A workload team submits a ticket for a new Azure subscription. Three weeks later, a subscription exists — manually created, placed in the wrong management group, and named subscription-1 because no naming convention was enforced. The team deploys anyway, into an environment with no tags, no …