What’s the best way to troubleshoot inconsistent Azure access?
I keep running into cases where an Azure resource exists and appears to be configured correctly, but one person can perform an action while another person cannot. Troubleshooting…
Azure RBAC
Can Azure Bicep Assign Reservation Reader and Savings Plan Reader Roles?
I'm trying to use an Azure Bicep template to assign read-only access for reservations and savings plans. I'm not trying to purchase either resource; I only want to…
Can Azure Bicep Assign Reservation Reader and Savings Plan Reader Roles?
I need to use an Azure Bicep template to assign the Reservation Reader and Savings Plan Reader roles. I'm not trying to purchase a reservation or savings plan;…
Should RBAC assignments live at the tenant root or the company-level group?
I need a central place to manage both always-on and on-demand RBAC role assignments for human users. Should these assignments be created directly at the tenant root management…
Should RBAC assignments live at the tenant root or the company-level group?
I need a central place to manage both on-demand and ambient (always-on) RBAC assignments for human users. Should these assignments be created directly at the tenant root group,…
I Accidentally Deleted a Company Azure Resource Group—What Should I Do?
I was cleaning up several Azure resource groups that I had created for personal projects. I assumed the portal was only showing groups I owned, so I deleted…
Should We Use One Azure Key Vault per Application or Share One per Environment?
Our platform team is designing secrets management for several applications in the same delivery group. We could manage one Key Vault per environment, or create separate vaults for…
Should We Use One Azure Key Vault per Application or a Shared Vault per Environment?
Our platform team is designing Azure Key Vault usage for several applications in the same ART. We are considering either a separate vault for each application or one…
How should we redesign Azure access across multiple subscriptions?
We have an Azure environment with multiple subscriptions, and users currently receive Owner and Contributor access at the tenant or root management-group level. Those permissions are inherited by…
Should Azure VMs Have Dedicated Subscriptions Separate From Other Workloads?
Our existing subscriptions contain non-server workloads deployed by the DevOps team. That team does not want to deploy or support virtual machines, so they would prefer the server…
Unable to remove a retired employee as the last Azure subscription Owner
We inherited a legacy Azure PAYG subscription that was originally created and managed by an employee who has since retired. Billing has been moved to organizational ownership: the…
How can we remove a retired employee’s final Azure subscription Owner assignment?
We inherited a legacy Azure pay-as-you-go subscription that was originally created and managed by a former employee. The payment method, billing profile name, billing contacts, and invoice recipients…