Azure Cloud Setup

What this covers

What is included

• Networking: hub and spoke topology or Virtual WAN, private endpoints, DNS, and connectivity to on-premises networks
• Governance applied at design time: management groups, Azure Policy, role based access control and consistent resource tags
• Cost structure including reserved instances and savings plans, licence cost, budgets and cost alerts
• Backup and recovery for business critical workloads, with a restore tested before the business depends on it

Approaches and how they differ

• Azure virtual machines: Windows servers lifted into Azure, keeping Active Directory and application dependencies intact. The pragmatic entry point for a Microsoft estate, but guest OS patching stays with the client team.
• Managed data services: Azure SQL and managed file and backup services replace self-managed servers. This removes database administration and locks those components to Azure, so it suits applications with a long life ahead.
• Hybrid identity: Entra ID synchronised with on-premises Active Directory so the existing directory stays authoritative. The correct pattern for most Indian enterprises, since group structure, group policy and user logon behaviour carry over unchanged.
• Azure landing zone: A prebuilt subscription hierarchy, policy baseline and shared services for networking and monitoring. Worth building for a larger organisation, and unnecessary overhead for a small tenant with two or three workloads.

What it suits, and what it does not

• Good fit: existing Windows Server, Active Directory and SQL Server estates where hybrid identity keeps the current directory in charge
• Good fit: Office 365 and Entra ID tenants where multi factor authentication and Conditional Access are the priority rather than application hosting
• Good fit: line of business applications that must be reachable both from on-premises networks and from the internet
• Poor fit: a small website with no Microsoft estate, where managed hosting is simpler, cheaper and has no licence complications
• Poor fit: workloads with a hard residency requirement that a particular Azure service does not satisfy inside India, since availability differs by service

Where projects like this go wrong

• Creating every resource in one subscription and one resource group, which makes cost allocation, policy and eventual removal painful
• Standing up Entra ID as a second source of identity while on-premises Active Directory is still authoritative, producing duplicate accounts
• Ignoring software licensing. Windows Server, SQL Server and Office licences can cost more than the Azure infrastructure hosting them
• Using local administrator accounts on virtual machines instead of managed identities, which leaves privileged sign-ins without a clean audit trail
• Assuming backups configured in the portal are a recovery plan, without ever restoring into an isolated environment

Who is responsible for what

• The client owns the Entra tenant, domain ownership, the Microsoft agreement and the billing relationship
• The client owns Active Directory, group policy and the decision on which directory is authoritative. The provider implements synchronisation
• The provider builds the Azure environment, applies the policy baseline and hands over the design documentation
• The client owns licence compliance. Under licensing Windows Server or SQL Server is an audit exposure, not a saving
• Operating responsibility is agreed explicitly. In the virtual machine model the client still patches the guest operating system, even though Azure patches the host beneath it

What buyers ask before starting

• Do we need a separate subscription per department or per environment?
• Should Entra ID or our on-premises Active Directory be authoritative?
• What would an Azure landing zone do for us?
• Can we keep our existing user accounts, groups and passwords?
• Will the Azure bill be higher than running our own servers?

What actually matters

• Total cost including licences, not just infrastructure. For a Microsoft estate the licence line is often the larger half of the bill
• Which directory is authoritative, decided once at design time. Reversing it later means a second identity project
• Cost allocation. A subscription per environment or business unit is what keeps the bill readable six months later
• Whether the client's own IT team can deploy and support workloads in Azure without calling outside help for routine changes
• Access control and audit. Role based access, MFA and Conditional Access are the parts a business cannot quietly switch off later