Managed services on Microsoft Azure

We start from what is actually deployed in your tenant, not from the architecture diagram. The assessment produces a costed transition plan, a remediation list and an explicit acceptance point.

• Inventory from Resource Graph, handed over. Management groups, subscriptions, resource groups and workloads inventoried using Azure Resource Graph queries we hand over, so the inventory can be refreshed rather than rebuilt.
• Diagnostic settings and ingestion reviewed. Azure Monitor diagnostic settings, Log Analytics workspace design, table plans, retention and current ingestion volume examined per source.
• Backup coverage checked per workload. Azure Backup policy coverage tested against each workload to find anything with no backup, no tested restore or a recovery objective the current policy cannot meet.
• Defender plan coverage by resource type. Microsoft Defender for Cloud plans assessed per resource type, with the existing recommendation and alert backlog recorded as the baseline for later reporting.
• Cost and commitments baselined. Azure Cost Management data baselined by subscription, tag and service, including reservation and savings plan coverage and the date each commitment expires.
• Privileged access flagged before handover. Microsoft Entra ID privileged role assignments, standing access and service principal credentials reviewed, with anything unsafe to operate as found written down.

Platform tooling is configured deliberately and kept in code, so the operating model survives reorganisation and staff turnover. Everything we build here is handed over, not held privately.

• Workspace design against real queries. Log Analytics workspace layout, table plans, retention and data collection rules set against actual query patterns and the cost each source generates.
• Application Insights on business transactions. Applications instrumented with availability tests and dependency tracking on the transactions the business would notice failing, not only on host metrics.
• Alert rules with linked runbooks. Azure Monitor alert rules authored with severity, action groups and a linked runbook, using dynamic thresholds where a fixed number produces false alarms.
• Policy initiatives that remediate. Azure Policy initiatives deployed at management group scope, using modify for tagging and deployIfNotExists for diagnostic settings and baseline configuration.
• Backup and immutability per workload class. Azure Backup vaults, policies and immutability settings configured per workload class, aligned to the recovery objective agreed with each workload owner.
• Arc for unmigrated servers. Servers and clusters outside Azure onboarded through Azure Arc so monitoring, policy and update management cover the whole estate rather than only the migrated part.

Posture management and detection run from the same data, so what your security team reads each month is evidence rather than assertion. Escalation steps are agreed before they are needed.

• Recommendations tracked to an end state. Recommendations reviewed on a set cadence and tracked to closed, accepted against a named owner and review date, or scheduled as funded work.
• Sentinel rules tuned, not accumulated. Microsoft Sentinel analytics rules and watchlists tuned to your environment, with rules that generate alerts nobody investigates retired rather than left running.
• Entra ID access reviews scheduled. Privileged roles, guest accounts and application registrations reviewed periodically, replacing standing access with eligible assignment where the role allows it.
• Key Vault expiry watched. Secret, key and certificate expiry monitored in Azure Key Vault, with rotation on a schedule agreed with each application owner rather than at the point of outage.
• Update and vulnerability state per workload. Update compliance and vulnerability findings tracked workload by workload, with exceptions held against a named owner instead of left implicit.
• Evidence, never certification. Operational evidence produced to support your alignment to frameworks such as the Essential Eight; assessment and certification remain with an accredited third party.

Tooling is only useful if your people can read it. We hand over the workbooks, queries and runbooks and teach the team to use them, so dependence on us reduces over time.

• Workbooks and queries in your tenant. Azure Monitor workbooks and saved KQL queries published in your own tenant, so your engineers can answer routine questions without contacting us.
• Runbooks in your repository. Runbooks and infrastructure code stored in your Azure DevOps or GitHub organisation, updated as part of each change rather than in a separate documentation exercise.
• Monthly review with both audiences. A service review with the platform owner and business sponsor covering incidents, changes, policy compliance, posture movement and cost.
• Service desk trained on real alerts. First-line triage taught for the alerts your desk will actually receive, including what to escalate immediately and what simply needs observing.
• Cost views finance opens themselves. A Cost Management view handed to finance with budgets and anomaly alerts set to thresholds they choose rather than defaults nobody reads.

What runs every month once the environment is under management. Coverage hours, contact channels, escalation steps and reporting cadence are set out in your service description rather than assumed.

• Workload health and pipeline runs watched. Availability tests, workload health and pipeline runs monitored through Azure Monitor and Application Insights, with alerts acted on under the arrangements in your service description.
• Incidents coordinated with Microsoft. Support case management under your agreement, stakeholder updates and a written review for significant events, so the same fault does not recur unexamined.
• Patching through Update Manager. Update rings applied through Azure Update Manager inside your change process, with maintenance windows agreed per workload rather than imposed.
• Restore tests reported honestly. Azure Backup restore tests run on the agreed schedule, with what each test proved reported alongside any workload it could not cover.
• Cost reviewed before the renewal date. Azure Cost Management data examined monthly for anomalies and idle resources, with commitment coverage checked ahead of renewal rather than after it.
• One backlog across all four areas. An improvement backlog spanning policy gaps, posture findings, resilience shortfalls and cost actions, ranked by business value and worked each cycle.