Azure platform engineering: Cloud Adoption Framework management groups and subscription hierarchy, hub-and-spoke and Virtual WAN networking, Private Endpoints with Private DNS zones, Key Vault, Azure Policy as code, and Entra RBAC. Use when designing an Azure landing zone or network topology, making Storage, SQL or other PaaS unreachable from the internet, or enforcing tagging and allowed regions across every subscription.
