Managed Azure Linux VMs: administration and cloud operations
We take over the agreed operation of suitable Azure Linux VMs and clearly scope Entra ID, VNet, Azure SQL, AKS, backup, governance, and FinOps. The tenant and resources remain with you.
Microsoft operates the Azure infrastructure. Depending on the selected IaaS or PaaS service, guest operating systems, applications, identities, network rules, data, and recovery remain wholly or partly with the customer.
Azure VM Operations as an Entry Point
For suitable Linux VMs, we take over guest operations, patching, hardening, monitoring, and backup management within a documented scope.
Cloud Services Scoped Separately
Entra ID, VNet, Azure SQL, AKS, governance, and other PaaS services have their own responsibilities and are agreed to match the environment.
Delegated Access Where Suitable
Azure Lighthouse, RBAC, and PIM where applicable are selected according to required roles and technical limits. The customer retains control.
Responsibility documented per service
The Azure shared responsibility model assigns these responsibilities by service model. During the audit, we document what Microsoft, your team, and WZ-IT handle for each service.
Azure service areas
Which Azure services we include in operations, governance, and migration
Azure Virtual Machines can be an entry point. The tenant, identities, networks, PaaS, AKS, monitoring, and recovery are nevertheless documented as separate responsibility areas rather than grouped under generic server management.
Virtual Machines
Take over Azure Virtual Machines and Linux operations in a controlled way
Azure Virtual Machines, images, and Managed Disks by workload and lifecycle
Azure Load Balancer and Virtual Machine Scale Sets after architecture review
Availability Sets or Availability Zones according to the actual failure model
Azure Update Manager for planned Linux updates and maintenance windows
Terraform or Bicep for repeatable provisioning and changes
Scope boundary and notes
We operate suitable Linux VMs and include the related compute, storage, update, and availability features.
Responsibility boundary: Microsoft operates the Azure infrastructure. Under shared responsibility, guest operating systems, configuration, data, and applications remain customer responsibilities unless WZ-IT takes them over.
Outcome: Documented VM operations with reliable update, access, and change paths.
Tenant & identity
Structure Microsoft Entra ID, RBAC, and delegated access
Microsoft Entra ID, Azure RBAC, and Managed Identities within the agreed scope
Conditional Access, MFA, and Privileged Identity Management by license and protection requirement
Azure Lighthouse for delegated management of suitable resources
Management Groups, Subscriptions, and Resource Groups as a governance structure
Azure Policy and Activity Log for rules and traceable changes
Scope boundary and notes
We separate tenant responsibility, human identities, workload identities, and technical WZ-IT access.
Responsibility boundary: The tenant, subscription, and billing remain with the customer. WZ-IT receives limited, revocable roles; Entra configuration and licensed features are agreed separately.
Outcome: Azure administration with clear roles and no shared global administrator accounts.
VNet & hybrid
Design VNet, private access, and site connectivity
Azure Bastion for suitable SSH or RDP access without a public VM IP
Azure VPN Gateway, Virtual WAN, or ExpressRoute by connectivity requirement
Azure Private Link, Private Endpoints, and Private DNS Zones for PaaS access
Azure Firewall, Application Gateway, and Web Application Firewall by scope
Scope boundary and notes
We structure hub-spoke, hybrid, or smaller VNet architectures and define administrative and application access paths.
Responsibility boundary: Bastion, NSGs, Firewall, and Private Link each solve part of the problem. The complete access, routing, and security model requires joint design.
Outcome: A documented network architecture for cloud, site, and administration traffic.
AKS & containers
Operate AKS, Container Registry, and workloads
Azure Kubernetes Service (AKS) with node pools, upgrades, autoscaling, and maintenance windows
Azure Container Registry for images, permissions, scanning, and lifecycle
Ingress, certificates, secrets, Workload Identity, policies, and GitOps
Azure CNI, Load Balancer, Application Gateway, or Private Cluster by architecture
Observability, persistent data, and application recovery
Scope boundary and notes
For Azure Kubernetes Service, Microsoft operates the control plane. WZ-IT covers node pools, add-ons, workloads, and their integration by scope.
