From the platform

Resource group, VNet and private DNS, a private AKS cluster with workload identity and the CSI secret driver, the file shares the portal mounts, a VNet-injected PostgreSQL flexible server, the portal's managed identity.

From the owner

The three workload pools, the Key Vault, the operations identity federated to the pipeline, the DNS zone — and the container registry the images are mirrored into.

What it is not

No laptop, no portal clicks, no stored cloud credential. The pipeline signs in with OIDC for the duration of one job.