Software development on the Microsoft Azure cloud

Built on the accounts
people already use

We build software on the Microsoft Azure cloud, signed in through the accounts your people already have, with each role granted only where it’s needed and no passwords kept in code, so you can see who can change what.

Thanks, we’ll be in touch soon.

{{ heroStatus }}

You’re in good company

A few of the companies we’ve worked with.

When everything shares one subscription

Everything you run on the Azure cloud sits in a subscription, a container for Azure resources and the bill that comes with them. A resource is any single thing you run there, such as an app, a database or a file store, and each one sits in a resource group with the others that share its lifecycle. Starting with one subscription and a few owners is the quick way in, and for a first system it works well.

Over time, test and live, every team and every app come to share it. A role, the set of things someone is allowed to do, granted on the subscription to get something working reaches every resource group and resource in it. A tag, a label such as a team’s name, isn’t passed down from a resource group or a subscription to the resources in it, so a resource made without its own tags is hard to place on the bill.

And what apps run on, from language versions to the way a function app runs its code, reaches the end of its support on dates Microsoft publishes.

None of this stops a system from working today. So most of the work is in the structure: which subscription holds what, who can change it, and keeping what runs within support. The first step depends on what you have now.

What we build

Changes to what runs go through code, a person’s review and CI, so the test and live subscriptions stay alike.

  • New services and apps

    Services and apps on Azure App Service or in containers, and functions, small pieces of code that run when they’re called, on Azure Functions, each with tests from the first commit.

  • Sign-in your people already have

    Apps your organization builds signed in through Microsoft Entra ID, the identity service that holds the accounts your people already use, so there’s no second password to keep.

  • Subscriptions, set up from the start

    Separate subscriptions for test and live and for each team, grouped under management groups, with the rules set once at the top in Azure Policy and applied to everything below.

  • What runs, in code

    Every resource described in code, reviewed and deployed from CI, so what runs in test is what runs in live.

  • A team on every cost

    Every resource tagged by team and product, the tags set by a policy since resources don’t take them from their group, with budgets and alerts in Microsoft Cost Management, and the bill read with you.

  • Runtimes kept in support

    Each runtime, the language version an app runs on, tracked against its end of support and moved forward ahead of it, on a branch, with tests.

  • Each role, only where it’s needed

    Each role granted at the narrowest level that works, and each app given a managed identity, an identity of its own that’s managed for it in Microsoft Entra ID, so, where the services support it, no password or key sits in its code or settings.

  • Systems brought across, in stages

    Systems moved onto Azure services in planned stages, .NET Framework apps among them, each stage tested before the next and the old system kept until the new one has taken over.

  • AI where it helps

    AI features built with Microsoft Foundry, which Microsoft describes as a platform for building AI agents, models and apps, each reaching only the data it needs, and code drafted by an AI assistant reviewed and tested before it ships.

Granted higher up, it reaches further

What you run on the Azure cloud is arranged in four levels, each inside the one above: management groups, subscriptions, resource groups and resources. A management group holds subscriptions, a subscription holds resource groups, and a resource group holds the resources in it.

A role granted at one level applies to everything inside it. Granted on a subscription, it reaches every resource group and resource in that subscription; granted on a resource group, it reaches only what’s in that group.

Rules set with Azure Policy at one level apply to everything inside it too, unless a level below is left out on purpose.

Tags are the exception: a tag on a resource group or a subscription isn’t passed down to the resources in it, so we set each resource’s tags with a policy.

So we grant each role at the narrowest level that works, set the rules at the top, and go through who can change what with you on a schedule.

Press a column’s name to sort the table by it. Sorting by where each role is granted brings the widest reach to the top.

Who can change what at Quillon Outfitters (the column headers with buttons sort the table) So it reaches {{ r.who }}{{ r.can }}{{ r.on }}{{ r.reach }}

The set-up account: granted for the first set-up, and still in place. We’d narrow this one first.

{{ scSay }}

Retired with notice, moved ahead of time

Most Azure services follow Microsoft’s Modern Lifecycle Policy, which gives notice before support ends for a service with no successor, and notice when you have to act to keep a service working as it should.

Retirements are announced on Azure Updates, each with its date, and Microsoft tells subscription owners about the changes that affect them.

Azure Functions runs .NET code in one of two models. Support for the in-process model is set to end on November 10, 2026, and Microsoft’s way forward is the isolated worker model; after that date, the in-process model gets no security updates or bug fixes.

We keep a list of each system’s runtimes and versions and the retirements that touch them, and move each one on a branch, tested, before its date.

