CloudRunbook | Practical Cloud Engineering
Straight-talking guidance for landing zones, identity, networking and the Azure changes worth acting on, written the way an in-house platform team would explain it.
An Azure-native, self-hosted pipeline that ships SailPoint Identity Security Cloud audit events into Microsoft Sentinel — why the governance layer is where detection belongs, and the design decisions that keep the pipeline itself Tier 0.
Four baselines, in the order they need doing — each one assumes the last exists.
Management groups, RBAC, policy guardrails, logging baseline, and subscription hygiene without the theatre.
Read the runbook →Entra, PIM, workload identity, Key Vault patterns, and least privilege that scales beyond one team.
Read the runbook →Hub/spoke or vWAN, Private Link + DNS, egress control, WAF patterns you can actually support.
Read the runbook →Plan coverage, auto-provisioning, and turning recommendations into guardrails teams will actually action.
Read the runbook →Fresh write-ups, patterns, and deployable guidance.
A practical Defender for Cloud baseline for Azure landing zones: plan coverage decisions, agent strategy, and closing the loop with policy-backed guardrails.
A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.
Basic SKU public IPs have retired. Azure VPN Gateway offers portal-based migration to Standard Public IP on active-active gateways — who’s affected, and the runbook to get off Basic safely.
A practical identity baseline for secure Azure architecture: admin separation, PIM, Conditional Access, workload identities, and secrets. Written as a runbook you can implement.
A runbook-style secure networking baseline for Azure: hub/spoke vs vWAN, DNS ownership, private endpoints, egress control, and inbound protection. Built to scale.
A hands-on walkthrough of Azure Landing Zones (ALZ): what they are, why they matter, and a runbook-style path to deploying a secure platform foundation.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, vpn gateway
