Agent team
Azure Platform Engineering
Runs and governs your Azure estate (subscriptions, policy, access, networks, cost) through infrastructure-as-code and approved changes, and audits its own changes daily.
In the product catalog as the Azure Platform Administration Team.
Seven agents, one lead
- Platform LeadLead
Your single point of contact. Owns change control and every approval gate.
- Provisioning Engineer
Infrastructure as code through pull requests, verified after every change.
- Network Engineer
VNets, peering, NSGs, private endpoints and DNS, each rule documented.
- RBAC Engineer
Least-privilege access and the monthly access review.
- Subscription & Governance Engineer
Azure Policy and landing zones, measured in audit mode first.
- Cost Engineer
Cost attribution and weekly anomaly reviews.
- Diagnostics Engineer
The daily change review: every write matched to an approved change.
Onboard it in 15 minutes
- 00:00Import the team
Seven agents arrive switched off.
- 02:15Connect Azure
Three connectors, each with its grant.
- 06:20Set policies and a budget
Choose what needs approval. A monthly budget per agent.
- 10:10Assign a routine
The daily change review, weekdays at 08:00.
- 13:30First run
It runs and reports back.
Discovery and your approval of its plan come before any change.
Four hard limits, written into every agent
- Never delete outside decommission.
- Never grant Owner or User Access Administrator.
- Never weaken a security control.
- Never touch break-glass identities.
It prepares an Owner or User Access Administrator grant; a person applies it.
Who approves what
- design
- assess blast radius
- open IaC pull request
- approve
- apply
- verify
- intake
- least-privilege design
- assess blast radius
- approve
- assign
- verify
- identify
- dependency check
- export
- approve
- deallocate
- scheduled delete
- author
- audit mode
- measure impact
- approve enforcement
- enforce
| Operation | Resource | Resource group | Subscription | Management group |
|---|---|---|---|---|
| Reversible | ||||
| Recoverable | ||||
| Irreversible | ||||
| Unrecognized |
The blast radius decides who approves, and it’s recorded.
More: where and when it works
Where it works
- Azure Resource ManagerProvisioning and networkingProvisioning, full grantNetwork, full grantLead, read-onlyGovernance, read-onlyRBAC, read-onlyCost, read-only
- GitHubInfrastructure as codeProvisioning, full grantGovernance, read-only
- ServiceNowChange managementLead, full grantDiagnostics, read-only
- SlackChange noticesLead, full grant
- Azure Log AnalyticsDiagnostics and auditDiagnostics, read-onlyCost, read-onlyGovernance, read-onlyLead, read-only
- Microsoft Entra IDDirectory lookups for role assignmentsRBAC, read-only
When it works
- Daily Change ReviewWeekdays at 08:00
- Monthly Orphaned Resource SweepThe 1st of each month at 11:00
- Monthly RBAC Access ReviewThe 1st of each month at 10:00
- Quarterly Landing Zone Conformance ReportThe 1st of each quarter at 09:00
- Weekly Cost Anomaly ReviewThursdays at 10:00
- Weekly Policy Compliance ReviewTuesdays at 09:00
Every weekday at 08:00, every write in Azure is checked against an approved change, including the team's own.