Modern
recommendedBalanced, photo-led, two-column
The default. Photo sidebar, clean main column, recruiter-friendly density. The right pick when you don't know who's reading.
LOCATION
Weyarn, DE
REGION
germanywestcentral
SINCE
8+ yrs on Azure
CLOCK
····
Freelance · Cloud Architecture, Governance & AI Enablement · since 2018
Microsoft Azure
Architect.
Available nowDay rate on requestRemote · DACH / EU
~ 8+ yrs on Azure · business case to code · DE / EN ~
From “what will the cloud really cost us?” to a platform running in production: I help executive teams make sound Azure decisions - and then build what the paper promised. Landing zones, API platforms carrying 130+ APIs, governed AI adoption with Azure AI Foundry, modern .NET. Based near Munich, working with enterprises and the upper mid-market, remote across DACH and the EU.
clients include:BMW GroupE.ONTRUMPFHDIWEKAGEA GroupNagel-GroupVersicherungskammer BayernELO Digital Office
About
§01 / profile
Microsoft Azure Architect - from the board-level decision to the platform in production.
I work on both levels of a cloud transformation. For executives and CIOs I build honest decision papers: business case, target architecture, migration strategy - including the cost traps standard calculators hide. For platform and engineering teams I then deliver what was decided: landing zones, governed AI platforms on Azure AI Foundry, API platforms and modern .NET engineering. Since 2018 this combination has carried projects for BMW, E.ON, TRUMPF, HDI and GEA. And with KeyVault Studio, my own app on the App Store, I prove that I don't just architect Azure - I build on it.
8+
Years on Azure
10+
Enterprise projects
130+
APIs on platform
2
Companies founded
Services
What I do
§02 / modules
01
Cloud Strategy & Business Case
Decision papers your board can act on: 5-year TCO on-premises vs. Azure, scenario analysis, migration strategy with wave planning - including the cost traps standard calculators leave out.
02
Migration & Landing Zones
Data-center migrations planned and governed along the Microsoft Cloud Adoption Framework: secure landing zones, hub-spoke networking, identity and governance - fully automated with Terraform and Bicep, from assessment to production.
03
AI Enablement & AI Governance
Regulated AI adoption on Azure: AI Foundry platforms, central AI gateways on API Management with token governance, guardrails and role models - so AI reaches production instead of dying as a proof of concept.
04
Azure API Management at scale
Design, automation and governance of API platforms: Terraform modules, Spectral-based linting and multi-region rollouts - most recently as the baseline for 130+ live repositories at HDI.
05
Security Engineering
Zero-trust architectures with Entra ID and Microsoft Defender: identity design, network hardening and security baselines, aligned with regulatory requirements.
06
Modern .NET Engineering
High-performance services with .NET 9 and C# 13: data evaluation on Elasticsearch, microservices, containers on AKS and serverless event-driven architectures.
Project Experience
Recent engagements
§03 / engagements
Year
Client
Role
Scope
Stack
2026 - now
WEKA Group (Kissing)Media
Cloud Strategy Consultant · Azure
- ▸Cloud business case for the executive board: 5-year TCO on-premises vs. Azure across 300+ servers
- ▸Well-Architected target architecture (landing zone) and dependency-based migration wave planning
- ▸Interactive scenario dashboard as the decision basis (reserved instances, Hybrid Benefit, regions)
Azure MigrateTCOCAFLanding Zone
2025 - now
HDI Versicherung (Hannover)Insurance
Azure Platform Architect · Landing Zones & Governance
- ▸Central platform structures: landing zones, subscription and provisioning automation, enterprise-wide governance
- ▸Central AI gateway on Azure API Management with token governance - adopted early in a Microsoft APIM AI services pilot
- ▸Landing zones and governance for AI workloads on Azure AI Foundry: guardrails, Azure Policy, role models
- ▸Unified APIM baseline across 130+ live repositories, built on reusable Terraform modules
Landing ZonesAPIM AI-GatewayAI FoundryAzure PolicyTerraform
Oct 2024 - 2025
TRUMPF SE + Co. KGManufacturing
Microsoft Azure Cloud Engineer
- ▸Leading analytics initiatives in a multi-cloud landscape (Azure + AWS)
- ▸High-performance .NET 8 / .NET 9 and C# 13 for data evaluation on Elasticsearch
- ▸Scalable PaaS architectures enabling data-driven insights across cloud environments
AzureAWS.NET 9Elasticsearch
2023 - 07/2025
E.ONEnergy
Azure Enterprise Architect
- ▸Target architecture and roadmap for the Heartbeat Information Router (HIR), originally engineered by me
- ▸Introduced Azure AI Foundry as the group-wide basis for AI use cases: reference architecture and AI governance (RAG, grounding, evaluation)
- ▸Zero-trust security architecture and reviews along the Azure Well-Architected Framework
AzureAI FoundryZero-Trust.NET 8C# 13
2022 - 2023
GEA GroupManufacturing
Azure Enterprise Architect
Reviewed and enhanced architecture for existing Azure workloads. Designed targeted landing zones, coached developers, led the Azure landing zone project at enterprise scale.
ALZCAFDevOps
2020 - 2021
Nagel-GroupLogistics
Azure Enterprise Architect
Secure Azure landing zone aligned with Microsoft CAF and regulatory requirements. Modern private networking, guidance for large-scale IaaS/PaaS, IAM and cost management.
CAFIAMFinOps
2019 - 2021
Versicherungskammer BayernInsurance
Azure Solution Architect
Technical concepts for IAM system integrations and migration. Introduced Azure DevOps for CI/CD, designed cloud-based architectures, authored operating manuals.
