Customer
- Owns the relevant Azure environment.
- Determines subscription and billing arrangements.
- Authorizes administrative access.
- Approves resource deployment.
- Approves security and region requirements.
- Accepts the operating handover.
Microsoft Azure
AZURE CLOUD ARCHITECTURE · IDENTITY · NETWORK GOVERNANCE
Microsoft Azure Architecture and Configuration for Businesses in Oman
Novatelia supports the planning and configuration of Microsoft Azure environments within customer-owned subscriptions. An agreed design may cover subscription organization, Microsoft Entra identity, virtual networking, named workloads, security requirements and administration handover. Region, licensing and recovery decisions are evaluated separately against the customer’s requirements.
The customer’s subscription. Azure work is designed inside a subscription the customer owns. The design covers identity, network layout, and the workloads named in the requirement, for organizations in Oman and the GCC. Administration stays with the customer after handover. No Microsoft partner title is published. No subscription price or guaranteed recovery time is published.
Every engagement includes the records named in the approved scope.
Explore the Architecture of a Customer-Owned Azure Environment
Where a management group is used, the hierarchy runs from management group to subscription, then to resource group, then to the Azure resource. The Entra tenant stays beside that hierarchy as the identity boundary. Subscription billing is distinct from tenant identity. Hub-and-spoke networks, Azure Firewall, ExpressRoute, Azure Kubernetes Service, Microsoft Sentinel, Azure Virtual Desktop, and a disaster-recovery region are options to evaluate. They are not assumed.
Conceptual Azure architecture — not a live Microsoft tenant, subscription or verified customer deployment.
01
Customer Organization
The legal and operational authority stays with the customer. Novatelia’s design or configuration role does not transfer ownership of the subscription.
02
Microsoft Entra Tenant
The Entra tenant is the identity directory and the sign-in context. It is related to the subscription. It is not an object inside a resource group, and it is not the same object as the subscription.
03
Management Group Hierarchy
A management group is an optional governance hierarchy above subscriptions, where the customer’s environment uses management groups. Management groups are not resources contained inside a subscription.
04
Azure Subscription
A subscription is a Microsoft Azure billing and access scope. Resources are created inside a subscription the customer owns. Novatelia does not become its owner by performing design work.
05
Resource Groups
A resource group is a logical management container for resources within a subscription. It organizes what the design deploys. It does not replace the subscription boundary.
06
Azure Virtual Networking
Virtual networks, subnets, and the security rules around them are designed for the named applications. A hub-and-spoke layout, VPN Gateway, ExpressRoute, or Azure Firewall is an option to evaluate, not a delivered default.
07
Compute & Platform Services
Virtual machines, storage, databases, application hosting, containers, or integration services are included only where a named workload needs them.
08
Security & Access Governance
Roles, policies, and security boundaries follow the approved design. Available Azure controls and controls actually configured under the contract are different lists.
09
Region & Data Requirements
A region is a deployment location selected for service availability, latency, customer policy, and the data rules that apply. This page does not assign a region and does not treat a Middle East region as automatic compliance for Oman.
10
Administration & Handover
Operating responsibility, documentation, and authorized access return to the customer’s administrators. Standing access for Novatelia is not assumed after handover.
The Customer Retains Subscription and Administrative Control
Novatelia, where scoped
- Reviews requirements.
- Proposes an architecture.
- Assists with approved configuration.
- Documents deployed components.
- Validates defined requirements.
- Transfers operating information to authorized customer administrators.
Permanent subscription access is not assumed. Ownership does not move.
Structure Azure Resources Before Deploying Workloads
A landing zone, when the customer wants that approach, is a way to agree management hierarchy, subscription organization, resource groups, naming, tagging, policy, administrative roles, network planning, security boundaries, and who operates the result. One architecture does not fit every enterprise. The actual scope is the design that was agreed.
Original design scope. Each line is included when the agreement names it.
