Azure Infrastructure Provisioning Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

The first drawing for Azure

Azure in this window is a lab you can name. You need the subscription and a new resource group name that says lab. The drafts come from the virtual machine, virtual network, subnet, and network security group generators. The generators draft commands or files. They do not log into the account, and they do not create anything. You read every name before a later window applies anything.

The network is one virtual network and one subnet or the product's equivalent. A documentation prefix such as 192.0.2.0/24 stays in the note. The prefix you would apply is the one the network guide already assigned. example.com is not a name you own.

The network security group denies inbound from the internet unless a single named source is written for one port you need. The line you keep has a source you can say. A draft that contains 0.0.0.0/0 is a draft you edit. Management from the whole internet is not the lab.

The pipeline and the virtual machine do not use the Owner role. A person who is Owner remains a break-glass identity, not the daily profile. prompt-for-this is not a key, a token, or a password. It does not go in the file, the ticket, or user-data.

One lab name, one draft you can read aloud

Write the account label, the region or location, and the lab name. Draft the network first, then the virtual machine, then the edge rule. Read the drafts in that order. If a name does not say lab, change the name before you continue.

A custom-script extension is out of this hour. If a later file needs a secret, the secret stays in the platform store, not in the extension text.

The identity on the virtual machine is not an owner and not a root key. The CLI or Terraform profile is the one in the ticket. A read of that identity, from the CLI guide, matches before any create.

Stop after the drafts are in the ticket. Apply is a later hour, one resource at a time, in the account you wrote down. The cost guide has the size. The infrastructure guide has the language if you are using a file. This page does not apply all four generators in one sitting.

# Azure lab note. Review before you apply.
# Account: the one in the ticket. Region written.
# virtual network uses an assigned prefix, not a documentation range.
# Delete 0.0.0.0/0 from any draft.
# prompt-for-this is not a credential.
# One resource per later window.

A change you can finish

The later change creates the network in the lab, then stops. The machine waits until that network exists and the edge rule is the one you edited.

Rollback of a lab you just created is deleting that lab resource. You do not delete a shared network. You do not edit state or the console blindly to hide a mistake.

Write the account, the region, and the lab name.
Draft the network and confirm the prefix is assigned.
Draft the edge rule and remove 0.0.0.0/0.
Draft one virtual machine at a lab size.
Confirm the identity is not an owner.
Save the drafts. Do not apply them in the writing hour.
Hand the first create to its own window.

Mistakes that outlive the command

Azure fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Applying four drafts in one hour.
A documentation prefix typed into the account.
A 0.0.0.0/0 rule kept because the generator wrote it.
An owner or root credential in the file.
The wrong account, noticed after a create.
A production name used as the lab.
User-data or metadata that contains a secret.
The largest size as the first machine.
Owner rights on the pipeline, or a secret inside a custom-script extension.
No second admin before you change a lockout setting.
Calling the draft a finished environment.

Decisions to write down before the window

One decision for Azure: The account in the note is the lab account. The region is written. The prefix is assigned, not a documentation range. The edge source is a name. 0.0.0.0/0 is absent from the draft you will keep. The machine size is a lab size. The identity is not an owner. No credential is in the file or the ticket. Apply is a later window. One resource will be created first, the network. The resource group name says lab, and Owner is not the daily role. And a second person can say which account this is.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for Azure. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. Azure is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Azure checks before the first create

Confirm this before you call the change done: The account and region are in the ticket. The lab name is obvious. The prefix is the assigned one. No 0.0.0.0/0 remains. No credential is in the draft. The size is a lab size. The identity was read and it matches, or create has not started. A second person read the account line. The hostname in the prompt matches the hostname in the ticket for Azure. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for Azure happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.