Organize governance before deployment
Separate environments at an appropriate subscription or management boundary. Use resource groups for components that share ownership and lifecycle. Apply naming, tagging, and policy consistently so cost and risk have visible owners.
Use centralized identity, multi-factor authentication, scoped roles, and temporary elevation. Assign VMs managed identities for access to secrets and platform services rather than storing credentials on disk.
Design VNets by trust
Create subnets for perimeter, application, data, and management functions. Network security groups should express the intended traffic path. Avoid public SSH; use protected administration and document DNS, routes, egress, peering, and hybrid links.
For resilient tiers, distribute instances across supported fault boundaries and place them behind an appropriate load-balancing service. Health probes should represent application readiness.
Standardize images and disks
Select supported Linux images, then create a versioned golden-image process for updates, agents, hardening, and tests. Bootstrap with cloud-init and configuration code. Keep application secrets outside metadata and images.
Treat operating-system disks as replaceable. Select data disks by measured latency and throughput, and use application-consistent backup for stateful systems. Protect keys and recovery information independently.
Operate cloud and hybrid paths
Collect guest metrics, application logs, platform events, identity changes, and network evidence. Track deployment versions and user-facing service levels. Test alerts after every agent or image change.
Hybrid connectivity adds routing, DNS, identity, latency, and failure dependencies. Design applications to tolerate link loss, and rehearse restoration into an isolated environment. Cost reviews should include idle VMs, disks, snapshots, network transfer, and log retention.
