Silent Spend & Config Drift
Azure spend and resource configurations drift quietly all month until an unexpected invoice arrives.
CLOSED BY CLOUD ACCOUNTABILITY
✓
AZURE MANAGED SERVICES & COST GOVERNANCE
SERVICE FAMILY: CLOUD
Who owns what you spend, what you expose, and how it performs in Azure?
THE WRITTEN PROMISE
Your Azure governed, with costs visible and ownership clear at the platform layer.
100% Written Scope Boundary
3 Tiers START · CORE · STRATEGIC
Named Senior Ownership
Designated Layer Mandate
Cloud Accountability
Contract Family
CLOUD
Delivery Model
Outcome-Based · Fixed Tier
Boundary Status
Inclusions & Exclusions Written
Escalation Point
Senior Cape Town Engineers
OPERATIONAL DIAGNOSTIC
Signs nobody owns this yet
Azure spend and configuration can drift quietly. Cloud Accountability brings daily cost visibility and platform governance, so cost surprises and ‘who owns this Azure resource?’ questions finally have a clear answer.
Unowned Cloud Resources
Nobody can answer ‘who owns this Azure resource?’ or whether orphaned disks and VMs are still required.
CLOSED BY CLOUD ACCOUNTABILITY
✓
Month-End Bill Shocks
Cost surprises are discovered on the month-end statement rather than prevented while there is still time to act.
CLOSED BY CLOUD ACCOUNTABILITY
✓
WRITTEN SCOPE ARCHITECTURE
What we own — and what stays separate.
Ambiguity is where IT partnerships break down. We publish both what is included in Cloud Accountability and what is scoped separately so your team never discovers a gap mid-incident.
[!] WHAT STAYS SEPARATE, AND WHY
Scoped separately: Security remediation, SOC and MDR · disaster recovery · application and database work · migrations · landing-zone and infrastructure-as-code (IaC) engineering · guaranteed outcomes. Azure consumption is billed separately.
Azure managed services govern the Azure platform layer — not internal application code, database queries, or uncapped usage consumption.
CONTRACTED INCLUSIONS (5 CORE MANDATES)
FAMILY: CLOUD
- Azure subscriptions through Microsoft’s CSP programme, with consumption billed transparently at Microsoft list price
- Cost visibility, budget thresholds, and usage reporting through SpendGuard →
- Baseline governance: Role-Based Access Control (RBAC) and Azure Policy guardrails
- Managed day-to-day platform operations across compute, networking, and identity CORE & UP
- Elevated ownership and advanced platform management, including AKS, Azure Firewall, vWAN, and WAF STRATEGIC
OPERATIONAL REALITY CHECK
Coverage and ownership are not the same thing.
GOOD TO KNOW // OPERATIONAL BOUNDARY RULE
Rule of thumb: If the Azure platform is unavailable, it may be in scope; if the platform is up but the app or data is the issue, it isn’t. Also note that Azure services are usage-based and uncapped by default — on Provisioning-only, the client accepts full financial responsibility for all consumption.
SERVICE TIER ARCHITECTURE
Cloud Accountability Tiers
From indirect CSP provisioning through to advanced enterprise platform operations.
CSP BILLING ONLY
Provisioning Only
Billing and provisioning. No support.
Azure is usage-based and uncapped by default. On provisioning only, we don’t monitor, limit, or optimise your spend.
VISIBILITY & GUARDRAILS
START
Visibility, baseline setup and reporting. Not managed operations.
Includes subscription hygiene review, SpendGuard cost alerting, one-time RBAC & Azure Policy setup, and monthly cost reporting.
RECOMMENDED STANDARD
RECOMMENDED
CORE
Managed day-to-day platform operations.
Everything in START, plus business-hours operational support across compute, networking & identity, Secure Score & Azure Backup visibility, and root-cause escalation.
COMPLEX ESTATES
STRATEGIC
Elevated ownership and senior oversight for complex estates.
Includes advanced platform management across AKS, Azure Firewall, vWAN, and WAF, plus executive cloud architecture oversight.
Our services are deliberately modular. Network, backup, security depth, server and cloud are separate commercial decisions — never bundled implicitly into per-user pricing.
CONNECTED ACCOUNTABILITY LAYERS
What connects with Cloud Accountability
Every layer is modular by design and integrates cleanly with adjacent operational responsibilities.
PROPRIETARY FINOPS ENGINE
SpendGuard
Continuous Azure cost anomaly and budget overrun early-warning system — alerts you while there is still time to act.
SERVICE FAMILY: DEFEND
Security Accountability
Pairs Azure platform governance with active security posture operations and RiskSight for Azure (270 controls).
QUESTIONS & CLARIFICATIONS
Cloud Accountability FAQs
Where does Crimson Line’s responsibility stop in Azure?
The rule of thumb is simple: if the Azure platform (compute, virtual network, storage, or identity layer) is unavailable, it is in scope. If the Azure platform is healthy and running, but an internal software application or database query is failing, that sits with your application team.
What is included in Cloud Accountability STRATEGIC?
STRATEGIC adds elevated architectural ownership and advanced platform management for complex estates, explicitly covering Azure Kubernetes Service (AKS), Azure Firewall, Virtual WAN (vWAN), and Web Application Firewall (WAF).
NEXT STEP