Azure Secure Tenant Resilience Architecture (ASTRA)
Azure managed service.Inside your own tenant.
ASTRA structures, secures and runs your Azure environment: with dedicated architects, infrastructure as code and a report that makes costs, subscriptions and resources visible month by month. Your tenant stays 100% yours.
- your tenant stays yours
- 100%
- per month in the entry tier
- EUR 5,000
- to audit readiness
- 3–6 weeks
managed service report
Managed Service Dashboard
// 59 months · 2021-07 to 2026-05
01Costs
Costs over time
// from the subscriptions table
Costs from the subscriptions table
02Scope
Subscriptions
// count per month
Resources
// total per month
The managed service report from ASTRA: costs, subscriptions and resources of one tenant, month by month since July 2021.
Why companies switch their Azure operations
Most companies that come to us already run Azure, with an IT service provider. That decision was reasonable: the provider knew the data center, the licenses and the people. What has changed since then is the model behind it.
An operations contract tied to a percentage of your Azure consumption rewards the provider when your bill goes up. The same provider decides which sizes you book and when anything gets scaled down. Both levers sit in one hand. And operations that treat Azure like a server in the basement keep things running, but they don't warn you about the next retirement and they don't modernize anything. You pay cloud prices for basement service.
Three questions that show you whether this applies to your current contract:
- 1Does your provider's invoice go up when your Azure consumption goes up?
- 2Does your provider earn a share of your Azure bill?
- 3When did your provider last warn you about a retirement in Azure before it hit you?
If your answers are “yes, yes, never”, ASTRA is the opposite model.
Why ASTRA? Reality speaks for itself
25%
of companies discover shadow IT only by chance - often with compliance consequences.
>50%
of Azure resources are publicly reachable according to studies - often unnoticed.
>40%
of cost variances arise from missing FinOps processes - with direct budget impact.
1
responsible person often knows all Azure dependencies - if they leave, knowledge is lost.
What exactly is ASTRA?
- Audit readiness in 3-6 weeks - no restart, building on your existing environment.
- Full documentation of your Azure environment - for transparency, knowledge retention, and safe handovers.
- Governance that works - policies, access models, and naming conventions that work in day-to-day operations.
- Team enablement instead of dependency - your team is involved, trained, and empowered to steer independently.
- Structured preparation for ISO 27001, TISAX & GDPR - with automated evidence and clear processes.
What's included in the Azure managed service ASTRA
ASTRA covers all nine methodologies of the Microsoft Cloud Adoption Framework (CAF, Microsoft Learn): from strategy through the landing zone and migration to governance, security and operations of your tenant.
| CAF methodology | What ASTRA takes on |
|---|---|
| Strategy | Define the business outcomes of your Azure adoption |
| Plan | Prepare people, processes and technology for Azure |
| Ready | Build your Azure landing zone or align your existing environment with it |
| Migrate | Move workloads from your own data center and other clouds to Azure |
| Modernize | Improve existing workloads so they better meet business needs |
| Cloud-native | Build new workloads and features cloud-native in Azure |
| Govern | Tenant management and governance for your entire Azure environment, including cost control |
| Secure | Securing your entire Azure environment |
| Manage | Operating your entire Azure environment: tenant health, patching and alerting with NOTA |
ASTRA is not a classic SOC: we run your tenant according to the CAF and deliver governance and security from a single provider.
For small, recurring changes to an existing application, such as an extra field or a changed interface, there's LUNA, our monthly allowance for software maintenance.
On the same foundation we run individual workloads such as a cloud-native CMS. IT security for Azure and the Azure security architecture set out what the security layer covers.
What ASTRA doesn't do
Four things we deliberately refuse, because they would break the model we sell:
We don't bill operations by your Azure consumption.
Put a hundred times more articles in your web shop and your Azure bill goes up, ours doesn't. If the environment itself grows, with new workloads, more subscriptions or tighter compliance requirements, a higher tier can make sense. Whether and when is your call. You will not get a price surprise from us.
