Technical skill for subscription (landing zone) vending: the automated, self-service process a platform team uses to request, deploy, and govern application landing zone subscriptions at scale. Covers the collect-data → initiate-platform-automation → create-subscription → post-deployment workflow, the Gitflow/parameter-file pattern, the deployment-pipeline task categories, and the platform-to-application-team handoff. Implementation uses the AVM sub-vending modules. WHEN: "subscription vending", "landing zone vending", "vend a subscription", "self-service subscriptions", "automate subscription creation", "sub-vending module", "lz-vending module", "subscription parameter file", "subscription request pipeline", "platform to app team handoff", "provision governed subscriptions at scale". DO NOT USE FOR: the management group hierarchy / subscription strategy itself (use caf-resource-organization); policy/initiative authoring (use caf-governance); deploying the platform foundation (use the alz-accelerator skill);
CAF/ALZ guidance for the Azure billing and Microsoft Entra tenant design area: choosing and securing the Entra tenant, agreement and billing structure (EA/MCA/CSP), enrollment hierarchy, and single- vs multi-tenant decisions for a landing zone. WHEN: "entra tenant", "azure ad tenant", "billing", "enterprise agreement", "EA enrollment", "microsoft customer agreement", "MCA billing account", "CSP", "billing scope", "invoice section", "multi-tenant", "new tenant", "tenant strategy", "who owns the tenant". DO NOT USE FOR: in-tenant identity, RBAC, PIM, or Conditional Access (use caf-identity-access-management); management group / subscription layout (use caf-resource-organization); deploying the platform (use the alz-accelerator skill).
CAF/ALZ guidance for the Governance design area: policy-driven guardrails with Azure Policy and initiatives, the ALZ default policies, compliance and regulatory frameworks, cost management, Enterprise Policy as Code (EPAC), and remediation. WHEN: "governance design area", "azure policy", "policy initiative", "guardrails", "policy driven", "compliance", "regulatory compliance", "alz default policies", "deny/deployifnotexists", "remediation", "EPAC", "enterprise policy as code", "cost management", "budgets", "azgovviz", "governance visualizer". DO NOT USE FOR: choosing a single RBAC role for a resource (use the azure-rbac skill); detailed cost-savings analysis of a live subscription (use the azure-cost-optimization skill); the management-group/subscription layout itself (use caf-resource-organization); deploying the platform (use the alz-accelerator skill).
CAF/ALZ guidance for the Identity and access management design area: Microsoft Entra ID design, the identity subscription, RBAC and custom roles, Privileged Identity Management (PIM), Conditional Access, and hybrid identity for landing zones. WHEN: "identity", "entra id", "azure ad", "rbac", "role assignment strategy", "custom role", "PIM", "privileged identity management", "conditional access", "managed identity", "service principal", "identity subscription", "domain controllers in azure", "hybrid identity", "least privilege", "break glass". DO NOT USE FOR: choosing/creating the tenant or billing (use caf-billing-entra-tenant); finding a specific role for a resource and generating the assignment (use the azure-rbac skill); Entra app registration walkthroughs (use entra-app-registration); deploying the platform (use the alz-accelerator skill).
CAF/ALZ guidance for the Management design area: platform operations baselines, the centralized Log Analytics workspace and Azure Monitor, Azure Monitor Baseline Alerts (AMBA), the Management subscription, backup and disaster recovery, patching/Update Manager, and the dev-test-prod management approach. WHEN: "management design area", "monitoring baseline", "log analytics workspace", "azure monitor", "AMBA", "baseline alerts", "management subscription", "backup strategy", "disaster recovery", "business continuity", "BCDR", "update manager", "patching", "operational baseline", "platform operations". DO NOT USE FOR: SIEM/threat detection with Sentinel or Defender (use caf-security); policy/compliance reporting (use caf-governance); debugging a live production incident (use the azure-diagnostics skill); deploying the platform (use the alz-accelerator skill).
CAF/ALZ guidance for the Platform automation and DevOps design area: infrastructure as code for the platform, the bootstrap/management of the deployment toolchain, CI/CD pipelines and Git workflow, identities for automation (managed identities, OIDC/workload identity federation), environments/promotion, and keeping the landing zone up to date. WHEN: "platform automation", "devops design area", "infrastructure as code", "IaC strategy", "ci/cd pipeline", "github actions", "azure devops pipelines", "gitops", "deployment identity", "workload identity federation", "OIDC to azure", "keep alz up to date", "drift", "promote environments", "bootstrap automation". DO NOT USE FOR: choosing between Bicep and Terraform accelerators or actual deployment steps (use the alz-accelerator skill); policy-as-code authoring (use caf-governance); deploying a specific app workload to Azure (use the azure-deploy skill).
CAF/ALZ guidance for the Resource organization design area: the management group hierarchy, subscription strategy (subscription democratization), the conceptual ALZ management groups (Platform, Landing Zones, Decommissioned, Sandbox), resource groups, naming, and tagging. WHEN: "management group", "management group hierarchy", "subscription strategy", "how many subscriptions", "subscription organization", "resource organization", "naming convention", "tagging strategy", "resource group structure", "corp vs online", "sandbox management group", "platform management group", "landing zones management group". DO NOT USE FOR: requesting/creating individual landing-zone subscriptions at scale (use the landing-zone-vending agent); policy assignment design (use caf-governance); deploying the hierarchy (use the alz-accelerator skill).
CAF/ALZ guidance for the Security design area: applying Zero Trust to a landing zone, Microsoft Defender for Cloud and secure score, Microsoft Sentinel, encryption and key/secret management, network security controls, and the CAF Secure methodology. WHEN: "security design", "zero trust", "defender for cloud", "secure score", "sentinel", "siem", "encryption at rest", "key vault", "customer managed keys", "secrets management", "security baseline", "threat protection", "security posture", "MCSB", "microsoft cloud security benchmark". DO NOT USE FOR: identity, RBAC, PIM, or Conditional Access design (use caf-identity-access-management); policy authoring/compliance reporting (use caf-governance); running an azqr/Key Vault expiry audit (use the azure-compliance skill); deploying the platform (use the alz-accelerator skill).