Azure your team can run without me.

• Essential

  • Weeks 1-2: discovery, regulatory mapping, ADR set signed
  • Weeks 3-6: landing zone + Terraform library deployed, pilot workload through it
  • Starter topology: the root and the nine groups of the template, 3 to 5 subscriptions
  • Entra ID + PIM foundation (PIM needs Entra ID P2 or Entra ID Governance), CIS policy + tagging baseline
  • 10 platform runbooks + 30-day hand-off support window

  A governed Azure estate your own team operates, with the design decisions on paper.

• Operate

  • Everything in Essential
  • Drift scans on the schedule agreed at scoping; findings arrive as pull requests
  • Monthly platform review: drift, policy compliance, cost by owner
  • Quarterly Azure Policy + RBAC review with Defender tuning
  • Monthly retainer: ten hours a month, no roll-over, delivered by me, no response time promised, no minimum term, 30 days' notice for either party, invoiced monthly in advance

  The estate stays as designed. Your auditor can trace every change deployed through the pipeline to a reviewed pull request; a change outside the pipeline comes back as a finding with a pull request.

• Host-pool topology and capacity model
• Image pipeline (Packer or Azure VM Image Builder, plus Azure Compute Gallery)
• FSLogix profile and Office container deployment
• Autoscaling with a measured cost curve
• App delivery: App Attach (MSIX or Appx packages), FSLogix App Masking or install-on-image per inventory

Terraform is the default and the only language the kit ships. Bicep, CDK or Pulumi are possible where your team already works in them, scoped separately.

Start smaller. Essential builds a starter landing zone: the root and the nine groups of the template, and 3 to 5 subscriptions. A full estate typically ends up with 5 to 15 subscriptions. Existing subscriptions stay where they are until a planned wave moves them.

For reading, dashboards and diagnostics: yes. Production is not changed from the portal: nobody holds a standing write role, PIM grants it just in time, and a manual change is drift that goes back into code (RUNBOOK-08). A documented break-glass path covers real emergencies. Sandbox subscriptions stay open for experiments, so the guardrails protect production without slowing anyone's learning down.

Your people. Reviewers on the repository and PIM approvers are named client roles from day one; I submit pull requests like everyone else. On Operate I also review, and the approval authority stays with your people.

The management plane (management groups, policy, RBAC) costs nothing. Run-rate comes from the hub (Azure Firewall and gateways), logging retention and the paid Defender for Cloud plan the kit enables, since Defender for Cloud shows the CIS standard only with a paid plan. Each is sized and priced in the design phase before anything is deployed. If a Firewall SKU is oversized for your estate, the design says so.

Brownfield is the normal case. Existing subscriptions are inventoried at discovery, imported into state or migrated in planned waves, and nothing is moved without its owner knowing the window.

It stays with you: it was in your GitHub organisation and your state storage from the first commit. Once paid for, you may use and change the deliverables, this code included, inside your organisation for good, and pass them to another supplier (Terms of Service, section 6). The Exit Kit adds the state hand-off procedure, access removal on my side, and the list of anything unfinished. That applies to every tier.

Different problems. Windows 365: simple, per-user, low flexibility. AVD: dense, cost-efficient at scale, more operational overhead.

Almost always one of two things: hosts sized to headcount instead of measured concurrency, or autoscale never enabled because nobody trusted it with live sessions. The kit fixes both: the capacity model sizes to peak concurrency, and the scaling plan drains hosts only at zero active sessions.

For Windows 11 Enterprise multi-session access rights: yes, those licences carry them (confirmed against current Microsoft terms during discovery). What you pay on top is Azure compute and storage, which is the part the capacity model and autoscale keep in check.

That is one of the main reasons to run AVD. Contractors get browser access to published apps only: no client install, no drive or clipboard redirection, access that expires on the project end date by default. The contractor access flow is part of the AVD build runbooks. Each contractor needs an AVD-eligible licence (Microsoft 365 E3 or Business Premium, for example) assigned to their account in your tenant; a licence from their own company generally does not count.