// Identity & Authentication

Part 4 - The final part (at least for now, until I find somewhere else that we can expand on with this)! This part will focus on porting the keys that we have recently generated onto our YubiKey device. I own a YubiKey NEO, so i'll be using that.

Okay, part 3! At this point, I'm assuming that you have already familiarised yourself with [part 1](./blog/gpg-git-part-1) and [part 2](./blog/gpg-git-part-2) of the series. As a quick recap, part 1 focused on why we would consider using GPG Keys in general. Part 2 focused on how to generate GPG keys along with some recommended practices on splitting out our master (Certification) key, from our specific purpose-driven keys. This post (part 3) focuses on using those keys as part of our usual development workflow using Git. We'll be assuming that GitHub is our end target, as GitHub supports [commit signature verification using GPG Keys](https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification).

Vlog #10 is a milestone episode: Chris celebrates his birthday and a full year of Cloud With Chris with a new Shure SM7B microphone upgrade. The bulk of the episode is a walkthrough of Microsoft Ignite announcements, covering Azure Arc-enabled Machine Learning for on-premises data sovereignty scenarios, the Azure Communication Services and Microsoft Teams interoperability story, and significant security updates including Azure Key Vault Managed HSM (preview) and Trusted Launch for VMs. GitHub Actions fans also get a bonus segment on four lesser-known platform capabilities, including semantic release note generation and bring-your-own-environment workflows.

What exactly is an Azure Landing Zone, and why does every cloud architect keep talking about it? In this episode, Chris Reddington is joined by Karim Fahmy — an Azure Solutions Architect with over 12 years of IT experience — to demystify Azure Landing Zones and their place within the Cloud Adoption Framework. Learn how landing zones provide the structured foundation covering networking topology, identity, governance, subscriptions, and security that your workloads need to succeed in the cloud. The episode also covers Azure Blueprints, Terraform automation, and real-world strategies for incrementally building and evolving your cloud foundation over time.

Chris marks two months of weekly vlogging with a big career update: leaving FastTrack for Azure to become a Cloud Solution Architect in Microsoft's UK Customer Success Unit, focusing on the Manufacturing & Resources industry. The cloudwithchris.com site is also refreshed with a PodScribe-powered interactive transcript player that highlights spoken words in real time and enables crowd-sourced corrections — a meaningful accessibility improvement. Azure news is substantial this week, headlined by Azure RBAC for Key Vault data plane reaching GA (enabling secret- and certificate-level access control) and Azure Front Door Standard & Premium entering preview with private origin support via Private Link.

Chris recaps the health endpoint monitoring pattern episode and a PC build blog, then previews the debut of Cloud Gaming Notes with Lee Williams on game server hosting, and a candid mental health conversation with Andrew Nathan. He reviews Azure updates including Azure Cloud Services Extended Support ARM-based deployment, Azure AD Premium 99.99% SLA, the Azure Architecture Center January digest, and GitHub engineering posts on canary deployment strategies and JavaScript performance optimisation.

Chris recaps a JamStack blog post, an appearance on the MS How-To show covering cloud design patterns, and the gatekeeper and valet key patterns session on API security. He covers Azure updates including AKS automatic cluster upgrade channels and the Secret Store CSI driver for Azure Key Vault, Azure DevOps Delivery Plans 2.0 with YAML manual validation, Pulumi as an infrastructure-as-code tool supporting Python, TypeScript, and Go, and a comprehensive GitHub 2020 year-in-review.

Continuing the 'Architecting for the Cloud, one pattern at a time' series, Chris and Peter Piper explore two closely related cloud design patterns for securing APIs and backend resources. The Gatekeeper pattern positions a dedicated host between untrusted clients and trusted backend services — handling authentication, authorization, request validation, protocol translation, and rate limiting. The Valet Key pattern complements it by issuing short-lived, scope-restricted tokens (such as Azure SAS tokens) so clients can access specific resources directly, reducing load on central services without sacrificing security. The episode covers practical implementation options on Azure including API Management, Azure Key Vault, and Azure App Configuration.

New to GitHub Actions? This episode is your starting point. Chris walks through GitHub Actions workflow fundamentals—YAML syntax, jobs, steps, GitHub-hosted runners, and secrets management—then shows how to authenticate against Azure using the Azure Login action and a service principal, before running Azure CLI commands as part of your first automated pipeline.

Chris is joined by Christos Matskas — former Microsoft Premier Field Engineer, developer tools evangelist, and .NET identity expert — for a deep-dive into modern identity patterns in the cloud. They cut through the confusion between Azure AD, Azure AD B2B, Azure AD B2C, and External Identities, explain why the network perimeter is no longer your security boundary, and make the case for letting battle-hardened libraries like MSAL do the heavy lifting rather than rolling your own auth. From eliminating secrets in ARM templates to Zero Trust principles, this episode lays a practical foundation for securing any cloud application.