Power BI
- Reports and dashboards
- Semantic models
- Direct Lake or import
CloudXcelerator · Azure landing zonesReady, set,
Ready, set,
landing zone.
Enterprise landing zone blueprints as code. Spin up a secure, well-architected Azure cloud foundation in days, with governance, networking and security in place before the first workload arrives.
Cloud Adoption FrameworkBicepTerraformAzure PolicyHub and spoke
What it is
Insights, not infrastructure
Built on Microsoft's Cloud Adoption Framework and delivered through proven Bicep and Terraform templates, CloudXcelerator delivers governance, networking, security, Databricks, Fabric and data pipelines, so you can focus on insights, not infrastructure.
Governed from day one
Policy, role-based access and Defender for Cloud are applied at the management-group level, so every new subscription inherits them without anyone remembering to.
Repeatable, from code
Every management group, policy, role and network is defined in Git and deployed by pipeline. Rebuild, review or extend it like any other code.
Ready for data
A data landing zone sits on top, with storage, ingestion and private networking laid out for Databricks, Fabric and Data Factory.
Enterprise landing zone
The benchmark for a well-architected cloud
Your Azure landing zone is grounded in Microsoft's Cloud Adoption Framework and proven across enterprise deployments. It weaves governance, security and scalability into your environment. Use the blueprint as your baseline, adapt it to your existing tools and policies, and accelerate the journey to a fully governed Azure estate.
Microsoft Entra ID tenantUsers, groups, service principals and Privileged Identity Management
Tenant root management groupYour organisation, with policy inherited by everything below
Platform
Identity
Subscription
- Domain controllers
- Key Vault
- Recovery vault
Management
Subscription
- Log Analytics workspace
- Azure Monitor and alerts
- Automation and update management
- Cost management
ConnectivityHub
Subscription
- Hub virtual network
- Azure Firewall
- ExpressRoute or VPN
- DDoS protection
- Private DNS zones
Landing zones
CorpSpoke
Subscription
- Spoke network peered to the hub
- Private workloads and data platforms
- Key Vault and recovery vault
OnlineSpoke
Subscription
- Internet-facing workloads
- Web application firewall
- Shared services
Sandbox
Sandbox
Subscription
- Experiments and proofs of concept
- Isolated from the corporate network
- Budget caps
Applied at every level
- Azure Policy
- Role-based access
- Defender for Cloud
- Network Watcher
- Budgets and tagging
CloudXcelerator deploys it from code
Git repositoryBicep or Terraform pipelineYour Azure tenant
- Management groups
- Policy definitions and assignments
- Custom roles
- Subscription vending
- Hub and spoke networking
What gets deployed
Everything a security review will ask about
Identity and access
- Management-group hierarchy
- Custom roles and role assignments
- Privileged Identity Management
- Break-glass accounts
Governance
- Azure Policy initiatives
- Tagging and naming standards
- Budgets and cost alerts
- Defender for Cloud plans
Networking
- Hub virtual network and firewall
- Spoke networks peered to the hub
- Private DNS zones
- ExpressRoute or VPN gateway
Operations
- Central Log Analytics workspace
- Diagnostic settings by policy
- Backup and recovery vaults
- Subscription vending
Data landing zone
Layers, resource groups and roles, laid out
The data landing zone architecture sets out the layers, their resource groups and the services each one contains, plus every group and role and the extent of its access to your control and data planes.
We use it as the starting point and shape it to your business and technical requirements when we plan your data landing zone.
Data landing zone One subscription per domain or region, peered to the connectivity hub
Reporting
Owned byEnd users
Data applications
data-application-rg · one per data product
- Data Factory pipelines
- Databricks or Fabric
- Machine learning
- AI services
- Key Vault
Owned byData application teams
Ingestion
metadata-ingestion-rg
- Data Factory
- Databricks (ingest)
- Event Hubs
- Metadata database
- Key Vault
external-data-rg
- Storage for third-party drops
runtimes-rg
- Self-hosted integration runtime
Owned byData landing zone ops
Storage
storage-rg · ADLS Gen2, Delta tables
- Raw
- Enriched
- Curated
- Development
Platform
network-rg
- Virtual network
- NSGs and route tables
- Network Watcher
monitoring-rg
- Log Analytics
- Databricks monitoring
mgmt-rg
- CI/CD agents
- Defender for Cloud
Owned byPlatform ops
How we can help
Three ways in
Deployment
We build and deliver your landing zones on Azure, whether you need multiple environments (DEV, TEST, PROD) or a fully secured implementation.
Existing Azure estate
Already have subscriptions? We deliver the data landing zone into them, or help you re-engineer ready for a new data project.
Infrastructure as code
Enterprise and data landing zones deployed from ARM templates, Bicep or Terraform, following best practice, and handed over in your own repository.
What runs on top
The foundation the other Xcelerators land in
Each of these deploys into a CloudXcelerator landing zone, inheriting its networking, identity and policy.
Technology
What it's built with
Azure Landing ZonesCloud Adoption FrameworkBicepTerraformARM templatesAzure PolicyMicrosoft Entra IDAzure FirewallLog AnalyticsDefender for CloudAzure DevOpsGitHub Actions