landing-zones
Enforcing Golden Images with Azure Policy: Making the Compute Gallery the Only Way In
A gallery full of hardened, versioned, agent-equipped images doesn’t help the VM somebody deployed from a marketplace URN on a Friday...
Azure Resource Graph Queries Every Platform Team Should Have Saved
Every control a platform team builds eventually produces a question it can’t answer from the portal. Policy says it will block...
The Approach to Patch Management in Azure: CAF, WAF, and Azure Update Manager in Practice
Patch management has a way of looking solved right up until you actually have to design it at landing zone scale....
Composability in Azure Verified Modules
The earlier post on adopting Azure Verified Modules as an enterprise IaC standard covered the trade-off decision — what you gain,...
Deployment Agent in Practice: From Prompt to Pull Request
Most of what’s been written about the Azure Copilot Deployment Agent describes it from the outside: it takes a high-level goal,...