Symptoms:
- Diagrams list servers, IPs, and VNets, but no actionable steps for Azure RBAC, PIM, or Entra group creation.
- The access-setup team can’t translate static topology into identity and role assignments.
- Design deliverables stop at infrastructure layers, leaving identity, security, and automation implicit.
🧩 The Missing Bridge: Implementation Mapping (WHAT → HOW)
DEFINITION: What’s really missing: A translational layer between the “physical design” (WHAT) and the “implementation procedure” (HOW).
What’s really missing: The Missing Link: bridging the WHAT and the HOW since time immemorial (or at least since the last design review). The quest: Somewhere between the "physical design" (WHAT) and the "implementation procedure" (HOW) lies a semi-mythical construct known to project managers as "the missing spec". It speaks all languages, but none fluently.
Static Topology to Dynamic Procedure
The WSxx structure runs cleanly from governance to go-live and beyond.
WS01–WS05 are about making sure the ground is solid;
WS06–WS09 are where the data and reporting magic happens;
WS10–WS12 are delivery, testing, and handover.
The Implementation Translation Layer (ITL) sits in WS01 — bridging the “what” of design and the “how” of implementation so no one is left guessing.
Programme Work Streams (WS00–WS12)
opening one WS closes the others. WS00 starts open.
| Description | Sets the programme up properly — ownership, cadence, RAID, reporting, and a common language across teams. |
|---|---|
| Key Deliverables | PID • Governance Framework • RAID Log • RACI Matrix • Delivery Calendar |
| Candidate Roles & Skills | Programme Manager — planning, steering, risk PMO Lead — cadence, reporting, tooling Change Analyst — comms, impact mapping |
| Student Hook | Like organising a huge school project so everyone knows their job and no one forgets homework. |
| Scenario | Before any migration, PMO sets up templates, channels, and weekly stand-ups so every WS works the same way. |
| Description | Builds the Azure foundations — environments, permissions, Entra groups, certs, connectivity. Produces the Implementation Translation Layer (ITL). |
|---|---|
| Key Deliverables | Environment Build Checklist • ITL (WHAT→HOW) • Access Matrix • Certificate Register |
| Candidate Roles & Skills | Solution Architect — landing zones, standards Azure Engineer — RBAC, subscriptions, policy IDAM Specialist — Entra, PIM, Conditional Access |
| Student Hook | Making sure everyone’s got the right keys to the right rooms — not everyone gets the master key. |
| Scenario | Dev/SIT/UAT built with group-based access; ITL says exactly how to request, approve, and assign roles. |
| Description | Connectivity between tenants, routing, DNS, ExpressRoute, private endpoints, and firewalls. |
|---|---|
| Key Deliverables | Network Design Pack • Firewall & Routing Config • Connectivity Test Plan |
| Candidate Roles & Skills | Network Engineer — IP, subnets, BGP Security Engineer — firewall rules, IDS Infra Architect — topology, resilience |
| Student Hook | Wiring up all the computers so messages know where to go. |
| Scenario | Firewall rules allow Dynamics (Serco) to reach SQL pool (Capita) for controlled test loads. |
| Description | Target apps (Dynamics, SharePoint, Power Platform) are patched, licensed, configured, and ready to integrate. |
|---|---|
| Key Deliverables | Application Readiness Report • Endpoint Register • Integration Access Plan |
| Candidate Roles & Skills | App Owner — configs, licensing Technical Lead — plugins, connectors Release Manager — gates, approvals |
| Student Hook | Making sure the toys work before the game starts. |
| Scenario | Power Platform connectors validated; known plug-ins smoke-tested in UAT. |
| Description | Defines secure data exchange — APIs, Logic Apps, KingswaySoft pipelines — with CI/CD and secrets. |
|---|---|
| Key Deliverables | Integration Design Document • API Catalogue • Connection & Secret Register |
| Candidate Roles & Skills | Integration Architect — patterns, contracts API Developer — REST, OAuth2 DevOps Engineer — pipelines, IaC |
| Student Hook | Building pipes that let different machines talk without shouting. |
