Entrazure
Entrazure for Azure architecture and AI engineering · Novarque by Entrazure for sovereignty and compliance
Most Azure estates are built once, by hand. And nobody can rebuild them.
We design it, build it, and hand you the repository.
Fixed scope, fixed duration, no dependency on us afterwards.
The stack we build on
02 What we get called in for
The architecture becomes the bottleneck
at five predictable moments.
A migration is due
VMware renewal, a data centre lease ending, or an acquisition to absorb. The deadline is set by someone else, and the estate was never documented.
Most failed migrations fail on something nobody knew talked to something else. We observe the estate over a real window before proposing a sequence.
Machines provisioned generously when the hardware was paid for become a monthly bill. Lift-and-shift without a sizing pass looks like a cost increase.
Written before the first cutover, not improvised at 2am.
AI reaches production
The pilot worked. Now it needs permissions, grounding, evaluation, a cost ceiling and a named owner. That is a different project.
An agent must not surface to one employee what another was not allowed to open. Security trimming is the part most implementations skip.
Measured on every change. The most durable asset produced, because it outlives the model.
Consumption forecast per use case, with budget alerts. A number you cannot forecast is a number that will surprise your CFO.
An audit is coming
SOC 2, HIPAA, or a customer's two-hundred-line security questionnaire. Either way the answer is in the architecture, not in a document.
Author, reviewer, test result, timestamp, recorded as work happens rather than reconstructed the month before.
Access becomes eligible rather than permanent, requested with a justification. That single change answers a disproportionate share of any audit.
Mapped to the control set you are measured against, in the format your auditor expects.
The bill is unexplained
Finance wants a number, not a range. The usual answer is to buy a visibility tool and circulate a weekly report. Six months later the tool is a line on the invoice it was meant to reduce.
A resource with an owner can be switched off. A resource without one cannot, no matter how good the dashboard is.
Reservations bought before right-sizing lock in the mistake for one to three years.
Untagged resources denied at deployment, budgets alerting per subscription.
Novarque by Entrazure
Residency is questioned
Quebec’s Law 25, a European customer, or a board asking where the data actually is. "Canada Central" is an answer about a region, not about sovereignty.
Enforced above the subscription, inherited by every future subscription. Nobody has to remember it.
Where personal information rests, where it moves, and what justifies each crossing.
Producing or erasing an individual's data on request is an architecture feature, not a manual procedure.
03 What we do
Architecture and build are usually two firms.
Here they are one team.
Landing zone and IaC
Management groups, policy, identity and network, deployed as code and handed over with the repository.
AI engineering on AI Foundry
Agents that reach production inside your tenant: grounded, permission-trimmed, evaluated and cost-capped.
Migration and VMware exit
Assessment, dependency map, wave plan and cutover, with the real cost of each path written down first.
Compliance architecture
Controls designed into the topology and the pipeline, with evidence produced as a by-product of deployment.
Data platform and Fabric
One governed layer feeding both Power BI and your AI workloads, instead of two parallel stacks.
Managed Azure and FinOps
Offered after a build, never a condition of one. Monthly, cancellable, handed back when your team is ready.
04 How we do it differently
Three things that change what you get at the end.
01
Our own module library
Reference architectures, policy sets and deployment modules distilled from production work. Everything in it has already passed a compliance review and survived real load.
What takes other teams weeks takes us days, and all of it transfers at handover, because it is the same code we deploy.
02
AI reads the estate. Architects decide.
We use agents to observe an environment, surface drift and flag patterns across subscriptions. It is visibility that would otherwise take days of manual review.
The agents observe and report. Every decision and every change in a client environment is made by a named architect. The agents hold no write permissions at all.
03
Knowledge that stays with your team
Every runbook, decision record and pipeline we build is documented and handed over, so operational knowledge stops living in one engineer's head.
We run working sessions on the code we wrote, because the goal is to make the next phase easier whether we are in it or not.
05 Industries
The constraints differ. The discipline does not.
All industries
Healthcare
PHI tolerates no ambiguity
Every place patient data lands has to be known, segmented, encrypted and logged. Your customers audit you before a regulator ever does.
What we build
HIPAA-ready landing zones, audit evidence from the pipeline, and AI grounded on clinical records with permissions preserved.
Industrial and manufacturing
Latency and uptime decide
Multi-site estates, OT boundaries, and workloads that cannot pause for a migration window.
Financial services
The auditor arrives annually
Change control, access review and evidence that holds up without a six-week scramble every year.
Public sector
Residency is not negotiable
Law 25 and provincial requirements enforced at the management group level, not left to a preference.
Professional services
The estate grew sideways
Acquisitions absorbed without consolidation, and a tenant nobody has mapped since 2021.
06 How we engage
Fixed shape. Fixed duration.
Written down before signature.
What is excluded is named before anyone signs, so the edge of the work is agreed rather than discovered in week three.
Assessment
Reader access only. Nothing in production touched.
- Estate review: cost, posture, drift
- Written opinion, not a deck
- Ranked remediation backlog
- 6 to 12 month roadmap
Landing zone build
The same scope every time, so the price holds. The most common of the four.
- Management groups, policy, identity
- Hub network, private endpoints
- Delivery pipelines
- Repository and decision record
AI agent build
One narrowed use case, to production.
- Grounded on your data, in your tenant
- Evaluation set and guardrails
- Cost model and alerts
- Named owner on your side
Managed and FinOps
Offered after a build. Never a condition of one.
- Cost attribution and right-sizing
- Drift and posture monitoring
- Update and patch management
- Cancellable, handed back on request
A scoped proposal within two business days of the first call. If the work does not fit one of these shapes, we say so on that call rather than reshaping it.
07 How an engagement runs
Four weeks, and you can see every one.
Taking the landing zone build as the example. Nothing is decided on our side and reported afterwards, and every week ends with something you can open.
See the other shapes01
We read the estate before we touch it
Reader access, no writes. We map what exists, what is drifting and what nobody owns. You get the findings even if the engagement stops here.
Output: estate report02
We write the decisions down, then you approve them
Region strategy, identity model, network topology, naming. Each one recorded with what was rejected and why. Reversible decisions are marked as such.
Output: decision records03
We build it as code, in your repository
Your repository from the first commit, not ours. Plan on pull request, apply on merge. You watch the work arrive rather than receiving it at the end.
Output: working landing zone04
We hand it over to the people who will run it
Working sessions on the code we wrote, with your engineers. The goal is that the next phase is easier whether we are in it or not.
Output: runbooks and a trained team08 Insights
What we publish, we deploy.
All insights
09 The people behind the work
Our architects are not a bench.
There is no pyramid here. The people who scope your engagement are the people who write the code, sit in the deployment call and hand over the documentation.
That is a deliberate constraint on how large we can be, and it is why every hour billed is a senior hour. If your timeline does not match our availability, we say so rather than staffing it with people you never met.
Get a scoped proposal
for your next engagement.
Thirty minutes with one of our architects. We map where you are, where you need to get to, and what the work actually involves. No deck.