Microsoft Azure
Also known as: Azure
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Microsoft Azure?
Microsoft Azure is a global cloud platform providing compute, networking, storage, data, identity, security and managed application services. This profile connects the concept to KBY's practical engineering guidance.
Resources are organised into tenants, subscriptions, resource groups and regions and controlled through Azure Resource Manager. Microsoft Entra identity, role-based access, policy and service-specific network controls define much of the operational boundary.
Build and operate applications and infrastructure using Microsoft-managed cloud services.
- Enterprise cloud infrastructure
- Hybrid cloud architectures
- PaaS for application development
Explore related technologies
Sub-technologies
18+ resources for Microsoft Azure
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Microsoft Azure
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(1)
Learn the architecture, concepts and engineering context.
Graduate Learning(2)
Build practical knowledge and hands-on skills.
Config Traps(12+)
Recognise and avoid known failure modes.
- Federated Credential Audience Mismatch Silently Blocks Azure Workload Identity Token ExchangeAn Entra ID federated identity credential can be created with no errors while its audience field never matches the workload's actual OIDC token, causing silent, indefinite Azure AD authentication failure. Open
- A Conditional Access Policy Stuck in Report-only Silently Skips EnforcementA Conditional Access policy can show as active while its real enablement state is Report-only, silently logging violations instead of blocking them. Here is how to detect, correct and safely roll back that gap. Open
- Azure Key Vault RBAC Migration Leaves Legacy Access Policies Silently ActiveToggling Azure Key Vault to RBAC authorisation does not remove existing access policies. Legacy identities can retain secret access until stale policy entries are explicitly deleted and verified. Open
- A Lower-Priority NSG Allow Rule Silently Overrides Subnet-Level DenyA lower-priority NSG allow rule attached to a network interface silently outranks a subnet-level deny rule, exposing a workload despite an apparently correct subnet policy. Open
- Azure Storage 'Selected Networks' Firewall Still Allows Trusted Azure Services ThroughAn Azure Storage account locked to 'Selected networks' still allows any trusted Azure service to bypass the firewall by default, letting unapproved resources read and write data through an exception hidden below the subnet rule list. Open
- System-Assigned Managed Identity Silently Loses Access After a VM RebuildRecreating an Azure VM with the same name generates a brand-new system-assigned managed identity object ID, silently orphaning existing RBAC role assignments and breaking application authentication without any visible configuration change. Open
- Azure Conditional Access Misses Service Principal Sign-InsA Conditional Access policy scoped to 'All users' does not cover Azure service principal or managed identity sign-ins. Here is how to verify the gap, correct it in report-only mode and roll back safely. Open
- Azure App Service Access Restrictions Skip the SCM EndpointA single Access Restrictions panel implies one rule set. Azure App Service actually keeps two, and the deployment surface is usually the one left open. Open
- Branch-Scoped Federated Credential Subjects Grant Azure Token Exchange to Every Workflow on That BranchA federated identity credential scoped to a GitHub branch grants Azure AD token exchange to every workflow on that branch, not just the intended deployment job. Open
- Switching an Azure Key Vault to RBAC Leaves Legacy Access Policies Dormant, Not DeletedEnabling Azure RBAC on a Key Vault does not clear its legacy access policy list. If the setting is later reverted, dormant permissions reactivate silently, bypassing every RBAC-based access removal. Open
- Default NSG Inbound Rule Silently Allows Lateral Traffic Across an Entire Azure Virtual NetworkAn Azure NSG that looks locked down can still allow unrestricted traffic between hosts in the same virtual network, because a non-removable default rule permitting VNet-sourced traffic is never overridden by deny rules aimed only at internet ranges. Open
- Leftover Client Secrets Let DefaultAzureCredential Bypass Azure Workload IdentityA leftover client secret in a pod's environment lets the Azure Identity SDK's default credential chain silently bypass Azure Workload Identity federation, keeping a long-lived secret active without any visible error. Open
Incident Runbooks(2)
Stabilise, recover and validate during incidents.
- Azure App Service Security Failure: Restore Microsoft Azure SafelyA structured runbook for stabilising and recovering from Azure App Service security incidents, focusing on isolation, diagnosis, and safe remediation. Open
- Azure Network Segmentation Failure: Restore Microsoft Azure SafelyStabilise and recover Azure network segmentation failures using read-only diagnosis, bounded NSG adjustments, and explicit rollback paths. Open