Is your Azure environment a sprawling mystery? Do you truly know what's running, or who's watching it? For many large organisations, Azure grows organically, like a wild garden: subscriptions multiply, teams have perhaps too much autonomy, and critical projects often launch long before any real governance takes root.
We recently partnered with an enterprise client facing precisely this chaos: a large Azure tenant with significant blind spots, operations teams suddenly accountable, and a burning question: "how do we bring order without breaking everything?".
Instead of starting from scratch, we teamed up with their operations, engineering, and architecture teams to deliver something smarter: scalable, policy-driven monitoring built on Azure-native tooling, applied with surgical precision, and collaboration at every step.
This is the story of how it came together.
Our engagement began with the operations team. They were newly accountable for supporting the tenant, yet had no baseline monitoring, alerting, or consistent governance to lean on. Their request was straightforward: “Give us visibility and make it sustainable.”
But the tenant was in a state of architectural drift:
This is not atypical for many mature Azure footprints: tenants that grow organically through quick project spin-ups, dev/test experiments that go production, or siloed business units with free rein. Governance and observability often come after the fact, if at all.
Our client was not oblivious to this. The architecture team, responsible for tenant design, shared the goal of modernisation but had valid concerns. With a major, critical programme of work underway, the risk of disruptive change meant that tenant restructuring could not be done in a rush. Everyone agreed that improvement was needed, but timing and proper scoping mattered.
The cherry on the cake? A strict compliance requirement for full isolation between siloed environments. For these workloads, monitoring data, including logs, should not co-mingle.
Successful delivery then required alignment with the broader technology group. What followed was a model example of collaborative design: senior leaders endorsed the direction, internal stakeholders helped shape it, and OSS Group brought the tools, patterns, and implementation expertise to get it over the line.
We couldn’t force a tenant-wide restructure, and we couldn’t interrupt existing projects. Instead, we took a targeted, modular approach focused on repeatability, visibility, and low-friction integration.
What we needed was a way to:
This is where Azure Verified Modules (AVMs), Microsoft’s Azure Monitoring Baseline Alerts (AMBA), and a lot of smart Terraform came into play.
There were five potential models for monitoring and alerting, ranging from fully centralised to entirely decentralised. After discussion across architecture, operations, and engineering, we landed on a hybrid approach:
A key decision, jointly agreed with the client’s Lead Platform Engineer, was to adopt Microsoft’s AVMs. These modular, policy-backed Terraform modules enabled rapid, consistent deployment of:
avm-ptn-alz)avm-ptn-alz-management)avm-ptn-monitoring-amba-alz)The use of AVMs meant we were building with Microsoft-supported, best-practice patterns from the start. It also made the solution highly repeatable across siloed environments.
All infrastructure was provisioned using Terraform via Azure DevOps pipelines. Shared state enabled collaboration within the team, and Terraform Workspaces were used to cleanly separate environments.
We relied on for_each, locals, and variable-driven design to scale configuration without duplicating code, while keeping things human-readable (mostly!).
This wasn’t just a “deploy and disappear” engagement. In parallel with infrastructure roll-out, we delivered guidance documentation and architectural rationale; and conducted training with operations and engineering teams.
The outcome was a capability, not just a build. Ops teams now understand how to extend and maintain their observability stack, and architects have a model for safe, modular tenant uplift that avoids large-scale restructure.
This kind of work is never just about tools. The success of the project came down to the strength of the relationships:
It was a case study in shared ownership: OSS Group brought the framework, but internal teams brought the insight that made it land.
The immediate outcome was clear:
But there’s also a strategic win: the organisation now has a tested pattern for rolling out CAF-aligned governance across their Azure footprint, with minimal disruption.
It stabilises the present and enables the future.
If your Azure environment has grown organically and you're wondering how to introduce structure without pausing everything, consider this:
Whether you're looking to stabilise your Azure tenant, roll out observability, or just start aligning to CAF in a practical way, OSS Group can help.
We specialise in:
Reach out to us at OSS Group or call 0800-OSS-GRP. Let’s structure something together, without stopping the show.