Work

Owned · CLOUD DEPLOYMENT & COST

Multi-Tenant Admin Platform on Azure

CIPP is an open-source project. I did not write it. What I did was put it into our Azure subscription, run it, and then move it onto Linux once it was clear the Windows VM cost more than the workload justified.

Monthly run cost down from roughly $60 to about $20

  • Microsoft Azure
  • Linux
  • Windows Server
  • Entra app registrations
  • Microsoft Graph
  • Backup & restore

What this is, and what it is not

CIPP is a community-maintained tool for administering many Microsoft 365 tenants from one place. The engineering here is deployment and operations, not product design. I evaluated it, stood it up on infrastructure we control, and kept it running.

Initial deployment

The first build ran on a Windows VM in our own Azure subscription. That got the platform into production and under our own identity controls rather than someone else's hosting.

  • Application registration scoped to the permissions actually used rather than the permissive default set.
  • Administrative access placed behind identity controls, with the audit trail retained on infrastructure we control.
  • Backup and restore path defined and tested, so a bad upgrade is a recovery rather than a rebuild.

Why it moved to Linux

The workload did not need Windows. It needed a runtime, a reverse proxy, and somewhere to keep state. Paying for a Windows VM to host that meant paying for licensing the application never used.

The conversion followed a documented procedure rather than being improvised, and the existing configuration and tenant connections carried over. Same platform, same team workflow, a smaller and cheaper VM underneath it.

  • Backup taken and the restore path confirmed before the move, since the rollback plan matters more than the migration steps.
  • Tenant connections verified after the cutover rather than assumed intact.
  • Monthly cost for the workload went from roughly $60 to about $20.

Ongoing

Upstream releases are staged and validated before they reach the live instance. Applying updates blind to a system with this reach is not a maintenance policy, and it matters more with a tool you do not control the release cadence of.

How it fits together

  1. Open-source platform community maintained, not written here
  2. Windows VM in Azure first production deployment, under our own identity controls
  3. Workload reviewed no Windows-specific dependency in the stack
  4. Converted to Linux documented procedure, configuration and tenant connections carried over
  5. ~$60/mo to ~$20/mo same platform, smaller VM, unchanged team workflow

Same platform and the same tenant connections, on a runtime that costs a third as much.

Evidence

Screenshots are from running systems. Client names, user identities, addresses, and financial values are redacted.

Administration console covering the Microsoft 365 portion of the environment: 25 tenants, 522 users, 401 mailboxes, and 87 Intune-enrolled devices. These are Microsoft 365 figures and do not represent total client count or total endpoint inventory.
Administration console covering the Microsoft 365 portion of the environment: 25 tenants, 522 users, 401 mailboxes, and 87 Intune-enrolled devices. These are Microsoft 365 figures and do not represent total client count or total endpoint inventory.