Symptoms:
- Diagrams list servers, IPs, and VNets, but no actionable steps for Azure RBAC, PIM, or Entra group creation.
- The access-setup team can’t translate static topology into identity and role assignments.
- Design deliverables stop at infrastructure layers, leaving identity, security, and automation implicit.
🧩 The Missing Bridge: Implementation Mapping (WHAT → HOW)
DEFINITION: What’s really missing: A translational layer between the “physical design” (WHAT) and the “implementation procedure” (HOW).
What’s really missing: The Missing Link: bridging the WHAT and the HOW since time immemorial (or at least since the last design review). The quest: Somewhere between the "physical design" (WHAT) and the "implementation procedure" (HOW) lies a semi-mythical construct known to project managers as "the missing spec". It speaks all languages, but none fluently.
Static Topology 2 Dynamic Procedure
The WSxx structure runs cleanly from governance to go-live and beyond.
WS01–WS05 are about making sure the ground is solid;
WS06–WS09 are where the data and reporting magic happens;
WS10–WS12 are delivery, testing, and handover.
The Implementation Translation Layer (ITL) sits in WS01 — bridging the “what” of design and the “how” of implementation so no one is left guessing.
Programme Work Streams (WS00–WS12)
Script-free accordion: opening one WS closes the others. WS00 starts open.
| Description | Sets the programme up properly — ownership, cadence, RAID, reporting, and a common language across teams. |
|---|---|
| Key Deliverables | PID • Governance Framework • RAID Log • RACI Matrix • Delivery Calendar |
| Candidate Roles & Skills | Programme Manager — planning, steering, risk PMO Lead — cadence, reporting, tooling Change Analyst — comms, impact mapping |
| Student Hook | Like organising a huge school project so everyone knows their job and no one forgets homework. |
| Scenario | Before any migration, PMO sets up templates, channels, and weekly stand-ups so every WS works the same way. |
| Description | Builds the Azure foundations — environments, permissions, Entra groups, certs, connectivity. Produces the Implementation Translation Layer (ITL). |
|---|---|
| Key Deliverables | Environment Build Checklist • ITL (WHAT→HOW) • Access Matrix • Certificate Register |
| Candidate Roles & Skills | Solution Architect — landing zones, standards Azure Engineer — RBAC, subscriptions, policy IDAM Specialist — Entra, PIM, Conditional Access |
| Student Hook | Making sure everyone’s got the right keys to the right rooms — not everyone gets the master key. |
| Scenario | Dev/SIT/UAT built with group-based access; ITL says exactly how to request, approve, and assign roles. |
| Description | Connectivity between tenants, routing, DNS, ExpressRoute, private endpoints, and firewalls. |
|---|---|
| Key Deliverables | Network Design Pack • Firewall & Routing Config • Connectivity Test Plan |
| Candidate Roles & Skills | Network Engineer — IP, subnets, BGP Security Engineer — firewall rules, IDS Infra Architect — topology, resilience |
| Student Hook | Wiring up all the computers so messages know where to go. |
| Scenario | Firewall rules allow Dynamics (Serco) to reach SQL pool (Capita) for controlled test loads. |
| Description | Target apps (Dynamics, SharePoint, Power Platform) are patched, licensed, configured, and ready to integrate. |
|---|---|
| Key Deliverables | Application Readiness Report • Endpoint Register • Integration Access Plan |
| Candidate Roles & Skills | App Owner — configs, licensing Technical Lead — plugins, connectors Release Manager — gates, approvals |
| Student Hook | Making sure the toys work before the game starts. |
| Scenario | Power Platform connectors validated; known plug-ins smoke-tested in UAT. |
| Description | Defines secure data exchange — APIs, Logic Apps, KingswaySoft pipelines — with CI/CD and secrets. |
|---|---|
| Key Deliverables | Integration Design Document • API Catalogue • Connection & Secret Register |
| Candidate Roles & Skills | Integration Architect — patterns, contracts API Developer — REST, OAuth2 DevOps Engineer — pipelines, IaC |
| Student Hook | Building pipes that let different machines talk without shouting. |
