02case study
Enterprise Hybrid Cloud Landing Zone & Migration (GATX India)
April 2025 - PresentWebsite
100%standing credentials eliminated
0reachable public assets
2.8 TBmigrated with zero data loss
Overview
Codified a zero-public-IP Azure landing zone in Bicep (4 zoned subnets, deny-all NSGs, Private Endpoints), eliminating 100% of standing credentials and reducing the attack surface to 0 reachable public assets, validated by Microsoft Defender. Operates an OIDC-federated GitOps pipeline promoting SHA-tagged containers across 30+ deployments a month. Migrated 2.8 TB of on-prem SharePoint data to M365 with 0 data loss using a throttling-aware, multi-threaded Python engine (MSAL, REST APIs) that recovers gracefully from 429/503 tenant responses, alongside MuleSoft API and Intune MDM integration.
Stack map
The declared stack, sorted into the layers these tools belong to. It assembles as you scroll.
Deliverybuild & release03
BicepGitOpsOIDC Federation
Edgeingress & network02
Private EndpointsNSGs
Computeruntime01
Python
Securityposture02
MSALIntune
Platformcloud03
AzureMicrosoft 365MuleSoft