Responsibility boundary: The AKS control plane does not automatically cover workers, add-ons, Kubernetes objects, data, or application functionality.
Outcome: A complete Kubernetes operating scope above the managed control plane.
PaaS & data
Scope Azure SQL, PostgreSQL, and other PaaS services
Azure SQL Database or Azure SQL Managed Instance after architecture review
Azure Database for PostgreSQL with networking, parameters, maintenance, and backup
Azure Storage Accounts with Blob Storage, Files, lifecycle, and access controls
Azure Managed Redis or other data services after separate product assessment
Private Endpoints, Managed Identities, data migration, and restore tests
Scope boundary and notes
We operate customer-side configuration and application integration for managed Azure services with an explicit boundary to the Microsoft scope.
Responsibility boundary: Microsoft operates defined platform components. Data models, queries, permissions, applications, cost, and recovery objectives remain customer and WZ-IT responsibilities.
Outcome: A PaaS and data scope with clear operating and application responsibility.
Monitor, backup & FinOps
Control observability, recovery, and cost over time
Azure Monitor, Log Analytics, Application Insights, and Alert Rules by scope
Azure Backup with Recovery Services Vault or Backup Vault and suitable policies
Azure Site Recovery for suitable DR scenarios after separate architecture review
Azure Cost Management, Budgets, Advisor, and commitments in the FinOps scope
24/7 monitoring, incident response, and Microsoft support coordination by service level
Scope boundary and notes
We connect Azure telemetry, backup and recovery services, human response, and cost review in an ongoing operations process.
Responsibility boundary: Azure Backup, Site Recovery, and availability features are not automatic availability or recovery guarantees. WZ-IT response times apply only to our scope.
Outcome: Azure operations with measurable states, tested recovery paths, and traceable cost decisions.
One operating model
One operating model for Microsoft Azure and additional systems
The provider is only one operating location. WZ-IT connects servers, clouds, and on-premises systems into a documented environment with consistent monitoring, controlled access, and one coordinated service level.
Contracts, accounts, and administrative control remain with you. We take over the agreed technical operations without moving the infrastructure into a closed hosting product.
Private connectivity
NetBird, WireGuard, or existing site connections integrate further clouds, Proxmox systems, and on-premises networks through controlled paths.
Operations and response
Monitoring, updates, backups, documentation, and incident response are designed across all participating systems and operated according to the selected service level.
Monitoring · SLA · Operations
Microsoft Azure
Private connectivity
Cloud · Proxmox · On-premises
Building blocks
From VM guest operations to the Azure platform
Not every Azure service belongs in the same flat fee. We combine the required components into a reviewable operating model.
Azure Virtual Machines
Linux guest operations, Managed Disks, load balancers, and scale sets after architecture review
Entra ID & RBAC
Identities, roles, MFA, PIM, and access processes separate from basic VM operations
VNet & Hybrid
NSGs, routing, Private Endpoints, VPN Gateway, peering, and ExpressRoute by scope
Azure SQL & PostgreSQL
Configuration, access, capacity, maintenance, backup, and application-side responsibility
AKS & Container
Cluster, node, add-on, workload, and data responsibility as a separate platform scope
Azure Monitor
Metrics, logs, agents, retention, and escalation aligned with the operating model
Azure Backup
Recovery points, consistency, and recovery depending on resource, vault, and redundancy
Governance & FinOps
Management Groups, Policy, tags, budgets, and commitments without blanket compliance or savings guarantees
Weighing migration, hybrid operations or a cloud exit?
The audit first establishes current state, responsibilities, and the required operating scope.
01
Assessment
Map tenants, subscriptions, Regions, services, access paths, and cost
02
Operating Boundaries
Document Microsoft, customer, and WZ-IT responsibility for each service
03
Onboarding
Configure RBAC, monitoring, backup, maintenance windows, and alert paths
04
Ongoing Operations
Handle agreed tasks, incidents, and changes with traceability
Service scope
Monitoring or full operations
With Monitoring Only, our team reviews alerts and notifies your team during service hours; incident resolution stays with you. Standard Linux VM operations start at €149.90. Kubernetes, managed databases, multi-account setups, and further cloud services are scoped individually. This also applies to complex suitable Azure Linux VMs environments.
