Entrazure
Three constraints that make this sector different
A change window is measured in production hours. Head office can absorb an outage at 2am. A line running three shifts cannot, and the two annual shutdowns were booked for mechanical work eighteen months ago. Every migration step, every identity cutover, every firewall change has to be small enough to reverse inside a single shift, because the real fallback is not a rollback script, it is a plant manager asking when the line restarts.
Half the estate cannot be patched, and everyone already knows it. The HMI runs a Windows version the machine vendor validated in 2014, and re-imaging it voids support on a press worth more than the annual IT budget. The answer is not an upgrade program. It is an accurate inventory, hard segmentation, compensating controls, and a written decision naming which machines are accepted risk and who accepted them. Ownership makes it harder: the cell network belongs to operations, the corporate network belongs to IT, and in most groups the two have never shared a diagram.
A plant is not a branch office. Connectivity is one fibre link with an LTE backup, latency to the nearest Azure region is real, and the operator on the floor needs the application at 6am whether or not the WAN is up. An architecture that quietly assumes head office bandwidth works in the pilot site and fails at site four.
What we build here
- A landing zone that models the plants. Management groups by country for residency, subscription vending so a new site is provisioned rather than improvised, and tagging enforced by Azure Policy so cost lands on the site that spent it. We deliver the Azure landing zone as Terraform in your repository, with the pipelines that deploy it.
- Azure Arc across the machines that are never moving. Plant servers, SQL instances and clusters under one inventory, Update Manager rings scheduled against the production calendar, and Defender for Cloud posture on hardware sitting in a building three provinces away. One operating model instead of a cloud team and a site team who compare notes twice a year.
- A segmented network with a boundary somebody drew on purpose. Hub-and-spoke topology, Azure Firewall, Private Link and private endpoints on every data service, and an explicit documented line between the corporate estate and the cell and area zones. The diagram matters as much as the rules, because it is the first artefact a customer’s security team asks to see.
- One number for production. Historian, MES and ERP extracts landed in a lakehouse with Data Factory pipelines and a Direct Lake semantic model, so the OEE the plant manager quotes and the OEE finance quotes are the same figure. That work is Microsoft Fabric implementation, and it is usually worth more than the AI project queued behind it.
- AI aimed at the paperwork, not the process. Document Intelligence over supplier certificates, inspection reports and packing slips, and retrieval over maintenance history with source permissions preserved. Our AI engineering work starts from a manual baseline you can measure, because that is the only way to know whether the agent paid for itself.
Migration off ageing on-premise hardware is a separate discipline with its own dependency mapping and wave planning, covered in Azure migration.
An anonymized scenario
Anonymized scenario, not a named client.
A manufacturing group with eleven plants in two countries grew by acquisition. Each site arrived with its own domain, its own file server, its own reporting spreadsheet, and in three cases an Azure subscription someone bought on a corporate card. Nobody could answer two questions: which machines are exposed to the internet, and why the group production figure differs from the sum of the sites.
The engagement is not glamorous. A management group hierarchy and subscription vending, so the next acquisition lands somewhere defined. Azure Arc onboarding across roughly 300 servers to produce the first honest inventory the group has had. Segmentation between corporate and production networks at each site, with the legacy machines isolated and documented rather than pretended away. Then, and only then, the production data model, because the reporting argument was never about the report. Patching the two oldest sites is scheduled around a shutdown eight months out, and that constraint is in the plan from week one rather than discovered in week nine.
Regulatory context we design against
Manufacturers are rarely regulated the way a bank is, and are audited constantly anyway, by customers. IEC 62443 shapes how we segment the production network. ISO 27001 and SOC 2 architecture come up the moment you supply a large OEM or a regulated buyer. NIS2 applies where there is a European parent or European operations. Quebec Law 25 covers employee, contractor and video surveillance data, which manufacturers routinely forget is personal information. Where the parts are aerospace or defense, export control dictates which regions and which support personnel may touch the data, and that has to be enforced at the management group level rather than requested politely. We design the estate so each of those maps to a control that is enforced, logged and exportable, which is the subject of compliance architecture.
Questions we get
Can we do any of this without stopping production?
Yes, but only if the work is decomposed to fit the windows you actually have. We plan migrations and identity cutovers in steps that are individually reversible inside one shift, we schedule anything touching a plant server against the production calendar rather than Patch Tuesday, and we agree the abort criteria before the window opens, not during it.
Our SCADA and HMI machines run unsupported Windows. Does that block a cloud project?
No, and replacing them is usually the wrong first move because re-imaging a validated machine can void the vendor support on equipment worth more than the IT budget. We inventory those machines with Azure Arc, segment them behind an explicit network boundary, apply compensating controls, and write down which ones are accepted risk and who accepted it.
What do we do about sites with one internet link and no redundancy?
We design so the floor keeps working when the WAN drops: local processing where the process demands it, queued and retried integration rather than synchronous calls, and Azure Firewall plus Private Link on the corporate side. Where data genuinely cannot leave a building, we say so instead of selling you a region.
Our largest customer sends a 200-line security questionnaire every year. Does this help?
That questionnaire is an architecture document in disguise. When segmentation, access review, logging and change control are enforced by policy and pipeline, most of it is answered by exporting evidence you already generate. When they are manual, each questionnaire costs a fortnight of somebody senior.
Do we need a data platform before we do anything with AI?
You need governed access to the data the model will read. In practice that means a lakehouse or at least a certified semantic model, plus classification, before an assistant touches production records. Skipping it is why most manufacturing AI pilots stall in month two.