Azure consulting: a structured platform connected to your Microsoft ecosystem

Azure is often a choice of consistency

For many companies, Azure is not primarily a technical choice: it is an extension of a Microsoft ecosystem that is already in place. Identities live in Entra ID, email and office tools in Microsoft 365, and part of the application estate runs on Windows Server and SQL Server. That consistency is a real advantage, provided the Azure environment is properly structured.

The problems we see are recurring: subscriptions created as needs arise with no shared hierarchy, resource groups with no naming convention, permissions granted at subscription level “to save time”, a network built through successive additions, and Azure policies that are missing or left in audit-only mode. Feekr, based in Villeneuve-d’Ascq in the Lille metropolitan area (northern France), steps in to lay or rework these foundations.

A landing zone aligned with the Cloud Adoption Framework

Microsoft’s Cloud Adoption Framework describes how to adopt Azure in a governed way, from strategy through to operations. Its landing zone guidance defines the design areas to address before hosting applications. We adapt them to your size and constraints:

• Management group hierarchy: separation between the platform (identity, connectivity, management) and application landing zones, with rules inherited at each level.
• Subscriptions: a split by environment and scope, to isolate permissions, quotas and billing.
• Identity and access: roles assigned on a least-privilege basis, just-in-time privileged access with Entra ID Privileged Identity Management depending on your licences, documented emergency access accounts.
• Network: hub-and-spoke or Virtual WAN topology, DNS resolution, private endpoints, outbound traffic filtering.
• Governance: Azure Policy to enforce allowed regions, encryption, tags or a ban on public IP addresses.
• Management and security: centralised logs in Log Analytics, Microsoft Defender for Cloud, backups and monitoring.

Microsoft provides reference implementations, including in Terraform and Bicep. We start from these references rather than reinventing them, and we adapt them: a small or mid-sized business does not need the full structure designed for a large group. Everything is described as code; see our Terraform and Infrastructure as Code consulting.

Hybrid: connecting Azure to your existing estate

Most companies operate in hybrid mode for a long time: part of the IT estate stays on premises while another part moves to Azure. The points to design:

• Connectivity: site-to-site VPN or ExpressRoute, depending on bandwidth, latency and how critical the traffic is.
• Identities: synchronisation between on-premises Active Directory and Entra ID, with a single source of truth and separate administrator accounts.
• Unified management: Azure Arc lets you apply Azure policies, inventory and monitoring to servers that remain on premises or with another provider.
• Licensing: Azure Hybrid Benefit can reduce the cost of Windows Server and SQL Server machines, subject to your licences being eligible; check this against your contract.

If you are preparing to move applications or a VMware estate to Azure, our cloud migration page describes the approach.

Microsoft 365 and Entra ID: one shared base to secure

The Entra ID tenant that serves Microsoft 365 is usually the one that controls Azure. A weakness on one side therefore becomes a risk on the other. We address this shared base: conditional access, multi-factor authentication, separate administrator accounts, review of registered applications and consents, and sign-in logging. It is also the foundation for AI projects built on the Microsoft ecosystem, which we cover in our AI in production expertise.

Architecture review, security and costs

For critical workloads, we carry out a review against the Azure Well-Architected Framework and its five pillars: reliability, security, cost optimisation, operational excellence and performance efficiency. Findings are prioritised by risk and effort.

Security is built into the foundation, as described on our cloud security and governance page. On costs, the landing zone includes tags, budgets and alerts per subscription; ongoing cost management falls under our FinOps consulting.

Deliverables

• Assessment of your Azure environment and Entra ID tenant, with prioritised findings.
• Target architecture: management groups, subscriptions, network, identities.
• Landing zone as Infrastructure as Code, with a deployment pipeline.
• A documented set of Azure policies, with the rationale for each rule.
• Architecture decision record.
• Operating procedures: creating a subscription, managing access, responding to an alert.
• Knowledge-transfer sessions with your teams.

Common Azure pitfalls

• Assigning everything at subscription level. Permissions should follow the hierarchy and least privilege, not convenience.
• Leaving policies in audit mode. A policy that never blocks anything records deviations but does not prevent them.
• Confusing the tenant with the platform. Microsoft 365 administrators are not meant to administer Azure, and vice versa.
• Copying a large group’s architecture. The landing zone must be proportionate to your organisation to stay maintainable.
• Building by hand in the portal. What is not described as code cannot be reviewed, reproduced or restored identically after a mistake.
• Forgetting emergency access accounts. If conditional access or multi-factor authentication locks you out, you need break-glass access that is documented, monitored and tested.

How we work, and when to call us

We follow our Scope, Build, Industrialise, Improve method, with your teams involved at every stage: they review the code, take part in decisions and receive the documentation. We stay neutral between providers, as explained on our AWS and Azure cloud consulting page.

Calling us is worthwhile if you are starting on Azure, if your subscriptions have multiplied without shared rules, if you are preparing a migration from a data centre or VMware, or if an audit requires you to demonstrate control over your access. Book a 15-minute call to talk it through.

[ YOUR QUESTIONS ]

Frequently asked questions

What is an Azure landing zone?

An Azure landing zone is the starting Azure environment, preconfigured according to Microsoft’s Cloud Adoption Framework recommendations: management group hierarchy, subscriptions, identities, network, policies, logging and security. Applications are then deployed into subscriptions that inherit these rules.

Hub and spoke or Virtual WAN for Azure networking?

Microsoft offers both topologies in its landing zones. A self-managed hub and spoke gives a lot of control and suits most organisations. Virtual WAN, a managed service, becomes worthwhile with many sites, several regions or a large number of VPN connections.

Is there a Well-Architected Framework for Azure?

Yes. Microsoft publishes the Azure Well-Architected Framework, organised into five pillars: reliability, security, cost optimisation, operational excellence and performance efficiency. We use it as the review grid for critical workloads.

What does an Azure DevOps consultant do?

An Azure DevOps consultant automates the deployment chain on Azure: Infrastructure as Code, pipelines (Azure DevOps or GitHub Actions), secrets management and observability. Deployments become reproducible, reviewed and traceable.

Can health data be hosted on Azure in France?

Microsoft states that part of its Azure services holds HDS certification (Hébergement de Données de Santé, the French certification for hosting health data). The exact services and regions covered must be checked in Microsoft’s compliance documentation, and the provider’s certification does not relieve you of securing your own configuration.