4.2. Security Management Capabilities of Azure

💡 First Principle: Deploying the right controls once isn't enough — cloud environments change constantly (new resources, new misconfigurations, new vulnerabilities), so security management capabilities continuously assess posture across the entire environment and surface prioritized recommendations, turning "did we configure this correctly on day one" into "are we still configured correctly today."

Why care: a resource deployed securely today can drift out of compliance next week when someone adds a public endpoint for convenience. Without continuous posture assessment, that drift goes unnoticed until it's exploited — this is the same continuous-verification idea from GRC (Phase 2.1.5) and compliance (Phase 1.2), applied specifically to cloud security configuration.

⚠️ Common Misconception: Assuming a secure initial deployment stays secure indefinitely. Cloud environments drift constantly, which is exactly why continuous posture management tools exist rather than one-time configuration reviews.