| Scenario | Logic App posts nightly updates from Dynamics to Synapse; secrets stored in Key Vault. |
| Description | Enforces BBC InfoSec and UK GDPR: Entra, Conditional Access, PIM, audit, key rotations. |
|---|---|
| Key Deliverables | Security Architecture • IDAM Build Book • Compliance Statement • RBAC Mapping |
| Candidate Roles & Skills | Security Architect — policy, controls Compliance Officer — GDPR, DPIA IDAM Engineer — PIM, CA, audits |
| Student Hook | Setting the rules so no one sneaks into the sweet shop. |
| Scenario | MFA required for admins; PIM used for just-in-time elevation; logs sent to SIEM. |
| Description | Moves data cleanly and provably: extract, transform, load, reconcile, evidence. |
|---|---|
| Key Deliverables | Data Migration Strategy • Entity Mapping • Reconciliation Logs • Migration Runbook |
| Candidate Roles & Skills | Data Architect — design, lineage ETL Developer — SSIS, Python, SQL Test Analyst — data QA, counts |
| Student Hook | Like moving toys from one box to another without losing any pieces. |
| Scenario | Legacy SQL → staging → Dataverse; counts checked at each hop; exceptions logged and fixed. |
| Description | Masks/pseudonymises production data for safe non-prod testing while keeping realism. |
|---|---|
| Key Deliverables | Concealment Rules Catalogue • Algorithm Register • KingswaySoft Pipeline Spec |
| Candidate Roles & Skills | Data Engineer — hashing, tokenisation Data Privacy Officer — policy, risk Security Architect — key mgmt, KMS |
| Student Hook | Changing real names into made-up ones so testers can play safely. |
| Scenario | Names and postcodes swapped with deterministic fakes; audit shows what changed (not who). |
| Description | Rebuilds reporting: Synapse, models, Power BI; validates meaning and performance. |
|---|---|
| Key Deliverables | BI Design Pack • Dataset Catalogue • Visual Validation Log |
| Candidate Roles & Skills | BI Architect — modelling, governance Data Modeller — star, SCD Power BI Dev — DAX, visuals |
| Student Hook | Drawing pictures that tell the story of what’s happening. |
| Scenario | Legacy KPIs rebuilt in Power BI; refresh via pipelines; numbers reconcile to finance baseline. |
| Description | Migrates and republishes SSRS RDLs; updates data sources; aligns permissions. |
|---|---|
| Key Deliverables | RDL Inventory • Publishing Runbook • Verification Checklist |
| Candidate Roles & Skills | Report Developer — RDL, datasets DBA — connections, performance Release Manager — scheduling |
| Student Hook | Copying old drawings onto new paper without smudging them. |
| Scenario | Finance RDLs re-pointed to Synapse SQL; shared data sources; folder-level RBAC applied. |
| Description | Builds the playbook for go-live: sequence, timing, checkpoints, rollback. Proves it end-to-end. |
|---|---|
| Key Deliverables | Cutover Plan • Dress Rehearsal Report • Issue Log |
| Candidate Roles & Skills | Cutover Manager — choreography Release Lead — gates, comms Tech Leads — scripts, rollback |
| Student Hook | Practising the big show before opening night. |
| Scenario | Full trial run with checkpoints and a timed rollback drill; lessons logged into the plan. |
| Description | Runs SIT, UAT, NF testing; proves systems and data behave; defects tracked and closed. |
|---|---|
| Key Deliverables | Test Plan • Test Scripts • Defect Log • QA Sign-off |
| Candidate Roles & Skills | Test Manager — strategy, cycles Data QA Analyst — reconciliations Business Tester — acceptance |
| Student Hook | Checking your homework before handing it in. |
| Scenario | UAT verifies contacts in Dynamics, reconciles row counts and key KPIs to legacy. |
| Description | Stabilises after go-live, resolves issues, hands over to BAU with documentation and KT. |
|---|---|
| Key Deliverables | Hypercare Plan • Transition Checklist • Knowledge Transfer Pack |
| Candidate Roles & Skills | Service Transition Lead — ITIL, KT Support Engineer — monitoring, fixes Knowledge Manager — runbooks |
| Student Hook | Making sure the new toy keeps working after Christmas morning. |
| Scenario | Runbooks handed to BAU; job runs monitored; user tickets triaged and closed within SLOs. |