Reading time 4 min

Patrik Söderström

The yearly inspiring Azure conference CloudBrew organized by the Azure User Group took place on December 12th and 13th, 2024. The best speakers from all over Europe were invited to share their experiences and knowledge of the latest developments in Azure. ACA Group is one of the partners of CloudBrew and the Azure User Group in Belgium . This allowed us not only to participate but have selected customers join us into the ever evolving world of Azure at the event. With two action packed days of events, we want to highlight the topics which touched and inspired us. Opening Keynote: The opening keynote was delivered by no other than Sakari Nahi , the CEO of Zure. He talked about the advances in AI and specifically how it will impact the hard working engineers and architects in the public cloud. There’s no denying that AI will impact how we use and work with Azure. This may make us worried on different levels, some may worry that we will be replaced by AI, while others will have privacy concerns. Wherever you are on this scale, the AI revolution is positive for everyone. We have to see ourselves as operators of AI, not as replacements. It’s always DNS Rik Hepworth and his magnificent gray hair was present to explain how it’s always DNS. It’s always DNS in the sense that no matter what you decide to deploy, DNS has to be taken into consideration. Here we learned the importance of centralizing DNS with a HUB and SPOKE configuration. The Azure Private DNS Resolver is taking over as the go-to solution for DNS Conditional Forwarding. By centralizing this in the HUB, it’s possible to scale the environment into as many virtual networks and subscriptions as required. Avoid setting up Private DNS zones in individual SPOKE subscriptions as this is a recipe for management disaster as the environment grows. Orchestration vs Choreography As our daily work rarely involves software architecture, we weren’t sure what to expect from this talk. However, we were pleasantly surprised as Laila Bougria delivered one of the most captivating sessions on building microservice-based application architectures. Orchestration uses a coordination and management system between the different software components. Choreography on the other hand is decentralized offering and in some cases provides easier maintenance. There is no card to trump them all, it all depends on your situation. After this awesome session from Laila, we got more interested in the topic. You can find more about her work here . GPT-4 vs Starcraft II - Strategic Decision Making using Large Language Models AI is everywhere and CloudBrew is not an exception. This session from Alan Smith provided a practical example on how you can integrate GPT-4 into an existing system, which in this case was Starcraft II . Starcraft II is a strategy game released in 2010, where there is a wealth of information on the Internet on how to beat your opponent. All of this information has been picked up by GPT-4 and if you would ask it, based on the state of the game, such as what the opponent is doing, it can devise a strategy in text format to counter this. This was a live demonstration of how the screen output of Starcraft II was fed to GPT-4. GPT-4 returned a set of instructions on what the next actions would be to counter and beat your opponent. These were translated to in game activities and we could watch in awe how GPT-4 was beating the opponent. Granted, in this scenario GPT-4 was playing against the computer, which is also considered a type of AI. AI beating AI feels like we are coming full circle, in a surprisingly positive kind of way 🙂 Seriously securing an Azure PaaS application Joonas Westlin gave a lecture on Azure security for PaaS solutions, and he delivered it with a good dose of humor and relatable real-world examples. We started with the basics: affordable, standard solutions like Private Endpoints and Network Security Groups. Nice and simple, and budget-friendly. But the further you move the security slider up, the more serious it gets. Think WAF (Web Application Firewall) and Application Gateway , which lock down your environment completely — but can also stretch your budget significantly. Joonas presented his story in a way that made you laugh regularly because it was so relatable. His anecdotes struck exactly the right chord, while also providing useful insights. Especially on how to smartly balance security and costs, without feeling like you're running a fortress. Ending with Amazement: Although CloudBrew has only just passed, we can’t help but look back with a smile. The conference, the speaker lineup, and their engaging topics were nothing short of exceptional. The knowledge and insights we gained in just two days would have taken months to acquire elsewhere. We’re already looking forward to CloudBrew 2025 and hope to see you there as well!

