mir-cloud-azure

Make It Right (Azure module). Microsoft Entra identity and Azure service mechanics, loaded after the provider is chosen. Covers: app registration vs. service principal vs. managed identity, and the ~24-hour token cache that delays every role change; federated identity credentials that fail silently on a subject mismatch; RBAC scope inheritance, additive-only evaluation, and no deny assignment you can write — Azure…