Private corporate batches, live online cohorts and 1-on-1 mentoring in the Microsoft infrastructure stack — Azure, Windows Server, Active Directory, PowerShell and Azure DevOps — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches the Microsoft stack as one system rather than as separate certifications — Entra ID and Active Directory identity first, then the Azure resource hierarchy and RBAC that everything else inherits from, then PowerShell and Bicep as the two languages that describe it, and finally Azure DevOps pipelines that deploy it. Sessions cover the seams most courses avoid: hybrid identity with Entra Connect, managed identity versus service principal, Azure Policy that denies rather than audits, and reading Azure Monitor with KQL when a deployment silently succeeded but the workload did not.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Microsoft that means a trainer who has run it in production — the Microsoft infrastructure stack — Azure, Windows Server, Active Directory, PowerShell and Azure DevOps — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Microsoft batchMicrosoft is not one product to an infrastructure engineer — it is a stack that starts at the operating system and runs all the way to the cloud control plane. In practice that means Windows Server and Active Directory on the estate side, Azure and Microsoft Entra ID on the cloud side, PowerShell as the automation language that spans both, and Azure DevOps or GitHub Actions as the delivery pipeline that ships changes into either.
The Azure half is organised as a hierarchy: management groups, subscriptions, resource groups and resources, with role-based access control and Azure Policy applied at each level. Identity is Entra ID rather than a network perimeter, so managed identities, service principals and conditional access decide what a workload can reach. Infrastructure is expressed as ARM templates, Bicep or the Terraform azurerm provider; compute lands on virtual machine scale sets, App Service, Azure Functions or AKS; and Azure Monitor with Log Analytics and KQL is where you find out what actually happened.
The on-premises half has not gone away. Most organisations run a hybrid estate — domain controllers, Group Policy, file and print, SQL Server, Hyper-V or VMware underneath — connected to Azure through Entra Connect, Azure Arc and site-to-site networking. The engineering skill that Microsoft shops hire for is operating both halves as one system: consistent identity, consistent automation in PowerShell and Bicep, consistent pipelines, and one place to look when something breaks.
Azure is the second-largest public cloud and the default landing zone for organisations that already run Windows, Active Directory and SQL Server, which is most large enterprises. That makes Microsoft skills unusual in one respect: the demand is rarely for cloud alone. Employers want engineers who can move a workload from a domain-joined virtual machine into a subscription without breaking identity, licensing or backup.
At the same time the automation expectation has moved. Clicking through the portal is no longer an acceptable delivery method for anything that has to be reproduced, so Bicep, PowerShell modules, Azure DevOps pipelines and Azure Policy have become the working surface rather than an advanced topic. Landing zones, managed identities and policy-as-code are now entry requirements on Azure platform roles.
The gap in the market is depth across the seam. Plenty of engineers know Azure portal basics or Windows administration; far fewer can design an Entra ID model, express the estate in Bicep, wire it into a pipeline and prove the result in KQL.
An honest map of the portfolio before any hands-on work: which parts are operating system, which are cloud, which are identity, which are delivery, and which are legacy that still pays the bills. Where Azure, Windows Server, System Center, Intune and Azure DevOps each begin and end, and how a hybrid estate is actually wired.
Topics: The portfolio in layers: OS, identity, cloud, delivery, management · Hybrid estates and what stays on-premises and why · Licensing models that change architecture decisions · Azure regions, availability zones and paired regions · Choosing between IaaS, PaaS and container hosting · Where Azure Arc extends the control plane outward
The layer everything else in a Microsoft shop inherits. Domain and forest structure, sites and replication, DNS as an AD dependency, Group Policy processing order and precedence, and the delegation model that decides who can change what. Then the server roles that carry most enterprise workloads.
Topics: Forests, domains, OUs and trust relationships · Sites, replication topology and DNS dependencies · Group Policy processing order, loopback and WMI filtering · Delegation, tiered admin and privileged access · Core roles: DNS, DHCP, file services, certificate services · Hyper-V and failover clustering fundamentals
PowerShell is the connective tissue of the stack, and treating it as a scripting afterthought is why Microsoft automation rots. The object pipeline, modules and scopes, remoting, error handling, and the difference between a script someone ran once and a module a team can depend on.
Topics: The object pipeline and why it is not text · Cmdlets, functions, modules and the module path · PowerShell Remoting, sessions and JEA endpoints · Error handling: terminating vs non-terminating, try/catch, ErrorAction · The Az module: authentication, contexts and subscriptions · Pester tests and script signing · Desired State Configuration and where it still applies
The decisions that are expensive to reverse. The management group and subscription hierarchy, resource group boundaries, Entra ID as the identity plane, role assignments and custom roles, and the difference between control-plane and data-plane permissions that catches almost everyone once.
Topics: Management groups, subscriptions and resource groups · Microsoft Entra ID: users, groups, app registrations, service principals · Managed identities: system-assigned vs user-assigned · RBAC scopes, inheritance and custom role definitions · Control plane vs data plane permissions · Conditional access and privileged identity management · Hybrid identity with Entra Connect and password hash vs pass-through
The resources workloads actually land on. Virtual networks, subnets, network security groups, private endpoints and DNS resolution — which is where most Azure connectivity problems live. Then compute options, storage tiers and redundancy, and the managed data services that replace self-hosted SQL Server.
