Identity and access
Identity is the first thing configured on an Azure platform and the hardest thing to change later. Role assignments outlive the people who made them, and service principals outlive the projects that needed them.
What I cover here
Two problems I keep coming back to. The first is structuring RBAC in Terraform so that state stays small and a pull request is readable without an external lookup table. The second is working out what an existing service principal actually has access to, which comes up every time someone proposes decommissioning one.