Nine months after go-live, internal audit asks a simple question: do the firewall rules running in production today match the ones that were approved? You run terraform plan to prove it. Fourteen changes come back. Three are rule edits someone made in the portal during an incident. One opened a port …

The incident ticket lands on a Tuesday morning. Production degraded last Friday. You open the Azure portal, pull up the subscription’s Log Analytics Workspace, and realize the diagnostics on the App Gateway were never enabled. The VNet flow logs are going to a different workspace some …