SGKeystone is an independent architecture and consulting practice working across Microsoft Azure, Entra ID, Microsoft Foundry, Data and Analytics platforms, and Container services. We design the platform, write the documentation that explains it, and stay to see it built.
Discuss an engagementMost cloud estates are not short of technology. They are short of coherence — a subscription model that made sense two reorganisations ago, network segmentation that nobody can draw, identity permissions that accumulated faster than anyone could review them. That is usually the problem we are asked to fix.
Our work is architectural rather than task-based. An engagement produces a defensible design: high-level and low-level design documents, decision records with the trade-offs written down, and a build path your delivery teams can follow without guessing at intent. Where the design touches regulated or classified workloads, it is written to be read by auditors and assurance functions as well as engineers.
Reference frameworks are useful when they are applied with judgement and useless when they are recited. We use them as a structure for the conversation, then adapt to what the organisation actually operates.
Azure landing zones, hub-and-spoke and virtual WAN topologies, Azure Virtual Network Manager, Network Security Perimeter, private connectivity and DNS design, ExpressRoute, and layer 4 and layer 7 load balancing.
Entra ID architecture, joiner-mover-leaver automation, RBAC and ABAC models, Conditional Access, entitlement management, identity governance, external identities, and the governance of non-human identities.
Azure SQL and managed instances, analytics platforms, storage tiers including Azure NetApp Files, and Microsoft Foundry deployments landed on private networking with managed identity and a governance wrapper.
Kubernetes and container platform design including hardened and air-gapped environments, registry and supply chain controls, and Azure Virtual Desktop delivered through Nerdio.
Client names and sector detail are withheld. The following describes the shape of recent engagements.
An enterprise estate split across tenants after a corporate change, needing consolidation into a single Entra tenant without a service outage. The work covered dependency mapping across subscriptions, the migration sequence for Azure SQL and its supporting services, re-establishing managed identities and role assignments on the far side of the move, Private Link and DNS re-pointing, and a rollback position at every cut-over. Consolidation of the SQL estate followed, reducing the number of instances under management and putting a consistent backup, patching and access model behind them.
Architecture and service operations design for a container platform running in an air-gapped environment spanning several classification levels. Constraints included no outbound connectivity, an offline registry and image promotion path between enclaves, hardened baselines, and an operating model that could be run by cleared staff without escalating to the internet for support.
Reference landing zone design for a mature hub-and-spoke estate, with the policy set, network segmentation and privileged access model documented to low-level design standard. Identity workstream covered access package design in entitlement management, access reviews, Conditional Access rationalisation, and bringing service principals and managed identities under a named ownership and lifecycle model.
We work on a statement of work with defined deliverables and acceptance criteria, typically as an architecture lead embedded alongside your platform, security and delivery teams. Engagements range from a short design review or assessment through to a multi-month platform build, and we are equally comfortable producing the design for someone else to build or staying through implementation to keep the design honest under contact with reality.
Start a conversation