Entrazure
What it is
Most consulting engagements begin with a proposal written before anyone has looked at the estate. This one exists so that does not happen. Two weeks of reading, interviewing and measuring, ending in a document that says what we think, in order, with a number against each item.
It is deliberately read-only. We take Reader access, not Contributor. Nothing in production is touched, no policy is assigned, no pipeline is modified. That constraint keeps the engagement easy to approve and makes the output honest: an assessment that quietly starts fixing things loses the ability to describe what it found.
What we look at
Governance and structure. Management group hierarchy if one exists, subscription sprawl, naming and tagging discipline, and whether anything at all enforces the rules people believe are in place. This is the ground floor for Azure landing zone work, and the single most common finding is that a policy set exists in audit mode and has never been enforced.
Identity. Entra ID configuration, conditional access coverage and its gaps, standing administrative access, guest governance, service principals with secrets that expired in 2024 or never expire at all. Identity findings are usually the highest-severity items in the report.
Network and exposure. Topology, what is public and whether it needs to be, private endpoint coverage on data services, firewall and DNS design, and what an external scan attributes to your organization.
Security posture and evidence. Defender for Cloud plans and Secure Score, log coverage, retention against the period your obligations require, and whether any control produces evidence automatically or is reconstructed by hand each year. That distinction drives most of the compliance architecture recommendations.
Cost. Where the money goes, which resources are running for nobody, reservation and Hybrid Benefit coverage, and the two or three items that account for most of the surprise on the bill.
Data and AI readiness. Where the data actually lives, what state its permissions are in, and whether the AI use case someone has in mind is a modeling problem or a data problem. It is usually the second, which is worth knowing before an AI engineering budget is committed.
Regulatory footing where it applies. Residency, transfer paths and incident detection against Loi 25, or the equivalent under HIPAA, SOC 2 or NIS2. Sovereignty questions are covered in more depth under Novarque when that is the driver.
How the two weeks run
Days 1 to 2, access and intake. Read-only access is provisioned, tooling is pointed at the estate, and we collect whatever documentation exists. We also ask what you already believe is wrong, so we can confirm or contradict it explicitly rather than pretending we arrived without context.
Days 3 to 6, evidence. Automated collection across governance, identity, network, posture and cost, followed by manual reading. Automated tools generate findings. They do not generate opinions, and the difference is the engagement.
Days 4 to 8, interviews. Four to six conversations with the people who operate the estate, not only the people who own it. Most of the genuinely useful findings come from an engineer describing the workaround they built two years ago that everything now depends on.
Days 9 to 10, the opinion. Findings ranked by severity against effort, written up, and presented in a 90-minute readout with the technical and the accountable audience in the same room. Disagreement in that session is welcome and gets recorded in the document.
What you receive
- A written report, typically 20 to 30 pages, with a two-page summary a non-technical executive can read.
- A ranked backlog: every finding with a severity, an effort estimate in days, a dependency, and what it prevents.
- Current-state diagrams for subscriptions, network topology and identity flow.
- A named list of what we deliberately did not investigate, and why.
- A statement of what we would do first if it were our estate, which is the part clients quote back to us most often.
What it costs you, in effort and access
Access: Reader on subscriptions in scope, Security Reader, Global Reader in Entra ID, read on repositories and pipeline history. Time-boxed accounts with an expiry are welcome. No write access is requested at any point.
Effort: about eight hours of your team’s time in total, plus a 90-minute readout. One named counterpart on your side to unblock access, which is the only dependency capable of delaying the two weeks.
Who this is for
Organizations with an Azure estate that grew faster than its governance, teams facing an audit, a migration or an AI project and wanting to know what will break first, and any incoming IT director who has inherited an environment nobody can currently describe. It also works well as a second opinion before signing a large build with anyone, including us.
Who this is not for
If you already know exactly what you want built and have the backlog, skip this and go straight to the four-week landing zone build or the eight-week AI agent build. Paying for an assessment to confirm a decision you have already made is a waste of two weeks.
If you need someone to produce a document that justifies a decision already taken politically, we are the wrong firm. The report says what we found, and we will not adjust the ranking to fit a preferred conclusion.
Related
- Azure landing zone, the most common destination for the backlog.
- Compliance architecture, when the driver is an audit.
- Healthcare, where the assessment is scoped around clinical data first.
- Novarque by Entrazure, when the driver is residency or sovereignty.
Questions we get
How long is it and what fixes the duration?
Two weeks, from kickoff to readout. The duration is fixed because the scope is fixed: we look, we form an opinion, we rank the work. If an estate is genuinely too large to read in two weeks, we scope the assessment to two or three domains rather than extending it, because an assessment that runs for six weeks has quietly become a project with no deliverable.
What access do you need?
Reader on every subscription in scope, Security Reader for Defender for Cloud, Global Reader in Entra ID, and read access to the infrastructure repositories and pipeline history if they exist. No write access at any point, and no changes to production. If your process requires a named account with a defined expiry, that is normal and we prefer it.
How much of our team's time does it take?
Around eight hours in total, spread across four to six interviews of 45 to 60 minutes with the people who actually operate things, plus a 90-minute readout at the end. We do not run workshops that require your leadership team to sit in a room for two days.
Do we get anything if we do not continue?
Yes, everything. The report, the backlog and the diagrams are yours whether or not you engage us for the remediation. We take no referral fee from any audit firm or vendor, and there is no clause requiring us to be the ones who fix what we found.
Will you tell us things we already know?
Some of it, and that is useful too, because a written third-party statement of a known problem is often what finally moves it up a budget list. The value is usually in the ranking rather than the discovery: most teams know their ten problems and disagree about the order.
Can you assess an estate that is not on Azure yet?
Yes. In that case the assessment covers the current environment, the workloads that are candidates to move, and what the target should look like, which is the input to a migration plan rather than to a remediation backlog.
Have a question about this work?
Three fields. An architect reads it and answers within one business day.