🔐 Customer-managed disk encryption (Key Vault + Disk Encryption Set) 🛡️ Network Security Group 💾 Configurable data disks 🏷️ Environment-based storage tiers (dev/test/uat = Standard_LRS, ...