Microsoft Azure DevOps and Cloud Platform Engineering Services
Azure DevOps work means designing, building and operating your delivery pipeline and cloud platform on Microsoft Azure — landing zones, AKS or Azure Container Apps, Azure Functions, Bicep, Azure Pipelines and GitHub Actions. Mixcore Studio has shipped production software for more than 8 years, and the Azure work we do today is mostly platform work: a paved road your developers use every day, infrastructure defined in code, builds that produce evidence of where they came from, and a bill that somebody owns by name.
Azure is a defensible default for organisations already running Microsoft Entra ID, Microsoft 365 and an existing enterprise agreement. Identity and commercial gravity decide more Azure adoptions than any compute feature does. We say that plainly because it also tells you when Azure is not the obvious answer, and we would rather have that conversation before the migration than during it.
Where Azure stands in August 2026
Azure and other cloud services grew 43% in Microsoft's FY2026 Q4, and Azure passed $100 billion in annual revenue for the first time; Microsoft Cloud revenue was $59.3 billion, up 27% (Microsoft FY26 Q4 press release, 29 July 2026). Cloud growth re-accelerated on AI rather than settling into maturity.
The practical consequence is not price, it is capacity. Amazon, Google, Meta and Microsoft together guided to roughly $635 billion of capital expenditure for 2026, and that build-out is itself driving shortages in components such as memory (The Register, 6 February 2026). If your roadmap needs GPUs or accelerators in a specific region, treat it as a procurement question with a lead time rather than a portal click, and get the answer from your Microsoft account team before the architecture assumes it.
On the platform itself, Microsoft Build 2026 introduced Azure Cobalt 200 Arm-based VMs, in preview and quoted at up to 50% better CPU performance than the Cobalt 100 generation (workload dependent), and positioned Microsoft Foundry as a production agent runtime with hosted agents, memory, grounding, observability and governance. Both are worth planning around; neither is a reason to rewrite something that already works.
What we build on Azure
- Landing zone and identity — subscription and management group structure, Azure Policy, private networking, and Entra ID workload identity federation so pipelines authenticate without long-lived service principal secrets.
- Delivery pipelines — Azure Pipelines or GitHub Actions, environment promotion, database migrations, and a rollback path that has actually been rehearsed rather than documented.
- Runtime selection — AKS where the workload genuinely needs it, Azure Container Apps or App Service where it does not, Azure Functions for event-driven work.
- Data and state — Azure Database for PostgreSQL, Azure SQL, Blob Storage lifecycle rules, and restores tested on a schedule instead of assumed.
- Observability — OpenTelemetry instrumentation exporting to Azure Monitor and Application Insights, with alerts tied to named failure modes rather than generic thresholds.
Heroku migrations are a common reason teams arrive here. Salesforce moved Heroku to a Sustaining Engineering model in February 2026: security, stability and reliability work only, no new feature development, and no new Enterprise contracts for new customers. It is not shutting down and list pricing is unchanged, so the honest advice is to plan the exit rather than panic-migrate. Azure Container Apps is usually the closest-shaped target; the awkward parts are add-ons, Postgres, and any code that assumes an ephemeral filesystem or a 30-second request limit.
AKS, and when Kubernetes is the wrong answer
Kubernetes won the substrate argument. 82% of container users now run it in production, up from 66% in 2023, and 66% of AI adopters use it to scale inference workloads (CNCF 2025 Annual Cloud Native Survey, published 20 January 2026). It also stopped being the thing worth selling: in the same survey, 47% of organisations name cultural change within development teams as their biggest barrier to cloud native adoption, outranking technical concerns for the first time.
So we will say the unpopular part. For a system with five services and one team, AKS is usually over-engineering that you then have to defend on cost. Azure Container Apps or App Service reaches the same outcome for a fraction of the operating hours, and the honest measure of a platform decision is engineer-hours per month to keep it running, not how modern it looks on a diagram. We quote that number before you commit.