| Scenario | Logic App posts nightly updates from Dynamics to Synapse; secrets stored in Key Vault. |
| Description | Enforces BBC InfoSec and UK GDPR: Entra, Conditional Access, PIM, audit, key rotations. |
|---|---|
| Key Deliverables | Security Architecture • IDAM Build Book • Compliance Statement • RBAC Mapping |
| Candidate Roles & Skills | Security Architect — policy, controls Compliance Officer — GDPR, DPIA IDAM Engineer — PIM, CA, audits |
| Student Hook | Setting the rules so no one sneaks into the sweet shop. |
| Scenario | MFA required for admins; PIM used for just-in-time elevation; logs sent to SIEM. |
| Description | Moves data cleanly and provably: extract, transform, load, reconcile, evidence. |
|---|---|
| Key Deliverables | Data Migration Strategy • Entity Mapping • Reconciliation Logs • Migration Runbook |
| Candidate Roles & Skills | Data Architect — design, lineage ETL Developer — SSIS, Python, SQL Test Analyst — data QA, counts |
| Student Hook | Like moving toys from one box to another without losing any pieces. |
| Scenario | Legacy SQL → staging → Dataverse; counts checked at each hop; exceptions logged and fixed. |
| Description | Masks/pseudonymises production data for safe non-prod testing while keeping realism. |
|---|---|
| Key Deliverables | Concealment Rules Catalogue • Algorithm Register • KingswaySoft Pipeline Spec |
| Candidate Roles & Skills | Data Engineer — hashing, tokenisation Data Privacy Officer — policy, risk Security Architect — key mgmt, KMS |
| Student Hook | Changing real names into made-up ones so testers can play safely. |
| Scenario | Names and postcodes swapped with deterministic fakes; audit shows what changed (not who). |
| Description | Rebuilds reporting: Synapse, models, Power BI; validates meaning and performance. |
|---|---|
| Key Deliverables | BI Design Pack • Dataset Catalogue • Visual Validation Log |
| Candidate Roles & Skills | BI Architect — modelling, governance Data Modeller — star, SCD Power BI Dev — DAX, visuals |
| Student Hook | Drawing pictures that tell the story of what’s happening. |
| Scenario | Legacy KPIs rebuilt in Power BI; refresh via pipelines; numbers reconcile to finance baseline. |
| Description | Migrates and republishes SSRS RDLs; updates data sources; aligns permissions. |
|---|---|
| Key Deliverables | RDL Inventory • Publishing Runbook • Verification Checklist |
| Candidate Roles & Skills | Report Developer — RDL, datasets DBA — connections, performance Release Manager — scheduling |
| Student Hook | Copying old drawings onto new paper without smudging them. |
| Scenario | Finance RDLs re-pointed to Synapse SQL; shared data sources; folder-level RBAC applied. |
| Description | Builds the playbook for go-live: sequence, timing, checkpoints, rollback. Proves it end-to-end. |
|---|---|
| Key Deliverables | Cutover Plan • Dress Rehearsal Report • Issue Log |
| Candidate Roles & Skills | Cutover Manager — choreography Release Lead — gates, comms Tech Leads — scripts, rollback |
| Student Hook | Practising the big show before opening night. |
| Scenario | Full trial run with checkpoints and a timed rollback drill; lessons logged into the plan. |
| Description | Runs SIT, UAT, NF testing; proves systems and data behave; defects tracked and closed. |
|---|---|
| Key Deliverables | Test Plan • Test Scripts • Defect Log • QA Sign-off |
| Candidate Roles & Skills | Test Manager — strategy, cycles Data QA Analyst — reconciliations Business Tester — acceptance |
| Student Hook | Checking your homework before handing it in. |
| Scenario | UAT verifies contacts in Dynamics, reconciles row counts and key KPIs to legacy. |
| Description | Stabilises after go-live, resolves issues, hands over to BAU with documentation and KT. |
|---|---|
| Key Deliverables | Hypercare Plan • Transition Checklist • Knowledge Transfer Pack |
| Candidate Roles & Skills | Service Transition Lead — ITIL, KT Support Engineer — monitoring, fixes Knowledge Manager — runbooks |
| Student Hook | Making sure the new toy keeps working after Christmas morning. |
| Scenario | Runbooks handed to BAU; job runs monitored; user tickets triaged and closed within SLOs. |