Regulated estates lose the year in the same place. The landing-zone programme is approved. The partner still holds the tenant. Workshops fill the calendar. The contract that operates production comes up for renewal before identity, network, policy, and logging exist as something a supervisor can be shown.
A landing zone is the control a migration lands in. Until that control exists, every workload that moves inherits the estate the programme is trying to leave.
A 24-month roadmap from MSP dependency to internal operational independence starts to move when the first phase is cut to a six-month execution window. The compression is a decision about ownership. It is not a faster copy of the same plan.
Seventy-two hours is the target for the stamp, not for the estate.
What has to be true when the stamp is done
The first seventy-two hours produce a place where later workloads are allowed to land. Six things, and no more.
- A management group and a subscription model a board can point at. Someone can say which subscription is production, which is identity, and which is sandbox, without opening a ticket.
- A hub. Hub-and-spoke or virtual WAN, with a written path for ingress, egress, and private endpoints. Segmentation that lives in a diagram does not survive the first application team.
- Policy and tags as code. Portal writes are blocked. On one landing zone, 18 percent of assets had been created in the portal, outside Terraform. That is how a baseline disappears between audits. The measured result is in The Baseline Before the Model: spend down 32 percent, builds from 40 minutes to 11, the model still out of the path.
- Logging the estate can export without the partner in the room. If the diagnostic settings, the activity log, and the retention sit in the MSP's tenant or the MSP's tool, the customer has a favour, not evidence.
- Break-glass and just-in-time privilege. A four-hour maximum window. Revoke under thirty seconds. Zero standing admins. A policy named PIM, with a session that outlives the ticket, is standing privilege with a countdown on it. That standard is the Zero-Drift paper.
- Four named owners: tenant, privilege, evidence, and revoke. A cloud exit that cannot name those four is still operated by the partner. That inventory is the four owners.
The stamp is built from Azure Verified Modules. Most of the landing zone should be a verified module with a signature, not a one-off script that only its author can change. Custom logic belongs where the estate is actually different. It does not belong in the hub, the policy baseline, or the logging pattern.
What stays out of the first seventy-two hours
Rightsizing the whole invoice. Ownership comes first. The 49 percent OpEx reclaim on a CHF 1.7 million estate happened after extraction from the MSP, not before the tenant had a name. That sequence is the 49% OpEx blueprint.
An AI FinOps tool. A model multiplies the architecture underneath it. Buy the measurement after the baseline exists.
A lift of every legacy VM. The stamp is the platform. Application cutover is the programme that follows, in parallel, one system at a time.
A new SOC platform. If the activity log, the policy state, and a revoke cannot be shown in the room the estate is already in, another console will not create the evidence.
The programme after the stamp
Once the control exists, the work looks ordinary, and that is the point.
Workloads move into the stamp on a parallel run. The partner operates the old estate until the cutover for that application is done. Identity, privilege, and logging moved on day one, which is why the end is allowed to happen.
Drift is watched continuously and remediated back to the stamp. The landing zone is a measured state, not a workshop output. When shape diverges — an NSG, a tag baseline, a diagnostic setting — remediation starts. Waiting for the quarterly audit means the audit writes the finding.
The MSP exit is then a transfer of runbooks, access, and evidence against a clock. Six to twenty-four months for a full insourcing, with the first phase measured in months because the control was stamped before the argument about tooling began.
What a supervisor can be shown
DORA has applied since 17 January 2025. NIS2 makes the management body accountable for the risk measures it approves. The question in the room is whether someone can show the hub, the policy, the log export, and a revoke, and name the person who owns each.
A seventy-two-hour stamp is small enough to exist before the next renewal, and concrete enough to answer that question. If the landing zone is still a programme plan, and the partner still holds the keys, the estate has a roadmap. It does not yet have a control. The shape of that control plane is described under architecture.