- 01Subscription and management-group placement the customer already uses, or a new subscription they create
- 02Entra ID sign-in for the people who will administer it
- 03Network layout for the applications in scope
- 04Compute and platform services only where the workload needs them
- 05A handover of names, access, and the operating notes
- Not a Microsoft partner badge
- Not a published price for virtual machines or licenses
- Not a backup design by itself; recovery is on the backup page
- Not a claim that a given Azure region is approved for every organization
Define Identity and Administrative Access
Microsoft Entra ID holds user identity, groups, and authentication for the tenant. Administrative roles in the directory, Azure RBAC on resources, subscription ownership, and billing authority are separate. Least privilege, multifactor authentication where supported, and a review of privileged access are design topics. Credentials are not shown, and this page does not start a Microsoft login.
Design Cloud Networking Around Application Requirements
The network is drawn for the named applications. Optional services such as VPN Gateway, ExpressRoute, Azure Firewall, or a hub-and-spoke layout are explained as options that need evaluation. No connectivity speed is invented, and no network resource is created from this page.
01
Azure Virtual Network
The virtual network is the defined cloud networking environment for the applications in scope. Address space is chosen for those applications and for any network they must reach.
02
Subnets
Subnets divide that network so application tiers and management access can be separated. The split follows the application, not a universal template.
03
Network Security Groups
Network Security Groups filter traffic at the subnet or network interface according to the rules the design approves. They are one control. They are not a complete security program.
04
Routing
Routes send traffic toward the next hop the design names. Custom routing is added only when an inspection device, an on-premises path, or an application requirement needs it.
05
Private connectivity
Private access to a platform service is considered when the application should avoid the public endpoint. It is specified per service. It is not assumed for every resource.
06
Internet-facing connectivity
Public entry is designed only for the applications that need it, with the filtering the design names.
07
DNS dependencies
Name resolution has to work for the identities and the applications in scope. DNS is a dependency of the design, recorded with the rest of the network.
08
On-premises integration
A VPN gateway or ExpressRoute can be evaluated when the customer needs a private path to a site. Neither is required for every Azure design, and no speed or availability figure is stated here.
Select Azure Services Only for Defined Workloads
The categories below are examples. Each one still needs a business requirement, availability in the selected region, connectivity, identity, an operator, and a billing owner. No cost estimate is published.
- 01
Virtual machines
A virtual machine is considered when an application needs that compute model, the size exists in the selected region, and identity, network, operations, and billing are accepted.
- 02
Storage
Storage is selected for the data the workload holds, including access, redundancy options the region offers, and the backup decision if backup is separately scoped.
- 03
Databases
A database service is included when the application requires it and the service is available in the chosen region. The data rules and the operating responsibility are part of the same decision.
- 04
Application hosting
A platform for the application is chosen against the runtime, the scale, and the network path the application needs. The platform is not selected because it is available in a catalog.
- 05
Container platforms
A container platform, including Azure Kubernetes Service, is an option when the workload is specified that way. It is not part of every design.
- 06
Integration services
Integration is included when named systems have to exchange data. The connection, the identity, and the failure behavior are written into the design.
Select Azure Regions Against Data and Operational Requirements
Region selection weighs the data requirements that apply, which services exist in that region, latency and where users are, regulatory obligations, customer policy, data residency, and any backup or continuity requirement that is scoped separately. A region is not suitable for every organization merely because it exists. An Oman-based Azure region is not asserted here. A Middle East region does not by itself prove legal compliance. Services are not available in every region. Data movement outside the selected region has to be checked against the actual service. The customer approves the region in writing.
Apply Security Controls According to the Approved Design
Role-based access, network segmentation, security policies, logging, resource configuration, secrets and keys where they apply, encryption considerations, and change governance are designed for the subscription in scope. A control that Azure offers is not the same as a control the contract configured. This page does not operate a monitoring desk, and it does not show a security score.
Understand Cost Drivers Without Inventing Prices
The customer owns billing. Cost follows consumption, service size, region, storage, and data transfer, plus any reserved capacity the customer chooses. Azure provides cost-visibility tools the subscription owner can use. A budget review belongs with that owner. This page publishes no virtual-machine price, license price, or total. Official pricing stays on Microsoft’s own pricing documentation, read against the current date and the real workload. A technical architecture proposal is not a final commercial price.
Cloud Architecture Is Not Automatically a Recovery Plan
Deploying a resource, using a resilient Azure configuration, taking a backup, replicating, planning disaster recovery, and planning business continuity are different decisions. A resource is not backed up because it runs in Azure. No recovery-point or recovery-time figure is published here.