Reading time 7 min

Patrik Söderström

Imagine you could transform your cloud strategy into a finely tuned machine that reduces costs and drives maximum business value. That’s exactly what we did for one of our customers by implementing FinOps with Azure. Through targeted optimizations and a strong focus on organizational alignment, we helped our customer save thousands of euros on their Azure bill, while setting up a sustainable framework to keep cloud costs under control. Curious about how FinOps can help you to optimize working costs and scale better? Read all about it in this blog. Long-running history in CapEx cost payment This large organization has been a customer of ACA Group for a couple of years. For a while now, they are moving more and more workload from on premise into Azure. The finance department was still handling the budgeting, relying on Capital Expenditure (CapEx) , where IT infrastructure costs are paid and known upfront. This is in contrast to Operational Expenditure (OpEx) , where costs fluctuate daily based on the actual usage of the digital resources consumed in Azure. Our customer had allocated a substantial monthly budget for Azure, that was consistently adhered to. As a result, there was no internal trigger to explore FinOps practices. How ACA discovered a substantial IT cost-saving opportunity While ACA was assisting this customer with their workload migration, we noticed a familiar pattern: FinOps had never been considered. Virtual machines for all environments ran 24/7 without Reserved Instances and non-production Storage Accounts were using costly Geo-replication. This triggered us to make a quick overview of potential savings, which we suggested along with a full FinOps exercise. The immediate savings were so compelling that the customer quickly agreed to our proposal. What is a FinOps exercise? When we talk about FinOps, we are referring to the standards set by the FinOps foundation . This is a large project by the Linux Foundation with a huge community of more than 23,000 members and 10,000 businesses. In a FinOps exercise, we guide our customers through two deliverables: FinOps assessment: This focuses on the organizational alignment of our customer, emphasizing that FinOps is a shared responsibility. An engineer deploying a resource in Azure must consider costs like sizing and SKU, while the business department has to ensure adequate budget for projects and resources. This mindset has to extend across the entire organization. Technical evaluation: This focuses on the current setup and how it can be optimized for cost savings. We analyze the entire Azure environment to detect optimization opportunities. Cost savings vs. value maximization The goal of FinOps is not to minimize cloud spend, but to maximize the value our customers gain by using cloud services. This distinction is key, but often misunderstood. Every resource in Azure should be used in a way that delivers the highest possible business value. Maximizing business value also helps minimize the ecological footprint of our customers. It’s an outcome that aligns closely with ACA’s commitment to sustainability . Optimizing the customer's web application Let’s take a look at our customer’s web application running on an Azure App Service. Each user interaction generates a load on the system and value for the business. For simplicity, let’s say the business value is 1 EUR every time a user opens the web application. With thousands of users, the application delivers 1,000 of euros in value. Our job is to ensure the App Service is optimized to handle this demand effectively, maximizing business value. If we need to scale the App Service out, it’s a good thing! As long as we are using the most efficient resource and settings, we increase the capacity and help the customer generate even more value. Selecting key focus points with all stakeholders The FinOps Assessment involves multiple workshops with key stakeholders of our customer. We brought the customer’s Finance, Business, Engineering and Operations together to show how they all play a part in the cloud costs. With over 20 Target Capability Scopes in FinOps, the customer selects a few key areas to focus on for optimization. In this case the customer selected the following: Anomaly Management Anomaly management addresses unexpected or abnormal cloud spending patterns. For example, in 2024, the customer experienced a surge in cost for a virtual machine scale set during a couple of weeks. They realized detection took too long and wanted better controls to prevent this. Rate Optimization Rate optimization ensures the most cost-effective pricing models and discounts are used. Before starting the FinOps exercise, we had already identified potential savings, for example by using Reserved Instances . In addition, we analyzed the rate they were paying for Azure resources. Workload Optimization Workload Optimization ensures resources like App Services, Virtual Machines are used efficiently. For instance, does it make sense for a non-production environment to have the resources running 24/7? Assessing Target Capabilities through workshops Together with the customer we set goals for each Target Capability. For example, they said that Anomaly Management is very important to them and they are aiming to become a Knowledge Leader in that area. During the workshops with all stakeholders, our role was to ask the right questions to assess the selected Target Capability Scopes . For Anomaly Management , it became evident they were still in the early stages, earning a “1/Partial Knowledge” evaluation in that section. Once all the workshops were completed, we were able to compile a final standing on all the Target Capability Scores. This gave the customer a benchmark, meaning that in the next evaluation in 4 months, we will be able to see how far they have come with regards to their targets. Diving into technical details With the workshops behind us, we could now focus on the