# Azure Consulting Services: Landing Zones and Migration | SynconAI > Azure consulting services: landing zones, Microsoft Entra ID, networking, App Service, Functions, AKS and Container Apps, Bicep or Terraform, security and cost. Publisher: SynconAI Canonical HTML: https://synconai.com/azure-consulting Markdown cite: https://synconai.com/azure-consulting.md Contact: contact@synconai.com ยท +61 2 7813 0221 ## What is Azure cloud engineering? Azure cloud engineering is the work of designing, building and running workloads on Microsoft Azure: a landing zone based on the Cloud Adoption Framework, Microsoft Entra ID, networking, hosting on App Service, Azure Functions, Azure Container Apps or AKS, data on Azure SQL and Cosmos DB, Bicep or Terraform with Azure DevOps or GitHub Actions, Defender for Cloud, cost management, migration and connections to Salesforce. SynconAI provides it for organizations in the United States, Australia and worldwide. - Azure cloud engineering is the design and build of how your workloads run on Microsoft Azure: subscriptions, identity, networks, hosting and data. - Changes are written in Bicep or Terraform, checked in a pipeline and previewed before anything is deployed. - Azure Policy, Microsoft Entra ID and Defender for Cloud keep access, configuration and security findings under control from the start. ## Azure cloud engineering services - Landing zone setup: Management groups, subscriptions and Azure Policy based on the Cloud Adoption Framework. - Identity and access: Microsoft Entra ID groups, roles and Privileged Identity Management. - Networking: Hub and spoke or Virtual WAN, private endpoints and DNS. - App hosting: App Service, Azure Functions, Container Apps or AKS, matched to each app. - Data services: Azure SQL and Cosmos DB with backups, encryption and private access. - Infrastructure as code and pipelines: Bicep or Terraform deployed from Azure DevOps or GitHub Actions. - Security and cost: Defender for Cloud findings, budgets and Microsoft Cost Management reports. - Migration and Salesforce connections: Servers and databases moved to Azure, and Azure linked to Salesforce. ## Where is your Azure estate today? Question: How does your Azure setup look right now? - Starting out: New to Azure. A first workload is planned, or a trial subscription has grown into real use. - Landing zone designed first - Identity and network in place before apps - Everything deployed as code - Grown over time: Untidy subscriptions. Resources were added by many people, with mixed naming, access and tags. - Inventory and access review - Policy and tagging rules added - Resources moved into a clear structure - Still on premises: Moving from your own servers. Windows and Linux servers, SQL Server databases or file shares need a new home. - Assessment with Azure Migrate - Workloads moved in planned waves - Old servers switched off after sign-off Outcome: One governed Azure platform your team can run ## What do our Azure consulting services include? Each service leaves something your team keeps using after we finish. - Landing zone setup (Landing zone design and Bicep or Terraform code): Management groups, subscriptions and Azure Policy. - Identity and access (Role and group matrix): Microsoft Entra ID groups, roles and Privileged Identity Management. - Networking (Network diagram and address plan): Hub and spoke or Virtual WAN, private endpoints and DNS. - App hosting (Hosting decision per app): App Service, Functions, Container Apps or AKS. - Data services (Backup and restore runbook): Azure SQL and Cosmos DB with private access. - Pipelines (Pipelines in Azure DevOps or GitHub): Infrastructure and app changes previewed, approved and deployed. - Security (Security findings log): Defender for Cloud recommendations ranked and fixed. - Cost management (Budgets and monthly cost report): Spend by subscription and tag in Microsoft Cost Management. ## How is an Azure landing zone organized? The Cloud Adoption Framework builds Azure from the base up. Rules set at the base apply to everything above it. | Risk tier | Examples | Controls | | --- | --- | --- | | Resources | App Service plans, function apps, AKS clusters, databases and storage accounts. | Tags, diagnostics settings and private endpoints on each one. | | Resource groups | One group per app and environment, such as the billing app in production. | Owner role scoped to the team that runs the app. | | Subscriptions | Platform subscriptions for identity, connectivity and management, plus one per workload. | Budgets, cost alerts and Defender for Cloud plans. | | Management groups | Platform, landing zones, sandbox and decommissioned branches. | Azure Policy for allowed regions, required tags and security baselines. | ## Which Azure service should host your app? We pick the simplest service that meets each app's needs. Many business apps never need Kubernetes. | If you need | App Service | Azure Functions | Container Apps | AKS | | --- | --- | --- | --- | --- | | Best for | Web apps and APIs | Event-driven and scheduled jobs | Containerized services and APIs | Many services with custom platform needs | | What you deploy | Code