- Client
- UK food manufacturer
- Sector
- Food Production
- Services
- Azure Infrastructure, Application Design
- Year
- 2023
- Timeline
- Design to deployment
- Read time
- 3 min read
35 days
Automated backup retention on the database tier
0
Public inbound paths to the application or its database
1
Runbook that deploys the entire platform as code
01 · The challenge
What we walked into
The manufacturer's ERP platform is the system the business runs on, covering production, stock, and financials. It needed to move to Azure, and the move needed to leave it more resilient, more observable, and simpler to operate than the platform it was leaving.
ERP platforms reward a deliberate design. The application and its database have different needs, so we decoupled them, giving each the infrastructure that suits it and the whole platform a security posture the manufacturer's standards could sign off.
02 · Our approach
How we got there
- 01
Design the platform
The ERP application server on a dedicated Windows Server VM, and its database on Azure SQL Managed Instance, each sized for the workload and placed in a dedicated subnet inside a UK South virtual network.
Core design
- 02
Secure by construction
Application security groups and network security groups permit only the specific flows the platform needs, peered to the central hub, with Azure Bastion for remote management and no public inbound path anywhere.
Network design
- 03
Build the safety net
Azure Backup for the VM and automated backups for the database tier, with the Managed Instance zone-redundant so a datacentre-level event does not become a business-level one.
Resilience
- 04
Deploy as code, hand over running
The whole platform deploys from a single infrastructure-as-code runbook, with monitoring, alerting, and cost tracking configured, and every security insight resolved before the handover to operations.
Transition
03 · The outcome
What changed
The manufacturer's ERP platform now runs on Azure with its database on a managed, zone-redundant service, its network closed to everything but named flows, and its whole shape reproducible from a single runbook. Operations inherited a platform they can see, secure, and rebuild.
A database with a service level
Azure SQL Managed Instance brings automated backups, 35-day retention, and zone redundancy to the ERP database, managed as a platform rather than a server.
Least privilege, everywhere
Every network rule permits a named flow between named resources, so the platform's attack surface is the platform and nothing else.
Observable from day one
Azure Monitor and Microsoft Defender for Cloud watch the platform, with alerts tuned so operations sees what matters rather than everything at once.
Reproducible by design
Because the platform is code, the manufacturer can stand up a matching environment for test or disaster recovery without commissioning another project.
Technologies
- Microsoft Azure
- Azure SQL Managed Instance
- Azure Backup
- Azure Bastion
- Microsoft Defender for Cloud
- Infrastructure as Code
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.