Tier 3: Platform Transit Hub
A governed Azure platform for teams migrating workloads: everything in Tier 1, plus hub-and-spoke transit networking, Azure Firewall, Bastion, central logging, and security policy guardrails. Your application teams deploy onto a platform that is already governed and inspected.
- Fixed fee
- $48,000
- Delivery
- 10–15 business days
- Azure idle cost
- ~$1,400–1,800/mo
- Network
- Hub and spoke
How the platform is organized
Shared services sit in Platform subscriptions. Workloads sit in Landing Zones, peered to the hub and inspected on the way in and out.
(global guardrails and audit logging)"] Root --> Plat["Platform
(shared core services)"] Root --> LZ["Landing Zones
(application and workload subscriptions)"] Root --> SB["Sandbox
(isolated experiments)"] Plat --> SubMgmt["Management subscription
(central Log Analytics and alerts)"] Plat --> SubConn["Connectivity subscription
(hub network)"] Plat --> SubId["Identity subscription
(directory services)"] SubConn --> Hub["Hub virtual network
Azure Firewall, Bastion, private DNS"] LZ --> Corp["Corp
(internal only)"] LZ --> Online["Online
(public endpoints)"] Corp -.->|"Peered spoke"| Hub Online -.->|"Peered spoke"| Hub
What the $48,000 covers
For multi-team organizations moving workloads out of their data centers and onto Azure.
-
Everything in Tier 1
The Cloud Governance Foundation is included in full.
- Management group hierarchy: Platform, Landing Zones (Corp, Online), Sandbox, Decommissioned
- Subscription vending with guardrails inherited at creation
- Entra ID groups mapped to least-privilege roles
- Cost Management scopes, chargeback tags, and budget alerts
-
Hub-and-spoke transit network
A central hub in the Connectivity subscription with defined routing, ready for ExpressRoute.
- Hub-and-spoke virtual network or Virtual WAN, with dual-region transit routing
- Azure Firewall Standard or Premium with central route tables
- Firewall SKU chosen for current traffic, with a documented upgrade path
-
Bastion and private DNS
Administrative access and name resolution handled centrally.
- Azure Bastion for administrative access without public IPs on virtual machines
- Central private DNS zones and resolution for every spoke
-
Central logging and alerts
One Log Analytics workspace in the Management subscription, collecting audit logs, metrics, and security events from every spoke.
- Diagnostic settings applied to new resources
- Baseline alerts for performance, disk capacity, and health on new virtual machines, databases, and networks
-
Security policy guardrails
Azure Policy assignments based on the Microsoft Cloud Security Benchmark, evaluated continuously so drift shows in the compliance view rather than at audit time.
- Deny public IP exposure and unencrypted storage
- Require TLS 1.2 or later and private routing
- Network inspection policies for traffic through the hub
-
Business continuity
Azure Backup vaults and Site Recovery policies for your most critical stateful workloads.
-
Code and documentation
The code and delivery pipelines in your repository, for repeatable subscription deployment and vending.
- Architecture design document, diagrams, and decision records
- RACI, disaster recovery plan, and network runbooks
-
Handoff workshop
Full-day workshop and 14 days of post-handoff support.
- Route peering and DNS forwarding worked through with your platform engineer
- Repository handover with full code ownership
Know the Azure run cost before you sign
Tier 3 runs at about $1,400 to $1,800 a month for Azure Firewall, Bastion, and Log Analytics. We state it up front and deploy only what the tier needs.
| Cost area | Common source of idle spend | How Tier 3 handles it |
|---|---|---|
| Firewall | SKU sized above what current traffic needs | SKU chosen for current traffic, with a documented upgrade path |
| Gateways | Provisioned before any connection uses them | Hub prepared for ExpressRoute; only what the tier requires is deployed |
| Logging | Duplicate Log Analytics ingestion | One central workspace for every spoke |
| Non-production | Running around the clock | Auto-stop policies on non-production sandboxes |
| Allocation | Costs that cannot be traced to a team | Policy-enforced cost-allocation tags and budget alerts |
What you provide
Deployment rights
Owner rights on the target subscription or management group scope.
Address space
A non-overlapping CIDR block, such as a /22 or /23, for the hub subnets.
A platform engineer
One engineer for route peering, DNS forwarding, and the handoff workshop.
Ask about Microsoft Azure credits
If you are in Microsoft for Startups Founders Hub or planning a migration, Microsoft runs programs that can provide Azure credits. Microsoft sets eligibility; ask during your first call and we will help you check.
Add-on modules
Extend the platform with a fixed-scope module. To see Tiers 1, 2, and 3 side by side, compare tiers.
- SQL database migration
Schema assessment, transactional sync, and post-migration validation for moving to Azure SQL Managed Instance.
- Multicloud transit hub
Extends the hub to AWS and Google Cloud environments with BGP peering.
- AI and ML lakehouse
Databricks with Unity Catalog, deployed into your private platform network.
Questions
How is this different from an Azure landing zone?
An Azure landing zone is Microsoft's conceptual framework. The Platform Transit Hub is a concrete implementation of it, deployed into your tenant with policy guardrails and transit networking included.
What will the platform cost to run each month?
About $1,400 to $1,800 a month for Azure Firewall, Bastion, and Log Analytics. It rises as traffic and network interconnections grow. Tiers 1 and 2 add $0 a month.
Will this satisfy our SOC 2 or ISO 27001 auditors?
It covers the Azure infrastructure side. Policies based on the Microsoft Cloud Security Benchmark are evaluated continuously and produce evidence your auditor can sample. The outcome is your auditor's decision, and organizational controls stay with your team. For framework-specific mapping, see the Compliance Guardrail Pack.
Can we change the architecture later?
Yes. The platform follows the modular Cloud Adoption Framework structure, so your team can add spokes, regions, and services without reworking the management hierarchy.
Do we own the architecture and code?
Yes, all of it. Everything is delivered into your repositories, with no software licenses, proprietary agents, or ongoing fees to VitCamp.
Related field notes
On migration planning, landing-zone run cost, and subscription vending.
- Why enterprise Azure migrations stall
Governance sprawl, unmanaged networking, and compliance blockers, and why putting the foundation in place first removes them before workloads move.
- The idle cost of an Azure landing zone
Governance first, connectivity later: when transit networking is worth its monthly cost.
- Azure subscription vending
Replacing manual portal requests with a repository-based workflow.
Give your migration a platform to land on.
$48,000 fixed fee, 10 to 15 business days. Prefer to talk first? Book a free 30-minute architecture assessment.