Defaults like the Cloud Adoption Framework, Azure Verified Modules and the Azure Security Benchmark all deliver. Just not straight out of the box. The problem is that Microsoft's guidance is written for the average company, and the average company is hard to find.

We look through what the standards are and why they will or will not work for you. Maybe your company doesn't need the flexibility of AVM, which can be a pain to update. The Cloud Adoption Framework gives developers a freedom plenty of organizations do not actually want. And some Security Benchmark policies will happily block built-in Azure resources.

None of these standards are wrong. They are written for someone else. You leave knowing which parts to adopt, which to adapt, and which to leave alone.