Start with the subscriptions, and who can change them

The review covers the tenant, and the subscriptions and management groups in it; who holds which role at each level, owners on subscriptions above all, and access nobody uses; your Azure Policy assignments, and what they cover; how your apps sign people in; which apps reach other services with managed identities, and which still keep passwords or keys, and where; Azure Key Vault, for the secrets that still have to exist; what can be reached from the internet, and what stays private; tags, budgets and alerts in Microsoft Cost Management, and the largest costs, which we go through with you; how much of what runs is described in code, and how it’s deployed; runtimes and versions against their end of support, the Azure Functions model above all; which systems run across availability zones, separate groups of datacenters within a region, and whether their data has been restored from its copies in a test; logs and alerts; and CI and deploys.

The first step is one of these, each tried in a test subscription first: test and live in separate subscriptions, under a management group with its rules set; one owner on a subscription narrowed to the role their work needs; one app moved from a stored password to an identity of its own; tags set by policy, with budgets and alerts; or one function app moved to the isolated worker model.

What you receive is a written review and a proposal for that first step.

Questions worth asking

  1. Will it suit our system?

    It’s often a good fit when your organization already runs on Microsoft 365 or builds with .NET, though that depends on the system and the team. We look at what it runs and what your team knows first, and suggest what fits.

  2. Can our people sign in with the accounts they already have?

    Yes. Apps we build for you can sign people in through Microsoft Entra ID, which already holds your people’s accounts if your organization uses Microsoft 365, so nobody needs a new account for them.

  3. Can you work in our existing tenant and subscriptions?

    Yes. You give each of us our own access, at the level the work needs, and the tenant and the subscriptions stay yours throughout.

  4. Do our apps need passwords to reach our data?

    Often not. Where the services support it, each app gets a managed identity, an identity of its own that’s managed for it in Microsoft Entra ID, and gets its access without a stored password. The secrets that still have to exist are kept in Azure Key Vault.

  5. How do we see what each team spends?

    Every resource carries tags for its team and product, set by a policy as each one is made, with budgets and alerts in Microsoft Cost Management. A budget sends an alert; it doesn’t stop anything running. We also go through the bill with you.

  6. What happens when a runtime reaches the end of support?

    Microsoft publishes the date ahead, and after it there are no more fixes. For the in-process model of Azure Functions, for example, no security updates or bug fixes are provided once its support ends. We move each one forward on a branch, tested, before its date.

  7. Can you bring our systems over?

    Yes. We plan the move in stages, test each one before the next, keep a way back at every step, and switch the old system off only once the new one is doing its work.

  8. Can you move our older apps as well?

    Yes. Apps on the .NET Framework move to current .NET a part at a time, with the old app working until each part is replaced, as our .NET Development page sets out.

    .NET Development

  9. How do you look after security?

    Roles are granted only where they’re needed, apps get identities of their own, rules are set at the top with Azure Policy, and networks stay private where they should. A security review goes further.

    Application Security

  10. Can we add AI features?

    Yes, with Microsoft Foundry, which Microsoft describes as a platform for building AI agents, models and apps, with each feature reaching only the data it needs.

    AI Services

  11. Can you pick up systems that are already running?

    Yes. We start by reading your subscriptions: how they’re arranged, who holds which role, how much is described in code and how it’s deployed. Then we agree one piece of work to start with, with a named person on our side working next to your developers.

    Support & Maintenance

  12. What does it cost?

    It depends on what you run and where you want to start. Before any work starts, you get a written proposal with the scope, the price or rate, and how you pay.

    Pricing

  13. Can AI assistants help with our code?

    Yes, as one of the ways code gets written. Each change an assistant drafts, app code or the code that describes your resources, is tested and reviewed by a person before it reaches a live subscription.

    AI-Assisted Engineering

  14. Can we hire developers for our own team?

    Yes. We introduce developers for the Microsoft Azure cloud within 48 hours of your request, each working in your time zone, and you choose who joins after meeting them.

    Developers for your team

Microsoft, Azure, Microsoft 365, Microsoft Entra, Power Platform and SharePoint are trademarks of the Microsoft group of companies, and the other Microsoft product names on this page, such as .NET, Azure App Service, Azure Functions, Azure Key Vault, Azure Policy, Microsoft Cost Management and Microsoft Foundry, may be too. Webair is independent of Microsoft, and isn’t sponsored by, endorsed by or affiliated with it.

Let’s build it better

Tell us what runs in your Azure subscriptions and who can change it, and we’ll suggest where to start, in a short call.

Thanks, we’ll be in touch soon.

{{ ctaStatus }}