Posts
Hub-and-Spoke Networking for Azure Landing Zones: Azure Firewall, Bastion, and Private DNS
Your new workload team files their first support ticket three weeks after go-live. A developer can’t reach the database. You pull the logs. The VM is making an outbound call to a public IP on port 1433—in plain text, no firewall inspection, straight out to the internet. You ask who approved …
Design Your Azure Management Group and Subscription Hierarchy
Six months after the initial landing zone deployment, a new VP reorganizes the business units. Your management group tree — which you built to mirror the org chart — is now wrong. Every policy assignment, every RBAC scope, every cost report that referenced “BU-Finance” and …
Azure Platform Engineering: The Complete Guide to Building an Enterprise Landing Zone
Your Azure bill arrives and one line item is $47,000. Nobody on your team knows which subscription it came from. You trace it back to a developer who spun up a GPU cluster three weeks ago “just to test something.” There was no policy to stop them. There was no budget alert configured. …