Service principals, managed identities and now Entra agent identities are all non-human identities in the same directory, and they multiply faster than anyone reviews them. This guide explains what each type is, which credential each should use, what Workload ID Premium and Agent 365 actually add, and which identity to choose for which workload, with every claim checked against Microsoft's documentation in September 2026.
Microsoft's guidance is clear that AI workloads belong in ordinary application landing zones. What changes is the order of work. Some Foundry networking choices are fixed the moment the resource is created, so they have to be settled before the first model is deployed. This guide covers placement, private endpoints and DNS, agent network isolation, keyless identity, the renamed Foundry roles, policy, the AI gateway, quotas and regions, checked against Microsoft's documentation in September 2026.
Most Azure waste is not a bad architecture decision. It is a meter that kept running after its reason ended: a disk left behind by a deleted VM, a public IP nobody released, an empty App Service plan, a reservation nobody watches. This list covers seven common leaks, with how to find each one, how to fix it, and whether policy can stop it coming back, checked against Microsoft's documentation in September 2026.