CloudRunbook | Practical Cloud Engineering
If you only read a few things, follow this path: land the platform safely, sort identity, keep networking predictable, then standardise monitoring and ops without the drama.
Follow the order; each layer assumes the last one exists.
Design the management group tree, policy guardrails, logging baseline, and subscription lifecycle.
Entra roles, PIM, workload identity, and secrets discipline so privileges are never standing.
Hub & spoke or vWAN patterns, Private Link conventions, DNS, and egress control.
Defender coverage, actionable recommendations, and feedback loops that close the gap with app teams.
Want everything on one topic instead? Landing Zones · Identity · Secure Networking · Defender for Cloud
Deeper cuts and change notes that sit alongside the path rather than inside it.
Exchange Online EWS retirement: what Microsoft's sources say about dates, how to find EWS users in the usage report, and how to allow-list apps.
How the Defender for Cloud secure score is calculated, what to fix first, and how exemptions can flatter the number. A runbook from Microsoft Learn.
Entra SMS voice retirement dates, who is in scope, and how to choose a telephony provider or move users to passkeys before the cut-off.
Learn gives 31 March 2027 for the Sentinel Defender portal move. What changes for roles, automation and workspaces, and a runbook to onboard safely.
An Azure Policy baseline built on Microsoft Learn guidance: audit first, stage rollout, handle exemptions and remediation, then move to enforcement.
A baseline for Entra app consent: user consent, admin workflow, credential expiry, app management policies and owners, with portal paths and roles.
Entra passkeys on Windows: what MC1282568 says, where Learn disagrees on AAGUIDs, and a runbook to pilot, check and roll back.
How to pick Sentinel analytics rules to enable first: content hub templates, data source checks, false-positive tuning and the Defender portal.
Learn lists 10 November 2026 as the expected end of support for PowerShell 7.4, .NET 8, .NET 9 and in-process Functions. Who is affected and how to move.
A baseline for Entra break-glass accounts: two cloud-only Global Administrators, phishing-resistant MFA, Conditional Access exclusions, alerts, 90-day test.
A Sentinel cost control runbook: pick the right tier, set a commitment, filter at ingestion and monitor spend, with the Defender portal move in mind.
A sourced Conditional Access baseline for Entra: emergency access, legacy authentication, MFA, admin protection and a report-only rollout that avoids lockouts.
MC1325414 says Entra SSPR will stop accepting some directory attributes. What it says, where Microsoft's dates disagree, and how to check registration coverage.
How to run Privileged Identity Management day to day: licensing, eligible assignments, role settings, approvals, alerts, audit and lockout traps.
From 4 November 2026 default Entra users can create agent blueprints unless you turn it off. What changes, who should keep the ability, and how to restrict it.
A self-hosted Azure pipeline that ships SailPoint Identity Security Cloud audit events into Microsoft Sentinel, and the design choices that keep it Tier 0.
The customer-initiated window to move VPN Gateway off Basic public IPs has closed. How to check your gateways have moved, handle a pending one, and validate.
A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, vpn gateway