Backup and Disaster RecoveryAssess Migration Only When Workloads Are Included
Migration is optional. When it is in scope, the work can include an application inventory, compatibility, dependency mapping, the source environment, identity, network connectivity, data transfer, cutover planning, testing, and acceptance. It is not part of every Azure design. Zero downtime and zero data loss are not promised.
Return a Documented Azure Environment to Customer Administrators
Handover items apply where that part of the environment was in scope. Confidential architecture and tenant identifiers are not published.
- 01Tenant and subscription relationship
- 02Resource inventory for what was deployed
- 03Naming conventions
- 04Management hierarchy
- 05Resource group map
- 06Network diagram
- 07Access role matrix
- 08Region decisions
- 09Operational procedures
- 10Known dependencies
- 11Open issues
- 12Change and support responsibilities
From Customer Subscription to Defined Workloads
01
Customer subscription
The work sits in a subscription the customer owns, placed in the management-group structure they already use, or in a new subscription they create.
02
Identity
Microsoft Entra ID sign-in is defined for the people who will administer the subscription. Directory roles, resource RBAC, and billing authority stay distinct.
03
Network
The virtual network is laid out for the applications in scope, including the paths those applications actually need.
04
Named workloads
Compute and platform services are added only for the workloads the design names. An architecture review, an approved configuration, validation, and handover are different stages of the work. A review does not by itself deploy resources.
Related Enterprise Cloud Services
Cloud Architecture Knowledge
Knowledge HubMicrosoft Azure Architecture — Questions and Answers
01What is Microsoft Azure?
Microsoft Azure is Microsoft’s cloud platform for identity-linked subscriptions, networking, and the compute or platform services a customer chooses to deploy. On this page it is a design inside a subscription the customer owns.
02What is an Azure subscription?
A subscription is a Microsoft Azure billing and access scope. Resources in the design are created inside that scope. Novatelia does not become the owner by designing in it.
03Who owns the Azure subscription in a Novatelia engagement?
The customer owns the subscription. The customer’s subscription remains the customer’s subscription. Novatelia’s design or configuration role does not transfer ownership.
04Is Novatelia a Microsoft Azure partner?
No partner title is published. The subscription remains the customer’s.
05Can Novatelia help design Azure infrastructure in Oman?
Novatelia supports planning and configuration of Azure environments for organizations in Oman and the GCC, inside a subscription the customer owns. Region, licensing, and recovery are evaluated against that customer’s requirements.
06What is the difference between a Microsoft Entra tenant and an Azure subscription?
The Entra tenant is the identity directory and sign-in context. The subscription is the billing and resource-management boundary. They are related. They are not the same object, and the tenant is not placed under a resource group.
07What is an Azure management group?
A management group is a governance hierarchy above subscriptions, used where the customer’s environment has one. It is not a resource inside a subscription, and not every customer has management groups.
08What is an Azure resource group?
A resource group is a logical container for resources within a subscription. It is how deployed resources are organized. It does not own the subscription and it does not contain the Entra tenant.
09What is an Azure landing zone?
An Azure landing zone is an architectural approach for organizing hierarchy, subscriptions, resource groups, naming, tags, policy, roles, network, and security boundaries before workloads are placed. It is a concept for the design. It is not a claim that every customer receives a fully implemented landing zone.
10Does every Azure project require a landing zone?
No. The structure is agreed in the design. A small, named workload does not automatically receive a full enterprise landing-zone build.
11What is an Azure Virtual Network?
An Azure Virtual Network is the defined cloud network for the applications in scope. Subnets, security rules, routing, and any private or internet path are designed for those applications.
12What are Azure subnets?
Subnets are subdivisions of a virtual network used to separate application tiers and management access. The split follows the application requirements.
13What are Network Security Groups?
Network Security Groups are rule sets that filter traffic to a subnet or a network interface. They are configured for the flows the design allows. They are not assumed to be a firewall product.
14How does Azure connect to an on-premises network?
A private path can be evaluated with a VPN gateway or ExpressRoute when the customer needs one. The choice depends on the sites, the provider, and the applications. Neither option is required for every design, and no bandwidth figure is published here.
15Is ExpressRoute required for Azure?
