Wave 11 · Cloud Identity and Device Control Azure / Landing Zone / Guardrail proof Synthetic management-group + subscription drift exports

Azure landing-zone drift, policy guardrails, and platform hygiene that stay operator-readable.

This control plane turns Azure landing-zone snapshots into one platform-governance surface: missing policy assignments, owner-role drift, public ingress, Defender coverage, diagnostic gaps, stale baselines, and the remediation packets needed before audit or rollout windows drift.

Overview Zone Lane Guardrail Risks Drift Posture Verification Docs

Commercial Front Door

Azure landing-zone, management-group, and guardrail operations for platform, identity, and security teams.
Audit-safe visibility into policy inheritance, network exposure, Defender posture, and baseline freshness without exposing tenant credentials.

Proof Layer

Offline drift analyzer + CLI + dashboard surface.
This repo includes a reusable analyzer that reads landing-zone drift exports and turns them into owner, guardrail, and remediation packets.

Why it matters

Recruiters looking for Azure / Microsoft 365 / Entra / Intune / AWS / GCP should see real cloud-admin work: policy inheritance, route integrity, owner-role hygiene, and audit-safe cleanup proof.

Docs

routes · cli · api

routes

Public control surface

/, /zone-lane, /guardrail-risks, /drift-posture, /verification, /docs

api

Structured payloads

/api/dashboard/summary, /api/zone-lane, /api/guardrail-risks, /api/drift-posture, /api/verification, /api/sample

cli

Offline landing-zone drift analysis

npx azure-landing-zone-drift fixtures/azure-landing-zone-clean.json --format summary renders the same posture the dashboard exposes.