CloudRunbook | Practical Cloud Engineering

Start Here

If you only read a few things, follow this path: land the platform safely, sort identity, keep networking predictable, then standardise monitoring and ops without the drama.

Recommended path

Follow the order; each layer assumes the last one exists.

See all posts →

Landing zones first

Design the management group tree, policy guardrails, logging baseline, and subscription lifecycle.

Identity as the control plane

Entra roles, PIM, workload identity, and secrets discipline so privileges are never standing.

Secure networking by default

Hub & spoke or vWAN patterns, Private Link conventions, DNS, and egress control.

Visibility + detections

Defender for Cloud, Sentinel/KQL, and operational feedback loops that close the gap with app teams.

What makes CloudRunbook different

Every post is structured like a runbook: prerequisites, steps, checks, and rollback.
Architecture trade-offs explained for real deadlines and regulatory pressure.
Security is the default, not the final tick-box before go-live.

New here? Start with Landing Zones and work clockwise.

Series to go deeper

Pick a focus area to stay current with the work that actually lands on your desk.

Secure Landing Zone

Foundations

Management groups, RBAC, policy guardrails, logging baseline, and subscription hygiene without the theatre.

View series →

Identity-first Architecture

Security

Entra, PIM, workload identity, Key Vault patterns, and least privilege that scales beyond one team.

View series →

Secure Networking

Connectivity

Hub/spoke or vWAN, Private Link + DNS, egress control, WAF patterns you can actually support.

View series →

Weekly Azure Changes

News

Practical impact notes: what changed, who should care, what to do next.

View series →

Latest recommended posts

14 Jan 2026 4 min read

Defender for Cloud baseline: plan coverage, auto-provisioning, and turning recommendations into guardrails

A practical Defender for Cloud baseline for Azure landing zones: plan coverage decisions, auto-provisioning, and closing the loop with policy-backed guardrails.

Defender for Cloud Security Azure

14 Jan 2026 3 min read

Private Endpoints + DNS baseline: stop outages before they happen

A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.

Secure Networking Security Azure

12 Jan 2026 5 min read

Identity-first Azure: the baseline every landing zone should start with

A practical identity baseline for secure Azure architecture: admin separation, PIM, Conditional Access, workload identities, and secrets. Written as a runbook you can implement.

Identity Security Azure

12 Jan 2026 4 min read

Secure Azure networking baseline: a practical foundation for landing zones

A runbook-style secure networking baseline for Azure: hub/spoke vs vWAN, DNS ownership, private endpoints, egress control, and inbound protection. Built to scale.

Secure Networking Security Azure

12 Jan 2026 5 min read

Azure Landing Zones: the practical guide (secure-by-default, engineer-friendly)

A hands-on walkthrough of Azure Landing Zones (ALZ): what they are, why they matter, and a runbook-style path to deploying a secure platform foundation.

Landing Zones Security Azure

12 Jan 2026 3 min read

Weekly Azure Change (Jan 2026): VPN Gateway portal migration for Basic IP on Active-Active

Azure VPN Gateway introduces portal-based migration for Basic Public IP on active-active gateways (planned Jan 2026). What it means, who’s affected, and the runbook to prepare.

Weekly Azure Changes Networking VPN Gateway