Licensing, Cost and FinOps
Azure performance and cost optimization assessment
Azure performance and cost optimization assessment is a 3-day, $500 fixed-price review of your existing Azure environment.
$500 per project3 days
View service →Implementation
Microsoft Azure Security Hardening — Environment & Application Protection
This service makes your Microsoft Azure environment safer and more secure: IT Partner reviews your current Azure services, access controls, network-layer security, and cloud service configurations, compiles a prioritized list of changes for your approval, and applies the approved changes based on Microsoft Azure security best practices. The service is billed at $175 per hour, typically runs 2-3 weeks, and is managed by Mike Mackey.
01 — Overview
What this engagement is
A Microsoft partner since 2006, currently holding Microsoft Solutions Partner designations, IT Partner provides this service to help prevent unauthorized access and reduce the risk of compromise in your Azure environment. The review works with the security controls Microsoft actually ships today: role-based access control (RBAC) and least-privilege assignments, Microsoft Defender for Cloud recommendations and Secure Score, Azure Policy alignment, network security groups and access points to Azure resources, security log visibility, and the configuration of workloads such as virtual machines, databases, and applications. The engagement follows a review-approve-apply cycle: IT Partner analyzes the current state, compiles a coordinated roadmap of recommended changes with expected impact, and implements only the changes you approve, within agreed change windows. The objective is a measurably safer Azure environment without surprises to access or application behavior.
02 — Outcomes
Success criteria
01The current status of Azure Services is analyzed
02The list of changes is compiled and approved
03Approved changes are successfully applied
03 — Deliverables
What you receive
✓Project closeout report indicating the final project status, including evidence of meeting acceptance criteria, any outstanding issues, and the final budget
04 — Plan
How the work unfolds
Kickoff meeting
Confirm the Azure environment scope, business priorities, key stakeholders, access approach, change-control process, maintenance windows, and any known security concerns or recent incidents that should guide the review.
Azure Cloud health check
Review the current Azure services and configurations in scope, including subscriptions, resource groups, RBAC, access points, security logs, networking controls, virtual machines, databases, applications, and other relevant Azure resources.
Start securing process
Identify security gaps and practical hardening actions, prioritize them by risk and effort, and begin preparing safe configuration changes that align with Microsoft Azure best practices and the client's operating requirements.
Provide and coordinate the changes road map
Present a coordinated list of recommended changes, expected impact, dependencies, owners, and proposed implementation sequence so the client can review, approve, defer, or reject each item before changes are applied.
Verification of changes
Validate proposed or staged changes against the approved roadmap, confirm that access and application behavior are not expected to be negatively affected, and agree on any testing or rollback steps required before final implementation.
Apply changes
Implement the approved security changes within the agreed scope and change windows, support client validation, document completed work, and identify any remaining recommendations or follow-up items for closeout.
05 — Before we start
Prerequisites
→Azure tenant and subscription details for the environment in scope, including subscription IDs, resource groups, and any known production, non-production, or excluded resources.
→Appropriate least-privilege access for discovery and review, typically including Azure Reader or Security Reader access and access to relevant logs; elevated roles such as Contributor, Network Contributor, User Access Administrator, or Owner should be granted only when needed for approved changes.
→Client approval to review security-related telemetry such as Azure Activity Logs, Microsoft Defender for Cloud recommendations, Microsoft Entra ID sign-in and audit logs, Log Analytics workspaces, network security logs, or firewall logs where available and in scope.
→Current architecture or environment information, such as network diagrams, resource inventory, critical applications, data-flow notes, identity and access model, and any known compliance or internal security requirements.
→Named client stakeholders for Azure administration, networking, identity, security, application ownership, and change approval who can answer questions and validate recommendations.
→Agreed change-control process, approval authority, maintenance windows, communication plan, backup requirements, and rollback expectations before any configuration changes are applied.
→Test accounts, validation steps, or application smoke-test procedures where access, network, or service configuration changes may affect users or workloads.
06 — Working together
Who does what
IT Partner
- Review the client cloud infrastructure and current Azure service configurations, such as virtual machines, databases, and applications.
- Review Role-Based Access Control (RBAC) assignments and access points to Azure resources.
