A city deploys municipal landing-zone NSGs and diagnostic settings only through Bicep or Terraform pull requests. What Azure security practice is that?

Deploying municipal landing-zone NSGs and diagnostic settings only through Bicep or Terraform pull requests is infrastructure-as-code (IaC) enforcement of Azure security controls for civic tenants. The landing zone becomes a coded, reviewable baseline: network security groups that segment city workloads and diagnostic settings that feed logs to Log Analytics or storage are proposed as code, peer-reviewed, and applied by pipeline—not by ad-hoc portal clicks. That pattern reduces configuration drift, creates an auditable change history for city auditors, and keeps every department subscription aligned to the same civic security posture. When a parks or finance team needs a rule change, they open a PR against the landing-zone modules; reviewers check least-privilege intent, logging coverage, and blast radius before merge. Assigning Azure Policy initiatives for NSGs and diagnostics compliance in civic tenants fails because it is policy-based audit and remediation of compliance state, not the peer-reviewed Bicep or Terraform pull-request enforcement of NSGs and diagnostic settings described in the scenario. Policy initiatives can audit NSG and diagnostics compliance, but they do not create the reviewable IaC change history, and drift still creeps in when network and monitoring modules are updated outside pull requests. Forwarding NSG flow logs and diagnostics to Log Analytics workspaces for civic tenants fails because it describes configuring log destinations, not the practice of enforcing NSGs and diagnostic settings exclusively through Bicep or Terraform pull requests. Pulling NSG and diagnostics values from Key Vault in Bicep pipelines for civic tenants fails because it describes sourcing parameter values securely during deployment, not the municipal practice of enforcing landing-zone NSGs and diagnostic settings through IaC pull requests. Exam caveat: IaC is the delivery mechanism, not a substitute for sound control design. Policy assignments that allow overly permissive rules still weaken the city; reviewers and policy-as-code must reject unsafe templates. Operational check: Confirm landing-zone pipelines apply NSGs and diagnostic settings on every subscription create or remediate run; require PR approval for network and monitoring modules; run periodic drift detection comparing live Azure resource properties to the last-applied Bicep/Terraform state; and verify diagnostic settings actually emit to the municipal Log Analytics workspace with retention that meets the city's retention policy.