Topics: VNets, subnets, NSGs, route tables and peering · Private endpoints, service endpoints and private DNS zones · VM sizing, scale sets, availability zones and maintenance · App Service, Functions and Container Apps · Storage accounts: tiers, redundancy, lifecycle and SAS · Azure SQL, SQL Managed Instance and migrating from SQL Server · Key Vault for secrets, keys and certificates
Portal clicks do not survive an audit or a rebuild. ARM template semantics, Bicep as the language most teams should actually write, modules and registries, deployment scopes and stacks, what-if previews, and the Terraform azurerm provider for teams standardising across clouds.
Topics: ARM template anatomy and why Bicep exists · Bicep syntax: parameters, variables, modules, loops, conditions · Deployment scopes: tenant, management group, subscription, resource group · what-if, incremental vs complete mode and deployment history · Bicep registries and reusable module libraries · Terraform azurerm: state, backends and authentication · Azure Policy and deploy-if-not-exists remediation
How change reaches the platform. Azure Repos and Boards where they are in use, YAML pipelines with stages and templates, environments and approval gates, agent pools and self-hosted agents, artifact feeds, and workload identity federation so pipelines stop carrying long-lived secrets.
Topics: YAML pipelines: stages, jobs, steps, templates and variable groups · Environments, approvals and deployment gates · Service connections and workload identity federation (OIDC) · Microsoft-hosted vs self-hosted agents and scale-set agents · Azure Artifacts feeds and package promotion · GitHub Actions equivalents and when to choose which · Deploying Bicep and containers from a pipeline
Kubernetes as Azure delivers it. Cluster and node pool design, the networking model choice that cannot be changed later, Entra-integrated RBAC, workload identity for pod-level access to Azure resources, ingress and certificate management, and upgrades that do not take the platform down.
Topics: Cluster architecture, node pools and system vs user pools · Azure CNI vs kubenet and the IP planning consequences · Entra ID integration and Kubernetes RBAC · Workload identity and Key Vault CSI driver · Ingress, Application Gateway and certificate automation · Cluster and node image upgrades, surge settings and PDBs · Azure Container Registry, image scanning and private clusters
The part that decides whether the platform is trusted. Azure Monitor's data model, Log Analytics workspace design and retention costs, KQL for real investigation, alert rules and action groups, Defender for Cloud posture management, and the cost controls that keep a subscription from becoming a finance conversation.
Topics: Azure Monitor metrics, logs, diagnostic settings and data flow · Log Analytics workspace design, retention and ingestion cost · KQL: where, summarize, join, render and time-series operators · Alert rules, action groups and alert noise reduction · Application Insights for application-level telemetry · Microsoft Defender for Cloud and secure score · Cost Management, budgets, tagging policy and reservation planning
The newest layer of the stack, taught as infrastructure rather than as a demo. Azure AI Foundry and Azure OpenAI deployment and quota mechanics, then multi-agent orchestration with AutoGen and the Magentic-One pattern — agent roles, task allocation, inter-agent communication, error recovery — and what it costs to run and monitor on Azure.
Topics: Azure AI Foundry, model deployments, quotas and content filters · Multi-agent systems: where an agent beats a single prompt and where it does not · AutoGen and the Magentic-One orchestrator pattern · Agent roles, capabilities and the agent lifecycle: creation, execution, termination · Task allocation, routines and multi-step workflow orchestration · Agent-to-agent communication, error handling and task recovery · Extending agents with API and tool integration under managed identity · Private networking, data residency and grounding on your own data · Deploying and scaling agent workloads on Azure Container Apps or AKS · Monitoring, tracing and token-cost management for agent systems
We rebuild the agenda around the tools you actually run.
Request a custom agendaStand up Active Directory, connect it to Entra ID, and prove sign-in, group sync and conditional access behave as designed across both directories.
Build a hub-and-spoke virtual network, place a storage account and SQL database behind private endpoints, and fix the DNS resolution that always breaks first.
Express a subscription landing zone as Bicep modules — networking, RBAC, policy and diagnostics — then redeploy it into a second subscription unchanged.
Build a multi-stage Azure DevOps pipeline that deploys infrastructure and application to two environments using workload identity federation instead of secrets.
Deploy a private AKS cluster with Entra-integrated RBAC, give a pod access to Key Vault via workload identity, then upgrade the node pool live.
Build a multi-agent workflow on Azure AI Foundry using the Magentic-One orchestration pattern, give it tool access under managed identity, and cap its token spend.
Take a subscription with real telemetry, find a failure using KQL, then apply tagging policy, budgets and alerting so the same problem is caught next time.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
The Rundeck developer session was excellent and highly engaging. I appreciated how well the session was structured, with the theoretical concepts explained clearly and in simple terms. What stood out most to me was the demo — it was both informative and enjoyable. I especially liked how Rajesh walked us through not only the happy path but also the sad path, showcasing common issues and sharing practical troubleshooting tips.
Rajesh's experience and knowledge are exceptional and we learnt invaluable practical knowledge which we can apply in our production environment. Incredibly friendly and gave us a fantastic insight both in-depth and at a high level of the Rundeck product.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.