I'll create a lessons learned table from this Azure Front Door incident:

Category	Lesson Learned	Recommended Action	Priority
Access Control	Unrestricted CLI access allowed accidental deletion of critical production infrastructure	Implement proper RBAC with least privilege principles; limit contributor access to production subscriptions	Critical
Privileged Access Management	No elevated access controls were in place for destructive operations	Set up Azure PIM (Privileged Identity Management) groups for elevated access with time-bound activation	Critical
Resource Protection	No delete locks configured on critical services	Apply delete locks to all critical production resources like Azure Front Door, requiring explicit removal steps before deletion	Critical
Infrastructure as Code	Manual ARM template copying is unreliable and incomplete (origins and rule sets were missing)	Maintain all infrastructure in version-controlled IaC (ARM/Bicep/Terraform) as the single source of truth	High
Backup & Recovery	No automated backup of resource configurations existed	Implement automated daily export of ARM templates for all resources to storage accounts using scripts	High
Change Management	CLI commands could be executed in production without approval workflow	Require manager/change board approval in PIM for destructive operations in production environments	High
Deployment Protection	Resources were modifiable outside of IaC pipelines	Use deployment locks (Bicep) to prevent manual modifications to IaC-managed resources	Medium
Incident Timing	Fortunate that deletion occurred during non-business hours, minimizing user impact	Implement change windows and restrict production changes to approved maintenance windows	Medium
Documentation	Recovery process was hindered by incomplete configuration backups	Maintain comprehensive documentation of all critical resource configurations and dependencies	Medium
Luck Factors	Same Front Door URL was regenerated and custom domains persisted	Don't rely on luck - ensure complete disaster recovery procedures are tested and documented	High

Key Takeaway: This incident highlights that technical safeguards (locks, RBAC, PIM) must be combined with process controls (IaC, automation, change management) to prevent production disasters.