Ne Plus Ultra Global Solutions runs its public site, mail, and VPN on two servers we administer. Those servers are linked with WireGuard. The client's estate stays in the client's Azure subscription. The governor connects to that subscription and applies the control there.
The cloud account remains the client's. Billing, the directory, and the resources stay in the subscription they already hold. What the company keeps is the decision of what should exist, and a record of what was applied.
What the intake records
An intake names the estate before anything is created.
- The tenant.
- The target subscription.
- The region.
- The capability stack and the budget the apply has to respect.
That record is the intent. It is written down with the governor, on infrastructure Ne Plus Ultra operates, before the Azure API is called.
What the governor applies
The apply creates a resource group in the named subscription and region, then attaches policy to it. The call goes through the Azure API. The proof of that apply is stored back with the job, so a later change in the subscription can be compared with what was sent.
The resources that result from the apply are Azure resources. They live in the client subscription. The governor does not move them onto the Ne Plus Ultra servers.
What stays on our servers
The public site, the company mail, and the VPN are the systems we operate for ourselves. They are reached on the two servers, over the WireGuard mesh. A fault in a client subscription does not take those three down with it, because they are not running inside that subscription.
The same split is why the arrangement is useful. The client keeps the cloud account they already pay for and already audit. Ne Plus Ultra holds the control record and can apply it again. The company's own site, mail, and VPN stay on machines we administer.
More of the custody question, including who can still grant privilege after a partner leaves, is in Before the MSP leaves, name four owners.
Next step
Open an intake with the tenant, the subscription, and the region. The governor applies inside that subscription.
Start intake