Our work
Engagements
Work in Azure infrastructure, identity, and AI engineering. Clients are identified by sector.
01
Cloud & infrastructure
Platform & DevOps, Identity & security
Consolidating 14 business units onto one Azure platform
Context
A manufacturer had grown by acquisition into 14 business units, each running its own Azure subscription with its own networking, naming, and deployment habits. Two of the units had no infrastructure code.
Challenge
Changes that crossed a business-unit boundary required negotiation between teams with different conventions. The company could not determine which subscriptions met its own security baseline, because the baseline had never been expressed as anything a machine could check.
Work
thenar built one Azure landing zone: hub-and-spoke networking on Azure Virtual WAN, ExpressRoute into the two plants that needed it, and Azure Firewall between spokes.
A shared Terraform module library replaced the infrastructure code each business unit had maintained separately, and Azure Policy turned the security baseline into deny and audit rules that run continuously.
Deployments moved to GitHub Actions, with plan review on every pull request.
Outcome
A new business unit now lands on the platform in days rather than the quarter it once took. Every infrastructure change reaches the platform team as a pull request, and Azure Policy reports drift from the security baseline the day it happens.
02
Identity & security
Cloud & infrastructure, Managed technology services
Removing standing global admin from a 9,000-seat Entra tenant
Context
A state agency held 41 accounts with permanent Global Administrator or Owner rights across its Microsoft Entra ID tenant and Azure subscriptions. Several were service accounts created years earlier, with no record of what they were for.
Challenge
An annual assessment was approaching and the agency could not produce evidence of who held privileged access, why, or when it was last reviewed. Human administrators and workload identities followed different, undocumented conventions.
Work
Administrative roles were rebuilt as eligible assignments in Entra Privileged Identity Management. Activating one requires approval and a written justification, and the activation expires at the end of a set window.
Conditional Access separated administrative sessions from ordinary user sessions and required phishing-resistant authentication for them.
Service accounts moved to managed identities and workload identity federation. Secrets that remained necessary went into Azure Key Vault on a rotation schedule, and Entra ID Governance now runs quarterly access reviews with a named approver per role.
Outcome
Standing privileged access is down from 41 accounts to three break-glass accounts held in escrow. When an assessment asks who holds privileged access and why, the agency answers from its own Entra ID Governance exports. Microsoft Sentinel alerts on any activation outside a change window.
03
AI engineering
Software engineering & modernization, Managed technology services
Building an on-call AI assistant grounded in approved sources
Context
An operator's on-call engineers worked from runbooks in SharePoint, 10 years of tickets in ServiceNow, and architecture notes in Confluence, and answering a page meant searching all three.
Challenge
The assistant had to answer from approved documents only and take no action on its own. The failure modes that mattered were an invented remediation step and a document surfaced to an engineer without clearance to read it.
Work
Retrieval runs on Azure AI Search, combining keyword and vector search across the three approved sources. Results are trimmed by the requester's Entra ID group membership before anything reaches a model.
The orchestration layer calls Azure OpenAI, with Anthropic Claude as a fallback path. Every answer carries a citation to the source paragraph, and any step that would touch production stops at a human approval gate.
A 240-case eval set gates every prompt and retrieval change in CI, and OpenTelemetry traces each retrieval, tool call, and refusal.
Outcome
On-call engineers start with the assistant and follow its citations into the source documents. The eval set catches grounding regressions before a change ships. Production actions still require a person's approval before they run.