No. ExpressRoute is a possible private-connectivity option. It is evaluated when the requirement names it. It is not part of the default scope.
16How are Azure administrative permissions controlled?
Administrative access is granted by the customer to named people, using Entra directory roles where those roles apply and Azure role-based access control on the subscription and resources. Least privilege and a review of privileged access are part of the design when they are in scope. Multifactor authentication is used where the tenant supports it.
17What is Azure RBAC?
Azure role-based access control assigns permissions on a management group, a subscription, a resource group, or a resource. It decides what an already authenticated identity may do to Azure resources.
18What is the difference between Azure RBAC and Entra administrator roles?
Entra administrator roles govern the identity directory. Azure RBAC governs Azure resources. Subscription ownership and billing authority are further commercial controls. These are not identical assignments.
19Do you choose the Azure region?
The region is selected with the customer against their data rules. This page does not assign one. Service availability, latency, customer policy, and the data rules that apply are part of that selection. A Middle East region is not treated as automatic compliance.
20Is every Azure region suitable for Oman organizations?
No. Suitability is a decision for the customer’s data requirements, the services they need, and the latency they can accept. This page does not claim that every Azure region is suitable, and it does not invent an Oman Azure region.
21Does a Middle East region guarantee data residency compliance?
No. Choosing a Middle East region does not by itself guarantee compliance with Oman law. Service behavior, paired regions, support operations, and the customer’s own policy still have to be checked. Region selection requires documented customer approval.
22What workload information is needed for Azure design?
The design needs the application, its dependencies, the identity it uses, the network it must reach, the data it holds, and the availability the customer expects. Resources are included only when the agreed scope identifies them.
23Does Azure architecture automatically include virtual machines?
No. Virtual machines are one compute option, used where the workload needs them and the size is available in the selected region.
24Can an existing application be migrated to Azure?
An existing application can be assessed for migration when that work is in the approved scope. The assessment covers inventory, compatibility, dependencies, identity, connectivity, data transfer, cutover, testing, and acceptance.
25Is migration included in every design?
No. Migration is an optional assessment. The source-defined Azure service is architecture and configuration of named workloads. Zero downtime and zero data loss are not offered.
26How is Azure consumption billed?
The customer owns the subscription and its billing arrangement. Consumption depends on the services, their size, the region, storage, and outbound transfer. Reserved capacity is a commercial option where it applies. A technical proposal is not a final price.
27Does Novatelia publish Azure subscription prices?
No public VM, license, or subscription price is published. A price needs current Azure rates and the exact workload assumptions, which this page does not invent.
28Does Microsoft Azure automatically back up every workload?
No. A resource is not backed up because it runs in Azure. Backup, replication, and disaster recovery are a separate design.
29Is Azure replication the same as backup?
No. Replication copies state to another environment and can propagate unwanted change. A backup is a historical copy that can be restored. Neither is included automatically with the architecture.
30Does Novatelia guarantee an Azure recovery time?
No recovery time is published. Recovery objectives belong in a written backup and recovery design, not in this architecture page.
31What security controls may be relevant to an Azure design?
Role-based access, network segmentation, security policies, logging requirements, resource configuration, secrets handling where relevant, encryption considerations, and change governance. A control is relevant when the design includes it. This page does not provide continuous monitoring or a managed security operations desk.
32Does Novatelia offer live Azure monitoring through this page?
No. This page is an architecture description. It does not connect to a subscription or show a live monitor.
33What information is handed over to customer administrators?
Where the scope includes them, handover records can cover the tenant and subscription relationship, the resource inventory, naming, hierarchy, resource groups, the network, the access matrix, region decisions, procedures, dependencies, open issues, and support responsibilities. Tenant identifiers and credentials are not published.
34Which Novatelia solutions relate to Azure?
Microsoft 365, Backup and Recovery, and Cloud and Productivity. Each remains its own scope.
35How can an organization request Azure infrastructure scoping?
Open the RFQ draft or contact Novatelia. An RFQ saves a browser draft. It does not publish a price, Microsoft partner status or quotation reference.
Define Your Azure Subscription & Workload Requirements
An RFQ saves a browser draft. It does not publish a price, Microsoft partner status or quotation reference.
The RFQ page keeps a browser draft. It does not submit a quotation or issue a reference.