Microsoft Azure
Most Azure security failures I see trace back to the landing zone, not a missing control. Get the management group hierarchy and policy assignment right first.
Updated
How I use it
- Azure landing zone design aligned to the Cloud Adoption Framework
- Azure Policy assignment with a phased audit-then-enforce rollout
- Management group hierarchy review to stop policy inheritance surprises
- RBAC custom role reduction against least privilege
Recurring problems I find
- Policies set to Enforce on day one with no audit period, breaking existing workloads
- Subscription sprawl with no consistent management group placement
- Landing zone left on an old ALZ policy version long after a newer validated version shipped
An 'Audit Only' DoNotEnforce mode is now standard for rollout, letting a team see what a policy would catch before it blocks anything.
Related
Microsoft Defender for Cloud
Defender for Cloud for Azure-native CSPM, multicloud extension, container posture and AI workload security posture management.
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Microsoft AZ-500
AZ-500 Azure Security Engineer: identity, platform protection, data and application security, and security operations in Azure.
Multi-cloud baseline
How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.
Cloud security baseline
A printable cloud security baseline covering identity, network, data, MITRE ATT&CK-aligned logging and CIS-benchmarked posture management.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.