Wave 11 · Cloud Identity and Device Control Azure / Landing Zone / Guardrail proof Synthetic management-group + subscription drift exports

Azure landing-zone drift, policy guardrails, and platform hygiene that stay operator-readable.

This control plane turns Azure landing-zone snapshots into one platform-governance surface: missing policy assignments, owner-role drift, public ingress, Defender coverage, diagnostic gaps, stale baselines, and the remediation packets needed before audit or rollout windows drift.

Overview Zone Lane Guardrail Risks Drift Posture Verification Docs

Commercial Front Door

Azure landing-zone, management-group, and guardrail operations for platform, identity, and security teams.
Audit-safe visibility into policy inheritance, network exposure, Defender posture, and baseline freshness without exposing tenant credentials.

Proof Layer

Offline drift analyzer + CLI + dashboard surface.
This repo includes a reusable analyzer that reads landing-zone drift exports and turns them into owner, guardrail, and remediation packets.

Why it matters

Recruiters looking for Azure / Microsoft 365 / Entra / Intune / AWS / GCP should see real cloud-admin work: policy inheritance, route integrity, owner-role hygiene, and audit-safe cleanup proof.

Zone Lane

owner · focus · next action

Lane	Owner	Focus	Status	Findings	Next action
Policy guardrail lane Management-group inheritance drift is weakening the Azure baseline.	Cloud Governance	Deny assignments and landing-zone inheritance	red	1	Restore required deny assignments and re-run baseline capture.
Identity lane Direct user owner drift is live in the production zone.	Azure IAM	Owner role assignments and PIM hygiene	red	1	Revoke direct owner grant and force role path back through PIM groups.
Network perimeter lane Public ingress and hub-spoke bypass both need cleanup.	Network Security	NSGs, UDRs, and firewall path integrity	red	3	Close open ingress and restore firewall transit routes.
Observability lane Key telemetry coverage and snapshot cadence have drifted.	Platform Reliability	Diagnostics, logs, and stale baseline freshness	yellow	5	Restore diagnostics and refresh stale zone baselines.