Architecture that can be built, operated and defended.

What an engagement produces

Most requests arrive as a technology problem and turn out to be a coherence problem. The subscription model, the network drawing, the identity permissions and the operating model have drifted independently. Our work is architectural rather than task-based: we restore a design that can be explained, built and operated.

• High-level and low-level design — documents written so engineers can build from them and assurance functions can read them without a translation layer.
• Decision records — the options considered, the trade-offs accepted, and the places a legacy dependency forces a compromise.
• A build path — sequence, rollback, ownership and the operating model that keeps the design from drifting after handover.

Landing zones and platform structure

Cloud Adoption Framework landing zones are useful when they are applied with judgement. We use the reference as a structure for the conversation, then adapt to what the organisation actually operates — including estates that have already grown past the model they started with.

• Management groups and subscriptions — hierarchy, sandbox, connectivity, identity and workload landing zones, and subscription democratisation that does not abandon governance.
• Policy and guardrails — the policy set, tagging and naming, and the change model that keeps the structure from accumulating exceptions until nobody can draw it.
• Operating model — who vends a subscription, who owns a platform service, and how drift is detected after the design pack is signed off.

Network and connectivity

Network design is treated as part of the platform, not as a separate drawing that identity and policy then have to work around. Hub-and-spoke and virtual WAN are chosen for the traffic and the operating model, not recited from a reference architecture.

• Topology — hub-and-spoke and virtual WAN, Azure Virtual Network Manager, segmentation that can be drawn, and the boundary between platform and workload networks.
• Private connectivity and DNS — Private Link, Network Security Perimeter, DNS zones and resolution paths, including the re-pointing work that migrations actually fail on.
• Hybrid and edge — ExpressRoute, layer 4 and layer 7 load balancing, and the inspection points the security function expects to see on a diagram.

Identity and access

Entra ID architecture treated as platform, not as a collection of portal clicks. The work covers how people, guests and non-human identities are created, authorised, reviewed and retired, and how that model is expressed in Conditional Access, RBAC and entitlement management.

• Directory architecture — tenant design, administrative units, hybrid considerations, and the boundary between human and workload identity.
• Lifecycle — joiner-mover-leaver automation, access packages, access reviews, and named ownership for service principals and managed identities.
• Control plane — Conditional Access rationalisation, privileged access, RBAC and ABAC, external identities, and least privilege that can actually be operated.

Zero Trust and security architecture

Zero Trust is explicit verification, least privilege and assumed breach applied to identity, network, workload and data — with the compromises documented where a legacy dependency forces one. Security Adoption Framework sequencing is used so controls arrive in an order the business can absorb.

• Control sequencing — identity and device before network theatre, privileged access before a new tool, and an order of operations that security and delivery can both live with.
• Well-Architected pressure — reliability, security, cost, operational excellence and performance treated as competing pressures rather than a checklist to be scored in isolation.
• Assured workloads — where the design touches regulated or classified systems, it is written to be read by auditors and assurance functions as well as engineers.

Data platforms

Data estates landed with the same private networking, identity and governance expectations as the rest of the platform. Consolidation is treated as architecture, not as a lift of instances into a new subscription.

• Azure SQL and managed instances — placement, networking, backup, patching and access models that can be explained without a tribal map of exceptions.
• Storage tiers — including Azure NetApp Files, lifecycle and the identity path used to reach the data.
• Migration and cut-over — dependency mapping, Private Link and DNS re-pointing, managed identity and role assignments on the far side of a move, and a rollback position at every cut-over.

Analytics, AI and Microsoft Foundry

Analytics platforms and Microsoft Foundry are treated as workloads that inherit the landing zone, not as exceptions that bypass it. Private networking, managed identity and a governance wrapper are part of the design, not a phase two.

• Foundry landing — private endpoints, managed identity, network isolation and the control plane the platform team will actually operate.
• Governance wrapper — who may deploy a model, which data it may see, how secrets and identities are issued, and how the deployment is reviewed.
• Analytics platforms — landed on the same identity, DNS and segmentation model as the rest of the estate so they do not become a second cloud.

Containers and segregated environments

Container platforms designed for the constraints the organisation actually has — including hardened baselines, air-gapped operation, and an operating model that does not assume outbound internet for day-to-day support.

• Kubernetes and platform design — cluster topology, node and network isolation, registry and supply chain controls, and the service operations model.
• Air-gapped and classified — no outbound connectivity, offline registry, image promotion between enclaves, and runbooks that cleared staff can follow without escalating to a public console.
• Hardened baselines — the configuration the platform starts from, the exceptions that are allowed, and the evidence path when assurance asks how an image entered the environment.

Virtual desktop and workspaces

Azure Virtual Desktop delivered as a platform service, typically through Nerdio, with identity, network and image management aligned to the rest of the estate rather than stood up as a parallel island.

• Host pools and images — golden image strategy, patching, and the identity used to broker and to access the desktop.
• Network placement — private connectivity to the applications and data the desktop exists to reach, without hairpinning that nobody documented.
• Operations — scaling, FSLogix or equivalent profile design, and the ownership split between platform and the desktop service.

How we engage

Work is contracted through SGKeystone Ltd on a statement of work with defined deliverables, milestones and acceptance criteria. We can work through your preferred supplier or procurement route, including the clearance and assurance expectations that come with regulated and government-adjacent environments.