Engineering Deep Dive¶
Scope
Engineering notes for AzAWSLab implementation decisions, control-plane boundaries, configuration patterns, and evidence routes. Each note connects architecture claims to public-safe source files, screenshots, CLI output, workflow records, manifests, or evidence folders in the repository.
Engineering map¶
The engineering material is grouped by platform lifecycle domain. Hybrid workplace, delivery, network, private platform services, operations, and AI governance each have their own controls and evidence routes.
| Lifecycle domain | Scope | Engineering notes |
|---|---|---|
| Release 1 Hybrid Workplace | Identity, Exchange Hybrid, Microsoft 365 operations, endpoint security, Microsoft Graph PowerShell, monitoring, and operational visibility. | Hybrid Identity Engineering Exchange Hybrid and M365 Services Modern Endpoint Management Graph and PowerShell Operations Monitoring and Operational Visibility |
| Release 2 Delivery Engineering | Terraform state boundaries, GitHub Actions OIDC, controlled apply, and traceability from claim to source to evidence. | Terraform State Boundaries GitHub Actions OIDC Code Traceability |
| Release 2 Network Engineering | Hub-spoke routing, Azure Firewall, FortiGate inspection, IPSec, BGP, AWS branch routing, and symmetric path validation. | Hybrid Multi-Cloud Networking Secure Transmission and Inspection Hybrid BGP Multi-Cloud Transit |
| Release 2 Platform Services | Private AKS, AVD secure workspace, FSLogix, private access patterns, inspected integration, and governed operator access. | Private AKS Platform AVD Secure Workspace Private AKS and AVD Architecture |
| Release 2 Operations Engineering | AWX automation, Ansible source control, monitoring, alert validation, backup protection, and resilience evidence. | Automation Control Plane Monitoring, Backup and Resilience |
| AI Governance | Policy-mediated tool use, human approval boundaries, decision evidence, and local AI lab context. | AI Operations Enclave Companion Local AI Lab |
Release 1 Hybrid Workplace¶
Release 1 establishes the realistic Microsoft hybrid enterprise environment used by the rest of the platform.
Use these notes to review identity synchronisation, Conditional Access, Microsoft 365 operations, endpoint management, Microsoft Graph PowerShell, and operational visibility.
- Hybrid Identity Engineering
- Exchange Hybrid and M365 Services
- Modern Endpoint Management
- Graph and PowerShell Operations
- Monitoring and Operational Visibility
Release 2 Delivery Engineering¶
Delivery Engineering covers how infrastructure changes are planned, reviewed, applied, and traced.
Use these notes to review Terraform state boundaries, GitHub Actions OIDC, root-scoped delivery, and claim-to-evidence traceability.
Release 2 Network Engineering¶
Network Engineering covers the routed and inspected fabric behind the platform.
Use these notes to review hub-spoke routing, FortiGate service chaining, Azure Firewall enforcement, IPSec/BGP, AWS branch transit, and symmetric return-path validation.
Release 2 Platform Services¶
Platform Services covers the private compute and governed operator access layer.
Use these notes to review private AKS, AVD secure workspace, FSLogix profile handling, private access patterns, and the paired AKS/AVD operating model.
Release 2 Operations Engineering¶
Operations Engineering covers the control planes used to operate, monitor, validate, back up, and recover the platform.
Use these notes to review AWX automation, Ansible source control, runtime secret handling, Sentinel, Defender for Cloud, Azure Monitor alerts, Recovery Services Vault controls, and BCDR evidence.
Review paths¶
| Reviewer focus | Start here |
|---|---|
| Hybrid workplace, identity, endpoint security, and Microsoft 365 operations | Hybrid Identity Engineering, Exchange Hybrid and M365 Services, Modern Endpoint Management, Graph and PowerShell Operations, Monitoring and Operational Visibility |
| Terraform, CI/CD, and delivery governance | Terraform State Boundaries, GitHub Actions OIDC, Code Traceability |
| FortiGate, Azure Firewall, IPSec, BGP, and AWS branch routing | Hybrid Multi-Cloud Networking, Secure Transmission and Inspection, Hybrid BGP Multi-Cloud Transit |
| Private platform services | Private AKS Platform, AVD Secure Workspace, Private AKS and AVD Architecture |
| Operations, automation, monitoring, backup, and recovery | Automation Control Plane, Monitoring, Backup and Resilience |
| AI governance and policy-mediated tool use | AI Operations Enclave, Companion Local AI Lab |
Evidence standard¶
Each note uses a simple evidence table:
| Field | Purpose |
|---|---|
| Claim | The implementation or design decision being linked to evidence. |
| Evidence path | The repository file, folder, screenshot set, workflow, manifest, or evidence directory that supports the claim. |
| What to verify | The specific signal to check. |
Evidence should point to stable, public-safe locations such as:
docs/release1/for Release 1 implementation notes.screenshots/release1/for Microsoft 365, identity, endpoint, Purview, monitoring, and recovery evidence.terraform/for infrastructure source and root boundaries..github/workflows/for workflow-controlled delivery.ansible/for Ansible playbooks, inventories, and AWX integration material.kubernetes/for Kubernetes manifests and platform support objects.docs/release2/evidence/for Release 2 validation output, workflow records, routing evidence, AWX evidence, AKS evidence, AVD evidence, backup evidence, and O6 evidence.
Review standard¶
These notes are written as engineering records, not marketing summaries. They explain what was built, why the design was chosen, how the control boundary works, and where the evidence route starts.
The strongest signal is traceability: architecture decision, implementation source, validation evidence, and reviewer evidence route.