Azure Daily Operations Guide

Overview

This guide covers the practical day-to-day mechanics of working in the Azure environment — how to authenticate, switch between subscriptions and tenants, navigate the portal, and run common CLI operations. For architecture and what lives where, see Azure Infrastructure Overview.

Cirius has two separate Azure tenants:

Tenant	Domain	Tenant ID	Purpose
PROD	ciriusgroup.com	d477c9f8	Internal users, servers, logging, networking
DDE	ciriusdde.com	ff1c5d68	Customer-facing AVD/published app for Medicare

Your @ciriusgroup.com account gives you access to PROD by default. DDE requires switching tenants in the portal or CLI.

Azure Portal Access

Logging In

Go to https://portal.azure.com
Sign in with your @ciriusgroup.com account
MFA will be required (Conditional Access — this applies even for admin accounts)
You land in the PROD tenant by default

Switching Subscriptions

PROD has multiple subscriptions (Prod, Logging, Identity, Firewall, Development, Main). To switch:

Top of the portal → Subscriptions filter icon → select the subscription
Or click the subscription name in any resource's breadcrumb

Switching to the DDE Tenant

Click your account avatar (top right) → Switch directory
Select Cirius DDE (ciriusdde.com)
The portal reloads in the DDE tenant context

To switch back to PROD, repeat and select Cirius Group (ciriusgroup.com).

Azure Subscription Quick Reference

Subscription	Purpose	Key Resource Groups
Production	Production VMs, application workloads	rg-prod-, rg-identity-
Logging	Log Analytics, SecOps platform, archive storage	rg-logging-logs
Identity	AD domain controllers, Entra Connect	rg-identity-*
Firewall	Palo Alto VM-Series, hub VNets	rg-firewall-*
Development	Dev workloads (minimal)	rg-dev-*
Main	OIDC federation, Terraform state, Key Vault	rg-main-*

Azure CLI Setup

Install

bash

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
az --version   # should show 2.x

Authenticate

bash

az login

This opens a browser. Log in with your @ciriusgroup.com account. After login, the CLI is authenticated and all subscriptions you have access to are listed.

bash

# List all subscriptions you can access
az account list --output table

# Set the default subscription
az account set --subscription "Production"

# Confirm what you're currently set to
az account show --output table

Switching Between PROD and DDE Tenants in CLI

bash

# Login to DDE tenant explicitly
az login --tenant ff1c5d68

# Or after initial login, switch tenant context
az account set --subscription "<DDE subscription name>"

Check your current tenant:

bash

az account show --query tenantId -o tsv

Common Daily CLI Operations

Finding Resources

bash

# List all resource groups in current subscription
az group list --output table

# List all VMs in a resource group
az vm list --resource-group rg-prod-servers --show-details --output table

# Find a resource by name across all resource groups
az resource list --name "*secops*" --output table

# List Container Apps in the logging subscription
az containerapp list --subscription "Logging" --output table

VM Operations

bash

# Start a VM
az vm start --resource-group rg-prod-servers --name vm-name

# Stop a VM (deallocated — no charges)
az vm deallocate --resource-group rg-prod-servers --name vm-name

# Check VM status
az vm get-instance-view --resource-group rg-prod-servers --name vm-name \
  --query instanceView.statuses --output table

# Get the private IP of a VM
az vm show --resource-group rg-prod-servers --name vm-name \
  --query privateIps -d --output tsv

Key Vault

bash

# List secrets in the Key Vault (names only — values require explicit get)
az keyvault secret list --vault-name cirius-openai-kv-prod --output table

# Get a secret value
az keyvault secret show --vault-name cirius-openai-kv-prod --name SecretName --query value -o tsv

Container Apps (SecOps Platform and Agents)

bash

# List Container Apps in the logging resource group
az containerapp list --resource-group rg-logging-logs --output table

# Get the SecOps platform URL
az containerapp show --resource-group rg-logging-logs --name ca-secops-prod \
  --query properties.configuration.ingress.fqdn -o tsv

# View Container App logs (last 100 lines)
az containerapp logs show --resource-group rg-logging-logs --name ca-secops-prod \
  --tail 100

# Restart a Container App (triggers redeploy)
az containerapp revision restart --resource-group rg-logging-logs \
  --name ca-secops-prod --revision $(az containerapp revision list \
  --resource-group rg-logging-logs --name ca-secops-prod \
  --query "[?properties.active].name" -o tsv | head -1)

Log Analytics — KQL from CLI

bash

# Run a KQL query against the central LAW workspace
az monitor log-analytics query \
  --workspace 5d76d1f2 \
  --analytics-query "SignInLogs | where TimeGenerated > ago(1h) | limit 10" \
  --output table

Storage and Archives

bash

# List storage accounts
az storage account list --output table

# List containers in a storage account
az storage container list --account-name <storage-account> --output table --auth-mode login

