7 days. 7 hands-on projects. All production-style.

Enterprise Hub-Spoke Landing Zone

Northwind Retail needs a foundational Azure landing zone with centralised, governed networking that every future workload will hang off.

• Design an enterprise Hub-Spoke landing zone with centralised networking
• Author reusable Terraform modules and wire up a remote state backend
• Generate the Ansible inventory automatically from Terraform outputs
• NSGs and route tables (UDRs) for controlled traffic flow

Hands-on project: Enterprise landing zone. Hub-Spoke architecture with Azure Firewall and Bastion, remote Terraform state and a modular structure. Troubleshooting drill: fix a broken User-Defined Route that is black-holing spoke traffic.

Secure Data Platform

The platform now needs a secure data tier: secrets, storage and identity that never traverse the public internet.

• Provision Key Vault, Storage and identity entirely through Terraform
• Lock data services behind Private Endpoints and Private DNS
• Configure managed identity and RBAC with Ansible-driven post-config
• Log Analytics workspace for the data tier

Hands-on project: Secure data tier. Key Vault and hardened Storage Account, managed identity and least-privilege RBAC. Troubleshooting drill: diagnose a Private DNS resolution failure preventing private-endpoint connectivity.

Internet-Facing Production Platform

Northwind Retail must expose a public web tier: scalable, health-checked and protected at the edge.

• Automate an Application Gateway and WAF fronting a VM Scale Set with Terraform
• Configure HTTPS, health probes and autoscaling rules as code
• Use Ansible to configure and harden the scale-set instances
• Edge-to-backend traffic flow

Hands-on project: Public web tier. Application Gateway with WAF, VM Scale Set with autoscaling and HTTPS termination. Troubleshooting drill: trace and resolve an unhealthy backend pool behind the Application Gateway.

Zero Trust Administration

Security posture tightens: administrative access becomes just-in-time and every action is observable and audited.

• Enable Defender for Cloud and JIT access via Terraform
• Stand up Azure Monitor, NSG Flow Logs and audit logging as code
• Drive Ansible playbooks for compliant host baselines
• Centralised audit logging

Hands-on project: Zero Trust administration. Microsoft Defender for Cloud, Just-In-Time VM access and Azure Monitor. Troubleshooting drill: track down why expected monitoring data is missing from Log Analytics.

Enterprise Encryption

Regulated data demands encryption everywhere: at rest with customer keys and in transit end to end.

• Automate Customer-Managed Keys and disk encryption with Terraform
• Wire up end-to-end TLS and HTTPS backends as code
• Automate certificate deployment and key rotation with Ansible
• Encryption compliance validation

Hands-on project: End-to-end encryption. Customer-Managed Keys, disk encryption and key rotation, end-to-end TLS. Troubleshooting drill: resolve a certificate validation error breaking the end-to-end TLS chain.

Governance as Code

The organisation enforces standards centrally: policy, tagging and cost control become code, not documentation.

• Author Azure Policy and initiatives in Terraform
• Enforce mandatory tags and cost-governance guardrails as code
• Generate compliance reports and remediate via Ansible
• Cost-governance controls

Hands-on project: Governance as code. Azure Policy and initiatives, compliance reporting and mandatory tagging standards. Troubleshooting drill: debug a Terraform apply that is being denied by an Azure Policy assignment.

Event-Driven Platform Engineering

The capstone build: an event-driven layer reacts to platform events automatically, fully observable end to end.

• Deploy Azure Functions with a Blob trigger via Terraform
• Bind managed identity and Application Insights as code
• Automate function configuration and validation with Ansible
• End-to-end monitoring

Hands-on project: Event-driven layer. Azure Functions with Blob trigger, managed identity integration and Application Insights telemetry. Troubleshooting drill: fix a Functions networking issue blocking the blob-triggered execution.

Capstone

Capstone Assessment: Enterprise Azure Platform

Independently design and implement a complete enterprise Azure platform for a regulated organisation, applying every concept from the seven days: landing zone, secure data, edge, zero-trust, encryption, governance and event-driven automation.

• Enterprise architecture and capability mapping across the full platform
• Terraform and Ansible automation with reusable modules and roles
• Zero Trust security, encryption and least-privilege RBAC
• Governance, mandatory tagging and cost optimisation as code
• End-to-end monitoring, troubleshooting and continuous validation
• A complete GitHub repository and reusable modules