AzureDevOpsIAM
2018 - 2021
E.ON Digital TechnologyEnergy
Cloud Engineer (Microsoft Azure)
Resource-efficient, highly available microservices in Azure using multithreading strategies, under strict security and performance requirements.
Microservices.NETThreading
2019 - 2020
BMW GroupAutomotive
Cloud Solution Architect
Designed and implemented the landing zone architecture for BMW's global Azure environment. Hybrid cloud security, hyperscaler network strategy.
ALZHybridNetwork
2017 - 2020
ELO Digital OfficeSoftware
Cloud Solution Architect
Led design and implementation of fully automated Terraform deployments. Hub-Spoke network segments and IT security within a hardened Azure environment.
TerraformHub-SpokeSecurity
Enterprise references from 2017 onwards. Full CV on request.
Entrepreneurship
§04 / startup
2020 - 2023
Co-Founder & CEO
Cloud Business Group (CBG IT GmbH)
Responsible for strategy development, governance and driving business growth through cloud-focused initiatives.
My Product
KeyVault Studio
§05 / product
built by me
Founder · Developer · Designer
A Swift-native Mac and iOS app for Azure Key Vault. Built by an Azure architect, for Azure practitioners.
KeyVault Studio is my own commercial product on the App Store. I built it because I felt the pain myself: every feature solves a problem I hit in my day job as an Azure architect. Managing secrets across dozens of tenants, rotating keys without breaking production, diffing certificate versions - the things Azure people actually do, without browser detours or tab overload. Designed, built and shipped solo, entirely on Apple's native platforms.
Proof that I don't just architect Azure - I build on it.
- ▸Native macOS and iOS, made for Apple Silicon
- ▸Secrets, keys and certificates with a keyboard-first workflow
- ▸Multi-tenant support, Entra ID sign-in, on-device AI assistance
- ▸No cloud backend, no tracking - your secrets never leave your control
Tech stack
SwiftSwiftUImacOS + iOSMSALCryptoKitOn-device AI
Skills
Technical proficiency
§06 / competence
Azure Architecture & Landing Zones
since 2017 · BMW, GEA, Nagel-Group
Azure API Management (APIM)
130+ APIs · AI gateway · HDI
Azure AI Foundry & AI Governance
AI gateway · token governance · RAG
Cloud Strategy & Business Cases
TCO models · CAF · wave planning
C# / .NET 8 & 9
since 2018 · E.ON, TRUMPF
IaC with Terraform & Bicep
since 2017 · fully automated deployments
DevSecOps & CI/CD
Azure DevOps · GitHub Actions · Spectral
Multi-Cloud (Azure & AWS)
analytics workloads · Elasticsearch
Testimonial
§07 / feedback
Amazing Azure architect who has successfully transferred his knowledge to non-technical experts as well as IT architects. Highest recommendations!
Walter Wirl, Cancom
CV
Pick the CV that suits the role
§08 / cv
Three takes on the same résumé, all rendered fresh from a single source - pick the one that fits your audience. Every PDF is generated from code, not from a designer's leftovers, so what you download is identical to what you preview.
Executive
Editorial serif, magazine layout
Warm paper, italic accents, drop cap on the lead. Designed for boardroom-style hand-overs and senior stakeholders.
Technical
Terminal aesthetic, mono headlines
Same content, engineer-targeted typography. Useful for technical interviews and platform-engineering hiring panels.
Contact
§09 / handshake
Let's ship your platform.
Whether it's a business case, a landing zone, a migration or an API platform: tell me about your project - a short intro call will show whether and how I can help.
Send a message →● contact.json● live
email:
phone:
location:
Weyarn, Germany
linkedin:
github:
Impressum
Angaben gemäß § 5 TMG
Stephan Bail Prälaturhof 1 83629 Weyarn
Kontakt
Telefon: +49 172 1077570 E-Mail: kontakt@stephanbail.com
Umsatzsteuer-ID
Umsatzsteuer-Identifikationsnummer gemäß § 27 a Umsatzsteuergesetz: DE815765712
Redaktionell verantwortlich
Stephan Bail
Verbraucherstreitbeilegung / Universalschlichtungsstelle
Wir sind nicht bereit oder verpflichtet, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen.
Privacy Policy
Controller
Stephan Bail Prälaturhof 1 83629 Weyarn, Germany Phone: +49 172 1077570 Email: kontakt@stephanbail.com
Hosting
This website is hosted as a static site on GitHub Pages, a service of GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit the site, GitHub processes technical connection data (such as your IP address) in server logs to deliver the pages and to ensure the security and stability of the service. This processing is based on our legitimate interest in providing a reliable website (Art. 6 (1)(f) GDPR). Details: GitHub Privacy Statement at docs.github.com.
No cookies, no tracking
This site does not use cookies, analytics or tracking of any kind. Your language and theme preference are stored solely in your browser's local storage and never leave your device.
Fonts and assets
All fonts, scripts and images are served from this domain. No third-party CDNs or font services are loaded.
Contact
If you contact me by email or phone, I process the data you provide (name, contact details, message) solely to handle your inquiry (Art. 6 (1)(b) GDPR). The data is deleted once the purpose no longer applies and no statutory retention obligations remain.
External links
This site links to external services such as the Apple App Store, keyvault.studio, LinkedIn and GitHub. Their respective privacy policies apply once you follow those links.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection regarding your personal data, as well as the right to lodge a complaint with a supervisory authority (Art. 15-21, 77 GDPR).