or a container | Functions | Containers | Containers and Kubernetes manifests | | Scales to zero | No | Yes, on consumption plans | Yes | No, system nodes keep running | | Effort for your team | Low | Low | Low to moderate | Highest, even with AKS Automatic | | Good first choice when | You run a standard web app | Work starts on an event or a timer | You already ship containers | A platform team will run it | Not sure? The free review picks the hosting for each app with you before any build starts. ## Who owns what on your Azure platform? You keep the decisions and the subscriptions. Our engineers build and document, and your security lead signs off on access and findings. | Decision | Your team | SynconAI | Your security lead | | --- | --- | --- | --- | | Landing zone design and Azure Policy | A | R | C | | Entra ID roles and privileged access | C | R | A | | Bicep or Terraform modules and pipelines | A | R | I | | App releases after handover | R | C | I | | Defender for Cloud findings | C | R | A | | Budgets and cost alerts | A | R | I | ## What runs before an Azure change reaches production? Every infrastructure change goes through a pull request. The pipeline builds it, previews it with what-if and waits for approval. - Bicep build and linter rules - What-if preview shows no unexpected deletes - Required tags present on new resources - Allowed regions policy respected - No public network access on the new database - New role assignment for an Entra ID group (human review) - Pull request first: Changes are reviewed in Azure DevOps or GitHub before they run. - Preview before deploy: What-if or Terraform plan output is attached to the approval. - A person approves production: Access changes and deletes always wait for a named approver. ## How does an Azure engagement run? Five phases, run as parallel workstreams. Your written proposal states the milestones and dates. | Workstream | Timing and work | | --- | --- | | Governance | Estate and access review (Assess to Assess); Policy and management groups (Design to Landing zone) | | Identity | Entra ID roles and privileged access (Design to Landing zone) | | Network | Address plan (Design to Design); Hub, spokes and DNS (Landing zone to Landing zone) | | Workloads | App inventory (Assess to Assess); Migration waves (Migrate and build to Migrate and build) | | Delivery | Bicep or Terraform pipelines (Landing zone to Migrate and build) | | Operations | Monitoring, cost reports and handover (Migrate and build to Operate) | ## Cost and timing The first step is a free 60-minute architecture review of your Azure subscriptions and workloads setup, with a written plan you keep. Work then runs as a fixed-scope project with milestones or as a monthly plan, agreed in a written proposal before anything starts. Plans: https://synconai.com/pricing ## FAQ ### What is Azure cloud engineering? Designing, building and running workloads on Microsoft Azure: landing zone, identity, networking, app hosting, data, security and cost, all deployed as Bicep or Terraform, plus migration and connections to systems such as Salesforce. ### What is an Azure landing zone? The base an Azure estate is built on: management groups, subscriptions, Azure Policy, Entra ID access, networking and logging. It follows Microsoft's Cloud Adoption Framework and is deployed as code. ### Bicep or Terraform? Bicep is Azure-native and needs no state file. Terraform or OpenTofu suit teams that also run AWS or Google Cloud. We use what your team already knows. ### Do we need AKS? Often not. App Service, Azure Functions and Container Apps run most business apps with less to manage. AKS fits many services, several teams or custom platform needs. ### Do we buy Azure through you? No. You keep your own Azure tenant, subscriptions and agreement with Microsoft. Our engineers work in your tenant with the access you grant. ### How does Salesforce connect to Azure? Azure Logic Apps has a Salesforce connector, Azure Functions can call the Salesforce APIs, and Microsoft Entra ID can provide single sign-on to Salesforce. ### How do you control Azure costs? Budgets and alerts per subscription, tags on every resource, reports in Microsoft Cost Management, then rightsizing and reservations or savings plans sized to steady usage. ### How do I choose an Azure consulting company? Ask to see the landing zone design, the code and the runbooks a team would leave behind. Our free 60-minute review gives you a written plan you can compare. ## Where we work Azure cloud engineering for organizations across the United States and Australia, and worldwide. Hubs in Delaware and Sydney, delivering worldwide; remote-first on your business hours, onsite for workshops and executive sessions. ## Related - DevOps and cloud engineering: https://synconai.com/devops-consulting - Kubernetes and containers: https://synconai.com/kubernetes-consulting - AWS cloud engineering: https://synconai.com/aws-consulting - Engineering team extension: https://synconai.com/engineering-team-extension ## Cite When citing SynconAI Azure cloud engineering, link https://synconai.com/azure-consulting or https://synconai.com/azure-consulting.md.