CloudRunbook | Practical Cloud Engineering
Straight-talking guidance for landing zones, identity, networking and the weekly Azure noise, written the way an in-house platform team would explain it.
Azure VPN Gateway introduces portal-based migration for Basic Public IP on active-active gateways (planned Jan 2026). What it means, who’s affected, and the runbook to prepare.
Portal-based migration lets you move active-active VPN Gateways from Basic to Standard Public IPs on your schedule—plan a brief outage and make sure the GatewaySubnet is sized correctly.
Watch for automation or IaC that still assumes Basic Public IP SKUs, and confirm you have rollback steps if BGP or tunnels sulk after the change.
Ignore cosmetic portal tweaks; the only thing that matters is prepping your gateways so the migration is boring.
The calm, opinionated path that stops the platform falling over.
Deep dives arranged the way a platform engineer scribbles the plan in a notebook.
Management groups, RBAC, policy guardrails, logging baseline, and subscription hygiene without the theatre.
View series →Entra, PIM, workload identity, Key Vault patterns, and least privilege that scales beyond one team.
View series →Hub/spoke or vWAN, Private Link + DNS, egress control, WAF patterns you can actually support.
View series →Practical impact notes: what changed, who should care, what to do next.
View series →Fresh write-ups, patterns, and deployable guidance.
A practical Defender for Cloud baseline for Azure landing zones: plan coverage decisions, auto-provisioning, and closing the loop with policy-backed guardrails.
A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.
A practical identity baseline for secure Azure architecture: admin separation, PIM, Conditional Access, workload identities, and secrets. Written as a runbook you can implement.
A runbook-style secure networking baseline for Azure: hub/spoke vs vWAN, DNS ownership, private endpoints, egress control, and inbound protection. Built to scale.
A hands-on walkthrough of Azure Landing Zones (ALZ): what they are, why they matter, and a runbook-style path to deploying a secure platform foundation.
Azure VPN Gateway introduces portal-based migration for Basic Public IP on active-active gateways (planned Jan 2026). What it means, who’s affected, and the runbook to prepare.
Short, practical: what changed + what to do.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, weekly changes