We don't take Owner access to your tenant.
We don't click on request.
A change that would earn you an audit finding or an outage later is carried out only after we've reviewed it together. That costs one more phone call in the individual case and saves the project the change would otherwise trigger six months later.
We don't just keep the lights on.
Microsoft changes Azure continuously. You hear about retirements, new sizes and price changes from us before they reach your environment, and Modernize is part of operations for us, not a separate project.
What ASTRA costs, and when it pays off
Managed service providers often bill Azure operations as a percentage of monthly consumption, typically ten to 25 percent (Opsio, March 2026). ASTRA costs EUR 5,000 a month, at EUR 20,000 of Azure consumption just as at EUR 100,000, for the same scope: service hours on business days from 9 a.m. to 5 p.m. (CET/CEST), monitoring and alerting with NOTA, a monthly architecture session.
| Consumption per month | Percentage model | ASTRA |
|---|---|---|
| EUR 20,000 | EUR 2,000 to 5,000 | EUR 5,000 |
| EUR 100,000 | EUR 10,000 and up | EUR 5,000 |
Depending on your provider's percentage, the break-even sits somewhere between EUR 20,000 and EUR 50,000 of consumption. Above that, the percentage model gets more expensive with every euro of Azure. ASTRA does not.
If you are at EUR 20,000 and intend to stay there, the percentage model serves you better, and we will say so in the call. ASTRA is built for companies that want to grow in Azure.
Showcase: Relationship Between Azure Costs and Managed Service
// 49 months · 2021-07 to 2025-07
01Costs
Costs per month
// azure consumption vs. managed service
Jul 25
EUR 10,695·EUR 10,000
02Scope
Resources
// count per month
Subscriptions
// count per month
03Milestones
- Jun 22Project A EOL
- Jul 22MVP Go-Live: Project B
- Aug 22PoC Project C
- Sep 22End of PoC Project C
- Nov 22AI tooling for Project B
- Jan 23Build an AI platform
- Sep 23Start security assessment
- Feb 24AI platform in production
- Jun 24Azure Machine Learning training
- Sep 24Azure Machine Learning training completed
- Oct 24PoC LLM plus SQL RAG
- Jan 25Resource ramp-down after successful PoC
- Feb 25Mitigate ASTRA findings from 2024
- Mar 25Build CAF - Hub and Spoke
- May 25Implement Azure Firewall
Then there's the sentence a percentage-paid provider can't say: 30-50% lower cloud costs - through FinOps structures, automatic optimization, and clear accountability. A provider who earns a share of your Azure bill would cut their own revenue with every saving. We earn nothing from the saving and lose nothing from it, which is why we can promise it.
All prices are fixed monthly prices excl. VAT.
More consumption does not change your ASTRA price. Moving to a different tier is something we talk through together, and you decide.
Service hours in the smaller packages are on business days from 9 a.m. to 5 p.m. (CET/CEST).
Jupiter is our full-service package at EUR 30,000 per month. We set service hours and response times in the contract.
Included · ASTRA Mercury
For a structured start - fast, secure, manageable.
- Monitoring and alerting for core Azure resources with NOTA, service hours on business days from 9 a.m. to 5 p.m. (CET/CEST)
- FinOps basics: reporting, cost-driver analysis & quick wins
- Monthly architecture session with engineering feedback
- Cloud Fit Assessment (2-3 weeks) incl. risk report
- Introduction of Azure Policy & role-based access (RBAC)
- Governance basics: naming, tagging, role models
Whether you buy Azure through us as a Cloud Solution Provider or through your existing Enterprise or Customer Agreement with Microsoft is your decision. Our price is the same either way.
When companies call us
Rarely out of conviction, usually on a date:
- The Azure bill nobody can explain, and the provider whose invoice went up in the same month.
- The audit report in which three external companies hold Owner rights on the tenant.
- The retirement you learned about in the Azure portal instead of from your provider.
