Managed cloud services
Run Azure services through a clear service catalogue and responsibility model.
Sense Cloud provides agreed Azure service-management functions with controlled access, defined severity and escalation rules, transparent ownership, routine reporting, and an exit procedure.
Responsibility model
| Activity | Customer | Swaves | Microsoft | SOC |
|---|---|---|---|---|
| Business priority | A/R | C | I | I |
| Platform engineering | A | R | C | I |
| Azure service platform | I | C | A/R | I |
| Security monitoring | A | C | I | R |
| Incident coordination | A | R | C | R |
R Responsible A Accountable C Consulted I Informed
- Boundary
- Service catalogueCovered resources, activities, and exclusions are listed.
- Access
- Least privilegeDelegation uses customer-approved roles and PIM where available.
- Coverage
- Contract-definedSupport windows and response targets are stated only in the agreement.
Service catalogue
Managed work is limited to named Azure resources and activities.
The catalogue identifies included tasks, request routes, change classes, dependencies, and ownership.
Monitor and triage
Receive agreed Azure Monitor or integrated alerts, enrich context, classify severity, route incidents, and suppress noise through approved tuning.
Service management
Handle incident, request, change, problem, and capacity activities within contracted boundaries and customer change controls.
Protection checks
Inspect scheduled backup results, investigate failures, verify selected restores, and track agreed Defender for Cloud posture items.
Cost and health
Report material consumption changes, budget alerts, capacity signals, service health notices, and agreed optimization items.
Supported service classes
Each resource class receives a named operating schedule.
Coverage is selected per resource and task; inclusion of one service class never implies unrestricted administration of the workload above it.
Virtual machines
- Availability, host, capacity, disk, and backup signals
- Approved Azure configuration and lifecycle changes
- Guest OS patching only when separately listed
PaaS and databases
- Service health, capacity, backup, and maintenance events
- Approved platform configuration changes
- Database administration and schema work only when listed
AKS and application platforms
- Cluster, node pool, ingress, runtime, and platform health
- Planned platform upgrades and configuration changes
- Application code and release ownership remain separate
Network and security services
- Gateway, firewall, NVA, DNS, WAF, and connectivity health
- Rules and routes changed through customer change control
- Vendor licensing and support remain customer-owned unless stated
Onboarding and exit
The service has controlled entry, steady-state routines, and a planned exit.
Access and ownership are reassessed when scope changes.
- 01
Catalogue and baseline
Confirm resources, criticality, contacts, support windows, severity model, dependencies, monitoring, backup, and known issues.
- 02
Delegate access
Use customer-tenant Azure RBAC and PIM, or Azure Lighthouse where suitable, with named roles and expiration controls.
- 03
Activate service
Test alert routing, ticket exchange, escalation, change procedures, communications, and service reporting before acceptance.
- 04
Exit cleanly
Transfer open tickets and runbooks, export agreed records, remove Sense Cloud delegation, verify access removal, and confirm remaining customer actions.
Shared responsibilities
Microsoft, the customer, the Sense Cloud team, and any contracted SOC retain different duties.
The final RACI is service-specific; this table states the usual boundary without replacing the agreement.
| Area | Microsoft | Customer | Sense Cloud team | SOC when contracted |
|---|---|---|---|---|
| Azure platform | Azure service availability and platform maintenance | Tenant configuration and business acceptance | Triage service health impact and coordinate customer actions | No default role |
| Identity and access | Entra and Azure control-plane services | Identity lifecycle, approval, break-glass, and role ownership | Use approved delegated roles and report access issues | Investigate identity threats in contracted scope |
| Workload service | Underlying cloud service by service model | Application behavior, data, users, and business priorities | Perform catalogue tasks for named Azure resources | Security monitoring and response tasks only as contracted |
| Incident escalation | Handle valid Azure support cases | Set severity, authorize business actions, and communicate internally | Triage, coordinate, escalate, and document technical actions | Lead or assist security incident handling when contracted |
Service materials
Managed service artifacts define the work and its current state.
Service levels, hours, channels, and response targets belong in the signed schedule, not generic catalogue copy.
- 01
Service definition
Resource scope, activities, support window, request routes, severity rules, escalation, dependencies, and exclusions.
- 02
RACI and access register
Task ownership, approvers, delegated roles, privileged access method, contacts, and access review dates.
- 03
Runbooks
Alert triage, incident coordination, standard changes, backup failures, capacity events, and Azure support escalation.
- 04
Service report
Incidents, changes, problems, capacity, backup status, posture, cost themes, risks, and agreed actions.
Service fit
Managed services require a stable catalogue and active customer ownership.
A readiness assignment can close monitoring, access, and documentation gaps before activation.
Best suited to
- Azure estates needing repeatable service management
- Teams supplementing internal platform and application ownership
Needed to begin
- Named resources and service owners
- Monitoring, ticketing, severity, and change processes available
- Contracted coverage and escalation terms agreed
Customer responsibilities
- Own business impact, application priorities, and approvals
- Maintain user identities and internal communications
- Fund Azure consumption, support plans, and third-party licenses
Not included by default
- Uncontracted SOC or security incident response
- Implicit around-the-clock coverage or response targets
- Application ownership, Microsoft platform duties, or unlimited project work