CloudRunbook | Practical Cloud Engineering
Straight-talking guidance for landing zones, identity, networking and the Azure changes worth acting on, written the way an in-house platform team would explain it.
Exchange Online EWS retirement: what Microsoft's sources say about dates, how to find EWS users in the usage report, and how to allow-list apps.
Four baselines, in the order they need doing — each one assumes the last exists.
Management groups, RBAC, policy guardrails, logging baseline, and subscription hygiene without the theatre.
Read the runbook →Entra, PIM, workload identity, Key Vault patterns, and least privilege that scales beyond one team.
Read the runbook →Hub/spoke or vWAN, Private Link + DNS, egress control, WAF patterns you can actually support.
Read the runbook →Plan coverage, auto-provisioning, and turning recommendations into guardrails teams will actually action.
Read the runbook →Fresh write-ups, patterns, and deployable guidance.
How the Defender for Cloud secure score is calculated, what to fix first, and how exemptions can flatter the number. A runbook from Microsoft Learn.
Entra SMS voice retirement dates, who is in scope, and how to choose a telephony provider or move users to passkeys before the cut-off.
Learn gives 31 March 2027 for the Sentinel Defender portal move. What changes for roles, automation and workspaces, and a runbook to onboard safely.
An Azure Policy baseline built on Microsoft Learn guidance: audit first, stage rollout, handle exemptions and remediation, then move to enforcement.
A baseline for Entra app consent: user consent, admin workflow, credential expiry, app management policies and owners, with portal paths and roles.
Entra passkeys on Windows: what MC1282568 says, where Learn disagrees on AAGUIDs, and a runbook to pilot, check and roll back.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, vpn gateway
