Azure administration lab: CLI provisioning, cost controls and private storage with RBAC

At work, Azure and Entra ID administration happens inside an established enterprise tenant with its own subscriptions, policies and change process. That is valuable experience, but it does not cover setting up a subscription from nothing.

This lab exists to work through subscription-level administration from scratch: creating resources, controlling spend and granting access the way a production environment should, using the CLI rather than the portal so that each step is explicit and repeatable.

• —Resource groups and resources created and managed through Azure CLI.
• —A monthly budget with an Action Group for cost notifications, configured before any chargeable resource.
• —A private blob storage account with public access disabled.
• —The Storage Blob Data Contributor role assigned through RBAC to the identity that needed to work with the data.

Access was tested rather than assumed. Blob upload and listing operations were run as the authenticated identity against the private storage and confirmed to succeed with the RBAC assignment in place.

Cost governance and access control were configured first because they are cheaper to get right up front than to retrofit. A budget alert that exists before the first resource catches mistakes early, and a least-privilege role assigned before any data is present means nothing was ever reachable more broadly than intended.

The lab is the counterpart to the Entra ID and Intune administration I do at Lockton. Identity, RBAC and Conditional Access concepts carry across directly; the lab adds the subscription, resource and cost layers that a service-delivery role does not normally touch.