From the board-level decision to the platform in production.
A group-wide platform is running, and a board-level decision paper was delivered successfully in August 2026. That combination is what this practice is built on.
Decision papers your board can act on: 5-year TCO on-premises vs. Azure, scenario analysis, migration strategy with wave planning - including the cost traps standard calculators leave out.
Data-center migrations planned and governed along the Microsoft Cloud Adoption Framework: secure landing zones, hub-spoke networking, identity and governance - fully automated with Terraform and Bicep, from assessment to production.
Regulated AI adoption on Azure: AI Foundry platforms, central AI gateways on API Management with token governance, guardrails and role models - so AI reaches production instead of dying as a proof of concept.
Design, automation and governance of API platforms: Terraform modules, Spectral-based linting and multi-region rollouts - most recently as the baseline for 130+ live repositories at HDI.
Zero-trust architectures with Entra ID and Microsoft Defender: identity design, network hardening and security baselines, aligned with regulatory requirements.
High-performance services with .NET 9 and C# 13: data evaluation on Elasticsearch, microservices, containers on AKS and serverless event-driven architectures.
| Year | Client | Role | Scope | Stack |
|---|---|---|---|---|
| 2026 | WEKA Group (Kissing)Media | Cloud Strategy Consultant · Azure |
| Azure MigrateTCOCAFLanding Zone |
| 2025 - now | HDI Versicherung (Hannover)Insurance | Azure Platform Architect · Landing Zones & Governance |
| Landing ZonesAPIM AI-GatewayAI FoundryAzure PolicyTerraform |
| Oct 2024 - 2025 | TRUMPF SE + Co. KGManufacturing | Microsoft Azure Cloud Engineer |
| AzureAWS.NET 9Elasticsearch |
| 2023 - 07/2025 | E.ONEnergy | Azure Enterprise Architect |
| AzureAI FoundryZero-Trust.NET 8C# 13 |
| 2022 - 2023 | GEA GroupManufacturing | Azure Enterprise Architect | Reviewed and enhanced architecture for existing Azure workloads. Designed targeted landing zones, coached developers, led the Azure landing zone project at enterprise scale. | ALZCAFDevOps |
| 2020 - 2021 | Nagel-GroupLogistics | Azure Enterprise Architect | Secure Azure landing zone aligned with Microsoft CAF and regulatory requirements. Modern private networking, guidance for large-scale IaaS/PaaS, IAM and cost management. | CAFIAMFinOps |
| 2019 - 2021 | Versicherungskammer BayernInsurance | Azure Solution Architect | Technical concepts for IAM system integrations and migration. Introduced Azure DevOps for CI/CD, designed cloud-based architectures, authored operating manuals. | AzureDevOpsIAM |
| 2018 - 2021 | E.ON Digital TechnologyEnergy | Cloud Engineer (Microsoft Azure) | Resource-efficient, highly available microservices in Azure using multithreading strategies, under strict security and performance requirements. | Microservices.NETThreading |
| 2019 - 2020 | BMW GroupAutomotive | Cloud Solution Architect |
| ALZServiceNowIaCHybridNetwork |
| 2017 - 2020 | ELO Digital OfficeSoftware | Cloud Solution Architect | Led design and implementation of fully automated Terraform deployments. Hub-Spoke network segments and IT security within a hardened Azure environment. | TerraformHub-SpokeSecurity |
The engagements that shaped the practice. Many more are not listed here, among them Volkswagen, GETEC and LSI Bayern. Every project below has its own detail page in the CV. Download the CV as a PDF →
Architecture decisions are worth what people can actually use afterwards. Three examples where the result was a platform teams worked with every day.
I automated the entire onboarding for a large automotive group. Internal departments ordered landing zones through ServiceNow like a catalogue item. Ordering, approval and security clearance ran as one continuous process, and provisioning was fully handled by infrastructure as code. Every subscription arrived ready to use, with the mandated standard resources already in place. That was 2019, years before platform self-service became a standard topic.
For another automotive group I helped build an internal developer platform. Development teams ordered more than Azure resources there: they received complete project environments, with Git repositories, Azure DevOps structures, working CI/CD pipelines, prescribed repository patterns and managed identities. Anyone starting a project got the governance as a running environment rather than as a document.
For an industrial manufacturer I did not only design the analytics platform, I built the .NET application behind it. Any system or interface can deliver data to it; the platform processes that data under load, stores it on Elasticsearch and serves it back for evaluation. Spanning Azure and AWS.
Alongside the consulting practice I run my own company and ship my own product. Both are a reason to trust the architecture advice: I carry the consequences of my own decisions in production.
Co-Founder & Managing Director · since 2026
B2B SaaS for recurring compliance obligations: website compliance, a legal register and a white-label training academy. Built for organisations without a compliance department.
simplymate.com →Founder, developer and designer · since 2025
A Swift-native Mac and iOS app for Azure Key Vault, on the App Store. Secrets, keys and certificates with a keyboard-first workflow. No cloud backend, no tracking. Designed, built and shipped solo.
keyvault.studio →I work on both levels of a cloud transformation. For executives and CIOs I build honest decision papers: business case, target architecture, migration strategy - including the cost traps standard calculators hide. For platform and engineering teams I then deliver what was decided: landing zones, governed AI platforms on Azure AI Foundry, API platforms and modern .NET engineering. Since 2018 this combination has carried projects for BMW, E.ON, TRUMPF, HDI and GEA. And with KeyVault Studio, my own app on the App Store, I prove that I don't just architect Azure - I build on it.
An amazing Azure architect who has successfully transferred his knowledge to non-technical experts as well as IT architects. Highest recommendations.
Stephan Bail delivered a highly scalable Azure solution meeting E.ON's rigorous quality and safety standards. Consistently professional, with excellent communication.
Current mandate, career at a glance, the engagements on a single spread, and a dedicated detail page for every project: client profile, scope, technology and outcome. In German and English.
Whether it's a business case, a landing zone, a migration or an API platform: tell me about your project - a short intro call will show whether and how I can help.
Send a message →Stephan Bail Prälaturhof 1 83629 Weyarn
Telefon: +49 172 1077570 E-Mail: kontakt@stephanbail.com
Umsatzsteuer-Identifikationsnummer gemäß § 27 a Umsatzsteuergesetz: DE815765712
Stephan Bail
Wir sind nicht bereit oder verpflichtet, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen.
Stephan Bail Prälaturhof 1 83629 Weyarn, Germany Phone: +49 172 1077570 Email: kontakt@stephanbail.com
This website is hosted as a static site on GitHub Pages, a service of GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit the site, GitHub processes technical connection data (such as your IP address) in server logs to deliver the pages and to ensure the security and stability of the service. This processing is based on our legitimate interest in providing a reliable website (Art. 6 (1)(f) GDPR). Details: GitHub Privacy Statement at docs.github.com.
This site does not use cookies, analytics or tracking of any kind. Your language and theme preference are stored solely in your browser's local storage and never leave your device.
All fonts, scripts and images are served from this domain. No third-party CDNs or font services are loaded.
If you contact me by email or phone, I process the data you provide (name, contact details, message) solely to handle your inquiry (Art. 6 (1)(b) GDPR). The data is deleted once the purpose no longer applies and no statutory retention obligations remain.
This site links to external services such as the Apple App Store, keyvault.studio, LinkedIn and GitHub. Their respective privacy policies apply once you follow those links.
You have the right to access, rectification, erasure, restriction of processing, data portability and objection regarding your personal data, as well as the right to lodge a complaint with a supervisory authority (Art. 15-21, 77 GDPR).
