Azure landing zone
and cost, reviewed.
We review how your Azure subscriptions are organised, governed, connected and billed, using exports and screenshots you choose to share, and give you a written report of guardrail gaps, idle spend and the fixes to do first.
Who it is for
Organisations that have grown into Azure without a deliberate design, are about to add workloads, or are seeing costs rise. It is narrower and deeper than the general Azure and hybrid assessment, which covers topics you choose across your estate.
What we review
- Management groups and subscriptions. hierarchy, how subscriptions are separated by environment or workload, and whether the structure supports policy and access at scale.
- Azure Policy. assignments, effects (for example audit or deny), exemptions and compliance state. Microsoft advises starting with an audit effect to see the impact before enforcing.
- Role-based access control. the number of subscription Owners (Microsoft recommends a maximum of three), whether privileged roles are scoped narrowly, custom roles, group-based assignment and service principals holding broad roles.
- Networking. address plan and overlaps, hub-and-spoke or similar design, network security group rules exposing management ports, firewall presence, private endpoints versus public access on platform services, and DNS design.
- Identity for Azure. how administrators sign in to Azure, Conditional Access for management, managed identities versus stored secrets and emergency access.
- Security posture and logging. Microsoft Defender for Cloud plans enabled, diagnostic settings, Log Analytics workspace design and activity log retention.
- Cost visibility and idle resources. underutilised VMs (as Advisor flags them), unattached disks, unused public IP addresses and oversized resources found in the exports, reservation and savings plan coverage, and budgets and alerts. Advisor notes its savings estimates can be higher than actually possible.
- Tagging and ownership. whether every resource has an owner and a cost centre tag, and whether the standard is enforced.
- Backup and resilience. backup coverage of VMs and data services, retention against your recovery targets, and use of availability zones where relevant.
- Infrastructure as code and change. how environments are deployed, whether templates exist and how drift is detected.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A landing zone map of subscriptions, networks and controls as found
- Findings with severity and the evidence behind each one
- A cost findings list with the evidence for each item (no savings are promised)
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over the Azure tenant and subscriptions
- Exports or screenshots named in the scope, such as the management group tree, policy compliance, role assignments, network configuration and a cost export
- Your workload types and any compliance standards that apply
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not sign in to your Azure tenant or use Azure Resource Graph against it.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not sign in to Azure, change resources, delete idle items, or deploy anything. We promise no savings and give no security guarantee.
What needs separate approval. Any change to policy, access, networking or resources, any deployment, and any follow-up check after changes.
Questions before an enquiry
Will you tell us how much we will save?
No. The report lists idle or oversized resources with the evidence, so you can decide. We do not promise savings.
Do you need access to our Azure subscriptions?
No. Your administrator shares the exports or screenshots named in the scope.
How is this different from the Azure and hybrid assessment?
The assessment covers topics you choose, including hybrid and application questions. This review is a fixed checklist of foundations: structure, governance, networking, logging, backup and cost.
Do you follow a Microsoft framework?
The checklist draws on the design areas in Microsoft’s Azure landing zone guidance. Check current Microsoft documentation, since guidance is updated.
Can you fix what you find?
Not under this review. Fixes need their own scope, change approval and rollback plan.
Free tools, reading and vendor documentation
- SIEM log cost estimator (free)
- Hyper-V vs Azure VMs vs Azure Local: three-year cost
- SIEM cost optimisation without blind spots
- Compare Entra Domain Services and self-managed AD DS
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.