SERVICE SCOPE
What’s in scope.
01
Identity and organisation
Map the Microsoft Entra tenant, privileged access, management groups and subscriptions. Review resource ownership and the boundaries between the platform team, workload teams and service owners.
02
Policy, network and security evidence
Inspect Azure Policy, exceptions, connectivity, topology and DNS alongside logging and monitoring. Review Defender for Cloud scope and the evidence available to investigate an incident or explain a control.
03
Hybrid and operational coverage
Assess Azure Arc choices for supported resources outside Azure. Include tagging, backup, recovery, automation and operating responsibilities so the review connects architectural guardrails with the work of running services.
A control plan with owners and priorities.
Compare the current state with agreed platform and workload requirements, then identify the decisions that need action.
✓
Current control-plane and subscription map.
✓
Landing-zone and privileged-access findings.
✓
Policy, logging and exception gap register.
✓
Hybrid and Arc coverage decisions.
✓
Prioritised remediation backlog and executive risk readout.
When this review fits.
Use it when growth, acquisitions, new subscriptions or hybrid systems have fragmented control and ownership. The architecture should distinguish shared platform foundations from the requirements of individual workloads.
01
Find where control becomes inconsistent
New subscriptions, acquired businesses and hybrid servers can create different access models, policies and logging practices within one organisation. The review asks where those differences are deliberate and where ownership or standards have been lost. The focus is the ability to govern the estate consistently, including documented exceptions.
Azure landing-zone design areas provide a way to examine identity, resource organisation, connectivity and governance. Azure Arc can extend management to supported servers outside Azure; connecting a server does not move its workload. The review should distinguish management coverage from migration and from the security plans enabled on each resource.
02
Prepare the map of administrative responsibility
Bring tenant and subscription details, management groups, privileged roles, network relationships, policies and the logging arrangement. For hybrid resources, identify server ownership, connectivity and existing management tools. Include exceptions and inherited environments so the findings reflect more than the best-documented subscription.
Customer platform, security and workload owners should agree the baseline and decide where exceptions are justified. The output should record the current control map, missing coverage, policy conflicts and a prioritised remediation backlog. Assessment does not automatically authorise policy enforcement or privileged-access changes; those changes need a defined delivery and validation scope because they can affect existing workloads.
BEFORE YOU DECIDE
Practical questions.
▸
Does a landing zone establish compliance?
▸
Does Azure Arc migrate servers?
▸
Are all Defender capabilities included?
▸
Is this a review of application source code?
▸
Will policies be enforced during the review?
▸
Can different business units retain exceptions?
▸
What if administrative ownership is unclear?
BUILD YOUR BUSINESS CASE
Make management ownership visible across the estate.
The problem to solve.
Subscriptions and resources can be working while policies, privileged access and operational responsibility differ from one part of the estate to another.
What success should look like.
Agree a consistent management baseline and prioritise the ownership or configuration gaps that put controlled operation at risk.
Bring these into the discussion.
A useful starting point for your team and the people approving the investment.
Useful reading for your proposal.
Evidence, examples and questions to take into the decision.
Insight
2 September 2026
Change governance
Treat a network setting as a managed change
Use the firewall example to test ownership, prerequisites and the change window.
Read the insight
Insight
14 August 2026
Operational control
Keep runbooks aligned with the tools
Review what happens when a security workflow moves between services.
Read the insight
LET’S GROW.
Work through the next step with Braintree.
Bring the structure and the exceptions. We can help turn them into a clear management improvement plan.
