Terraform for Azure: State Locking, Directory Layout & DRY Modules

### Best Practices for Azure Terraform Provisioning

1. **Always Use Remote State Storage**: Store `terraform.tfstate` in a secure Azure Blob Storage container with lease-locking enabled via Azure Storage Accounts. 2. **Use Managed Identities for Authentication**: Avoid hardcoding Azure client secrets in pipeline environment variables. Use OpenID Connect (OIDC) federated credentials with Azure DevOps or GitHub Actions. 3. **Structure Workspaces for Isolation**: Separate your state files per environment (`dev`, `test`, `prod`) to minimize blast radius.