Microsoft Azure in Cranbury, NJ

Mostly the ownership and the shape. The inventory typically finds the pieces scattered — email in one tenant (whose name is on it, nobody is sure), files in a personal account, a workload on a reseller’s terms, something production-shaped on a personal card — each working, none sharing one identity or policy, the invoices arriving in pieces. The programme consolidates that sprawl into your own tenant with a designed landing zone: one identity for your people across everything, policy applied by construction, the strays re-homed in waves your users validate, and one monthly invoice that can be explained line by line. Your staff keep using the tools they know; what changes is that the estate underneath them becomes one governed, provably yours asset instead of an archaeology of good intentions.

On a properly built tenant, the controls are the platform’s best: your people sign in as themselves (one identity per person), access is bounded by role and need, sensitive actions are logged, departures close every door in one act, and the data sits under your keys and your policy with backups tested by restoration. The configuration is the thing — Azure provides the instruments, the landing zone decides whether they’re played — and the standing operation keeps posture measured against its baseline, with the evidence kept for insurers, clients or auditors who ask. The honest comparison is with the incumbent sprawl, where the access question often has no answer at all.

Mostly as tidiness: one sign-in that works everywhere, files in the places the design says they live, the tools they know continuing to be the tools they know. The waves are sequenced around the practice’s calendar and validated on real work by the people who do it, so changes arrive as briefed improvements rather than surprises; anything genuinely new (a device policy enrolling their laptop, a sign-in that asks for a second factor) is introduced with its reason attached, which professionals accept readily — it is, after all, the same discipline their own clients demand of them. What disappears without ceremony is the archaeology: the second tenant, the personal card, the reseller’s margin.

Very often, yes — and where it can’t host them well, the design says so in writing. The inventory sentences each workload by its evidence: the platform-native and the web-shaped tools land naturally; the sector application with its own hosting terms stays where it is, governed inside the same identity and register rather than forcibly absorbed; the genuinely premises-bound system remains local under the hybrid pattern. Azure’s role in this programme is the estate’s governed centre, not a vacuum: sovereignty means one map and one policy across wherever each piece rightly lives, not a single address imposed for tidiness.

By a person, monthly, in the report — which is the only mechanism that has ever worked. The operation audits the meter against real use: idle resources named and closed, oversized ones right-sized, storage tiered to its access pattern, and advance commitments bought only where usage patterns are proven stable enough to justify them. The landing zone’s structure prevents the classic accidents (the forgotten test environment billing at production size, the personal card quietly carrying a workload) by making every resource owned, tagged and reviewed. The practice receives the invoice’s explanation line by line in plain language; a platform whose rent cannot be explained is a platform not yet governed.

One act: the identity is disabled, and because everything in the governed estate hangs from identity — files, mail, applications, platforms, devices — every door closes by that single act, with the register confirming what closed. Their work product stays in the firm’s tenant because it always lived there; the archaeology of the sprawl era (what did they administer, what sits in their personal storage, what renews on their card) is a category the design has retired permanently. Joiners are the same procedure in reverse: provisioned from the documentation, inside the policy from their first sign-in, ready on their first morning.

In the programme’s sequence: the inventory and landing-zone design as a fixed engagement (the map, the spill of duplicated subscriptions and unclaimed capabilities priced in it, is routinely the most valuable document of the year), implementation waves priced against that design, and the standing operation as a monthly line. The comparison belongs against the sprawl’s true ledger — the duplicated rentals, the reseller margins, the security purchases the licence already covered, and the unpriced one: the client questionnaire answered in archaeology instead of evidence. Consolidations of this kind commonly pay for their design in the first year’s cleaned ledger alone; the governance is what the practice keeps.