Atmora Tech

Cloud & Platform

Azure where identity
is the hard part

Most enterprise Azure work is really identity work: Entra ID, conditional access, and hybrid trust with a domain that has been running since 2006. We build landing zones, AKS platforms and data estates on an identity model that survives audit.

Overview

Azure for organisations with Active Directory, auditors and an on-premises estate to keep.

Azure tends to arrive in an enterprise through Microsoft 365 rather than through engineering, and it shows. Subscriptions created ad hoc, management groups bolted on afterwards, conditional access policies written by three different teams. The first job is usually reconciling what exists with what the Cloud Adoption Framework assumes exists.

We do the identity work properly because everything else rests on it. Entra ID tenant design, Privileged Identity Management with time-bound elevation, workload identity federation so pipelines stop holding long-lived secrets, and conditional access policies that are documented, tested in report-only mode, and owned by a named team.

On the platform side: AKS with managed node pools and Azure CNI address space sized for real pod density, Azure SQL or PostgreSQL Flexible Server depending on your licensing position, Private Endpoints throughout, and Azure Policy compiled into the pipeline. Bicep or Terraform, whichever your team will maintain, since the discipline matters more than the choice.

62%
fewer standing privileged assignments after the PIM rollout
94.6%
Azure Policy compliance across production subscriptions at handover
27%
annual licence cost recovered through correctly applied Hybrid Benefit

Capabilities

What this covers

Six areas we staff properly. If your problem sits outside them, the honest note at the foot of this page says so.

  • Entra ID and access governance

    Tenant and directory design, Privileged Identity Management with time-bound elevation, recurring access reviews, and conditional access policies tested in report-only mode before enforcement.

  • Enterprise-scale landing zones

    Management group hierarchy, subscription vending, Azure Policy initiatives and a network hub built on Azure Firewall or a third-party appliance, delivered as code against your Cloud Adoption Framework baseline.

  • AKS platform delivery

    Cluster design with Azure CNI address planning, workload identity, node pool separation for regulated workloads, and an upgrade cadence tracked against the published AKS support window.

  • Data platform on Azure

    Azure SQL, PostgreSQL Flexible Server, Synapse or Fabric depending on where the analytics workload actually sits, with Private Endpoints and customer-managed keys where policy demands them.

  • Hybrid and on-premises integration

    ExpressRoute, Azure Arc for servers that will never move, and DNS resolving consistently on both sides. This is the part that decides whether a hybrid estate is workable or merely connected.

  • Licensing and cost position

    Azure Hybrid Benefit applied where the entitlement genuinely exists, reservation and savings plan mix, and dev/test subscription placement. Licensing is where Azure estates quietly overspend most.

Deliverables

What you get

  • Management group and subscription hierarchy with Azure Policy initiatives
  • Entra ID design covering roles, PIM configuration and conditional access
  • Infrastructure as Bicep or Terraform, with pipeline and drift detection
  • AKS cluster baseline, node pool plan and upgrade runbook
  • Hybrid connectivity design covering ExpressRoute, DNS and Arc-enabled servers
  • Licensing position review with Hybrid Benefit and reservation recommendations

Stack

What we build it with

  • Microsoft Entra ID
  • Azure Kubernetes Service
  • Bicep
  • Terraform
  • Azure Policy
  • Azure SQL Database
  • Azure Database for PostgreSQL
  • Azure DevOps
  • ExpressRoute
  • Azure Arc
  • Microsoft Defender for Cloud
  • Azure Monitor

Process

How the engagement runs

Two-week increments against a written definition of done. You can stop at any increment boundary and keep everything built so far.

  1. Tenant and estate assessment

    We inspect the live tenant, subscriptions, policy assignments and conditional access before proposing anything. Azure estates rarely match their own documentation.

  2. Identity design first

    Entra ID, PIM and conditional access are designed and reviewed before the platform, because retrofitting an identity boundary onto a live estate is the most disruptive change available.

  3. Landing zone build

    Management groups, subscription vending, policy initiatives and hub networking delivered as code, with a deployment pipeline that your own platform team operates.

  4. Workload onboarding

    Two representative workloads move first, one of them regulated, because compliance requirements surface constraints that greenfield services never manage to expose.

  5. Operate and review

    Monthly policy compliance review, quarterly access review, and a licensing check timed ahead of each Enterprise Agreement anniversary date.

When this is the wrong engagement

If your organisation has no Microsoft footprint at all, no Entra ID, no Active Directory and no Enterprise Agreement, then Azure's main advantage over its competitors does not apply to you and we will say so early.

FAQ

Questions we get asked

Bicep or Terraform?

Terraform if you run more than one cloud or already have Terraform skills in the team. Bicep if you are Azure-only and live in Visual Studio Code, since it deploys ARM natively and picks up new resource types sooner. Both are defensible; mixing them in one estate is not.

Our Active Directory is twenty years old and messy. Does that block us?

It slows the identity workstream, it does not block the platform. We usually run a directory cleanup in parallel, covering stale objects, nested group sprawl and service accounts set to never expire, then gate hybrid join on that cleanup reaching an agreed threshold.

Can you work alongside our existing Microsoft partner?

Yes, and it is common. We tend to take the engineering: landing zone code, AKS, data platform and pipelines. Licensing, Enterprise Agreement negotiation and first-line Microsoft escalation usually sit better with the partner holding the commercial relationship.

How do you handle data residency requirements?

Region pinning through Azure Policy at management group level, so a non-compliant deployment fails rather than being caught later in an audit. We also check the services in scope, because some still process metadata outside the selected geography and regulators care about that.

Related

More in Cloud & Platform

Start a project

Tell us what is
breaking.

We reply within one working day, and the first call is with an engineer who would actually work on it — not an account manager. If we are not the right studio for the problem, we will say so on that call.

Start a project