Productised offer
Your Azure foundation,
production-ready in 3 weeks.
A fixed-price Azure Landing Zone built by the engineer who has landed platforms for state health, federal government, and a global mining major. A$55,000 - not a six-month engagement.
Why this exists
Most Azure foundations are built the wrong way.
Too many Azure environments start as a single subscription, grow into a sprawl, and collapse under the first audit, acquisition, or Copilot rollout. The fix isn't another six-month engagement or a stack of slides. It's a governed platform your team can run.
Tech Design Concept builds Azure Landing Zones the way Microsoft's Cloud Adoption Framework says they should be built - with Bicep, with policy-as-code, with handover - and does it in three weeks for a fixed price.
What you get
A platform, a policy baseline, and a handover.
A governed platform
Management groups, subscriptions, identity, networking, logging, and cost controls - built to the Cloud Adoption Framework, delivered as Bicep you own.
A policy baseline that passes audit
10–15 Azure Policies covering the gaps auditors always find: tagging, location, diagnostic settings, encryption, and SKU controls. Deployed as code, not clicks.
A handover, not a dependency
Your engineers walk away with the Bicep repo, a runbook, a policy catalogue, and a 90-minute knowledge transfer. Our job ends when yours becomes easier.
Fixed price, fixed time
A$55,000. Three weeks. No scope creep, no time-and-materials, no surprises. 50% on start, 50% on handover.
How it works
The three-week plan.
Week 1 - Discover & Design
Architecture, signed off before a single resource deploys.
A short discovery, then the architecture. Management group hierarchy, subscription model, identity baseline, network topology. You sign off before a single resource is deployed.
Week 2 - Implement
The entire landing zone deploys from Bicep.
The entire landing zone deploys from Bicep in your repo. Policies, logging, cost controls, the lot. By the end of the week, the platform is live.
Week 3 - Enable
Live knowledge transfer and full handover.
A live 90-minute knowledge transfer with your engineering team, full documentation, a policy catalogue, and 30 days of post-handover support for questions as your team settles in.
What you walk away with
The repo, the runbook, the catalogue.
Full Bicep source in your GitHub or Azure DevOps. A runbook your team can follow. A policy catalogue your auditor can read. No consultant dependency.
Who this is for
Mid-market IT leaders who need it done right, once.
You're the Head of Infrastructure or IT Director at a mid-market firm. Your Azure environment started organically and has grown messy. You have an audit, acquisition, Copilot rollout, or executive pressure making the mess visible.
You need it done right, once, by someone who has done it before in regulated environments - and you want your team to be able to run it after.
You are not looking for a consultancy that sets up camp.
Scope contract
What's in the box.
Included
- Cloud Adoption Framework-aligned management group hierarchy
- Subscription model: Platform, Landing Zone, Sandbox, Decommissioned
- Identity foundation: Entra ID baseline, PIM, break-glass accounts
- Network foundation: hub-spoke or vWAN, private DNS, NSG baseline
- 10–15 baseline Azure Policies (tagging, location, SKU, diagnostics, encryption)
- Log Analytics workspace with diagnostic settings wired across scope
- Cost controls: budgets, cost tags, alerts
- Full delivery via Bicep in your GitHub or Azure DevOps repo
- 90-minute knowledge transfer with your engineering team
- 30-day post-handover email support
Add-ons (flagged transparently)
- Defender for Cloud + Sentinel wiring - +A$15,000
- Copilot governance overlay (Purview + DLP) - +A$18,000
- Workload migration - separate engagement
- IRAP assessment - partnered delivery, quoted separately
Proof
Platforms already delivered.
State Health Department
12-month tenant-wide security program. 100% Defender coverage. 24/7 Sentinel monitoring.
State Government Agency
Secure network foundation delivered in 10 weeks. 100% Bicep-managed policies.
Global Mining Major
112+ applications integrated post-acquisition. 70% reduction in tracking errors.
Multi-Region Hospitality
CAF landing zones across 3 regions. 15+ subscriptions governed. 100% IaC.
Questions we get
Objections, answered.
Can it really be done in 3 weeks?
Yes - because the design is opinionated and the IaC is already written. We're deploying a proven pattern to your tenant, not inventing one.
Will we be locked in?
No. You receive the full Bicep repo and runbook. The offer is explicitly designed for handover, not retainer-capture.
What if our environment is unusual?
A 30-minute fit call confirms this is the right engagement for you. If it isn't, we'll tell you and recommend what is.
Do you do compliance frameworks?
The policy baseline maps to CIS and Essential 8 controls. Formal IRAP assessment is partnered delivery - quoted separately.
What happens after handover?
Thirty days of post-handover email support, then your team owns it. If you want ongoing governance oversight, that's the Fractional Cloud Governance Lead retainer.
How do we start?
Book a 30-minute fit call. We'll confirm scope, answer your questions, and if it's a good fit you'll have a signed SOW within 48 hours.
A$55,000 fixed · 3 weeks · no surprises
Ready to have an Azure foundation that works?
Book a 30-minute fit call. We'll confirm scope and, if it's a good fit, you'll have a signed SOW within 48 hours.