written report and dive further into the technical details of the customer’s Azure environment. This involved a two part process: Part 1: Data collection We ran informational gathering scripts to extract configuration details and present them in a more readable format. Part 2: Manual review We manually analyzed the outputs from tools like Azure Cost Management and Advisor . Key areas for cost savings Having both the output from the scripts and the data from the portal, we saw that the following areas could yield the largest savings: Implement a Savings Plan / Reserved Instances Reconfigure redundancy for all Storage Accounts , they were all set to: Geo Redundant Storage (GRS) Non production to Local Redundant Storage (LRS) Production to Zone Redundant Storage (ZRS) Schedule shutdown and removal of compute resources for non production Implement Governance framework ( Azure Policies ) to avoid deployment of excessive SKUs. For example, expensive Azure Virtual Machines with nVidia video cards should be prohibited Implement budget thresholds and Anomaly Alerts Implement the FinOps Toolkit along with the PowerBI reporting Leverage Anodot for a single pane of glass across their multiple environments We compiled our findings and recommendations into a written report. Together with the customer we reviewed the report and outlined actionable next steps. 💡 One of the recommendations was to implement the FinOps Toolkit . This is a set of controls, Power BI reports and workbooks which are aligned with the FinOps framework. We were happy to see that they embraced this along with our other recommendations. Looking ahead with renewed focus on business value Going forward, the customer will continue to adopt Azure for their workload. The difference from now on is that they will do it with the mindset of maximizing the business value. In four months, ACA will reassess the status of the FinOps journey and help them measure how far they have come. The long term strategy also involves leveraging the strategic partnership ACA has with Anodot for FinOps . Together, we push the boundaries of FinOps by combining cost efficiency with carbon accountability. This brings a standard toolset and a unified visibility of FinOps across all their environments. ➡️ At the ACA Group we are experts in FinOps! Let us guide you through the FinOps journey to ensure you are unlocking the full potential of your cloud investment. {% module_block module "widget_a0726d77-6dd9-452b-ade6-cf5fd08a91b1" %}{% module_attribute "buttons" is_json="true" %}{% raw %}[{"appearance":{"link_color":"light","primary_color":"primary","secondary_color":"primary","tertiary_color":"light","tertiary_icon_accent_color":"dark","tertiary_text_color":"dark","variant":"primary"},"content":{"arrow":"right","icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"tertiary_icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"text":"Check out FinOps services"},"target":{"link":{"no_follow":false,"open_in_new_tab":false,"rel":"","sponsored":false,"url":null,"user_generated_content":false}},"type":"normal"}]{% endraw %}{% end_module_attribute %}{% module_attribute "child_css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "definition_id" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "field_types" is_json="true" %}{% raw %}{"buttons":"group","styles":"group"}{% endraw %}{% end_module_attribute %}{% module_attribute "isJsModule" is_json="true" %}{% raw %}true{% endraw %}{% end_module_attribute %}{% module_attribute "label" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "module_id" is_json="true" %}{% raw %}201493994716{% endraw %}{% end_module_attribute %}{% module_attribute "path" is_json="true" %}{% raw %}"@projects/aca-group-project/aca-group-app/components/modules/ButtonGroup"{% endraw %}{% end_module_attribute %}{% module_attribute "schema_version" is_json="true" %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute "smart_objects" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "smart_type" is_json="true" %}{% raw %}"NOT_SMART"{% endraw %}{% end_module_attribute %}{% module_attribute "tag" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "type" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "wrap_field_tag" is_json="true" %}{% raw %}"div"{% endraw %}{% end_module_attribute %}{% end_module_block %}

Reading time 6 min

Patrik Söderström

In Belgium, there’s a saying, “Every Belgian is born with a brick in their stomach,” reflecting the nation's deep-rooted drive to build homes that last. But this principle doesn’t just apply to houses, it’s equally true for your cloud infrastructure. Without a strong foundation, your Azure workloads risk becoming unstable, inefficient, or even vulnerable. That’s where Microsoft’s Well Architected Framework (WAF) comes in. Read on to discover how this framework’s five pillars can turn your cloud workload into a structure built to last. What is the Well Architected Framework (WAF)? The Well Architected Framework helps you build secure, high-performing, resilient, and efficient infrastructure applications on Azure. By following the guidelines in this framework, you ensure that your cloud infrastructure is following the recommendations and standards set by Microsoft. This framework consists of five pillars: Reliability Security Cost Optimization Operational Excellence Performance Efficiency ( Image source: https://learn.microsoft.com/en-us/azure/well-architected/ ) Each of these pillars offer valuable guidance and best practices, but they also involve tradeoffs. Every decision - whether financial or technical - comes with its own set of considerations. For example, while securing workloads is important, it comes with added costs and potential technical implications. Let’s take a closer look at each of the five pillars of the Well Architected Framework. Reliability Failures are inevitable, no matter how much we wish otherwise. That’s why designing systems with failure in mind is crucial. A workload must