Starting over in new Azure tenant. Advice?
My department has had its own Azure tenant and subscriptions for about 4 years now. We have a handful of typical workloads including VMs, storage, SQL MI, and Synapse. There's been some reorg in recent months and now the central IT team is requiring us to migrate into new subscriptions within their new tenant (new enterprise agreement). This will likely be a long, manual process as we've been told by our MS team there isn't a simple way to just re-link our existing subscriptions to the new tenant. I'm ok with that as I don't want to just drag a bunch of junk forward. We had to get running in Azure fast so we didn't have much time to learn best practices, proper configs, etc in the beginning. I'm sure there's plenty of things I'd do differently now so I view this as a rare opportunity to start from scratch and implement some best practices and things learned along the way.
The reorg has a heavy focus on security so we're getting up to speed with Defender for Cloud, lots to do there. Also, now making use of Azure Update Manager. I've done a little with Azure Policy, but know there's a ton more we should leverage there. Seeking some advice on the top 3 to 5 areas we should focus on implementing from the start BEFORE we actually begin creating/migrating any resources. The tenant admins will create the subscriptions for us and they will manage Entra and provision the networking bits, but we will remain owners of these new subscriptions. Any advice is much appreciated. Thanks.