Azure Bastion: diagnose native client access before opening RDP or SSH
A production runbook for separating local client, SKU, tunneling, RBAC, NSG and guest-service failures when Azure Bastion native access breaks.
Read article
Tag
rbac
16 articles connected to this technical signal.
Azure Resource Locks: diagnose a blocked deployment before removing the lock
A production runbook for separating inherited Azure management locks, RBAC, Policy and deny assignments, then validating a bounded unlock, deployment and rollback.
Read articleAzure Key Vault: migrate access policies to Azure RBAC without breaking workloads
A production runbook for inventorying Key Vault access, staging data-plane roles, cutting over to Azure RBAC with real probes, validating workloads and rolling back without broadening permissions.
Read articleAzure Resource Graph: prove inventory completeness before automated remediation
A production runbook for proving Azure Resource Graph scope, identity, pagination and result completeness before an inventory drives automated changes.
Read articleMicrosoft Entra PIM: diagnose Azure role activation before granting permanent access
A production runbook for separating PIM eligibility, activation, approval, Conditional Access, RBAC propagation and effective ARM access before any permanent bypass.
Read articleAzure Managed Identity: diagnose principal drift after resource recreation
A production runbook for proving that a recreated Azure resource has a new principalId, finding orphaned roles and restoring least privilege without broadening RBAC.
Read articleAzure Automation: prove the runbook identity before broadening RBAC
A production runbook to identify the principal that actually executes an Azure Automation job, bound its permissions, validate with a canary and retain rollback.
Read articleAzure AKS: diagnose Workload Identity before bringing back a secret
A production runbook for isolating a Microsoft Entra Workload ID failure across the pod, ServiceAccount, webhook, OIDC token, managed identity and RBAC, then validating or rolling back without a client secret.
Read articleAzure Policy: bound a remediation task before it rewrites production
A production runbook for validating the target set, identity, roles, canary, logs and rollback of an Azure Policy remediation before scaling it out.
Read articleAzure Chaos Studio: bound a resilience test before disrupting production
A production runbook for controlling blast radius, execution identity, evidence, abort criteria and recovery for an Azure Chaos Studio scenario.
Read articleAzure Deployment Stacks: validate unmanage and deny settings before an update
A production runbook for reviewing managed resources, unmanage behavior, deny settings, excluded identities, validation and rollback before updating an Azure Deployment Stack.
Read articleAgentOps: diagnose permission drift before widening an agent's rights
A production runbook for qualifying AI agent permission drift with the real identity, RBAC, tool scopes, traces, expected denials, human validation and rollback before widening access.
Read articleAzure Container Apps: diagnose Managed Identity before widening a role
A production runbook for qualifying Azure Container Apps 401/403 failures with Managed Identity, token evidence, RBAC scope, Key Vault, ACR, logs, validation and rollback before widening permissions.
Read articleAzure Policy: diagnose a deny before creating a production exemption
A production runbook for qualifying an Azure Policy deployment deny with assignment, initiative, deny effect, compliance, scoped exemption, validation and rollback.
Read articleAzure Key Vault: diagnose secret references before rotation
A production runbook for qualifying a Key Vault reference failure with managed identity, RBAC, secret version, diagnostics, KQL, validation and rollback before rotating or broadening access.
Read articleAzure RBAC: diagnose authorization drift before widening a role
A production runbook for qualifying Azure RBAC drift with the real identity, scope, PIM, role assignments, deny assignments, logs, validation and rollback before adding permissions.
Read article