survive failures while continuing to deliver services without disruption. This requires more than just designing your workload for failures, it also means setting reliable recovery targets and conducting sufficient testing. First you need to identify the reliability targets. After all, making everything Geo redundant is great - but comes with a cost for the business. Once your reliability targets are identified, the next step is to map redundancy level to the Azure technology. Only considering the compute parts of an application is not enough, you also need to take into account the supporting components, such as network, data and other infrastructure tiers. Deep dive into the Microsoft checklist: https://learn.microsoft.com/en-us/azure/well-architected/reliability/checklist Security All workloads should be built around the zero-trust approach. A secure workload is resilient to attacks while ensuring confidentiality, integrity and availability. Just like availability, confidentiality and integrity come with multiple options - each with its own impact on cost and complexity. For instance, how important is Encryption in Use ? Answering this question can significantly shape your solution. Security isn’t a one-layer fix; it must be applied at every level. While it’s standard practice to route all incoming (ingress) traffic through a firewall, the same must be done for outgoing (egress) traffic. Ensuring all outgoing traffic is approved and routed through a firewall is essential. There are additional ways to secure communication within your Azure environment. Using Private Endpoints is essential for secure communication between application components, offering better protection compared to Service Endpoints , which are cheaper but carry the risk of data exfiltration. Don’t overlook Azure DDoS Protection either. DDoS attacks can target any publicly accessible endpoint, potentially causing downtime and forcing your environment to scale up and out. This not only slows down your workload but also leaves you with a large consumption bill. The comprehensive checklist from Microsoft is available here: https://learn.microsoft.com/en-us/azure/well-architected/security/checklist Cost Optimization Any architecture design and workload is driven by business goals. The focus of this pillar is not about cutting costs to the minimum. It’s about finding the most cost-effective solution. This pillar aligns closely with the FinOps framework which we have covered here . A good first step is to create a cost model to estimate the initial cost, run rates, and ongoing costs. This model provides a baseline to compare the actual cost of the environment on a daily basis. The work doesn’t stop here, it’s essential to set up anomaly alerts that notify you when the expected baseline is exceeded. It’s also important to optimize the scaling of your application. Can your resources scale both out and up? Which approach is the most cost-effective and delivers the best results? Certain applications may hit a performance plateau when scaling up, which is where you add cpu and memory. Perhaps the application can only handle a minor extra load when you reach 256GB of memory. Instead, it may be more beneficial to scale out by adding more instances rather than simply scaling up with additional compute power. The comprehensive checklist from Microsoft is available here: https://learn.microsoft.com/en-us/azure/well-architected/cost-optimization/checklist Operational Excellence The core of Operational Excellence are DevOps practices, which define the operating procedures for development practices, observability and release management. One key goal in this pillar is to reduce the chance of human error. It’s important to approach implementations and workload with a long term vision. Take the distinction between ClickOps and DevOps as an example. While it's tempting to quickly set up resources using the Azure Portal (ClickOps), this builds up technical debt. Instead, adopting a DevOps approach helps you build a more sustainable, efficient, and automated workflow for the future. Read our in depth blog about moving from ClickOps to DevOps for more details. Always use a standardized Infrastructure as Code (IaC) approach. Formalize the way you handle operation tasks with clear documentation, checklists, and automation. This ties into what we covered under Resiliency , but focuses on processes. Make sure you have a strategy to address unexpected rollout issues and recover swiftly. The comprehensive checklist from Microsoft is available here: https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/checklist Performance Efficiency This pillar is all about your workload’s ability to adapt to changing demand. Your application must be able to handle increased load without compromising the user experience. Think about the thresholds you use to scale your application. How quickly can Azure resources scale up or out ? Consider traffic patterns as there may be high load during certain hours, like in the morning. Perhaps you can schedule scaling in advance to ensure resources are available when needed. The overall recommendation is to make performance a priority at every stage of the design. As you move through each phase, you should regularly test and measure performance. This will provide valuable insights, helping you identify and address potential issues before they become problems. The checklist from Microsoft is valuable: https://learn.microsoft.com/en-us/azure/well-architected/performance-efficiency/checklist Start optimizing your Azure workload today! Our team of experts is ready to assist you in applying the Well Architected Framework to your Azure environment. Let’s ensure your workload is secure, cost-optimized, and ready for the future. {% module_block module "widget_0f5df892-336b-43b8-ad2c-759301a948f2" %}{% module_attribute "buttons" is_json="true" %}{% raw %}[{"appearance":{"link_color":"light","primary_color":"primary","secondary_color":"primary","tertiary_color":"light","tertiary_icon_accent_color":"dark","tertiary_text_color":"dark","variant":"primary"},"content":{"arrow":"right","icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"tertiary_icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"text":"Reach out to us now"},"target":{"link":{"no_follow":false,"open_in_new_tab":false,"rel":"","sponsored":false,"url":null,"user_generated_content":false}},"type":"normal"}]{% endraw %}{% end_module_attribute %}{% module_attribute "child_css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "definition_id" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "field_types" is_json="true" %}{% raw %}{"buttons":"group","styles":"group"}{% endraw %}{% end_module_attribute %}{% module_attribute "isJsModule" is_json="true" %}{% raw %}true{% endraw %}{% end_module_attribute %}{% module_attribute "label" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "module_id" is_json="true" %}{% raw %}201493994716{% endraw %}{% end_module_attribute %}{% module_attribute "path" is_json="true" %}{% raw %}"@projects/aca-group-project/aca-group-app/components/modules/ButtonGroup"{% endraw %}{% end_module_attribute %}{% module_attribute "schema_version" is_json="true" %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute "smart_objects" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "smart_type" is_json="true" %}{% raw %}"NOT_SMART"{% endraw %}{% end_module_attribute %}{% module_attribute "tag" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "type" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "wrap_field_tag" is_json="true" %}{% raw %}"div"{% endraw %}{% end_module_attribute %}{% end_module_block %}

Reading time 6 min

Patrik Söderström

For effective cloud management in today’s digital world, organizations demand speed, security, and efficiency. However, many still rely on a manual configuration approach known as ClickOps , using the Azure portal for deployments. While easy to start with, ClickOps can result in slower deployment times, misconfigurations, and limited scalability. The solution is an Infrastructure as Code (IaC) and DevSecOps mindset. This blog covers: The six key challenges of ClickOps How IaC and DevSecOps solve these challenges Practical steps to secure and scale your Azure environment The challenges of ClickOps (and their DevSecOps solutions) According to the Global DevSecOps report from July 2024 , only 56% of organizations have implemented DevSecOps practices. This leaves many relying on ClickOps, manually deploying infrastructure via the Azure portal GUI. ClickOps offers a low entry barrier, making it tempting for teams to quickly set up infrastructure without any governance framework. While this approach is easy to get started with, it will create growing technical debt and operational challenges over time. Below, we explore the six biggest challenges of ClickOps and how IaC and DevSecOps can overcome them . 1) Technical debt with hidden costs ClickOps may seem like an easy way to deploy resources in Azure. After all, it is just a few clicks in the portal, right? But as organizations scale, this approach becomes a costly bottleneck. For example: Deploying a virtual machine in the Azure portal requires navigating eight tabs, each with important information that has to be filled in correctly before the resource can be deployed. While manageable for a single virtual machine, it becomes increasingly difficult to ensure consistent and error-free entries for larger deployments. Over time, the limitations of ClickOps become painfully clear. Routine tasks, such as adding additional disks to multiple virtual machines with specific configurations are time-consuming and repetitive processes. The solution: Automating deployments with IaC reduces technical debt With DevSecOps and Infrastructure as Code (IaC), deployments are automated and deployed according to the defined security policies. Adjustments like changing or updating resources such as virtual machines, is a matter of updating parameters and initiating the deployment pipeline. 2) Slower time-to-market with repetitive tasks ClickOps involves a lot of manual and repetitive work, and increases the risk for human error. Setting up multiple resources with similar setup, slows time-to-market, especially in cloud environments where speed is crucial. The solution: Streamlined deployment with reusable IaC templates IaC provides reusable libraries and catalogs of pre-configured resources. Teams can deploy environments faster and use more cost efficient setups of cloud resources. 3) Managing multiple environments ClickOps makes it difficult to maintain consistency across different environments, such as test and production. Manual setup often requires manual checks to ensure that environments are identical, which is not only inefficient but also prone to mistakes. The solution: Consistency through IaC automation Infrastructure as Code enables teams to use a test environment as a blueprint for other types of environments such as production. The blueprint avoids manual comparison and ensures that both environments are identical. The same applies with changes on infrastructure. A change can be prepared, tested and validated in a test environment, reducing deployment stress and errors in the production environment. 4) Lack of collaboration and version control In ClickOps, changes to infrastructure often lack version control and transparency. It’s hard for teams to coordinate effectively and track who made which changes. The solution: IaC as the single source of truth Even when working with small teams, IaC acts as the single source of truth. It describes the actual configuration and setup of the cloud environment. Changes are also tracked on who, what and when they were applied. Working with Pull Requests on GIT can enforce teams to request changes before they are applied to the actual environment, creating an extra layer of validation. 