Governance failures rarely show up as a single bad decision. They show up as drift — small exceptions granted under deadline pressure that compound over 18 months into an environment nobody fully understands or controls. Here are the five patterns I see most consistently across enterprise Azure environments, roughly in order of financial impact.
1. No Subscription Strategy
One giant subscription holding every workload, every environment, every team. This kills cost visibility, makes RBAC unmanageable, and means a single quota limit or outage blast radius affects everything at once. A proper subscription design (by environment, business unit, or workload criticality) should be decided before migration, not retrofitted after.
2. Shadow IT Resource Groups
Teams spinning up resources outside the sanctioned landing zone because the approved path is slower than just doing it themselves. This is a process failure, not a technology failure — if your governed path takes three weeks and the unsanctioned path takes ten minutes, people will take ten minutes every time.
3. Over-Permissioned Service Principals
Service principals and managed identities granted Owner or Contributor at the subscription level because it was faster than scoping the actual permissions needed. This is the single most common finding in security reviews I run, and it’s also one of the cheapest to fix.
4. No Cost Allocation Tagging Enforced at Policy Level
Ungoverned tagging is a governance failure before it’s a cost failure. You can’t govern what you can’t attribute — and tagging left to individual discretion drifts within a quarter.
5. Well-Architected Reviews Treated as a One-Time Audit
Organizations run a Well-Architected Framework review once, produce a report, and never revisit it. Architecture drifts. A review from 18 months ago doesn’t reflect what’s actually running today.
The fix for all five is the same underlying discipline: governance has to be built into the platform (policy-as-code, landing zones, automated tagging) rather than enforced through documentation nobody reads. If any of these sound familiar in your environment, that’s usually the starting point for an engagement — a governance and Well-Architected review that tells you exactly where the drift is before it becomes a line item.