Short, honest write-ups of the ideas that come up in interviews and on the job. Each one teaches the concept properly, cites the Microsoft documentation, and points back to the class that drills it until it sticks.
Nine notes folded into one: how a definition is built, the eleven effects and the order they run in, why remediation needs a managed identity, exemptions versus exclusions, and the five guardrails to assign first — allowed locations, tags, no public IPs, diagnostic settings, and a custom definition — with verified built-in names and CLI.
Corp means corporate connectivity, Online means internet-facing — the split is intent, not importance. Where workloads really land, the policy differences that matter, common mis-placements, and when full ALZ is over-building.
All three are billing boundaries — but used at completely different scales, and a GCP project behaves more like an Azure resource group than a subscription. Here's the honest mapping and where it breaks.
The top of the org tree on each cloud — a place to push policy and billing down by inheritance. Same intent, but they leak in three spots: identity binding, the enforcement model, and nesting defaults.
An Azure resource group is a hard container — everything lives in exactly one. A GCP project does the same job. AWS has no native container at all, so you group with tags and stacks. Here's the leak that bites both directions.
A shared vault per environment is easy to run — and puts every team's secrets one over-broad role apart. Blast radius, throttling, RBAC boundaries, and the recommended default.
The portal keeps sign-in logs only briefly. Export them to Log Analytics, storage, and a SIEM — then query, alert, and keep the history an investigation needs. With the KQL you'll actually use.
The Azure Cloud Adoption Framework (CAF) is Microsoft's guidance and reference architecture for moving an organization to a governed, secure Azure estate — across Strategy, Plan, Ready, Adopt, Govern, and Manage. Here's each phase in a sentence, what a cloud engineer touches, and the gap between naming the phases and standing up a landing zone that passes an audit.
An isolated US-government cloud for agencies and contractors — FedRAMP High, DoD Impact Levels, separate endpoints. Commercial vs Government, and what differs for engineers.
RBAC controls who can do what; Azure Policy controls what's allowed to exist. Different jobs, and you need both. The confusion, cleared up.
Someone with legitimate delete rights fat-fingers the wrong resource group and the production database goes with it. Resource locks make that specific disaster impossible — even for people who are allowed to delete.
One subscription is easy to govern. Fifty is a nightmare if you configure each by hand. Management groups are the layer above subscriptions where you set a rule once and let inheritance push it to all of them.
Three roles cover most of what you do — and the difference between two of them is the most common access mistake in the cloud. Contributor builds everything and grants nothing; that gap is the whole point.
A landing zone is the prepared runway workloads land on — secure, networked, and governed before the first application ships. The eight design areas and the platform/application split, without the enterprise-scale intimidation.
One short, honest Azure note at a time — plus the occasional hiring signal. No spam, no card, unsubscribe in one click.