Entrazure
Three constraints that make this sector different
The buyer is not the user, and neither of them will run it. Procurement scores a proposal, a program officer needs the service, and a small internal team inherits it after the vendor leaves. The failure mode is an environment only one supplier can operate, discovered at the next contract renewal when the price has moved and there is no realistic alternative. Handover is not a closing formality here. It is the requirement that should shape the architecture on day one: infrastructure as code in your repository, standard services rather than clever ones, and runbooks written for the team that actually exists.
The fiscal year is an architectural constraint. Budgets do not roll over, scope is fixed at tender time, and a change of scope is a contract amendment rather than a ticket. Work has to be decomposed into pieces that each deliver something usable inside their own funding period, and each piece has to leave the estate in a coherent state if the following phase is never funded. Designing a three-year platform that only produces value in year three is how programs get cancelled in year two.
Everything you build is disclosable, and everyone has to be able to use it. An access to information request can reach the architecture documents, the contract and the incident log. Accessibility is legislated, not aspirational, and applies to internal tools as much as to citizen-facing services. Both push the same way: write things down clearly, build interfaces to WCAG 2.1 AA, and avoid any component whose behavior you would struggle to explain in public.
What we build here
- A landing zone with residency enforced, not asserted. Management groups, subscription vending per program or department, and Azure Policy denying deployment outside the allowed regions. The Azure landing zone is delivered as Terraform in your own repository with the pipelines that deploy it, so the next supplier inherits a system rather than a mystery.
- Identity an auditor can read. Microsoft Entra ID with conditional access, Privileged Identity Management so nobody holds standing administrator rights, scheduled access reviews, and governed guest access for the contractors and partner bodies you work with daily. That is the substance of cybersecurity and Entra ID.
- Consolidation of what accumulated. Departmental tenants, orphaned subscriptions and file servers nobody has reconciled since a reorganisation, mapped with dependency analysis and moved in waves under Azure migration, each wave with its own rollback path.
- Evidence and monitoring sized for a public budget. Defender for Cloud posture, Azure Monitor, and Microsoft Sentinel with ingestion designed deliberately, because uncontrolled log ingestion is the line item that gets a security program cut. Control mapping and exportable evidence are covered in compliance architecture.
- AI where it is defensible. Document Intelligence over forms and applications that currently move on paper, and retrieval over your own policy and procedure documents with permissions preserved and citations shown. Our AI engineering work starts with what the system is forbidden to do, written down before anything is built.
An anonymized scenario
Anonymized scenario, not a named client.
A public body with roughly 900 staff runs two server rooms, an application inventory last reconciled before a reorganisation, and a four-person infrastructure team carrying an on-call rotation between them. A ministry directive requires demonstrable in-province residency. The hardware refresh quote arrived the same month.
What the engagement produces is unremarkable and durable. A dependency map that finally names the twelve applications nobody could account for, three of which turn out to have no users. A management group hierarchy with region policy, so residency is enforced by denial and the denial is logged. Migration in waves aligned to funding periods, each wave leaving a coherent estate behind it. Privileged access moved to time-bound elevation, which removes the standing domain admin accounts an auditor had flagged twice. Then a written handover: the Terraform, the pipelines, the runbooks and two weeks of working alongside the team that keeps it running, because a document nobody has practiced with is not a handover.
Regulatory context we design against
In Quebec, the Act respecting access to documents held by public bodies, Law 25 and the oversight of the Commission d’accès à l’information, including the privacy impact assessment required before personal information is communicated outside the province. Our Law 25 compliance page covers what that means architecturally. Elsewhere in Canada, provincial access and privacy legislation and the Accessible Canada Act; in the United States, Section 508 and state-level equivalents. Where a public body procures from a supplier that must itself be audited, SOC 2 Type II is the usual instrument. We design so each of those obligations lands as an enforced control with an exportable record, rather than as a paragraph in a policy nobody can verify.
Questions we get
How do we buy this without running a full tender?
Our offers are transactable on the Azure Marketplace, which lets an organization purchase against an existing Microsoft agreement or commitment rather than opening a separate procurement. Where a tender is required, we will help write requirements that are testable and vendor-neutral, including when that means we do not win it.
Can you guarantee our data stays in Canada?
We enforce it rather than guarantee it, which is stronger. Allowed regions are set by Azure Policy at the management group level, so a deployment outside them is denied and the attempt is logged. Where an obligation is provincial rather than national, the same mechanism applies with a narrower region list, and the log is the proof.
Our IT team is four people. Who runs this afterward?
You do, and that is a design constraint from week one rather than a handover meeting at the end. Infrastructure as code lives in your repository, runbooks are written for the team that exists, and we deliberately avoid patterns that only work when a specialist is on call. If you want us to operate it, that is a separate agreement you can end.
Does accessibility apply to internal systems too?
Yes, and it is the requirement most often discovered at user acceptance testing. We build to WCAG 2.1 AA on anything with an interface, internal or public, because a staff member using a screen reader is covered by the same obligation as a citizen, and retrofitting an application after launch costs several times what building it correctly costs.
Can a public body use generative AI responsibly?
In narrow, documented uses. Retrieval respects existing permissions on the source record, answers cite the document they came from, prompts and responses are logged, inference stays in your tenant, and a named human remains accountable for any decision affecting a person. Anything that cannot be explained to a requester under access to information legislation should not be deployed.