Azure for the enterprise that already runs on Microsoft.
AI-native Azure engineers for landing zones, AKS and App Service platforms, .NET modernisation, data platforms and Entra ID-centred security — managed as code and handed over with the runbook.
- Bicep
- Terraform
- AKS
- App Service
- Azure Functions
- Azure SQL
Many enterprises are Microsoft organisations first.
Many enterprises are Microsoft organisations before they are cloud organisations: identities in Entra ID, documents in Microsoft 365, line-of-business systems in .NET and SQL Server, and an enterprise agreement that already prices Azure in. On that ground Azure is not one option among three — it is the option with the least friction, because identity, licensing, networking and support all connect to things you already own.
We build Azure estates the way we build every platform: subscriptions laid out as a landing zone, workloads in AKS or App Service, data in Azure SQL, PostgreSQL Flexible Server or Cosmos DB, and every resource described in Bicep or Terraform and applied by a pipeline. Our own products run on cloud infrastructure managed as code, and the same discipline is what DevOps & Cloud installs in your organisation. Azure is also the cloud in our SAP & ERP stack, because many SAP landscapes already run there.
When we don’t: a start-up with no Microsoft estate and an event-driven, serverless-first design is usually better on AWS; a team whose product is mostly analytics and ML on large datasets often gets more from Google Cloud; and a single web application with modest traffic can ship on Vercel with a managed database and no subscription at all. We are experienced across all three majors and financially neutral — the recommendation follows your constraints.
Six things we ship on Azure.
Landing zones and governance
Management groups, subscriptions per environment and workload, Azure Policy for the rules that must never be broken, hub-and-spoke networking with Private Link, and Entra ID groups mapped to RBAC — the foundation the rest inherits.
.NET modernisation
Moving .NET Framework monoliths to .NET 8 on App Service or AKS, SQL Server to Azure SQL or Managed Instance, and Windows-only dependencies to containers — the core of our Software Modernisation work on Azure.
Container platforms on AKS
Managed Kubernetes with workload identity, node auto-provisioning, ArgoCD or GitOps via Flux, and ingress through Application Gateway with WAF. App Service or Container Apps where a full cluster is more platform than the team needs.
Integration and event-driven back ends
Service Bus, Event Grid, Azure Functions and Logic Apps for the asynchronous work between systems — order flows from SAP, webhook ingestion, scheduled settlement runs — built with idempotent handlers and dead-letter queues from the first commit.
Data platforms
Azure SQL and PostgreSQL Flexible Server for transactions, Data Lake Storage and Databricks or Microsoft Fabric for the warehouse, Data Factory for movement, and Power BI on top — the Data Engineering stack many Microsoft shops end up with.
AI inside the tenant
Azure OpenAI Service and Azure AI Search for retrieval-based assistants inside your subscription boundary, with the evaluation and guardrail layers from our AI & Machine Learning practice around them.
When to choose it.
Choose Azure when your identity lives in Entra ID, your applications are .NET and SQL Server, and your enterprise agreement already covers the platform — Azure Hybrid Benefit alone can change the economics of a Windows-heavy estate. It fits regulated organisations with strong governance needs, because Azure Policy, management groups and Private Link make the guardrails declarative. It also fits SAP landscapes, Power BI-centred analytics, and any programme where the operations team is already Microsoft-skilled.
Look elsewhere when there is no Microsoft estate to connect to and the design is serverless and event-driven from the start — the AWS primitives are more mature there and the ecosystem of tooling is wider. Look elsewhere too when the product is a small web application: a subscription brings a landing zone, networking and governance that a three-person team does not need yet. We will say so before you commit to anything.
A PostgreSQL server that is private, zone-redundant and reachable only through Private Link.
resource orders 'Microsoft.DBforPostgreSQL/flexibleServers@2023-12-01-preview' = {
name: 'psql-orders-${env}'
location: location
sku: { name: env == 'prod' ? 'Standard_D4ds_v5' : 'Standard_B2ms', tier: env == 'prod' ? 'GeneralPurpose' : 'Burstable' }
properties: {
version: '16'
// Delegated subnet + private DNS zone: no public endpoint exists to misconfigure
network: { delegatedSubnetResourceId: dataSubnet.id, privateDnsZoneArmResourceId: pgZone.id }
+ highAvailability: { mode: env == 'prod' ? 'ZoneRedundant' : 'Disabled' }
+ backup: { backupRetentionDays: 35, geoRedundantBackup: 'Enabled' }
authConfig: { activeDirectoryAuth: 'Enabled', passwordAuth: 'Disabled' }
}
tags: tags
}A typical Odeontech workload subscription on Azure.
What the Azure estates we hand over have.
- Everything in Bicep or Terraform. No resource created in the portal survives the next deployment. Changes are reviewed in pull requests and applied by a pipeline with a what-if step, not from a laptop.
- Identity, not secrets. Managed identities and workload identity for every service-to-service call, Entra ID authentication on databases, and Key Vault for the few secrets that cannot be avoided.
- Private by default. Private endpoints for storage, databases and Key Vault; hub-and-spoke networking; public network access disabled on data services and enforced by Azure Policy.
- Policy as the guardrail. Allowed regions, required tags, encryption and diagnostic settings enforced as deny or deploy-if-not-exists policies, so a mistake fails at deployment rather than at audit.
- Observability wired in. Azure Monitor and OpenTelemetry feeding Grafana dashboards, SLO-based alerts for the symptoms users feel, and activity logs shipped to a workspace nobody can edit.
- Backups that have been restored. Retention per data class, geo-redundant copies for the systems that need them, and a restore rehearsed and timed before go-live.
- Cost as a design input. Reservations and savings plans for steady load, Hybrid Benefit where you already own the licences, budgets with alerts per subscription, and a regular rightsizing pass, at a rhythm agreed with you.
- Residency decided early. Region choice, replication scope and access paths documented for KVKK and GDPR before the first resource exists, not after the audit.
What usually ships alongside the infrastructure.
- A Bicep or Terraform repository per landing zone and per workload, with environments and a documented promotion path
- A subscription and RBAC map: which subscription holds what, which Entra ID group can do which thing, and where the logs go
- CI/CD pipelines in GitHub Actions or Azure DevOps that validate, scan, deploy and roll back
- Grafana or Azure Monitor dashboards and alert rules for the four golden signals, exported as code
- A cost baseline with tags, budgets and a reservation and Hybrid Benefit register reviewed regularly, at a rhythm agreed with you
- Runbooks for deploy, rollback, failover, restore and the incidents we rehearsed together
Frequently asked questions
Neighbouring stacks and the services that use them.
An Azure estate to build, move or tidy.
Tell us what runs where and what your tenant looks like. An Azure engineer reads it and replies in writing with how we would approach it.