How do you approach security and access control when working with Azure?

Lead with least privilege and work outwards.

• Identity is the perimeter. Everything authenticates through Microsoft Entra ID. Enforce multi-factor authentication, use Conditional Access policies, and disable legacy authentication protocols.
• RBAC with least privilege. Assign the narrowest built-in role that works, at the narrowest scope — a resource group rather than a subscription. Assign to groups, never to individuals, so access is managed by group membership.
• Privileged Identity Management for just-in-time elevation, so nobody holds standing Owner rights.
• Managed identities instead of secrets. This is the most important practical point: a managed identity lets a service authenticate to another Azure service with no credential stored anywhere. Where a secret is unavoidable, it belongs in Key Vault with rotation, never in configuration or code.
• Network controls — private endpoints so data services are not exposed publicly, network security groups, and a firewall or WAF at the edge.
• Azure Policy to enforce standards automatically, and Defender for Cloud for continuous posture assessment.

Note: Saying you would enforce rules with Policy rather than documentation is what distinguishes an engineer who has operated a real subscription.