5) Disaster recovery limitations In case an environment would be tampered or due to human error be partly or completely corrupt, ClickOps offers no realistic way to rebuild it. Can you imagine having to set up hundreds of Azure resources manually in another region? 🥲 The solution: Building resilience with DevSecOps: IaC and DevSecOps enable you to recreate the complete environment from source code.This approach results in a shorter Recovery Time Objective (RTO) and Recovery Point Objective (RPO) during disaster recovery. 6) Security and compliance risks It is true that configuring new resources through ClickOps is governed by your established framework of Azure policies. Nevertheless, it is important to note that these checks occur only during or after the resource has been created. The solution : Ensuring compliance before deployment Having the configuration of your cloud infrastructure in code allows compliance and security scans directly on the source. Any infrastructure changes are audited, and any non compliances are flagged prior to the actual deployment. Resolving all noncompliance before actual deployment ensures the security posture remains intact. Enforcing an approach where only the CI/CD is given permission to change the infrastructure creates an additional layer of security defense. ClickOps out, DevSecOps in To overcome these challenges, organizations should implement Infrastructure as Code (IaC) and DevSecOps . Together, they automate entire deployments while ensuring security best practices are followed. Choosing the right IaC language When selecting an IaC language, there are two strong options on the table: Bicep : Azure’s native language, seamlessly integrated with Azure and directly backed by Microsoft. New Azure services are immediately supported in Bicep. Terraform : A cloud-agnostic option, widely supported across environments. A popular choice for organisations with multi-cloud needs. While Terraform adoption for new Azure services is fast, it is not always available on the first day of release. The general recommendation is to choose Terraform if you are automating deployments for virtualization environments, multi-cloud scenarios, or on-premises workloads. Microsoft provides an excellent comparison, which is available here . 💡Tip : Tools like Aztfexport can export your current Azure environment into Terraform code. This code can then be reviewed, stored in a repository, and used to provision resources consistently. The environment can be locked to prevent portal-based changes, ensuring all modifications occur through IaC, avoiding configuration drift. IaC and DevSecOps approach: success story at ACA Group For one of our clients, we reverse-engineered their existing setup into Terraform code, creating a reusable template. This IaC and DevSecOps approach reduced misconfigurations by 40% and cut deployment times for new environments by 50%. At the ACA Group, every Azure environment we manage follows IaC and DevSecOps principles. Here's how we approach new and existing environments: Greenfield approach (starting from scratch): Establishing a new landing zone from scratch is straightforward. We utilize governance frameworks, templates, and pipelines fully aligned with the Microsoft Cloud Adoption Framework to ensure compliance and efficiency. Brownfield approach (optimizing existing environments) : Existing setups require a more customized strategy. We use tools like Aztfexport , integrated into our existing workflows, to reverse-engineer the environment into IaC templates and ensure a seamless transition. Preparing for the DevSecOps transformation Transitioning to DevSecOps involves more than just technical change, it is a shift in mindset. Organizations have to evolve internal policies and processes to support IaC practices and shift to an efficient and secure cloud environment. At the ACA Group, we specialize in guiding organizations through this transformation. Whether you’re starting fresh or optimizing an existing Azure environment, we’re happy to help. ➡️ Ready to move beyond ClickOps? {% module_block module "widget_a0f585f9-5198-4517-990c-933ef498b09a" %}{% module_attribute "buttons" is_json="true" %}{% raw %}[{"appearance":{"link_color":"light","primary_color":"primary","secondary_color":"primary","tertiary_color":"light","tertiary_icon_accent_color":"dark","tertiary_text_color":"dark","variant":"primary"},"content":{"arrow":"right","icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"tertiary_icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"text":"Let us help"},"target":{"link":{"no_follow":false,"open_in_new_tab":false,"rel":"","sponsored":false,"url":null,"user_generated_content":false}},"type":"normal"}]{% endraw %}{% end_module_attribute %}{% module_attribute "child_css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "definition_id" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "field_types" is_json="true" %}{% raw %}{"buttons":"group","styles":"group"}{% endraw %}{% end_module_attribute %}{% module_attribute "isJsModule" is_json="true" %}{% raw %}true{% endraw %}{% end_module_attribute %}{% module_attribute "label" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "module_id" is_json="true" %}{% raw %}201493994716{% endraw %}{% end_module_attribute %}{% module_attribute "path" is_json="true" %}{% raw %}"@projects/aca-group-project/aca-group-app/components/modules/ButtonGroup"{% endraw %}{% end_module_attribute %}{% module_attribute "schema_version" is_json="true" %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute "smart_objects" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "smart_type" is_json="true" %}{% raw %}"NOT_SMART"{% endraw %}{% end_module_attribute %}{% module_attribute "tag" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "type" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "wrap_field_tag" is_json="true" %}{% raw %}"div"{% endraw %}{% end_module_attribute %}{% end_module_block %} Let us help Or talk to our expert Peter right away!

