Two questions the foundation still has to answer: is the estate configured well right now, and what happened when something went wrong. Posture with Defender for Cloud and a single central Log Analytics workspace, stood up as platform services so the estate can see itself and keep the record.
Two hardened break-glass accounts, the groups that carry every Azure role, RBAC placed on the management-group tree, Privileged Identity Management if you licensed it, and an end-to-end test that proves inheritance. The reproducible build for identity and access on the foundation.
The management-group tree, the hub, the name resolution: all of it is inert until an identity has the authority to act on it. In Azure, identity is the control plane, and this is how you arrange it so a small team can operate the foundation safely.
The build sheet for name resolution: the DNS private resolver and its inbound endpoint, the private DNS zones, the on-premises conditional forwarders, the catch-all remediation discovery flagged, and a private endpoint proven to resolve privately from both the spoke and on-premises.
The build sheet for the hub: carve the address space, create the hub and its fixed-name subnets, stand up the VPN gateway, peer the spokes with gateway transit, turn on virtual network flow logs, and prove a spoke reaches on-premises through the hub.
Hub and spoke even when it is small, an address plan built for where you are going, the two connectivity problems that age in opposite directions, and why name resolution and egress get their place in the hub from day one.
The build sheet for the governance backbone: elevate to the root once by hand, create the ten-group tree, place your subscription with the brownfield rule in mind, set the naming and tag standard, and prove inheritance flows.
The management group hierarchy, the subscriptions inside it, and the naming and tagging decisions that are nearly free on day one and painful to change later. Deploy the whole shape at once, and keep management groups for inheritance, never for workloads.
