The problems that bring people here
Most readers arrive from one of our Microsoft Entra or Azure guides with a specific problem. The engagement usually starts with one of these:
AI agents are getting identities and nobody owns their governance
Copilot Studio, Foundry and custom agents now register as identities in Microsoft Entra. Who sponsors them, what Conditional Access applies, how they are decommissioned and what their sign-ins look like in the logs are questions most tenants have not answered. Our Entra Agent ID governance guide is the public version of this work.
Passwordless is the default and the migration plan is a slide
Microsoft Entra now steers new tenants to passkeys and the Authenticator app, while existing tenants carry years of password policy, legacy authentication and exceptions. We write the phased migration, the Conditional Access policies that enforce it and the break-glass procedures that survive it. Start with the passwordless by default post.
The Azure estate grew by portal clicks and nobody wants to touch it
Resource groups with no owner, network rules nobody can explain, Key Vaults with access policies from three admins ago. We codify what is there, close the gaps against the Cloud Adoption Framework and Zero Trust, and leave the environment in Terraform so it can be audited and rebuilt.
The data has to stay in Canada, or in the United States, and the design has to prove it
Data residency for Microsoft 365, Windows 365, Azure Virtual Desktop and Azure AI services is a matter of region choice, service by service. We design for Canada Central and Canada East, or for US regions, and document which service stores what where.
AI workloads need an Azure foundation that controls cost and data flow
Azure AI Foundry projects, Azure OpenAI deployments, AI Search indexes and the telemetry around them need private endpoints, Key Vault, token budgets and residency controls before the first agent reaches production.
How an engagement runs
Every engagement is fixed-fee and remote by default, with on-site days available in Alberta and by arrangement across the United States and Canada. Hours cover Pacific, Mountain, Central and Eastern time. US clients are invoiced in USD and Canadian clients in CAD.
Phase 1: discovery and assessment (two to four weeks)
Review of the current Azure and Entra environment against the target architecture, prioritized by risk and business impact.
You get: an assessment report with prioritized recommendations and an executive summary.
Phase 2: architecture design
Target-state design: network diagrams, identity model, Conditional Access policy set, policy framework and Terraform module structure.
You get: architecture decision records and design documents your team can review and approve.
Phase 3: implementation
Infrastructure deployed through Terraform with a CI/CD pipeline: plan on pull request, apply on merge, preflight validation and drift detection. Each layer is applied incrementally and documented in code.
You get: a working Azure environment with its infrastructure-as-code repository.
Phase 4: knowledge transfer and handoff
Training on the Terraform codebase, operational runbooks, monitoring dashboards and day-two procedures.
You get: operational documentation and recorded walkthroughs.
What we build
Landing zone architecture
Management group hierarchy and subscription segmentation, hub-and-spoke or Virtual WAN networking with DNS, firewall and inspection, Azure Policy for tagging, regions, SKUs and security baselines, naming and tagging standards, and monitoring foundations in Log Analytics. Deployed into your subscription and validated with terraform plan, not delivered as a PDF.
Microsoft Entra identity and Zero Trust
Conditional Access policy design, passwordless migration, Privileged Identity Management, break-glass accounts, cross-tenant access, lifecycle workflows and governance for agent identities. Network security with NSGs, Azure Firewall, Private Endpoints and Private DNS zones. Key Vault with RBAC and rotation. Defender for Cloud posture management and CIS benchmark alignment. The principle is simple: encrypt everything, authenticate everything, log everything, trust nothing.
Infrastructure as code with Terraform
Layered Terraform with separate state files and clean dependency chains, reusable tested modules, Azure Storage state backend with locking, GitHub Actions or Azure DevOps pipelines, preflight validation and drift remediation. We have shipped more than 9,300 lines of HCL across ten layers for production environments. Our open-source W365Claw module automates Windows 365 infrastructure.
Azure for Windows 365 and Azure Virtual Desktop
Azure Network Connections, custom image infrastructure with Azure Compute Gallery, Private DNS zones for the PaaS services your desktops use, Intune prerequisites and cost modeling. The desktop layer is covered on our Windows 365 and AVD consulting page; the two are designed together.
Azure for enterprise AI
Azure AI Foundry project configuration, Azure OpenAI deployments with regional placement for residency, AI Search indexes, Application Insights with OpenTelemetry, Key Vault integration and token budgets with Azure Monitor consumption alerts. For AI automation engagements, every byte of inference, embedding storage and telemetry stays in your tenant.
Cost optimization and FinOps
Cost allocation through tagging, budgets and action groups, reserved instance analysis, right-sizing cycles, orphan resource cleanup and infracost in CI/CD so cost impact is visible before deployment.
Proof, without naming names
We do not publish customer names or logos. These outcomes come from engagements across energy, healthcare, retail, banking and telecom:
- A ten-layer Terraform foundation of more than 9,300 lines of HCL across 87 specifications, from networking through AI Foundry workloads, for a production Azure estate.
- Zero Trust networking with private endpoints and DNS zone integration replacing public PaaS endpoints across an enterprise subscription set.
- Windows 365 Cloud PCs deployed for enterprise teams with Intune co-management.
Kevin Kaminski has been a Microsoft MVP every year since 2008 and writes the Entra ID What’s New series on this site, so the identity guidance reflects the service as it ships this month.
Azure consulting FAQ
What Azure services do you specialize in?
Azure infrastructure for endpoint management, identity and AI workloads: networking, Microsoft Entra ID, governance, Azure AI Foundry and Azure OpenAI, and the compute foundation under Windows 365 and Azure Virtual Desktop.
Do you handle Microsoft Entra identity work?
Yes. Conditional Access, passwordless migration, PIM, break-glass accounts, cross-tenant settings, lifecycle workflows and Entra Agent ID governance are a large share of our Azure engagements.
Do you use Terraform or Bicep?
Primarily Terraform with the AzureRM provider, with Bicep where it fits better. The choice follows your team’s skills and toolchain.
Can you work with our existing Azure environment?
Yes. Most engagements start with an assessment, then remediate incrementally.
What does Azure consulting cost?
Fixed-fee, scoped after a discovery call. An assessment runs two to four weeks and implementation is quoted from it, in USD for US clients and CAD for Canadian clients.
Do you work with organizations in the United States?
Yes. Most work is remote from Calgary, Alberta across Pacific, Mountain, Central and Eastern time, with on-site days by arrangement.
Do you provide ongoing Azure support?
Yes, on a retainer: Terraform updates, security posture reviews, cost optimization cycles and architecture guidance.
Related services
Microsoft Intune consulting — endpoint management on your Azure and Entra foundation
Windows 365 and Azure Virtual Desktop consulting — the desktops that run on it
AI automation consulting — governed agents on Azure AI Foundry and Microsoft 365
W365Claw on GitHub — open-source Terraform for Windows 365 infrastructure