Landing zone & governance
A multi-account or management-group structure built to well-architected and Cloud Adoption Framework guidance rather than grown by accident: production, staging, security tooling, logging and sandboxes separated, with preventive guardrails so a mistake in one cannot reach another. New accounts and subscriptions arrive pre-governed instead of being cleaned up afterwards.
- AWS Organizations
- Control Tower
- Service Control Policies
- Management Groups
- Azure Policy
- Subscription vending
Identity & access
The part of a cloud estate that most often fails an audit. A designed access model instead of accumulated rules, just-in-time elevation for privileged roles, periodic access reviews, guest access that is governed rather than forgotten, and a standing review that walks permissions back toward least privilege instead of letting them pile up.
- IAM Identity Center
- IAM Access Analyzer
- Microsoft Entra ID
- Conditional Access
- Privileged Identity Management
- Access Reviews
Migration
Discovery and dependency mapping, a documented disposition for every workload across the seven Rs, wave planning, rehearsed cutovers and a written rollback for each wave. Database moves run with continuous replication, so the cutover window is minutes rather than a weekend.
- Application Discovery Service
- AWS MGN
- DMS
- Azure Migrate
- Site Recovery
- Database Migration Service
Microsoft 365 & the workplace
The tenant work most cloud providers will not touch: Exchange Online, SharePoint and Teams migrations, tenant-to-tenant moves after an acquisition, and coexistence while you are mid-flight. Then the estate that hangs off it — device enrolment and compliance policy, zero-touch provisioning for new starters, virtual desktops where people need a managed environment, and data governance applied to the content people create rather than only the infrastructure under it.
- Exchange Online Migration Service
- SharePoint Online
- Tenant-to-tenant
- Intune
- Autopilot
- Azure Virtual Desktop
- Microsoft Purview
24×7 operations
Alerting tied to service level objectives rather than raw thresholds, so a page means something is actually wrong for a user. Application-level tracing so a slow page can be traced to a slow dependency. Patching on a published schedule with a maintenance calendar you approve. Shell access through session logging — no bastion hosts, no shared SSH keys, every command recorded.
- CloudWatch
- EventBridge
- Systems Manager
- Azure Monitor
- Log Analytics
- KQL alert rules
- Automation runbooks
Containers & compute
Kubernetes as a managed responsibility rather than a shared anxiety: version upgrades planned and executed on a cadence, add-ons kept current, autoscaling that responds to real demand, deployments driven from Git so cluster state matches the repository, and the lighter-weight app platforms used where a full cluster is overkill.
- Amazon EKS
- ECS
- Fargate
- Karpenter
- Graviton
- AKS
- Flux GitOps
- Container Apps
Networking & edge
Addressing and segmentation planned once, properly, across accounts, subscriptions and regions. Private connectivity to services and partners without traffic crossing the public internet, and edge protection in front of anything a customer touches.
- VPC
- Transit Gateway
- PrivateLink
- Route 53
- CloudFront
- WAF & Shield
Security baseline
Threat detection on from day one across every account and subscription, continuous benchmark scoring against recognised standards, automated scanning of workloads and images, encryption keys with owned policies, and a security operations pipeline tuned to fire on real signal rather than shipped defaults.
- GuardDuty
- Security Hub
- Inspector
- KMS
- Defender for Cloud
- Microsoft Sentinel
- Key Vault
Resilience & disaster recovery
Multi-zone as the default, a cross-region recovery plan with a recovery time and recovery point you have signed off, backup policies applied by tag rather than by memory, geo-redundancy decisions made deliberately with the cost written down, and — the part almost nobody does — a quarterly restore test with the evidence sent to you.
- AWS Backup
- Elastic Disaster Recovery
- Azure Backup
- Site Recovery
- Documented RTO/RPO
- Quarterly restore test
Hybrid & on-premises
Servers, Kubernetes clusters and databases outside the cloud brought under the same policy, monitoring and patching regime as everything inside it. One inventory, one compliance view, whether the machine is in a hyperscaler, a data centre or a branch office.
- Azure Arc
- Arc-enabled Kubernetes
- Arc-enabled servers
- Azure Stack HCI
FinOps & licensing
Detailed billing analysis down to the workload, rightsizing backed by observed utilisation, a commitment portfolio actively managed rather than bought once and forgotten, storage moved down its lifecycle automatically, idle resources reclaimed, non-production shut down out of hours — and on the Microsoft side, where a large share of the saving is licensing rather than infrastructure, existing Windows Server and SQL Server entitlements applied against cloud compute.
- Savings Plans
- Reserved Instances
- Compute Optimizer
- Azure Hybrid Benefit
- Reservations
- Cost Anomaly Detection
- Auto-shutdown
Architecture reviews
A structured review across the framework pillars, delivered as a prioritised remediation backlog with effort and impact against each item — not a PDF that gets filed. Re-run on an agreed cadence so you can watch the score move.
- Well-Architected Tool
- Trusted Advisor
- Azure Advisor
- Secure Score
- Remediation backlog
Everything as code
Your infrastructure lives in your repository in Terraform, CDK or Bicep, with policy version-controlled alongside the infrastructure it governs. Changes arrive as pull requests, get reviewed, and leave an audit trail. Drift is detected and corrected. When our engagement ends you keep a platform you can run — not a dependency.
- Terraform
- AWS CDK
- Bicep
- GitHub Actions
- Azure DevOps
- Policy-as-code
- Drift detection