Where AKS is the right call, version discipline is the part teams underestimate. Kubernetes 1.34 reaches end of life on 27 October 2026, 1.35 on 28 February 2027 and 1.36 on 28 June 2027, with v1.37 scheduled for 26 August 2026 (kubernetes.io/releases). Anything at or below 1.33 is already unsupported. We set an upgrade cadence that keeps clusters inside the window rather than discovering the problem during an audit. For GPU and accelerator scheduling, Dynamic Resource Allocation went GA in Kubernetes 1.34 with a stable resource.k8s.io/v1 API, a more flexible alternative to the older device-plugin pattern. Managed control planes are the default posture; self-managing one is now an exception that needs a reason.
Supply chain evidence, and the 11 September 2026 deadline
The EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents from 11 September 2026, with a 24-hour early warning, a 72-hour notification and a final report within 14 days for vulnerabilities or one month for severe incidents, submitted through the CRA Single Reporting Platform to the relevant CSIRT and ENISA. Whether and how it reaches products you already have on the EU market is a scope question to settle with counsel early. Full CRA application follows on 11 December 2027.
That turns a security preference into a dated operational duty, and the first question to answer is who files the 24-hour report at 3am. We build the machinery around it: an SBOM produced per build, SLSA v1.2 provenance (Approved Specification, released 24 November 2025), Sigstore signing with Cosign, verification enforced at deploy time, and an on-call rota with the reporting path written down. We are not lawyers and do not give legal advice; we produce the evidence and the process your counsel signs off.
Credential hygiene is the same problem seen from the pipeline side. The CHAINDROP worm, discovered on 4 August 2026, backdoored more than 400 npm packages through stolen maintainer credentials, including keyv at over 600 million monthly downloads and flat-cache at 580 million (Elastic Security Labs, August 2026). That lineage of worms harvests secrets from CI environments, environment variables and cloud metadata endpoints. Long-lived tokens are indefensible now. The replacements are OIDC and workload identity federation for Azure and GitHub, short-lived credentials, a soak period before adopting new package versions, npm 12 or later (which blocks dependency lifecycle scripts by default), and enforced 2FA on publishing accounts.
Cost you can forecast, telemetry you can move
98% of FinOps practitioners now manage AI spend, up from 31% in 2024 (FinOps Foundation, State of FinOps 2026, 1,192 respondents representing over $83 billion in annual cloud spend). At the same time, an estimated 29% of IaaS and PaaS spend is wasted, the first increase after five years of decline (Flexera 2026 State of the Cloud Report). AI workloads made forecasting structurally harder, and the answer is unit economics rather than a monthly clean-up.
On Azure that means reservations and savings plans where usage is predictable, right-sizing driven by real data, tags enforced by Azure Policy at deploy time instead of reconciled afterwards, budget and anomaly alerts wired to a person, and a cost per GPU-hour or per thousand requests that the product owner can read without a spreadsheet.
Instrumentation is a cost lever too. OpenTelemetry became a CNCF Graduated project on 21 May 2026, with over 12,000 contributors from more than 2,800 companies and the second-highest project velocity among the CNCF's 240-plus projects, behind only Kubernetes. Traces, metrics and logs are GA and the Collector is production-ready; Profiles is still alpha. Writing new instrumentation against a single vendor's proprietary agent is technical debt at birth. We instrument with OpenTelemetry and export to Azure Monitor, which keeps Azure Monitor a destination rather than a dependency.
Delivery measurement moved as well. DORA's metric set is now five — rework rate joined the four familiar ones in 2024 — and the 2025 report replaced the Elite, High, Medium and Low tiers with seven team profiles. Its headline finding is that 90% of technology professionals now use AI at work, a median of two hours a day, with over 80% reporting productivity gains, while 30% still have little or no trust in the code it generates; AI adoption correlates with higher throughput and higher instability at the same time. We report change failure rate and rework alongside deployment frequency, because velocity on its own is a misleading number.
Exit plan, sovereignty and the trade-offs we will name
Cloud switching charges, expressly including egress fees for the switch, are completely prohibited in the EU from 12 January 2027 under the EU Data Act. That has made "what does leaving cost" a normal procurement question rather than an awkward one, and Heroku's freeze made the underlying risk concrete. We answer it with portable infrastructure as code, no proprietary glue where a standard interface exists, documented runbooks, and a costed migration path.
