# Azure Platform Engineering

URL: https://avispa.ai/agent-teams/azure-platform-engineering/

Agent team

Runs and governs your Azure estate (subscriptions, policy, access, networks, cost) through infrastructure-as-code and approved changes, and audits its own changes daily.

In the product catalog as the Azure Platform Administration Team.

## Seven agents, one lead

- **Platform Lead** · Lead · Your single point of contact. Owns change control and every approval gate.
- **Provisioning Engineer** · Infrastructure as code through pull requests, verified after every change.
- **Network Engineer** · VNets, peering, NSGs, private endpoints and DNS, each rule documented.
- **RBAC Engineer** · Least-privilege access and the monthly access review.
- **Subscription & Governance Engineer** · Azure Policy and landing zones, measured in audit mode first.
- **Cost Engineer** · Cost attribution and weekly anomaly reviews.
- **Diagnostics Engineer** · The daily change review: every write matched to an approved change.

## Onboard it in 15 minutes

1. 00:00 · **Import the team** · Seven agents arrive switched off.
2. 02:15 · **Connect Azure** · Three connectors, each with its grant.
3. 06:20 · **Set policies and a budget** · Choose what needs approval. A monthly budget per agent.
4. 10:10 · **Assign a routine** · The daily change review, weekdays at 08:00.
5. 13:30 · **First run** · It runs and reports back.

Discovery and your approval of its plan come before any change.

## Four hard limits, written into every agent

- Never delete outside decommission.
- Never grant Owner or User Access Administrator.
- Never weaken a security control.
- Never touch break-glass identities.

It prepares an Owner or User Access Administrator grant; a person applies it.

## Who approves what

1. design
2. assess blast radius
3. open IaC pull request
4. approve
5. apply
6. verify

1. intake
2. least-privilege design
3. assess blast radius
4. approve
5. assign
6. verify

1. identify
2. dependency check
3. export
4. approve
5. deallocate
6. scheduled delete

1. author
2. audit mode
3. measure impact
4. approve enforcement
5. enforce

| Operation | Resource | Resource group | Subscription | Management group |
| --- | --- | --- | --- | --- |
| Reversible |  |  |  |  |
| Recoverable |  |  |  |  |
| Irreversible |  |  |  |  |
| Unrecognized |  |  |  |  |

The blast radius decides who approves, and it’s recorded.

**More: where and when it works**

## Where it works

- **Azure Resource Manager** · Provisioning and networking · Provisioning ·, full grant · Network ·, full grant · Lead ·, read-only · Governance ·, read-only · RBAC ·, read-only · Cost ·, read-only
- **GitHub** · Infrastructure as code · Provisioning ·, full grant · Governance ·, read-only
- **ServiceNow** · Change management · Lead ·, full grant · Diagnostics ·, read-only
- **Slack** · Change notices · Lead ·, full grant
- **Azure Log Analytics** · Diagnostics and audit · Diagnostics ·, read-only · Cost ·, read-only · Governance ·, read-only · Lead ·, read-only
- **Microsoft Entra ID** · Directory lookups for role assignments · RBAC ·, read-only

## When it works

- **Daily Change Review** · Weekdays at 08:00
- **Monthly Orphaned Resource Sweep** · The 1st of each month at 11:00
- **Monthly RBAC Access Review** · The 1st of each month at 10:00
- **Quarterly Landing Zone Conformance Report** · The 1st of each quarter at 09:00
- **Weekly Cost Anomaly Review** · Thursdays at 10:00
- **Weekly Policy Compliance Review** · Tuesdays at 09:00

Every weekday at 08:00, every write in Azure is checked against an approved change, including the team's own.

## Onboard Azure Platform Engineering with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)