Design identity, governance, and monitoring solutions
Authentication before authorization
Microsoft Entra ID is the control plane for identity in Azure. For hybrid estates, the sync method is a deliberate choice: password hash synchronization (PHS) is the simplest, supports leaked-credential detection, and keeps working if on-premises fails; pass-through authentication (PTA) validates passwords on-premises but depends on agent health and connectivity; federation (AD FS) is the most complex and is justified only by a hard requirement for on-premises claims or third-party MFA. Seamless SSO can layer on top of PHS or PTA. Conditional Access (needs Entra ID P1) is where sign-in risk, device state, and location policies live; PIM (P2) governs just-in-time privileged role activation.
Guardrails: RBAC, Policy, locks
Learn the boundary cold. RBAC answers who can perform which operations at which scope (management group, subscription, resource group, resource). Azure Policy answers what a resource may look like, using deny, audit, append, modify, deployIfNotExists and auditIfNotExists; existing resources are only corrected when you run a remediation task. Resource locks sit outside RBAC entirely: CanNotDelete and ReadOnly apply to every principal, including Owners. Favor built-in roles; author custom roles only when the built-in set genuinely cannot express the need. For workload-to-resource access, use managed identities instead of stored secrets - system-assigned where the identity's lifetime should equal the resource's, user-assigned where it must be shared or pre-created.
Monitoring
Separate metrics from logs. Metrics are numeric, near-real-time, and drive metric alerts; logs land in a Log Analytics workspace and drive log search alerts. Diagnostic settings are what actually route resource telemetry to a workspace, storage account, or Event Hub - nothing is collected by default. Set workspace retention deliberately and consider long-term archive at lower cost.
Trap: a requirement phrased as "prevent resources from being created in a region" is Policy, not RBAC. The mirrored trap - "allow only the security team to delete" - is RBAC plus a lock.
Rule of thumb: if the sentence contains "must not be able to", ask who or what. Who → RBAC/locks. What → Policy.