On tooling, the trade-off is real and worth stating. Bicep is the most ergonomic way to describe Azure resources and the least portable off Azure. Terraform has been under the Business Source License since August 2023 and stayed BUSL after IBM closed its $6.4 billion acquisition of HashiCorp on 27 February 2025, so calling it open source is no longer accurate; OpenTofu is the Linux Foundation fork, with independent features including native state encryption. The decision also matters less than it did: on 4 August 2026 Pulumi shipped GA support for Terraform state, HCL as a first-class language and running Terraform modules on the Pulumi engine, and its Discovered Stacks release of 30 July 2026 brings existing ARM deployments under management with zero-diff previews. Incremental adoption replaced rip-and-replace, which is why we no longer treat the IaC choice as a one-way door.
Sovereignty deserves a direct answer rather than a region name. EU buyers now ask who operates the infrastructure, from where, and under which corporate entity. AWS's European Sovereign Cloud, with its first region in Brandenburg, a separate European parent company and operations restricted to EU-resident personnel, set the reference point that other providers are measured against. Bring that question to your Microsoft account team early and get the response in writing before the design assumes it is settled.
Engagements usually start with a two to three week assessment of your existing Azure estate, pipelines and cost profile, ending in a written platform decision with the operating cost in engineer-hours, an upgrade and exit plan, and a prioritised backlog. Build phases follow from there, and handover is part of the scope: your team should be able to operate and extend the platform without us. If the assessment concludes that a managed platform or plain containers serve you better than the Kubernetes build you came in asking for, that is what the document will say.
Our expertise
- Landing zones and identity
- AKS and Azure Container Apps
- Azure Pipelines and GitHub Actions
- Signed builds and SBOM provenance
- Azure cost management and FinOps
- OpenTelemetry and Azure Monitor
Frequently asked questions
Should we run AKS or Azure Container Apps?
Count the services and the people. For a handful of services owned by one team, Azure Container Apps or App Service usually delivers the same result for far fewer operating hours, and AKS becomes cost you have to justify. AKS earns its place when you need custom scheduling, GPU workloads through Dynamic Resource Allocation, service-mesh routing, many teams sharing one platform, or portability across clouds. We quote the monthly operating cost in engineer-hours for both options before you decide.
What does the EU Cyber Resilience Act require from us on 11 September 2026?
From that date, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents through the CRA Single Reporting Platform, with a 24-hour early warning, a 72-hour notification and a final report within 14 days for vulnerabilities or one month for severe incidents. Settle with your counsel how it reaches products you already have on the EU market. Practically you need an SBOM per build, signed artefacts, an on-call rota and a written submission path to your CSIRT and ENISA. We build that machinery; your legal counsel owns the interpretation.
Do you use Bicep, Terraform or OpenTofu on Azure?
Bicep when the estate is Azure-only and ergonomics matter most, OpenTofu when you want a genuinely open-source tool, Terraform when your organisation already standardised on it. Terraform has been under the Business Source License since August 2023 and remained so after IBM closed its acquisition of HashiCorp on 27 February 2025, so it is no longer accurate to call it open source. Since Pulumi's 4 August 2026 GA of Terraform state support and HCL as a first-class language, this decision is far less binding than it was in 2024.
We are on Heroku. Do we have to move to Azure now?
Not urgently. Heroku moved to a Sustaining Engineering model in February 2026, meaning security, stability and reliability work only, with no new feature development and no new Enterprise contracts for new customers. Existing apps still run and are still patched, and pricing has not changed. The risk is roadmap, not uptime, so plan the exit deliberately. Azure Container Apps is normally the closest-shaped destination; budget most of the effort for add-ons, Postgres, and code that assumes an ephemeral filesystem or a 30-second request limit.
How do you keep Azure costs for AI workloads predictable?
With unit economics rather than monthly clean-ups. We report cost per GPU-hour and per thousand requests, enforce tagging through Azure Policy at deploy time, apply reservations and savings plans where usage is predictable, and wire budget and anomaly alerts to a named owner. This matters more than it used to: 98% of FinOps practitioners now manage AI spend, up from 31% in 2024, while wasted IaaS and PaaS spend rose to 29% according to Flexera's 2026 State of the Cloud Report. We also confirm accelerator capacity and lead time in your target region before the architecture depends on it.
Contacts
We are always happy to talk with you.
Feel free to contact us in any suitable way
Request a quote
Let's discuss your project!
Please, provide us with a brief description of what you
already have and what you are going to achieve.
Mail us contact@brainiacminds.com