation
11 New Azure Policy assignment Policy assignments policies/policy_assignments/0x_*/*.json hub postdeployment
12 Update managed Azure Policy assignment Policy assignments same hub postdeployment
13 Assign a managed policy initiative to a management group Managed initiative on a management group policy_assignments/01_management_groups/*.json (+ definitions) hub foundation + postdeployment
14 Update Azure Cloud Landing Zone features / resource Platform features <region>/<layer>.auto.tfvars (feature flags) hub layer of the feature
15 Assigning / deleting managed monitoring rules Monitoring rules postdeployment.auto.tfvars, spoke JSON tags hub or spoke postdeployment
16 Add a region to the hub Add a region global.auto.tfvars, new <region>/ folder hub all layers
17 Renew or replace a certificate of a published workload Replace a certificate none (Key Vault), or application_gateways/*.json if the secret URI has a version hub (only if the JSON changes) connectivity
18 Inbound access through a firewall DNAT rule (for example SFTP) Firewall rules firewall_rule_configuration/*.json hub firewall
19 Create or change an IP group IP groups ip_groups/*.json hub firewall
20 Policy exemption (and review of expiring exemptions) Policy exemptions policies/policy_exemptions/0x_*/*.json hub postdeployment
21 Add DNS conditional forwarder(s) DNS conditional forwarder <region>/connectivity.auto.tfvars (private_dns_resolver_forwarding_rules) hub connectivity

Request fields common to every standard change

Field Required Use
Rationale yes Why the change is needed. Goes in the pull request description and the change record.
Environment yes Which platform environment (canary, prod) or, for spokes, which spoke environment (dev, tst, acc, prd, shared).
Comments no Anything else the implementer needs to know.

The change-specific fields are listed in each runbook.

Scope boundaries

These rules come from the platform's responsibility model. Keep them if you run the platform yourself:

  • Spoke tags are owned by the workload team, set in the spoke JSON tags block. They are not a hub standard change.
  • Policy initiatives on a single spoke are the workload team's responsibility. Standard changes only cover management group level assignments of managed initiatives.
  • Feature switches cover features that already exist in the codebase. A feature that requires new Terraform is a development change in the code repository, not a standard change.