- Your own developers, who can't find a common language with the provider because nobody there builds software.
- The change of account manager, after which nobody knows how your environment is set up anymore.
If one of these was your date, the architecture call is the next step.
Individual assessment instead of a standard solution
Talk directly with our Azure architects
No off-the-shelf demo. No sales talk. In a short conversation, we’ll clarify where you stand - and how ASTRA can make your Azure environment more secure, clearer, and team-ready.
How switching to ASTRA works
We take over your tenant, not your IT service provider. Licenses, hardware, Microsoft 365 and everything else your current provider does well stay with them. You move Azure operations, nothing else. That's a decision an IT lead can make alone.
- 1
We take over your tenant and align it with the CAF.
- 2
We identify the workloads that don't yet run cloud-native.
- 3
We migrate and modernize these workloads and then run the environment on an ongoing basis.
What lies in between depends on your environment and is what the architecture call is for.
NOTA is included in ASTRA: filter rules send critical Azure alerts to your receivers, and all alerts stay accessible in the history.
With DELTA, governance extends to your source code. You add DELTA to ASTRA as an option.
You can add ORCA to ASTRA as well. ORCA checks the dependencies of large repositories with OWASP Dependency-Check in two to three minutes instead of over an hour.
ASTRA does not cover your customers' identities: Entra ID, RBAC and PIM govern your team's privileged access, not your users' sign-in. That is what the Entra External ID migration is for.
Frequently asked questions about ASTRA
Is ASTRA a SOC?
No. ASTRA is not a classic SOC. We run your tenant according to the Cloud Adoption Framework and deliver governance and security from a single provider. Service hours in the smaller packages are on business days from 9 a.m. to 5 p.m. (CET/CEST).
Is there a minimum size for ASTRA?
ASTRA has no minimum size in subscriptions or Azure consumption. It pays off most for companies that want to grow in Azure and whose environment serves several departments or applications, because the fixed monthly price is then spread across them. For a single small application, ASTRA is usually too large, but it's not ruled out.
What costs extra on top of ASTRA?
DELTA and ORCA are add-ons. DELTA extends governance to your source code, ORCA checks the dependencies of your repositories with OWASP Dependency-Check. NOTA is included in ASTRA. More consumption does not change your ASTRA price.
Why doesn't DEVDEER bill by Azure consumption?
Because we make the recommendations that determine your consumption. Whoever is responsible for reservations, sizes and rightsizing must not earn from consumption going up. Our price follows the scope of the environment we operate, not your Azure bill.
Do we have to buy Azure through DEVDEER?
No. We're a Cloud Solution Provider and happy to handle procurement if that simplifies things for you. We operate your tenant just the same if Azure runs through your existing agreement with Microsoft. The price of ASTRA is the same in both cases.
What happens to our current provider?
They stay responsible for everything that isn't Azure operations, if that's what you want. We take over the tenant, not the relationship.
Does DEVDEER carry out changes we request?
Yes, after we've reviewed them together. We don't implement a change that makes your environment less secure or more expensive without saying so first. That's the difference between an operating model and a ticket system.
Ready for an Azure environment that fits you - not the other way around?
In 60 minutes, we’ll clarify together whether ASTRA fits your environment and your team - no obligation, but with substance.
Next step
Ready to create impact?
Tell us briefly what it’s about – by email or in a non-binding conversation. We listen, ask the right questions, and show how we can help in a solution-oriented and pragmatic way.
What happens next
- 01
Describe your case
Three fields, no sign-up. Two minutes is enough.
- 02
Personal reply
Stefanie Heine gets back to you within one business day.
- 03
Non-binding first conversation
We listen, ask the right questions, and show how we can help.
- hello@devdeer.com
- +49 (0) 391 - 55 68 00 5 0
- Herderstraße 31, 39108 Magdeburg
Your contact
Stefanie Heine
Executive Assistant
0/500 characters
We respond within one business day.
50+ customers trust DEVDEERAzure since 2015Microsoft Cloud Solution Provider