Management groups & subscriptions
A clear hierarchy for platform and workload subscriptions, with subscription vending so a new team gets a ready, compliant environment in minutes, not weeks.
Heartwood
A secure, well-governed Azure foundation, built entirely as code, so your teams can deploy workloads with confidence from the first day.
What Heartwood is
Heartwood is our Azure landing zone: the shared structure every workload sits on. It sets up subscriptions, networking, identity, security guardrails, monitoring and deployment pipelines in one consistent design, instead of each team building its own corner of Azure by hand.
It suits organisations moving to Azure, growing from one team to several, or tidying an estate that grew without a plan: subscriptions created ad hoc, resources reachable from the internet, no common monitoring, and changes made in the portal rather than in code.
Heartwood is delivered by Adam White and draws on the platform work in our case studies: subscription vending and a hub-and-spoke network at Stonewater, Azure estates rebuilt in Terraform at Schneider Electric and Landmark, and storage protected with Azure Defender at the UK Hydrographic Office.
What's included
Hub-and-spoke networking
A shared hub with peered workload spokes, private endpoints and private DNS, so services talk to each other privately rather than over the public internet.
Identity & secure access
Entra ID groups and role-based access with least privilege, managed identities instead of stored secrets, and Azure Bastion for administration without public IP addresses.
Security & governance
Azure Policy guardrails, Defender for Cloud, Key Vault for secrets and certificates, and naming and tagging standards that make ownership and cost obvious.
Monitoring & alerting
Central Log Analytics and Application Insights, with alerts and dashboards built around what your customers experience, not just CPU graphs.
Infrastructure as code
Everything in reusable Terraform or Bicep modules in your own repository, so the platform can be reviewed, versioned, rebuilt and extended.
Pipelines & build agents
Azure DevOps or GitHub Actions pipelines that deploy the platform and workloads the same way in every environment, with managed build agents where needed.
Cost management
Budgets, alerts and tagging from the start, and a FinOps review of what you already run, so spend is visible and owned.
A first workload, end to end
A sample application deployed through the new pipelines and network, proving the path from commit to production before your own workloads move in.
How it's delivered
Assess and design
We review your current Azure estate, security and compliance needs, and the workloads planned for it, then agree the design and the right package.
Build and configure
We deploy Heartwood into your tenant through pipelines, from code in your repository, alongside your team so they see how every part fits together.
Test, hand over, go live
We check the guardrails and monitoring, deploy the first workload, and hand over documentation and knowledge so your team can run and extend it.
Timescales and price are agreed after the assessment, once the scope is clear.
Packages
A sound start
- Single region
- Subscription structure and hub-and-spoke network
- Baseline policies, Key Vault and role-based access
- Central logging and core alerts
- Platform deployed from Terraform or Bicep by pipeline
For several teams
- Everything in Sapling
- Subscription vending for new teams
- Defender for Cloud and Azure Bastion
- Custom policies and tagging for cost ownership
- Dashboards and a first workload deployed end to end
Enterprise scale
- Everything in Grove
- Multi-region design with disaster recovery
- Policy sets for your compliance requirements
- Further automation of platform operations
- Several workload patterns, such as AKS, Functions and App Service
Planning an Azure foundation?
Tell us about your estate, your teams and what has to run on it. The fastest way to reach us is by email.
Email [email protected]