azure-best-practices

Azure Best Practices — Well-Architected Framework, Naming, Tagging & Governance

Always load the relevant references when advising on Azure resource management:

• references/naming-conventions.md — CAF naming patterns, abbreviation table, per-resource validation rules
• references/tagging-strategy.md — 5 foundational tag categories, minimum required tags, Azure Policy enforcement
• references/security-baselines.md — per-resource-type security checks with CLI commands
• references/cost-optimization.md — right-sizing, reserved instances, orphaned resource detection
• references/reliability-checklist.md — availability zones, backup policies, redundancy tiers, DR patterns
• references/resource-graph-queries.md — ready-to-use KQL queries for common audit tasks

Well-Architected Framework — 5 Pillars

Every Azure resource review should consider all five WAF pillars. Azure Advisor maps to four of them directly.

Pillar	Advisor Category	Key Concern
Reliability	HighAvailability	Resiliency, availability zones, backup, DR
Security	Security	Data protection, encryption, RBAC, network isolation
Cost Optimization	Cost	Right-sizing, reserved instances, orphaned resources
Operational Excellence	OperationalExcellence	Monitoring, diagnostics, tagging, automation
Performance Efficiency	Performance	Scaling, load balancing, caching, SKU selection

Design Principles per Pillar

Reliability: Design for business requirements, design for resilience, design for recovery, design for operations, keep it simple.

Security: Plan security readiness, protect confidentiality, protect integrity, protect availability, sustain and evolve security posture.

Cost Optimization: Develop cost-management discipline, design with cost-efficiency mindset, design for usage optimization, design for rate optimization, monitor and optimize over time.

Operational Excellence: Embrace DevOps culture, establish development standards, evolve operations with observability, automate for efficiency, adopt safe deployment practices.

Performance Efficiency: Negotiate realistic performance targets, design to meet capacity requirements, achieve and sustain performance, optimize for long-term improvement.

Quick Reference

Azure CLI Essentials

# Authentication
az login
az account show
az account list --output table
az account set --subscription {sub-id}

# Resource enumeration
az resource list --resource-group {rg} --output table
az resource show --ids {resource-id} --output json

# Azure Resource Graph (preferred for bulk queries)
az graph query -q "Resources | summarize count() by type" --output table
az graph query -q "Resources | where resourceGroup == '{rg}'" --output table

# Azure Advisor
az advisor recommendation list --output json
az advisor recommendation list --category Cost
az advisor recommendation list --category HighAvailability
az advisor recommendation list --category Security
az advisor recommendation list --refresh

# Policy compliance
az policy state list --resource-group {rg} --output table

# Security assessments
az security assessment list --output json

Naming Convention Pattern

Official CAF pattern: {abbreviation}-{workload}-{environment}-{region}-{instance}

Example: vm-sqlprod-prod-eastus2-001

Refer to references/naming-conventions.md for the full abbreviation table and per-resource validation rules.

Minimum Required Tags

Every resource should have at minimum:

Tag Key	Category	Purpose
environment	Functional	Which environment (dev/staging/prod)
application	Functional	Which workload or app
costcenter	Accounting	Cost allocation
owner	Ownership	Accountability
criticality	Classification	Business criticality level

Refer to references/tagging-strategy.md for the full tagging strategy.

Security Essentials

1. Never allow public access without explicit justification
2. Enforce encryption at rest and in transit for all data services
3. Use managed identities instead of service principal secrets
4. Scope RBAC to the narrowest resource group possible
5. Enable diagnostic logging on all resources
6. Use private endpoints for PaaS services in production

Refer to references/security-baselines.md for per-resource-type checks.

Audit Workflow — Collect → Analyze → Report

Follow the WARA (Well-Architected Reliability Assessment) pattern:

1. Collect: Pull resource inventory via Resource Graph, Advisor recommendations, and Policy compliance state
2. Analyze: Check naming, tagging, security baselines, and pillar-specific concerns
3. Report: Generate structured findings with severity levels and remediation steps

Use references/resource-graph-queries.md for ready-to-use collection queries.

Azure Resource Graph

Prefer az graph query over az resource list for bulk operations — it supports KQL queries across all subscriptions. For ready-to-use queries covering resource inventory, tagging audit, orphaned resource detection, security checks, reliability assessment, and cost analysis, load references/resource-graph-queries.md.