How to Use Your Spoke¶
Get access¶
- Make sure you are a member of your team's Entra ID group (the group named in your spoke request).
- If your role uses PIM: open Privileged Identity Management → My roles → Groups, and activate the
SG_SPOKE_<workload>_<env>_<role>group (the prefix can differ per platform). With approval, wait for an approver. - Open the Azure portal and select your subscription (
sub-<workload>-<env>or the agreed name).
More detail: Access, groups and PIM. To reach VMs, see Connect to VMs.
Roles on the subscription:
| Group | Role |
|---|---|
…_Owners |
Owner |
…_Contributors |
Contributor |
…_Readers |
Reader |
…_Support |
For support staff; always eligible with approval |
Deploy from your pipelines¶
- Use the spoke service principal
SPN-SPOKE-<workload>-<env>(Owner on your subscription). - If you asked for an Azure DevOps service connection, it is created for you with this SPN.
- Otherwise, the SPN secret is in your spoke Key Vault. The platform rotates it periodically; read it from the Key Vault at run time instead of copying it.
- Prefer federated credentials (workload identity federation) over secrets.
Build with the platform in mind¶
| Do | Because |
|---|---|
| Use private endpoints for PaaS services, in the private link subnet | Public endpoints are often denied by policy; DNS registration is automatic |
Don't create your own private DNS zones for privatelink.* |
The central zones are used; a policy registers your endpoints there |
| Request firewall rules before you need the traffic | Outbound traffic without a rule is blocked |
| Use the spoke Key Vault for secrets | It is private, RBAC-based and already wired |
| Send your logs to your Log Analytics workspace | It is yours for application logging and alerts |
| Tag your resources | Cost allocation and ownership |
| Check Azure Policy → Compliance for your subscription | Fix non-compliant resources; you own them |
| Deploy your own resources with code, and keep your own storage accounts out of the baseline one | The baseline storage account and Key Vault belong to the spoke baseline. Many platforms advise using the baseline storage account only for what the platform team names (for example Terraform state). Deploy storage your application needs together with the rest of your infrastructure. Ask your platform team what applies. |
Changes in acceptance and production¶
Many platforms expect that every change in acc and prd is deployed from a pipeline, with a reviewed pull request
(four-eyes principle), and not by hand in the portal. Manual changes leave no record of who changed what and why, and
they are overwritten or flagged as drift. Contributor or Owner rights in these environments are meant for emergencies
("break-glass") and short troubleshooting. If you use them, say why in the PIM reason and bring the change back into
code afterwards. Ask your platform team which rules apply to you. See also
Access, groups and PIM.
If your platform offers a library of managed Terraform or Bicep modules, see Use managed templates.
When something doesn't work¶
| Symptom | Likely cause | What to do |
|---|---|---|
Deployment denied with RequestDisallowedByPolicy |
A deny policy | Read which policy; adjust your design or request an exemption (Policy and exemptions) |
QuotaExceeded or AllocationFailed |
Quota or regional capacity | Quota and capacity |
| Can't reach an internet address | No firewall rule | Request a firewall rule |
| Private endpoint doesn't resolve | DNS policy not yet applied, or custom DNS on your VNet | Wait a few minutes; check that the VNet uses the platform DNS; contact the platform team |
| Can't see the subscription | Not in the team group, or PIM not activated | Check your group membership and activate PIM |
| SPN login fails | Secret rotated | Read the current secret from Key Vault, or switch to federated credentials |