Focus area
Secure-by-default architecture decisions and tradeoffs.
From encryption to monitoring, these runbooks show how to bake security expectations into platform components so teams don’t bolt it on later.
How the Defender for Cloud secure score is calculated, what to fix first, and how exemptions can flatter the number. A runbook from Microsoft Learn.
Jump into the guided path, or browse everything if you’re after something specific.
Hop between landing zones, identity, networking, and more.
An Azure Policy baseline built on Microsoft Learn guidance: audit first, stage rollout, handle exemptions and remediation, then move to enforcement.
A baseline for Entra app consent: user consent, admin workflow, credential expiry, app management policies and owners, with portal paths and roles.
How to pick Sentinel analytics rules to enable first: content hub templates, data source checks, false-positive tuning and the Defender portal.
A baseline for Entra break-glass accounts: two cloud-only Global Administrators, phishing-resistant MFA, Conditional Access exclusions, alerts, 90-day test.
A Sentinel cost control runbook: pick the right tier, set a commitment, filter at ingestion and monitor spend, with the Defender portal move in mind.
A sourced Conditional Access baseline for Entra: emergency access, legacy authentication, MFA, admin protection and a report-only rollout that avoids lockouts.
How to run Privileged Identity Management day to day: licensing, eligible assignments, role settings, approvals, alerts, audit and lockout traps.
From 4 November 2026 default Entra users can create agent blueprints unless you turn it off. What changes, who should keep the ability, and how to restrict it.
A self-hosted Azure pipeline that ships SailPoint Identity Security Cloud audit events into Microsoft Sentinel, and the design choices that keep it Tier 0.
A practical Defender for Cloud baseline for Azure landing zones: plan coverage decisions, agent strategy, and closing the loop with policy-backed guardrails.
A practical baseline for Azure Private Endpoints and DNS: ownership, zone design, resolver routing, and onboarding patterns that prevent midnight outages.
A runbook-style secure networking baseline for Azure: hub-spoke or vWAN, DNS ownership, private endpoints, egress control and inbound protection.
A hands-on walkthrough of Azure Landing Zones (ALZ): what they are, why they matter, and a runbook-style path to deploying a secure platform foundation.
A practical identity baseline for Azure landing zones: admin separation, PIM, Conditional Access, workload identities and secrets, written as a runbook.
Search
Type an Azure service, control, or tag. Results refresh after every deploy.
Examples: landing zone policy, workload identity, vpn gateway
