Consumers: For DevOps and Workload Teams

You build and run applications. The platform gives you a ready-to-use place in Azure to do that: a spoke. These pages explain what you get and how to work with it. You don't need to know Terraform or how the hub works.

The pages are grouped the way you meet them: first what you get, then getting onboarded, designing your spoke, building, running, changing, and the managed services.

In short

• You get one Azure subscription per workload per environment (for example dev and prd), already connected, secured and monitored.
• The platform team runs the shared hub and sets up your spoke. You build, run and pay for what you put in it. The platform team is XMMS (under a managed-service contract) or your organisation's own team (self-managed). See Operating models. Contract details such as support hours and the intake channel come from your onboarding document.
• You never need portal access to the hub. Changes to your spoke's baseline (network, access, tags) are made by the platform team from a request, through code.

Start here

Question	Page
What do I get?	What you get
How does it work behind the scenes?	How it works
What should I take care of myself, and what not?	Responsibilities
What can't I do?	Limits
Who do I contact, and what do I include?	Support

Get started

Question	Page
How do I get my application onto the platform?	Onboarding
How do I move an existing workload?	Migrate a workload
How do I request a spoke (or something else)?	How to request
How do I classify my workload (CIA/BIV)?	Security classification

Plan and design

Question	Page
How do I plan the IP range and subnets?	IP range and subnets
Which names and tags do I use?	Naming and tags
What does Azure Policy enforce, and how do I get an exemption?	Policy and exemptions
Who gets which access, and how do I activate it?	Access, groups and PIM

Build and deploy

Question	Page
How do I use my spoke day to day?	How to use
Which Azure DevOps settings and guardrails apply?	Azure DevOps
How do build agents reach my network?	Build agents
Which shared Terraform modules can I use?	Managed templates
Which shared services (gateway, registry, feeds, API Management, extensions) can I use?	Shared services

Run and operate

Question	Page
What about backup, keys, monitoring and quota?	Operate your workload
How do I reach VMs (Bastion)?	Connect to VMs
How do cost, budgets and reservations work?	Cost and reservations
How do I read Application Gateway logs?	Application Gateway logs
What happens when an app registration secret expires?	App registration secrets

Change and request

Question	Page
How do I change my spoke?	How to change
How do I get firewall rules and IP groups (request or pull request)?	Firewall rules and IP groups
How do I receive files over SFTP from an external party?	Inbound SFTP

Managed services

Question	Page
What does the managed spoke service cover?	Managed spokes
Virtual machines: request, backup, patching, cost	Managed virtual machines
What are the scope and boundaries of the managed VM service?	VM service description

Related topics

Question	Page
Core, direct and additional services, spoke variants	Service types
Roles, PIM and the identity model	Identity and access model
Guardrails for workload teams	Design principles
How are decisions, exceptions and changes governed?	Governance