- View and analyze available security logs in scope.
- Assess network-layer security considerations.
- Compile the prioritized list of recommended changes and coordinate the roadmap for client approval.
- Apply the approved changes based on Microsoft Azure security best practices within agreed change windows.
Your team
- Provide a dedicated point of contact and named stakeholders for Azure administration, networking, identity, security, and change approval.
- Provide the agreed access to the Azure environment and relevant security logs.
- Review the change roadmap and approve, defer, or reject each recommended change.
- Participate in validation after changes are applied, including application smoke tests where user-facing behavior could be affected.
- Communicate relevant changes to users and application owners.
07 — Scope
What's not included
✕Migration and deployment of new VM or services in Microsoft Azure
✕Azure performance and cost optimization assessment
08 — Fine print
Limitations & technical notes
!The plan may vary depending on your needs.
!More extensive documentation can be provided for an additional fee.
!Findings and recommendations are limited to the subscriptions, resources, and logs the client places in scope and grants access to.
!Security improvements depend on client approvals; changes the client defers or rejects remain documented as open recommendations in the closeout report.
09 — Questions
Frequently asked questions
What is the purpose of the Securing your Azure Environment and Applications service?
It makes your Microsoft Azure environment safer and more secure. IT Partner reviews current Azure services, access controls, network-layer security, security logs, and cloud service configurations, then compiles a prioritized change roadmap and applies the changes you approve, based on Microsoft Azure security best practices.
How much does the service cost, and how long does it take?
The service is billed at $175 per hour, with the total effort scoped to your environment, and typically runs 2-3 weeks. The rate and scope are confirmed in writing before work begins.
What Azure security areas are reviewed during this service?
The review covers Role-Based Access Control (RBAC) and access points to Azure resources, network-layer security controls such as network security groups, security log visibility, Microsoft Defender for Cloud recommendations and Secure Score where available, and the configuration of workloads such as virtual machines, databases, and applications.
Who approves the security changes before they are applied?
You do. IT Partner presents a coordinated roadmap listing each recommended change with its expected impact, dependencies, and proposed sequence, and you approve, defer, or reject each item. Only approved changes are implemented, within agreed change windows.
Who applies the approved changes — IT Partner or our team?
IT Partner applies the approved changes as part of the engagement, following your change-control process and maintenance windows. Your team participates in validation afterward, especially where a change could affect user access or application behavior.
What access does IT Partner need to perform the review?
Least-privilege access for discovery — typically Azure Reader or Security Reader plus access to relevant logs such as Azure Activity Logs, Microsoft Entra ID sign-in and audit logs, and Microsoft Defender for Cloud recommendations. Elevated roles are requested only when needed to apply approved changes, and only for the agreed window.
Will this service cause downtime or business disruption?
The review itself is non-disruptive. Because some security changes can affect access, networking, or application behavior, every change goes through the roadmap approval and verification steps first, with rollback expectations agreed before implementation. The service does not guarantee zero impact, which is why validation and change windows are built into the process.
What is not included in this Azure security service?
Migration or deployment of new virtual machines or services in Microsoft Azure, and Azure performance and cost optimization assessment — IT Partner offers that as a separate service. The scope here is security review, an approved change roadmap, and implementation of the approved hardening changes.
What are the success criteria for this service?
Three checkpoints: the current status of Azure services has been analyzed, the list of recommended changes has been compiled and approved, and the approved changes have been successfully applied. These keep the engagement focused on assessment, approval, and implementation.
What happens to recommendations we decide not to implement?
They remain documented. Changes you defer or reject are recorded as open recommendations in the project closeout report, so you keep a record of the residual risk decisions alongside the completed work.
What deliverable will we receive at the end of the service?
A project closeout report indicating the final project status, with evidence of meeting acceptance criteria, any outstanding issues or open recommendations, and the final budget. More extensive documentation can be provided for an additional fee.
Can IT Partner secure Azure virtual machines, databases, and applications?
Yes — the review covers the configuration of cloud services such as virtual machines, databases, and applications, and approved hardening changes to those configurations are applied as part of the engagement. Deploying new services or migrating workloads is separate scope.
Related
Related services
$175 per hour
2-3 weeks