The ticket
Priya cannot open the pay-api portal. Junior reboots the spoke VM. The VM is healthy. The sign-in log says the token was issued for the wrong tenant. You patched compute. The perimeter is Entra.
Microsoft’s shared-responsibility model: for every cloud type you still own data, identities, accounts, and access. IaaS adds OS and network controls on you; PaaS/SaaS move more of the stack to Microsoft. The Entra tenant is the identity boundary (users, apps, Conditional Access). A subscription is a billing + RBAC container that trusts a tenant. One tenant, many subscriptions. Compromised identity beats a perfect NSG.
Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.
Mental model
| Plane | Who owns it | This lab | If it breaks |
|---|---|---|---|
| Physical DC / host / hypervisor | Microsoft | You cannot SSH the host | Azure status — rare on a student ticket |
| Subscription + RBAC | You | sub-hub, sub-spoke-app | Cannot deploy / wrong Owner |
| Entra directory | You | Tenant techclick-lab.in | Nobody signs in, or the wrong people do |
| Data + app config | You | pay-api, kv-tc-lab | Leak or outage with a healthy VM |
Delete a subscription and the tenant remains. Compromise the tenant and every sub is in play.
How to choose
| Symptom | First plane | Not first |
|---|---|---|
| Sign-in failed / wrong tenant | Entra | Reboot pay-api |
| Deploy denied | RBAC on the subscription | Open NSG any-any |
| Host unreachable everywhere | Azure status + region | Reset Entra passwords |
techclick-lab.in
Runbook
Side A — who am I
Portal top-right: tenant name + email. If it says a personal MSA tenant, you are not in
techclick-lab.in.Side B — which sub
Directory + subscription filter.
sub-spoke-appfor pay-api.sub-hubfor Firewall and the VPN gateway.Side C — prove
az account showthen Entra sign-in logs for Priya. A healthy VM is not a healthy identity.
az account show --query "[name, id, tenantId]" -o tsv # sub-spoke-app # 11111111-1111-1111-1111-111111111111 # 22222222-2222-2222-2222-222222222222 # Portal top-right directory must read techclick-lab.in az ad signed-in-user show --query userPrincipalName -o tsv # priya@techclick-lab.in
Four failures
1 · “Microsoft will patch our Owner”
They will not. Owner, Guest invites, and CA are yours on every SKU.
2 · Tenant ≠ subscription
Junior deleted sub-spoke-app to “reset Azure AD.” Users and app registrations stayed. Billing died.
3 · Guest in the wrong directory
Priya’s work account is a guest of a partner tenant. Tokens look valid. Resources are not here.
4 · Status page as a close code
Regional green does not mean CA, RBAC, or a secret is healthy.
How to prove it
1) You named tenant vs subscription. 2) az account show matches the portal directory. 3) You said who owns identity. 4) You did not reboot pay-api as a ritual.
Traps
| Heard in chat | Truth | Wrong fix |
|---|---|---|
| Azure is down | Which plane — fabric, sub, or Entra? | Redeploy the hub VNet |
| Give her Owner on the tenant | Owner is a subscription/MG role | Global Admin “for a minute” |
| IaaS means Microsoft patches Windows | You patch the guest OS | Wait for a host update |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview
Sources
Related: Azure session factory · Migration series.