SMB Ready Foundation

Deploy a compliant Azure landing zone for SMB customers in under an hour — hub-spoke networking, governance policies, and four cost-tiered scenarios, all from a single command.

Quick Start Partner Onboarding View on GitHub

For partner consultants

Pick your path

Three entry points depending on where you are with your SMB customer engagement.

New to SMB Ready Foundation

Learn what problem this repo solves for partners running VMware-to-Azure migrations across many SMB customers.

Understand the pattern

Deploying now

Compare the four deployment scenarios, pick one, and run azd up against a customer subscription.

Compare scenarios

Operating an existing env

Post-deployment operations — monitoring, backup, compliance, cost, teardown.

Open runbook

Why SMB Ready Foundation

Engineered for repeatable SMB delivery

Four Cost-tiered deployment scenarios

Dual Bicep and Terraform tracks

Policy Governance built in at MG + subscription scope

One Command to deploy: `azd up`

Deployment scenarios

Four sizes, one architecture

Every scenario shares the same hub-spoke topology and governance baseline — you only add what the customer actually needs.

Baseline

~$48 / month

Hub-spoke networking, Bastion, Private DNS, core ops. Minimum viable landing zone.

Firewall

~$336 / month

Adds Azure Firewall Basic with availability-zone deployment for egress filtering and threat intelligence alerts.

VPN

~$187 / month

Adds VpnGw1AZ zone-redundant S2S VPN gateway for customer on-premises hybrid connectivity.

Full

~$476 / month

Firewall + VPN together — the hardened scenario for customers with compliance or hybrid requirements.

Architecture at a glance

Hub-spoke with governance built in

SMB Ready Foundation full architecture — hub-spoke with Firewall, VPN, Bastion, and shared operations

See all architecture diagrams →

Next steps