Reading time 6 min

Patrik Söderström

Cybersecurity is no longer optional—it’s a cornerstone of every organization’s operational resilience and compliance strategy. With the introduction of the EU's NIS2 directive , European organisations face a pressing need to meet rigorous security standards. While the EU's NIS2 directive sets clear standards for network and information security, translating its mandates into actionable steps can be a challenge—especially for businesses using cloud platforms like Microsoft Azure. Fortunately, Azure offers a range of tools designed to simplify compliance and strengthen your security framework. In this post, we’ll explain how Azure can help you to align with NIS2, breaking down the process into manageable steps to help you secure your environment and stay compliant. What is NIS2? The EU’s NIS2 (Network and Information Security Directive 2) is a cybersecurity directive introduced by the European Union to enhance the resilience and security of critical infrastructure and essential services across member states. It replaces the original NIS Directive from 2015 and has been incorporated into the national laws of each EU member state since October 18th, 2024. NIS2 standardizes cybersecurity practices for a wide range of sectors and organizations, from digital services, healthcare and energy, to transportation and public administration. Non-compliance can result in high fines and even reputational damage, so for affected organizations adherence is crucial. Challenges of NIS2 NIS2 covers a broad range of cyber security objectives, including governance, risk management and incident response. With so many objectives, it can be a daunting task for organisations to translate them into actionable steps. Are your infrastructure resources located in the public cloud Azure? Do you know Azure offers important tools in order to audit and ensure your environment is NIS2-compliant. How to start the implementation of NIS2? The first step for implementing NIS2 is to break the directive into smaller manageable controls. Once this has been done, the work of mapping the controls to the best technology and process can start. In this blog, we will break down a specific set of controls and map them to a technology with a focus on Microsoft Azure and Microsoft Entra ID . Microsoft Entra ID: identity and access management for NIS2 compliance One of the core requirements of NIS2 is ensuring only authorised personnel have access to critical systems and data . With Microsoft Entra ID , you have a very robust set of identity and access management (IAM) tools. Multi Factor Authentication Multi Factor Authentication (MFA) has become the de facto standard security method. It requires a user to provide at least two verification factors to access the environment. Conditional Access Policies Conditional Access Policies are often overlooked because they seem optional, but they are essential for ensuring a secure environment. They define the conditions users must meet to access the environment. They may grant or deny access based on parameters such as: IP address (location) User Group Membership in Entra ID Device Posture and compliance Just-in-Time Access Additional safety measures such as Just-in-Time-Access , which grants specific rights for a limited time, should also be configured. As an administrator, you should maintain read-only access by default, using Just-In-Time-Access to temporarily elevate privileges during approved change windows. Security Information and Event Management All the safety measures in the world mean nothing if you don’t have an effective way to continuously monitor and respond accordingly. There are several SIEM (Security Information and Event Management) solutions available. You can adopt Microsoft Sentinel which has both hybrid and cloud native support. Microsoft Sentinel At ACA, we recommend closely monitoring your secure score in Microsoft Entra ID tenant. It provides a quick, clear overview of your compliance progress. Azure tools for NIS2 compliance The Azure platform provides many tools and technologies to help you with NIS2 compliance. Microsoft Defender for Cloud Microsoft Defender for Cloud is an excellent tool to provide real-time threat detection along with security recommendations for different Azure resources such as VM’s, SQL databases, storage and many more. This also includes monitoring for vulnerabilities, policy compliance and security misconfigurations. Azure policy Azure policy is the foundation for keeping your infrastructure compliant, establishing the foundations