Azure
We host a number of projects on Azure.
Deployment
Section titled “Deployment”Deployment happens via GitHub Actions, not manually from a developer’s machine or the portal.
Access
Section titled “Access”Access to the Azure Portal requires PIM (Privileged Identity Management) activation — standing access is not granted. Activate the role you need before making changes, and let it expire again once you’re done rather than keeping it active by default.
Logging
Section titled “Logging”We use Application Insights for logging and monitoring, rather than Betterstack.
Infrastructure as code
Section titled “Infrastructure as code”All infrastructure must be documented in Bicep — no manual (“ClickOps”) changes in the portal. The portal is for viewing state and PIM-gated troubleshooting, not for provisioning or long-term configuration changes.
Resource tagging
Section titled “Resource tagging”Every resource must be tagged with:
- Customer — who the resource is deployed for.
- Environment — e.g.
production,staging,development. - Developer — who owns/maintains the resource.
- ProjectID — the identifier used to trace the resource back to its project.
Consistent tagging is what makes cost allocation, ownership, and cleanup possible across the subscription — untagged resources should be treated as a gap to fix, not left as-is.