Server operationsfrom €149.90Monitoring Only from €49.90
VMs, Lighthouse, Entra, Azure SQL, AKS, backup, and operations
The standardized entry point is operating suitable Linux VMs: patching, hardening, monitoring, backup management, and agreed incident response. Entra ID, VNet, Azure SQL, AKS, governance, security, and platform services are scoped separately for each environment.
Responsibility differs considerably by service. With Azure Virtual Machines, guest operations and applications remain with the customer, while Microsoft takes on more platform duties for PaaS services such as Azure SQL. Identities, configuration, data, applications, and recovery still require planning to different degrees.
Azure Lighthouse is suitable for many delegated subscription or resource-group tasks and makes activity visible in the customer tenant. However, it does not support every role or all DataActions. We select Lighthouse, customer-owned RBAC roles, or other controlled access paths according to the required scope.
Yes. The tenant, subscriptions, resources, and usage-based Azure charges remain with the customer. Delegated access can be reviewed and removed by the customer. WZ-IT invoices the agreed operations and consulting scope separately.
The standardized price anchor applies to suitable Linux VMs. We can operate Windows Server after assessment as part of an Azure or hybrid environment; operating system, licensing, Active Directory, applications, and vendor support are scoped separately.
Yes, if the application and data design are suitable. Scale Sets require consistent images, health checks, capacity and scaling policies, and appropriate load distribution. A stateful application does not become scalable or highly available automatically.
No. A single zonal resource remains tied to its zone. Zone resilience requires suitable resources distributed across zones, an appropriate application design, and planned failover and data handling. Service, Region, SKU, and configuration determine the available options.
Yes, where the service fits the access model. Target VMs then need no public IP, while Bastion has its own network, role, feature, and cost requirements depending on SKU and deployment mode. VPN or other administrative access may be more appropriate in some environments.
Azure Backup uses recovery points in a Recovery Services vault and provides different consistency and restore options. We plan policy, retention, vault redundancy, alerting, and recovery tests. Cross-Region, cross-zone, and cross-subscription restore each have prerequisites and limitations.
Yes, as a separate scope. Microsoft operates the underlying platform, while configuration, network access, identities, capacity, maintenance windows, data, queries, recovery objectives, and application integration still require agreement.
Yes, under a separate Kubernetes scope. The control plane, node pools, upgrades, add-ons, workloads, identities, networking, persistent data, observability, and recovery are considered separately. See our Kubernetes offering for details.
No. A Region defines the location of certain resource data but does not replace assessment of service architecture, replication, support access, telemetry, contracts, subprocessors, and the customer's technical and organizational measures. WZ-IT provides no blanket legal guarantee.
No. We assess metrics, unused resources, disks, data transfer, licensing options, and commitments. Reserved VM Instances, Savings Plan for Compute, or Azure Hybrid Benefit can help but introduce prerequisites and commitments. Recommendations therefore contain no blanket savings guarantee.
Suitable vendor-supported versions of Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, or SUSE can be included in scope. A Marketplace image alone does not replace lifecycle assessment or available security updates.
Monitoring-only starts at €49.90 net per server and month. Operating a suitable Linux VM starts at €149.90 net per month. Entra ID, Azure SQL, AKS, complex networking, governance, and other services are priced by scope.
The service can be cancelled monthly, with 30 days' notice to the end of the month.
Response time follows the selected service level. Production and Critical include 24/7 response to qualified P1 incidents. Microsoft support, repair, and recovery times remain separate.
Yes. We map dependencies, data, identities, networking, and the target operating model, perform test migrations, and plan cutover and rollback. Lift-and-shift is not automatically the best technical or commercial target architecture.
Knowledge
Further resources
Further assess operations, cost, and potential target architectures.
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbHView project
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
