The opportunity at a glance
RMIT University’s Azure cloud environment had evolved organically over time, resulting in fragmented subscriptions, manual configurations and controls, an inconsistent security posture, and higher application building and hosting costs. To address this, the university set out to establish an enterprise-grade Azure foundation that is centralised, fully automated, secure and scalable.
RMIT University partnered with Arinco, a trusted Microsoft Partner, to design and implement an Azure Enterprise Landing Zone. The solution was supported by a catalogue of secure-by-default infrastructure-as-code modules that enforce more than 350 security controls and achieve near perfect NIST compliance scores.
The ExpressRoute-integrated platform now delivers continuous compliance through a DevSecOps toolchain. It governs 18 Azure subscriptions across 12 application landing zones, accelerating application delivery, supporting modernisation initiatives and providing a strong foundation for future cloud growth.
About RMIT
RMIT University is a global university of technology, design and enterprise, with a strong focus on practical, industry-connected education and research. The university is ranked in the top 125 globally and 10th in Australia, with recognised strengths in architecture, engineering, computer science and communications.
Headquartered in Melbourne, RMIT supports more than 90,000 students and 12,000 staff worldwide, including a major campus in Hanoi, Vietnam (around 15,000 students) and a growing research and innovation hub in Barcelona, Spain.
The university operates a complex technology environment that must balance innovation, security, compliance and reliability to support teaching, research and enterprise systems.
Business challenge
Delivering world-class research and education requires RMIT University to have strong, reliable infrastructure capabilities. However, the university’s ability to respond to continuously evolving digital needs had been limited by the absence of a secure, optimised and agile Azure platform. Without a standardised approach to cloud deployment, teams were manually provisioning resources, increasing the risk of misconfiguration and security exposure.
Many workloads relied on publicly accessible endpoints and lacked enterprise-grade governance controls. This created challenges in enforcing consistent security standards, meeting compliance requirements and maintaining visibility across the environment. Delivery timelines were also impacted, as teams repeatedly rebuilt infrastructure patterns rather than reusing approved designs.
RMIT required a secure, scalable cloud foundation that would simplify governance, enforce security by default and enable teams to deploy new services more efficiently. The solution also needed to support hybrid connectivity to on-premises systems and provide a clear pathway for modernising legacy applications.
Solution
To address these challenges, RMIT University engaged Arinco to design and implement a secure, enterprise-ready cloud foundation on Azure. Leveraging Arinco’s Azure Done Right™ framework, Arinco delivered an Azure Enterprise Landing Zone that standardised governance, security and connectivity while enabling rapid, compliant application deployment.
Arinco’s Azure Done Right™ framework enabled the rapid delivery of a production ready enterprise landing zone through structured design workshops and immediate implementation. At the beginning of the engagement, focused workshops aligned RMIT stakeholders on governance models, security patterns and networking architecture. This focused design phase enabled immediate CAF-aligned implementation, delivering a production ready enterprise landing zone in weeks rather than months.
Enterprise landing zone foundation
Arinco implemented an Azure Enterprise Landing Zone aligned with Microsoft’s Cloud Adoption Framework. Delivered as the initial phase of the engagement, the platform established consistent management group structures, policy enforcement and operational controls, providing a secure baseline for all Azure workloads.
Secure connectivity and networking
The landing zone incorporated an Azure Virtual WAN networking model and ExpressRoute connectivity. This enabled secure, resilient hybrid connectivity between Azure and on-premises environments while eliminating the need for public exposure of workloads.
Secure-by-default infrastructure-as-code
The platform was built using Terraform, ensuring all infrastructure configurations were version-controlled, repeatable and auditable. Following completion of the core landing zone, Arinco delivered a secure module catalogue over a four-month period, working with RMIT to develop a catalogue of more than 20 reusable Terraform modules, each enforcing private networking and mapped to the Microsoft Cloud Security Benchmark and NIST controls. Automated security and compliance checks were progressively embedded into CI/CD pipelines, ensuring controls were enforced by default rather than applied retrospectively.
Legacy workload enablement
As a subsequent phase over approximately three months, Arinco supported the migration of a business-critical application into the landing zone using the module catalogue. This demonstrated secure deployment patterns and enabling a clear pathway for ongoing application modernisation.
In parallel with delivery, Arinco supported RMIT through knowledge-sharing sessions and collaborative implementation practices, helping build familiarity with the platform and establish a foundation for future capability uplift.
Outcomes
The project delivered a secure, scalable Azure foundation that significantly improved governance, security and delivery efficiency across RMIT University. Key outcomes include:
- Standardised cloud governance: Established a consistent Azure foundation aligned with Microsoft best practices, providing improved visibility and control across 18 Azure subscriptions spanning the platform landing zone and 12 application landing zones.
- Improved security posture: Enforced private networking and eliminated public endpoints by default, significantly reducing exposure and strengthening security across all governed workloads.
- Automated security control enforcement: Embedded over 350 Microsoft Cloud Security Benchmark and NIST controls across more than 20 reusable Terraform modules for Azure resources, with each deployment automatically enforcing 15-25 security requirements per resource type. This eliminated manual security configurations and ensured Microsoft security baselines are met by default.
- Faster, self-service delivery: Enabled teams to independently deploy production-ready Azure workloads in days using pre-approved Terraform modules and automated pipelines, a capability that previously did not exist due to fragmented approaches and lack of standardisation.
- Built-in compliance: Mapped infrastructure controls to Microsoft Cloud Security Benchmark and NIST frameworks, simplifying audit and compliance requirements.
- Reduced operational effort: Eliminated manual provisioning and inconsistent configurations through infrastructure-as-code and standardised patterns.
- Scalable modernisation platform: Provided a secure landing zone with private hybrid connectivity to support Azure Virtual Desktop and the ongoing modernisation of business-critical applications, including Maestro Text, Maestro Media and Maestro News.
With the Azure Enterprise Landing Zone and secure module catalogue now in place, RMIT University now has a strong foundation to onboard future workloads, scale cloud adoption and progress application modernisation as internal cloud capability continues to grow.
