Notes from the tenant, not a newsletter.
Written by whoever on the team had something worth documenting, usually right after finding it in a client environment.
Drift is not an edge case. It's the default state of any live environment.
A baseline assessment captures a single moment. The moment a developer opens a storage account's network rules to debug something at 11 p.m., or an admin grants a role for a project that ends up running six months longer than planned, the environment has already drifted from that baseline. Treating drift as a rare exception instead of a constant, ongoing process is the single most common mistake we see in organizations that manage this themselves.
Level 2 CIS controls are a business decision, not just a technical one.
Level 1 controls are close to free — minimal functional impact, broad applicability. Level 2 controls provide real additional defense but often come with genuine operational cost: more friction for developers, stricter conditional access, tighter network segmentation. We push clients to make that trade-off deliberately, control by control, rather than either skipping Level 2 entirely or applying it uniformly without weighing the cost.
An alert nobody trusts is worse than no alert at all.
The fastest way to make a SOC ineffective is to flood it with low-confidence findings until the team starts triaging by ignoring things. We spend more engineering time tuning what doesn't get escalated than what does, because the entire value of 24/7 monitoring collapses the moment a real finding gets lost in noise from ten false ones.
Most identity misconfigurations outlive the reason they existed.
A guest account gets added for a two-week contractor engagement and is still active two years later. A role assignment gets granted for an emergency fix and never gets revoked once the emergency passes. Individually, each of these looks harmless. Audited together across a mature tenant, they're usually the largest single category of findings we report — not because anyone did anything maliciously, but because nobody circled back.
Dealing with something like this in your own Azure tenant right now? Get in touch — that's usually how the first conversation starts.