of your governance framework for your entire landing zone. Before provisioning your first workloads in Azure, ensure your Azure policies are configured and compliant with the NIS2 directive. Do you already have workloads in Azure? It makes policy enforcement a little bit more complex, as they are often set up without strict enforcement. In such cases, the policies have to run in ‘audit’ mode. This is where any non-compliance is flagged but not enforced. This approach lets organizations review and assess the impact before fully enforcing policies. How to manage response and recovery in NIS2? NIS2 is not only about security, but also has a compliance section on “ Response and Recovery ”. This is where you can leverage Azure Backup , Azure Site Recovery and of course, Infrastructure as Code . Focusing further on the actual data, we need to consider the different types of data confidentially. Encryption is key here as it ensures that your data is only accessible to authorized individuals and systems. There are three main types of encryption available: 1. Data at Rest When you store a file in an Azure Storage Account , this is encrypted using Service-side encryption (SSE) automatically. There are different types of encryption at Rest in Azure, depending on which service you use. 2. Data in Transit When data is transmitted over the network there are different ways to encrypt it with the most common being Transport Layer Security (TLS). This is the primary method used when connecting to and interacting with Azure services. 3. Data in Use Data used for processing, such as when stored in memory, can also be encrypted. This is oftentimes overlooked because it’s more complex and the implementation varies depending on which service you use. If you use virtual machines in Azure, there’s a whole area covering Confidential Computing . In case someone would try to read the memory of the host, it is encrypted and unreadable. Struggling with NIS2 compliance? The journey towards NIS2 compliance is exciting, but can also be complex. The technological aspects alone involve numerous controls across various public cloud technologies. However, achieving true compliance requires a balanced approach that integrates the technologies with robust processes and governance. ➡️ At ACA, we care deeply about security. Wherever you are in the NIS2 journey, you can count on us to guide you towards NIS2 compliance success. Questions about NIS2 compliance? {% module_block module "widget_978e9903-327a-46e1-b6ad-b0d5e972d0de" %}{% module_attribute "buttons" is_json="true" %}{% raw %}[{"appearance":{"link_color":"light","primary_color":"primary","secondary_color":"primary","tertiary_color":"light","tertiary_icon_accent_color":"dark","tertiary_text_color":"dark","variant":"primary"},"content":{"arrow":"right","icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"tertiary_icon":{"alt":null,"height":null,"loading":"disabled","size_type":null,"src":"","width":null},"text":"Contact our NIS2 experts"},"target":{"link":{"no_follow":false,"open_in_new_tab":false,"rel":"","sponsored":false,"url":null,"user_generated_content":false}},"type":"normal"}]{% endraw %}{% end_module_attribute %}{% module_attribute "child_css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "css" is_json="true" %}{% raw %}{}{% endraw %}{% end_module_attribute %}{% module_attribute "definition_id" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "field_types" is_json="true" %}{% raw %}{"buttons":"group","styles":"group"}{% endraw %}{% end_module_attribute %}{% module_attribute "isJsModule" is_json="true" %}{% raw %}true{% endraw %}{% end_module_attribute %}{% module_attribute "label" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "module_id" is_json="true" %}{% raw %}201493994716{% endraw %}{% end_module_attribute %}{% module_attribute "path" is_json="true" %}{% raw %}"@projects/aca-group-project/aca-group-app/components/modules/ButtonGroup"{% endraw %}{% end_module_attribute %}{% module_attribute "schema_version" is_json="true" %}{% raw %}2{% endraw %}{% end_module_attribute %}{% module_attribute "smart_objects" is_json="true" %}{% raw %}null{% endraw %}{% end_module_attribute %}{% module_attribute "smart_type" is_json="true" %}{% raw %}"NOT_SMART"{% endraw %}{% end_module_attribute %}{% module_attribute "tag" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "type" is_json="true" %}{% raw %}"module"{% endraw %}{% end_module_attribute %}{% module_attribute "wrap_field_tag" is_json="true" %}{% raw %}"div"{% endraw %}{% end_module_attribute %}{% end_module_block %}