Managed services on Microsoft Azure

We start from what is actually deployed in your tenant, not from the architecture diagram. The assessment produces a costed transition plan, a remediation list and an explicit acceptance point.

• Inventory management groups, subscriptions, resource groups and workloads using Azure Resource Graph queries that we hand over, so the inventory can be refreshed rather than rebuilt.
• Review Azure Monitor diagnostic settings, Log Analytics workspace design, retention and current ingestion volume per source.
• Check Azure Backup policy coverage against each workload and identify anything with no backup, no tested restore or a recovery objective the current policy cannot meet.
• Assess Microsoft Defender for Cloud plan coverage by resource type, and record the existing recommendation and alert backlog as the baseline for later reporting.
• Baseline Azure Cost Management data by subscription, tag and service, including reservation and savings plan coverage and the dates each commitment expires.
• Review Microsoft Entra ID privileged role assignments, standing access and service principal credentials, flagging anything unsafe to operate as found.

Platform tooling is configured deliberately and kept in code, so the operating model survives reorganisation and staff turnover. Everything we build here is handed over, not held privately.

• Design Log Analytics workspace layout, table plans, retention and data collection rules against real query patterns and the cost each source generates.
• Instrument applications with Application Insights, including availability tests and dependency tracking on the transactions the business would notice failing.
• Author Azure Monitor alert rules with action groups, severity and a linked runbook, using dynamic thresholds where a fixed number produces false alarms.
• Deploy Azure Policy initiatives at management-group scope, using modify remediation for tagging and deployIfNotExists for diagnostic settings and baseline configuration.
• Configure Azure Backup vaults, policies and immutability settings per workload class, aligned to the recovery objective agreed with each workload owner.
• Onboard servers and clusters outside Azure through Azure Arc, so monitoring, policy and update management cover the whole estate rather than only the migrated part.

Posture management and detection run from the same data, so what your security team reads each month is evidence rather than assertion. Escalation steps are agreed before they are needed.

• Review Microsoft Defender for Cloud recommendations on a set cadence, tracking each to closed, accepted against a named owner and review date, or scheduled as funded work.
• Operate Microsoft Sentinel analytics rules and watchlists tuned to your environment, retiring rules that generate alerts nobody investigates.
• Run Microsoft Entra ID access reviews across privileged roles, guest accounts and application registrations, replacing standing access with eligible assignment where the role allows it.
• Monitor Azure Key Vault secret, key and certificate expiry, rotating on a schedule agreed with each application owner rather than at the point of outage.
• Track update compliance and vulnerability findings per workload, holding exceptions against a named owner instead of leaving them implicit.
• Produce operational evidence supporting your alignment to frameworks such as the Essential Eight; assessment and certification remain with an accredited third party.

Tooling is only useful if your people can read it. We hand over the workbooks, queries and runbooks and teach the team to use them, so dependence on us reduces over time.

• Publish Azure Monitor workbooks and saved KQL queries in your tenant, so your engineers can answer routine questions without contacting us.
• Store runbooks and infrastructure code in your Azure DevOps or GitHub organisation, updated as part of each change rather than in a separate documentation exercise.
• Run a monthly service review with the platform owner and business sponsor covering incidents, changes, policy compliance, posture movement and cost.
• Train your service desk on first-line triage for the alerts they will actually see, including what to escalate immediately and what to observe.
• Give finance a Cost Management view they can open themselves, with budgets and anomaly alerts set to thresholds they choose.

What runs every month once the environment is under management. Coverage hours, contact channels and escalation steps are set out in your service schedule rather than assumed.

• Monitor workload health, availability tests and pipeline runs through Azure Monitor and Application Insights, acting on alerts under the arrangements in your service schedule.
• Coordinate incidents including Microsoft support case management, stakeholder updates and a written review for significant events.
• Apply patching and update rings through Azure Update Manager inside your change process, with maintenance windows agreed per workload.
• Run Azure Backup restore tests on the agreed schedule and report what each test proved, including any workload the test could not cover.
• Review Azure Cost Management data monthly, investigating anomalies, identifying idle resources and checking commitment coverage before renewal dates.
• Maintain an improvement backlog spanning policy gaps, posture findings, resilience shortfalls and cost actions, ranked by business value.