Microsoft's Cloud Adoption Framework gives you a beautiful diagram of Azure Landing Zones. Neat boxes, clean lines, management groups in perfect hierarchy. What it doesn't tell you is how much pain lies between that diagram and reality.
Here's what I learned implementing landing zones for enterprise workloads.
"We'll add RBAC later."
I've heard this sentence on 4 different projects. "Later" usually means "after the security audit finds it" or "after an incident."
RBAC isn't a nice-to-have. In a shared Kubernetes cluster, it's the difference between teams coexisting safely and one team accidentally deleting another's production workloads.
Your containers are running. Your app is working. Your security posture? Probably has gaps you don't know about.
After securing containerised workloads across multiple enterprise environments, here are the 5 things I find teams consistently overlooking.
Two of the most powerful governance tools in Azure, and two of the most confused. I've seen teams use RBAC when they need Policy, and Policy when they need RBAC. Here's the clear distinction.
"We follow Zero Trust principles."
I hear this in every security architecture review. But when I ask "show me," the reality is usually a VPN, some network segmentation, and hope.
Zero Trust isn't a product you buy. It's an architecture you build. Here's what it actually looks like when implemented on Azure.