Deterministic Consent Gate: analytics remain disabled until explicit opt-in. No third-party trackers are loaded.

NPU
← Blog

Control plane · October 2026

The governor applies inside the Azure subscription

The client keeps the Azure subscription. The governor records the tenant, region, and intent, then applies the resource group and policy through the Azure API. The company site, mail, and VPN stay on servers we administer.

Ne Plus Ultra Global Solutions runs its public site, mail, and VPN on two servers we administer. Those servers are linked with WireGuard. The client's estate stays in the client's Azure subscription. The governor connects to that subscription and applies the control there.

The cloud account remains the client's. Billing, the directory, and the resources stay in the subscription they already hold. What the company keeps is the decision of what should exist, and a record of what was applied.

The NPU governor sends a resource group and policy into the client Azure subscription. Site, mail, and VPN stay on NPU servers, linked by WireGuard.CLIENT AZURE SUBSCRIPTIONTenantSubscription and regionResource groupPolicyAZURE APINPU GOVERNORIntakeTenant, subscription, regionRecord of the applyStays with Ne Plus UltraWIREGUARDNPU SERVERSPublic site, mail, VPN
The subscription stays with the client. The record of what was applied stays with the governor.

What the intake records

An intake names the estate before anything is created.

That record is the intent. It is written down with the governor, on infrastructure Ne Plus Ultra operates, before the Azure API is called.

What the governor applies

The apply creates a resource group in the named subscription and region, then attaches policy to it. The call goes through the Azure API. The proof of that apply is stored back with the job, so a later change in the subscription can be compared with what was sent.

The resources that result from the apply are Azure resources. They live in the client subscription. The governor does not move them onto the Ne Plus Ultra servers.

What stays on our servers

The public site, the company mail, and the VPN are the systems we operate for ourselves. They are reached on the two servers, over the WireGuard mesh. A fault in a client subscription does not take those three down with it, because they are not running inside that subscription.

The same split is why the arrangement is useful. The client keeps the cloud account they already pay for and already audit. Ne Plus Ultra holds the control record and can apply it again. The company's own site, mail, and VPN stay on machines we administer.

More of the custody question, including who can still grant privilege after a partner leaves, is in Before the MSP leaves, name four owners.

Next step

Open an intake with the tenant, the subscription, and the region. The governor applies inside that subscription.

Start intake