Project or retained

An estate you can rebuild from source.

We design and build Azure environments as infrastructure as code. Networking, identity, governance and cost controls all live in Terraform, so the environment is reproducible rather than remembered.

Service

Azure Infrastructure & Architecture

Engagement

Project or retained

Greenfield build

6 – 12 weeks

In short

What is Azure infrastructure and architecture?

Azure infrastructure architecture is the design and construction of an Azure estate as code: networking, identity, governance and cost controls expressed in Terraform, so the environment can be rebuilt from source rather than remembered.

The problem

Click-built clouds cannot be rebuilt

Most Azure estates start in the portal. Someone needed a virtual machine, then a database, then a network rule to make them talk. It works, until you need a second environment, or an auditor asks how a resource is configured, or the person who built it leaves. An estate that exists only in the portal is an estate that cannot be reproduced, reviewed or reasoned about.

Scope

What the engagement covers.

Anything outside this list is quoted separately rather than absorbed quietly.

Landing zone design: subscriptions, management groups, naming and tagging

Network architecture: virtual networks, subnets, private endpoints, egress control

Identity and access: Entra ID integration, RBAC model, managed identities

Governance: Azure Policy, resource locks, guardrails that prevent drift

Secrets and certificates in Key Vault, with rotation defined

Observability: Log Analytics, diagnostic settings, alert rules that mean something

Cost management: budgets, tagging discipline, rightsizing review

The whole thing expressed in Terraform, in your repository

Deliverables

What you are left holding.

Every item here is an artifact you own, in your systems, readable by someone who was not in the room.

Architecture decision record

Every significant choice, the alternatives considered and why this one. So the next engineer inherits reasoning, not just resources.

Terraform in your repository

Modular, reviewed, and runnable by your team. We do not hold the state file hostage.

Environment topology diagram

Current and target, drawn accurately enough to hand to an auditor.

Operating handover

A working session plus written runbooks covering how to change, extend and recover the environment.

Greenfield build: 6 – 12 weeks

A landing zone and first workload. Migrations and brownfield remediation are scoped separately after assessment.

Fit

Who this is for, and who it is not.

We would rather lose the engagement at this paragraph than three weeks in.

A good fit if

You are starting in Azure and want the foundation right before the sprawl
You have an existing estate nobody can reproduce or fully explain
You need infrastructure as code because an auditor, a customer or a funding round asked for it

Not a fit if

You want lift-and-shift with no change to how the environment is operated
You need 24/7 on-call operations. We design and build, and will help you find a partner who runs

Questions

About Azure infrastructure and architecture.

Terraform or Bicep?

Terraform by default, because it covers Entra ID, Azure DevOps and third-party providers in one state, and because the hiring pool is larger. If your team already runs Bicep well, we will use Bicep rather than force a migration for its own sake.

Do you work with our existing engineers?

That is the preferred arrangement. The handover is the point of the engagement, and it goes better when your team has been in the pull requests from week one rather than receiving a finished estate.

What if we already have resources in the portal?

We assess first and tell you honestly what is worth importing into code, what is worth rebuilding, and what should be left alone until it is retired. Importing everything is rarely the right answer.

Often paired with