Terraform — Plan-Only Workflow

All Terraform applies go through GitHub Actions. Local Terraform is plan-only.

bash

# Authenticate CLI for Terraform
az login
az account set --subscription "Production"

# Navigate to the relevant Terraform directory
cd ~/src/azure-infra/prod

# Initialize (first time or after provider changes)
terraform init

# Plan — shows what would change, no apply
terraform plan

# Never run terraform apply locally

If you get a credentials error in Terraform:

bash

az account show   # verify you're logged into the right subscription
export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv)

Azure Resource Naming Convention

All resources follow the pattern <type>-<env>-<purpose>[-<suffix>]:

Resource	Convention	Example
Resource group	`rg-<env>-<purpose>`	`rg-logging-logs`
Virtual machine	`vm-<purpose>-<suffix>`	`vm-twingate-conn01`
Log Analytics workspace	`<org>-<env>-law-<scope>`	`cirius-logging-law-central`
Container App	`ca-<purpose>-<env>`	`ca-secops-prod`
Key Vault	`<org>-<purpose>-kv-<env>`	`cirius-openai-kv-prod`
Storage account	(no dashes, 3-24 chars)	`ciriuslogarchive01`

Required Tags on All Resources

Every resource must have these tags (enforced by Azure Policy):

Environment = prod | dde | dr | dev
Owner       = infrastructure
Project     = cirius-group
ManagedBy   = terraform
Lifecycle   = permanent | decommission

Resources without these tags will flag in compliance scans.

Checking Azure Policy Compliance

Azure Policy enforces HIPAA/HITRUST and ISO 27001 controls on all subscriptions.

bash

# List non-compliant resources in a subscription
az policy state list --subscription "Production" \
  --filter "complianceState eq 'NonCompliant'" \
  --select "resourceId,policyDefinitionName" \
  --output table

Or in the portal: Policy → Compliance in any subscription to see the compliance dashboard with the percentage of resources meeting each control.

Troubleshooting Common Issues

`az login` Opens Browser But Hangs

bash

# Use device code flow instead
az login --use-device-code

`AuthorizationFailed` on a Resource

Your account doesn't have RBAC access to that resource. Check:

Are you in the right subscription? (az account show)
Do you have a PIM-eligible role that needs activation? (See runbooks/entra-identity-operations.md)
Is there a deny assignment blocking access?

Terraform Can't Find Resources

bash

# Verify the subscription is correct
az account show --query name -o tsv

# Re-authenticate if the token expired (tokens last 1 hour)
az login

Can't See DDE Resources

Make sure you've switched to the DDE tenant:

bash

az account show --query tenantId -o tsv   # should be ff1c5d68 for DDE
az login --tenant ff1c5d68

Azure Infrastructure Overview — subscriptions, architecture
AWS Account Access Guide — AWS equivalent of this guide
Entra Identity Operations — user, group, PIM management
OIDC Authentication — how CI/CD authenticates (different from human access)
Network Topology — VNets and IP ranges

Document History

Date	Change	Author
May 2026	Initial draft — portal access, CLI auth, subscription switching, common operations, Terraform workflow, naming conventions, troubleshooting.	Rory

Azure Daily Operations Guide ​

Overview ​

Azure Portal Access ​

Logging In ​

Switching Subscriptions ​

Switching to the DDE Tenant ​

Azure Subscription Quick Reference ​

Azure CLI Setup ​

Install ​

Authenticate ​

Switching Between PROD and DDE Tenants in CLI ​

Common Daily CLI Operations ​

Finding Resources ​

VM Operations ​

Key Vault ​

Container Apps (SecOps Platform and Agents) ​

Log Analytics — KQL from CLI ​

Storage and Archives ​

Terraform — Plan-Only Workflow ​

Azure Resource Naming Convention ​

Required Tags on All Resources ​

Checking Azure Policy Compliance ​

Troubleshooting Common Issues ​

az login Opens Browser But Hangs ​

AuthorizationFailed on a Resource ​

Terraform Can't Find Resources ​

Can't See DDE Resources ​

Related Documents ​

Document History ​

Azure Daily Operations Guide

Overview

Azure Portal Access

Logging In

Switching Subscriptions

Switching to the DDE Tenant

Azure Subscription Quick Reference

Azure CLI Setup

Install

Authenticate

Switching Between PROD and DDE Tenants in CLI

Common Daily CLI Operations

Finding Resources

VM Operations

Key Vault

Container Apps (SecOps Platform and Agents)

Log Analytics — KQL from CLI

Storage and Archives

Terraform — Plan-Only Workflow

Azure Resource Naming Convention

Required Tags on All Resources

Checking Azure Policy Compliance

Troubleshooting Common Issues

`az login` Opens Browser But Hangs

`AuthorizationFailed` on a Resource

Terraform Can't Find Resources

Can't See DDE Resources

Related Documents

Document History