Tier 1: Cloud Governance Foundation
The organizational backbone for your Azure tenant: a management group hierarchy, automated subscription vending, least-privilege access, and budget alerts. It is control plane only, so nothing in it bills while idle.
- Fixed fee
- $12,000
- Delivery
- 5 business days
- Azure idle cost
- $0/mo
- Runtime services
- None
A control-plane-only hierarchy
A management group tree aligned to the Microsoft Cloud Adoption Framework, separating Platform, Landing Zones, Sandbox, and Decommissioned subscriptions.
(activity logs and budgets)"] Platform --> ConnSub["Connectivity subscription
(reserved address space)"] Platform --> IdentitySub["Identity subscription
(Entra ID governance)"] LandingZones --> Corp["Corp
(internal services)"] LandingZones --> Online["Online
(public-facing apps)"] Corp --> CorpSub["Corp workload subscription"] Online --> OnlineSub["Online workload subscription"]
What the $12,000 covers
For early-stage and lean cloud teams setting up a new tenant, or bringing order to one that grew without a plan.
-
Management group hierarchy
A clean tree deployed at the tenant root, following Microsoft Cloud Adoption Framework guidance.
- Top-level intermediate management group
- Platform separation: Management, Connectivity, Identity
- Landing Zones (Corp, Online) and Sandbox trees
-
Subscription vending
A repeatable way for your team to create production, staging, and sandbox subscriptions on request, with guardrails already inherited.
- Subscription creation, naming conventions, and enrollment
- Placement into the right management group
- Baseline tags, budget alerts, and role assignments attached at creation
-
Least-privilege access
Built-in and custom roles mapped to Entra ID security groups, so subscription Owner rights stop spreading.
- Platform Ops, Network Contributor, and Security Reader roles
- Workload developer access scoped to workload resource groups
- No standing subscription Owner rights for operational teams
-
Budgets and tagging guardrails
Cost containment from the first subscription onward.
- Budget alerts by email
- Mandatory environment, owner, service, and cost-center tags
- Region restrictions that deny deployment outside approved Azure regions
-
No runtime services
Tier 1 deploys no firewalls, gateways, or compute, so Azure idle cost stays at $0 a month.
-
Documentation
Delivered into your repository, and yours to keep.
- Architecture design document and decision records
- High-level and low-level diagrams in editable vector format
- RACI and a step-by-step subscription provisioning runbook
-
Handoff workshop
A half-day workshop with your engineering lead to walk through the code, run subscription vending together, and review operating procedures.
- Repository handover and branching policy setup
- Full code ownership, with no license or lock-in
A fixed scope, a fixed fee, code in your repository
Landing-zone work is often billed by time, and some templates deploy firewalls and gateways that bill before any workload needs them.
| Aspect | Time-and-materials engagement | Cloud Governance Foundation |
|---|---|---|
| Fee | Moves with scope changes | $12,000 fixed |
| Timeline | Moves with scope changes | 5 business days |
| Azure idle cost | Templates may include firewalls or gateways that bill while idle | $0/mo, no compute or network runtime |
| Deliverables | Can stop at design documents | Deployed code plus design document, diagrams, and decision records |
| Code | Handover may need separate negotiation | In your repository, and yours to keep |
What you provide
Azure permissions
Global Administrator or Management Group Contributor rights for our deployment identity during the 5-day delivery window.
An empty repository
A new repository in GitHub Enterprise, Azure DevOps, or GitLab for the code to be committed to.
A technical owner
One platform lead available for the kickoff call and the half-day workshop.
Questions
Why is the ongoing Azure cost $0 a month?
Management groups, subscriptions, Entra ID role assignments, tagging policies, and Cost Management budget alerts are Azure Resource Manager control-plane features, and Microsoft does not charge for them. You pay Azure only when you deploy runtime resources such as virtual machines, databases, or firewalls.
Can we add Tier 2 or Tier 3 later?
Yes. Tier 1 is built to be extended. When you prepare for a SOC 2 audit, or need transit networking to connect on-premises sites, the Compliance Guardrail Pack or the Platform Transit Hub goes onto the existing hierarchy without rebuilding it.
Who owns the code and documentation?
You do. All deployed code, templates, and architecture documents are yours. VitCamp keeps no license over them and charges no recurring fees.
Related field notes
On the problems Tier 1 addresses: idle cloud cost, manual subscription requests, and enterprise security reviews.
- The idle cost of an Azure landing zone
Why some landing-zone templates bill before any workload exists, and how a control-plane-only foundation keeps Azure idle cost at $0 a month.
- Azure subscription vending
Replacing manual portal requests with a repository-based workflow, so new subscriptions arrive with budgets and policy attached.
- What CISOs look for in your Azure hierarchy
What enterprise security questionnaires ask about tenant hierarchy, privileged access, and audit logging, and how to answer from configuration.
Build the foundation once, before the tenant grows.
$12,000 fixed fee, 5 business days, $0/mo Azure idle cost. Prefer to talk first? Book a free 30-minute architecture assessment.