Azure From Scratch. Empty Subscription. Tight Deadline. A Real War Story.

Empty subscription. Tight deadline. A team that had never touched Azure before. That was day zero. The requirements were non-negotiable: multi-region HA across availability zones, zero trust as an actual network design (not a buzzword), 100% Terraform with no portal clicking, and a hub-spoke topology because flat networks in enterprise are a security incident waiting to happen. The foundation was Terraform modules for every resource type - reusable, versioned, tested. Landing zones with subscription vending so new teams get a secure environment in hours, not weeks. Azure Policy as guardrails. And a CI/CD pipeline for infrastructure itself: plan, review, apply. Nobody runs Terraform from a laptop. Security was not an afterthought. Private endpoints on everything - no public-facing resources in the backend. NSG rules version-controlled and audited. Key Vault for every secret, no exceptions. RBAC with least privilege, reviewed monthly. We spent 3 days on network design before writing a single line of Terraform. That decision saved 3 weeks of rework. The mistakes that bit hardest: underestimating DNS complexity in hub-spoke (it's always DNS), assuming Azure defaults are secure (they…